January 2016 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] sound: use-after-free in snd_timer_user_ioctl
by Dmitry Vyukov 13 Jan '16

13 Jan '16

Hello, The following syzkaller-generated program triggers use-after-free in snd_timer_user_ioctl: https://gist.githubusercontent.com/dvyukov/e833610757b098956b50/raw/d819cd1… ------------[ cut here ]------------ WARNING: CPU: 1 PID: 2066 at lib/list_debug.c:53 __list_del_entry+0x10b/0x1e0() list_del corruption, ffff8800359fd740->next is LIST_POISON1 (dead000000000100) Modules linked in: CPU: 1 PID: 2066 Comm: syz-executor Not tainted 4.4.0+ #240 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 00000000ffffffff ffff880034b67938 ffffffff82926eed ffff880034b679a8 ffff880034a00000 ffffffff8660b640 ffff880034b67978 ffffffff81350c89 ffffffff8298e77b ffffed000696cf31 ffffffff8660b640 0000000000000035 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff82926eed>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 [<ffffffff81350c89>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:483 [<ffffffff81350d99>] warn_slowpath_fmt+0xa9/0xd0 kernel/panic.c:495 [<ffffffff8298e77b>] __list_del_entry+0x10b/0x1e0 lib/list_debug.c:51 [< inline >] list_move_tail include/linux/list.h:168 [<ffffffff84ec0411>] snd_timer_start1+0x31/0x2b0 sound/core/timer.c:421 [<ffffffff84ec07b0>] snd_timer_continue+0x120/0x1b0 sound/core/timer.c:568 [< inline >] snd_timer_user_continue sound/core/timer.c:1751 [<ffffffff84ec493b>] snd_timer_user_ioctl+0xdab/0x2540 sound/core/timer.c:1824 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff817cbd3c>] do_vfs_ioctl+0x18c/0xfa0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [<ffffffff817ccbdf>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [<ffffffff86272ff6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 ---[ end trace 384a7ce57530be36 ]--- ------------[ cut here ]------------ On commit 67990608c8b95d2b8ccc29932376ae73d5818727 (Jan 12).

1 0

[alsa-devel] [PATCH 0/2] ASoC: fsl: make snd-soc-imx-sgtl5000 driver useable on i.MX6UL
by Lothar Waßmann 13 Jan '16

13 Jan '16

This patchset adds support for the i.MX6UL SoC to the imx-sgtl5000 sound driver. The first patch makes the audmux setup optional for the driver, since i.MX6UL does not have this unit. The second patch selects the SAI interface rather than the SSI interface for the i.MX6UL SoC. A patch to make the corresponding DTB changes has been sent separately.

4 9

[alsa-devel] [PATCH] ALSA: hda - fix the headset mic detection problem for a Dell laptop
by Hui Wang 13 Jan '16

13 Jan '16

The machine uses codec alc255, and the pin configuration value for pin 0x14 on this machine is 0x90171130 which is not in the pin quirk table yet. Cc: stable(a)vger.kernel.org BugLink: https://bugs.launchpad.net/bugs/1533461 Signed-off-by: Hui Wang <hui.wang(a)canonical.com> --- sound/pci/hda/patch_realtek.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index f0ed41e..61d8502 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -5626,6 +5626,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { {0x21, 0x02211040}), SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, {0x12, 0x90a60170}, + {0x14, 0x90171130}, + {0x21, 0x02211040}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60170}, {0x14, 0x90170140}, {0x21, 0x02211050}), SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell Inspiron 5548", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -- 1.9.1

2 1

[alsa-devel] Managing Android vs. UCM configuration
by Arun Raghavan 13 Jan '16

13 Jan '16

Hi folks, I'd spoken briefly about this at the Audio mini-summit at Dublin, and promised to send out a link. I've been working on a tool to automate translating Android mixer_paths.xml to UCM that PulseAudion (or CrAS or anything else) can consume. I've now written a bit about it at: http://arunraghavan.net/2016/01/audio-devices-and-configuration/ The code is up at: https://github.com/ford-prefect/xml2ucm I'll try to provide a quicker way to take this stuff out for a spin than building it yourself soon. Cheers, Arun

1 0

[alsa-devel] ASoC: multicodec: How to specify one codec as master and all others as slave
by Caleb Crome 13 Jan '16

13 Jan '16

Hi there, With a multi-codec setup, what's the 'correct' way to tell one codec to be master (i.e. send bit/word clock) and all the others to be slave? For example, I've got 8 stereo codecs (4x aic34), labeled, say aic_a, aic_b, aic_c, aic_d, aic_e, aic_f, aic_g, aic_h, and I want aic_a: SND_SOC_DAIFMT_CBM_CFM | SND_SOC_DAIFMT_DSP_A and all others to see SND_SOC_DAIFMT_CBS_CFS | SND_SOC_DAIFMT_DSP_A Is there an elegant way to do that? I see in soc-core.c:snd_soc_runtime_set_dai_fmt(rtd, dai_fmt) that it sets all codecs to the same format, then flips the polarity for the CPU. It seems this is not really correct behavior in multicodec mode when the codec is master, right? Should there be some way to mark one of the many possibilities as the master? My current thinking is to not set snd_soc_dai_link.dai_fmt to prevent snd_soc_runtime_set_dai_fmt from doing the wrong thing, then call each individual snd_soc_dai_set_fmt from the init function. Thanks, --Caleb

1 0

[alsa-devel] [PATCH v2] sound: hda_intel: add card number to irq description
by Heiner Kallweit 12 Jan '16

12 Jan '16

Currently the info in /proc/interrupts doesn't allow to figure out which interrupt belongs to which card (HDMI, PCH, ..). Therefore add card details to the interrupt description. With the patch the info in /proc/interrupts looks like this: PCI-MSI 442368-edge snd_hda_intel:card1 PCI-MSI 49152-edge snd_hda_intel:card0 Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com> --- v2: Make extension more generic and implement it in snd_card. This way every driver using struct snd_card can easily be switched to using the more descriptive irq describer. --- include/sound/core.h | 1 + sound/core/init.c | 3 +++ sound/pci/hda/hda_intel.c | 2 +- 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/include/sound/core.h b/include/sound/core.h index cdfecaf..31079ea 100644 --- a/include/sound/core.h +++ b/include/sound/core.h @@ -99,6 +99,7 @@ struct snd_card { char driver[16]; /* driver name */ char shortname[32]; /* short name of this soundcard */ char longname[80]; /* name of this soundcard */ + char irq_descr[32]; /* Interrupt description */ char mixername[80]; /* mixer name */ char components[128]; /* card components delimited with space */ diff --git a/sound/core/init.c b/sound/core/init.c index 20f37fb..6bda843 100644 --- a/sound/core/init.c +++ b/sound/core/init.c @@ -268,6 +268,9 @@ int snd_card_new(struct device *parent, int idx, const char *xid, if (err < 0) goto __error; + snprintf(card->irq_descr, sizeof(card->irq_descr), "%s:%s", + dev_driver_string(card->dev), dev_name(&card->card_dev)); + /* the control interface cannot be accessed from the user space until */ /* snd_cards_bitmask and snd_cards are set with snd_card_register */ err = snd_ctl_create(card); diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 83800ac..c0bef11 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -725,7 +725,7 @@ static int azx_acquire_irq(struct azx *chip, int do_disconnect) if (request_irq(chip->pci->irq, azx_interrupt, chip->msi ? 0 : IRQF_SHARED, - KBUILD_MODNAME, chip)) { + chip->card->irq_descr, chip)) { dev_err(chip->card->dev, "unable to grab IRQ %d, disabling device\n", chip->pci->irq); -- 2.6.4

3 6

[alsa-devel] [PATCH] ALSA: hda - Fix white noise on Dell Latitude E5550
by Takashi Iwai 12 Jan '16

12 Jan '16

Dell Latitude E5550 (1028:062c) has a white noise problem like other Latitude E models, and it gets fixed by the very same quirk as well. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=110591 Cc: <stable(a)vger.kernel.org> # v4.1+ Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 2fdda51d07c4..f0ed41e1a884 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -5339,6 +5339,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x1028, 0x05f6, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1028, 0x0615, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK), SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK), + SND_PCI_QUIRK(0x1028, 0x062c, "Dell Latitude E5550", ALC292_FIXUP_DELL_E7X), SND_PCI_QUIRK(0x1028, 0x062e, "Dell Latitude E7450", ALC292_FIXUP_DELL_E7X), SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS_HSJACK), SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), -- 2.7.0

1 0

[alsa-devel] sound: use-after-free in snd_timer_stop
by Dmitry Vyukov 12 Jan '16

12 Jan '16

Hello, I've hit the following use-after-free while running syzkaller fuzzer. It is followed by a splat of other reports and finally kernel death. I wasn't able to reproduce it with a standalone C program (there is probably some global state involved). But it reproduces by replaying fuzzer logs in a loop (you will need Go toolchain): $ go get github.com/google/syzkaller $ cd $GOPATH/src/github.com/google/syzkaller $ make executor execprog $ scp bin/syz-executor bin/syz-execprog your@machine $ scp snd_timer_stop your@machine # the attached file on test machine: $ ./syz-execprog -executor ./syz-executor -cover=0 -repeat=0 -procs=16 snd_timer_stop ================================================================== BUG: KASAN: use-after-free in _snd_timer_stop+0x394/0x450 at addr ffff8800356d0b70 Read of size 4 by task syz-executor/6313 ============================================================================= BUG kmalloc-256 (Not tainted): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in snd_timer_instance_new+0x52/0x3a0 age=20 cpu=1 pid=6312 [< none >] ___slab_alloc+0x486/0x4e0 mm/slub.c:2468 [< none >] __slab_alloc+0x66/0xc0 mm/slub.c:2497 [< inline >] slab_alloc_node mm/slub.c:2560 [< inline >] slab_alloc mm/slub.c:2602 [< none >] kmem_cache_alloc_trace+0x284/0x310 mm/slub.c:2619 [< inline >] kmalloc include/linux/slab.h:458 [< inline >] kzalloc include/linux/slab.h:602 [< none >] snd_timer_instance_new+0x52/0x3a0 sound/core/timer.c:105 [< none >] snd_timer_open+0x4ff/0xc50 sound/core/timer.c:286 [< none >] snd_seq_timer_open+0x223/0x540 sound/core/seq/seq_timer.c:279 [< none >] snd_seq_queue_use+0x147/0x230 sound/core/seq/seq_queue.c:526 [< none >] snd_seq_queue_alloc+0x36a/0x4d0 sound/core/seq/seq_queue.c:197 [< none >] snd_seq_ioctl_create_queue+0xdb/0x2b0 sound/core/seq/seq_clientmgr.c:1536 [< none >] snd_seq_do_ioctl+0x19a/0x1c0 sound/core/seq/seq_clientmgr.c:2209 [< none >] snd_seq_ioctl+0x5d/0x80 sound/core/seq/seq_clientmgr.c:2224 [< inline >] vfs_ioctl fs/ioctl.c:43 [< none >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607 [< inline >] SYSC_ioctl fs/ioctl.c:622 [< none >] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 INFO: Freed in snd_timer_close+0x351/0x5e0 age=10 cpu=3 pid=6345 [< none >] __slab_free+0x1fc/0x320 mm/slub.c:2678 [< inline >] slab_free mm/slub.c:2833 [< none >] kfree+0x2a8/0x2d0 mm/slub.c:3662 [< none >] snd_timer_close+0x351/0x5e0 sound/core/timer.c:364 [< none >] snd_seq_timer_close+0x9e/0x100 sound/core/seq/seq_timer.c:312 [< none >] snd_seq_queue_timer_close+0x28/0x50 sound/core/seq/seq_queue.c:473 [< none >] snd_seq_ioctl_set_queue_timer+0x159/0x300 sound/core/seq/seq_clientmgr.c:1809 [< none >] snd_seq_do_ioctl+0x19a/0x1c0 sound/core/seq/seq_clientmgr.c:2209 [< none >] snd_seq_ioctl+0x5d/0x80 sound/core/seq/seq_clientmgr.c:2224 [< inline >] vfs_ioctl fs/ioctl.c:43 [< none >] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607 [< inline >] SYSC_ioctl fs/ioctl.c:622 [< none >] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 INFO: Slab 0xffffea0000d5b400 objects=22 used=8 fp=0xffff8800356d0b60 flags=0x1fffc0000004080 INFO: Object 0xffff8800356d0b60 @offset=2912 fp=0xffff8800356d27d0 CPU: 0 PID: 6313 Comm: syz-executor Tainted: G B 4.4.0+ #222 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 00000000ffffffff ffff880036757748 ffffffff82904add ffff88003e807000 ffff8800356d0b60 ffff8800356d0000 ffff880036757778 ffffffff8172af94 ffff88003e807000 ffffea0000d5b400 ffff8800356d0b60 ffff8800356d0b60 Call Trace: [<ffffffff817344ae>] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:294 [<ffffffff84aefda4>] _snd_timer_stop+0x394/0x450 sound/core/timer.c:488 [<ffffffff84aefe84>] snd_timer_stop+0x24/0x140 sound/core/timer.c:535 [<ffffffff84b6947e>] snd_seq_timer_close+0x7e/0x100 sound/core/seq/seq_timer.c:311 [<ffffffff84b6235b>] queue_delete+0x3b/0x90 sound/core/seq/seq_queue.c:146 [<ffffffff84b63f86>] snd_seq_queue_client_leave+0x36/0x130 sound/core/seq/seq_queue.c:593 [<ffffffff84b558a8>] seq_free_client1+0x58/0x290 sound/core/seq/seq_clientmgr.c:273 [<ffffffff84b55b45>] seq_free_client+0x65/0x160 sound/core/seq/seq_clientmgr.c:299 [<ffffffff84b5882d>] snd_seq_release+0x4d/0xb0 sound/core/seq/seq_clientmgr.c:380 [<ffffffff8177b453>] __fput+0x233/0x780 fs/file_table.c:208 [<ffffffff8177ba25>] ____fput+0x15/0x20 fs/file_table.c:244 [<ffffffff8139a8fb>] task_work_run+0x16b/0x200 kernel/task_work.c:115 [< inline >] exit_task_work include/linux/task_work.h:21 [<ffffffff81347b4b>] do_exit+0x8bb/0x2b20 kernel/exit.c:750 [<ffffffff81349f28>] do_group_exit+0x108/0x320 kernel/exit.c:880 [<ffffffff8136d124>] get_signal+0x5e4/0x1500 kernel/signal.c:2307 [<ffffffff81192d83>] do_signal+0x83/0x1c90 arch/x86/kernel/signal.c:712 [<ffffffff81006685>] exit_to_usermode_loop+0x1a5/0x210 arch/x86/entry/common.c:247 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:282 [<ffffffff8100851a>] syscall_return_slowpath+0x2ba/0x340 arch/x86/entry/common.c:344 [<ffffffff85e74a62>] int_ret_from_sys_call+0x25/0x9f arch/x86/entry/entry_64.S:281 ================================================================== On commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc (Jan 10).

2 4

[alsa-devel] sound: GPF in snd_seq_fifo_clear
by Dmitry Vyukov 12 Jan '16

12 Jan '16

Hello, The following program triggers GPF in snd_seq_fifo_clear: // autogenerated by syzkaller (http://github.com/google/syzkaller) #include <unistd.h> #include <sys/syscall.h> #include <string.h> #include <stdlib.h> #include <stdint.h> #include <pthread.h> int fd; void *thr(void *arg) { switch ((long)arg) { case 0: *(uint32_t*)0x20001fb0 = (uint32_t)0x1; *(uint64_t*)0x20001fc8 = (uint64_t)0x0; *(uint64_t*)0x20001fd0 = (uint64_t)0x0; *(uint8_t*)0x20001fd8 = (uint8_t)0x3; *(uint8_t*)0x20001fd9 = (uint8_t)0x32be; *(uint8_t*)0x20001fda = (uint8_t)0x36; *(uint8_t*)0x20001fdb = (uint8_t)0x5120; *(uint32_t*)0x20001fdc = (uint32_t)0x0; *(uint8_t*)0x20001fe0 = (uint8_t)0x4; *(uint32_t*)0x20001fe4 = (uint32_t)0x0; *(uint32_t*)0x20001fe8 = (uint32_t)0x0; *(uint32_t*)0x20001fec = (uint32_t)0x0; *(uint32_t*)0x20001ff0 = (uint32_t)0x0; *(uint32_t*)0x20001ff4 = (uint32_t)0x0; *(uint32_t*)0x20001ff8 = (uint32_t)0x0; *(uint32_t*)0x20001ffc = (uint32_t)0x0; *(uint32_t*)0x20002000 = (uint32_t)0x0; *(uint32_t*)0x20002004 = (uint32_t)0x0; *(uint32_t*)0x20002008 = (uint32_t)0x0; syscall(SYS_ioctl, fd, 0x4040534eul, 0x20001fb0ul, 0, 0, 0); break; case 1: *(uint32_t*)0x20006000 = (uint32_t)0xaff; *(uint32_t*)0x20006004 = (uint32_t)0x5; *(uint32_t*)0x20006008 = (uint32_t)0x101; *(uint64_t*)0x20006010 = (uint64_t)0x0; *(uint64_t*)0x20006018 = (uint64_t)0x989680; *(uint32_t*)0x20006020 = (uint32_t)0x3; *(uint32_t*)0x20006024 = (uint32_t)0x4; *(uint8_t*)0x20006028 = (uint8_t)0x0; *(uint8_t*)0x20006029 = (uint8_t)0x0; *(uint8_t*)0x2000602a = (uint8_t)0x0; *(uint8_t*)0x2000602b = (uint8_t)0x0; *(uint8_t*)0x2000602c = (uint8_t)0x0; *(uint8_t*)0x2000602d = (uint8_t)0x0; *(uint8_t*)0x2000602e = (uint8_t)0x0; *(uint8_t*)0x2000602f = (uint8_t)0x0; *(uint8_t*)0x20006030 = (uint8_t)0x0; *(uint8_t*)0x20006031 = (uint8_t)0x0; *(uint8_t*)0x20006032 = (uint8_t)0x0; *(uint8_t*)0x20006033 = (uint8_t)0x0; *(uint8_t*)0x20006034 = (uint8_t)0x0; *(uint8_t*)0x20006035 = (uint8_t)0x0; *(uint8_t*)0x20006036 = (uint8_t)0x0; *(uint8_t*)0x20006037 = (uint8_t)0x0; *(uint8_t*)0x20006038 = (uint8_t)0x0; *(uint8_t*)0x20006039 = (uint8_t)0x0; *(uint8_t*)0x2000603a = (uint8_t)0x0; *(uint8_t*)0x2000603b = (uint8_t)0x0; *(uint8_t*)0x2000603c = (uint8_t)0x0; *(uint8_t*)0x2000603d = (uint8_t)0x0; *(uint8_t*)0x2000603e = (uint8_t)0x0; *(uint8_t*)0x2000603f = (uint8_t)0x0; *(uint8_t*)0x20006040 = (uint8_t)0x0; *(uint8_t*)0x20006041 = (uint8_t)0x0; *(uint8_t*)0x20006042 = (uint8_t)0x0; *(uint8_t*)0x20006043 = (uint8_t)0x0; *(uint8_t*)0x20006044 = (uint8_t)0x0; *(uint8_t*)0x20006045 = (uint8_t)0x0; *(uint8_t*)0x20006046 = (uint8_t)0x0; *(uint8_t*)0x20006047 = (uint8_t)0x0; *(uint8_t*)0x20006048 = (uint8_t)0x0; *(uint8_t*)0x20006049 = (uint8_t)0x0; *(uint8_t*)0x2000604a = (uint8_t)0x0; *(uint8_t*)0x2000604b = (uint8_t)0x0; *(uint8_t*)0x2000604c = (uint8_t)0x0; *(uint8_t*)0x2000604d = (uint8_t)0x0; *(uint8_t*)0x2000604e = (uint8_t)0x0; *(uint8_t*)0x2000604f = (uint8_t)0x0; *(uint8_t*)0x20006050 = (uint8_t)0x0; *(uint8_t*)0x20006051 = (uint8_t)0x0; *(uint8_t*)0x20006052 = (uint8_t)0x0; *(uint8_t*)0x20006053 = (uint8_t)0x0; *(uint8_t*)0x20006054 = (uint8_t)0x0; *(uint8_t*)0x20006055 = (uint8_t)0x0; *(uint8_t*)0x20006056 = (uint8_t)0x0; *(uint8_t*)0x20006057 = (uint8_t)0x0; *(uint8_t*)0x20006058 = (uint8_t)0x0; *(uint8_t*)0x20006059 = (uint8_t)0x0; *(uint8_t*)0x2000605a = (uint8_t)0x0; *(uint8_t*)0x2000605b = (uint8_t)0x0; *(uint8_t*)0x2000605c = (uint8_t)0x0; *(uint8_t*)0x2000605d = (uint8_t)0x0; *(uint8_t*)0x2000605e = (uint8_t)0x0; *(uint8_t*)0x2000605f = (uint8_t)0x0; *(uint8_t*)0x20006060 = (uint8_t)0x0; *(uint8_t*)0x20006061 = (uint8_t)0x0; *(uint8_t*)0x20006062 = (uint8_t)0x0; *(uint8_t*)0x20006063 = (uint8_t)0x0; *(uint8_t*)0x20006064 = (uint8_t)0x0; *(uint8_t*)0x20006065 = (uint8_t)0x0; *(uint8_t*)0x20006066 = (uint8_t)0x0; *(uint8_t*)0x20006067 = (uint8_t)0x0; syscall(SYS_ioctl, fd, 0x402c5342ul, 0x20006000ul, 0, 0, 0); break; case 2: *(uint8_t*)0x20007fb0 = (uint8_t)0x1037; *(uint8_t*)0x20007fb1 = (uint8_t)0x7; *(uint8_t*)0x20007fb2 = (uint8_t)0x30b; *(uint8_t*)0x20007fb3 = (uint8_t)0x34b0; *(uint32_t*)0x20007fb4 = (uint32_t)0x5; *(uint32_t*)0x20007fb8 = (uint32_t)0x7; *(uint8_t*)0x20007fbc = (uint8_t)0x75d; *(uint8_t*)0x20007fbd = (uint8_t)0x0; *(uint8_t*)0x20007fbe = (uint8_t)0x0; *(uint8_t*)0x20007fbf = (uint8_t)0x0; *(uint8_t*)0x20007fc0 = (uint8_t)0x0; *(uint8_t*)0x20007fc1 = (uint8_t)0x0; *(uint8_t*)0x20007fc2 = (uint8_t)0x0; *(uint8_t*)0x20007fc3 = (uint8_t)0x0; *(uint8_t*)0x20007fc4 = (uint8_t)0x0; *(uint8_t*)0x20007fc5 = (uint8_t)0x0; *(uint8_t*)0x20007fc6 = (uint8_t)0x0; *(uint8_t*)0x20007fc7 = (uint8_t)0x0; *(uint8_t*)0x20007fc8 = (uint8_t)0x0; *(uint8_t*)0x20007fc9 = (uint8_t)0x0; *(uint8_t*)0x20007fca = (uint8_t)0x0; *(uint8_t*)0x20007fcb = (uint8_t)0x0; *(uint8_t*)0x20007fcc = (uint8_t)0x0; *(uint8_t*)0x20007fcd = (uint8_t)0x0; *(uint8_t*)0x20007fce = (uint8_t)0x0; *(uint8_t*)0x20007fcf = (uint8_t)0x0; *(uint8_t*)0x20007fd0 = (uint8_t)0x0; *(uint8_t*)0x20007fd1 = (uint8_t)0x0; *(uint8_t*)0x20007fd2 = (uint8_t)0x0; *(uint8_t*)0x20007fd3 = (uint8_t)0x0; *(uint8_t*)0x20007fd4 = (uint8_t)0x0; *(uint8_t*)0x20007fd5 = (uint8_t)0x0; *(uint8_t*)0x20007fd6 = (uint8_t)0x0; *(uint8_t*)0x20007fd7 = (uint8_t)0x0; *(uint8_t*)0x20007fd8 = (uint8_t)0x0; *(uint8_t*)0x20007fd9 = (uint8_t)0x0; *(uint8_t*)0x20007fda = (uint8_t)0x0; *(uint8_t*)0x20007fdb = (uint8_t)0x0; *(uint8_t*)0x20007fdc = (uint8_t)0x0; *(uint8_t*)0x20007fdd = (uint8_t)0x0; *(uint8_t*)0x20007fde = (uint8_t)0x0; *(uint8_t*)0x20007fdf = (uint8_t)0x0; *(uint8_t*)0x20007fe0 = (uint8_t)0x0; *(uint8_t*)0x20007fe1 = (uint8_t)0x0; *(uint8_t*)0x20007fe2 = (uint8_t)0x0; *(uint8_t*)0x20007fe3 = (uint8_t)0x0; *(uint8_t*)0x20007fe4 = (uint8_t)0x0; *(uint8_t*)0x20007fe5 = (uint8_t)0x0; *(uint8_t*)0x20007fe6 = (uint8_t)0x0; *(uint8_t*)0x20007fe7 = (uint8_t)0x0; *(uint8_t*)0x20007fe8 = (uint8_t)0x0; *(uint8_t*)0x20007fe9 = (uint8_t)0x0; *(uint8_t*)0x20007fea = (uint8_t)0x0; *(uint8_t*)0x20007feb = (uint8_t)0x0; *(uint8_t*)0x20007fec = (uint8_t)0x0; *(uint8_t*)0x20007fed = (uint8_t)0x0; *(uint8_t*)0x20007fee = (uint8_t)0x0; *(uint8_t*)0x20007fef = (uint8_t)0x0; *(uint8_t*)0x20007ff0 = (uint8_t)0x0; *(uint8_t*)0x20007ff1 = (uint8_t)0x0; *(uint8_t*)0x20007ff2 = (uint8_t)0x0; *(uint8_t*)0x20007ff3 = (uint8_t)0x0; *(uint8_t*)0x20007ff4 = (uint8_t)0x0; *(uint8_t*)0x20007ff5 = (uint8_t)0x0; *(uint8_t*)0x20007ff6 = (uint8_t)0x0; *(uint8_t*)0x20007ff7 = (uint8_t)0x0; *(uint8_t*)0x20007ff8 = (uint8_t)0x0; *(uint8_t*)0x20007ff9 = (uint8_t)0x0; *(uint8_t*)0x20007ffa = (uint8_t)0x0; *(uint8_t*)0x20007ffb = (uint8_t)0x0; *(uint8_t*)0x20007ffc = (uint8_t)0x0; *(uint8_t*)0x20007ffd = (uint8_t)0x0; *(uint8_t*)0x20007ffe = (uint8_t)0x0; *(uint8_t*)0x20007fff = (uint8_t)0x0; syscall(SYS_ioctl, fd, 0x40505331ul, 0x20007fb0ul, 0, 0, 0); break; } return 0; } int main() { long i; pthread_t th; srand(getpid()); syscall(SYS_mmap, 0x20000000ul, 0x8000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); memcpy((void*)0x20005000, "\x2f\x64\x65\x76\x2f\x73\x6e\x64\x2f\x73\x65\x71", 12); fd = syscall(SYS_open, 0x20005000ul, 0x1ul, 0x0ul, 0, 0, 0); for (i = 0; i < 6; i++) { pthread_create(&th, 0, thr, (void*)(i%3)); if (rand()%2==0) usleep(rand()%1000); } usleep(10000); return 0; } kasan: CONFIG_KASAN_INLINE enabled[ 146.589109] kasan: CONFIG_KASAN_INLINE enabledkasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN Modules linked in: CPU: 2 PID: 6540 Comm: a.out Not tainted 4.4.0+ #222 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880064ed0000 ti: ffff880063620000 task.ti: ffff880063620000 RIP: 0010:[<ffffffff84b65301>] [<ffffffff84b65301>] snd_seq_fifo_clear+0x31/0x1d0 RSP: 0018:ffff880063627c48 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000015 RSI: 0000000020001ff0 RDI: 00000000000000a8 RBP: ffff880063627c98 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: ffff880064de1ec0 R13: dffffc0000000000 R14: ffff880063627d28 R15: 0000000000000001 FS: 00007fc371e37700(0000) GS:ffff88006d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000020002000 CR3: 0000000062a62000 CR4: 00000000000006e0 Stack: ffffffff867a5ce0 00000000000002b9 000000004040534e 0000000020001fb0 ffff880063627c98 1ffff1000c6c4f95 ffff880064de1ec0 dffffc0000000000 ffff880063627d28 0000000000000001 ffff880063627d50 ffffffff84b56918 Call Trace: [<ffffffff84b56918>] snd_seq_ioctl_remove_events+0x178/0x1b0 sound/core/seq/seq_clientmgr.c:1966 [<ffffffff84b5954a>] snd_seq_do_ioctl+0x19a/0x1c0 sound/core/seq/seq_clientmgr.c:2209 [<ffffffff84b5973d>] snd_seq_ioctl+0x5d/0x80 sound/core/seq/seq_clientmgr.c:2224 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff817b3531>] do_vfs_ioctl+0x681/0xe40 fs/ioctl.c:607 [< inline >] SYSC_ioctl fs/ioctl.c:622 [<ffffffff817b3d7f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:613 [<ffffffff85e748f6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 Code: 41 56 41 55 41 54 53 48 89 fb 48 83 ec 28 e8 47 aa 9f fc 48 8d bb a8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 RIP [< inline >] __write_once_size include/linux/compiler.h:246 RIP [< inline >] atomic_set ./arch/x86/include/asm/atomic.h:39 RIP [<ffffffff84b65301>] snd_seq_fifo_clear+0x31/0x1d0 sound/core/seq/seq_fifo.c:99 RSP <ffff880063627c48> ---[ end trace 3ee37e6a5304c762 ]--- On commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc (Jan 10).

2 3

[alsa-devel] [PATCH] ALSA: usb-audio: Avoid calling usb_autopm_put_interface() at disconnect
by Takashi Iwai 12 Jan '16

12 Jan '16

ALSA PCM may still have a leftover instance after disconnection and it delays its release. The problem is that the PCM close code path of USB-audio driver has a call of snd_usb_autosuspend(). This involves with the call of usb_autopm_put_interface() and it may lead to a kernel Oops due to the NULL object like: BUG: unable to handle kernel NULL pointer dereference at 0000000000000190 IP: [<ffffffff815ae7ef>] usb_autopm_put_interface+0xf/0x30 PGD 0 Call Trace: [<ffffffff8173bd94>] snd_usb_autosuspend+0x14/0x20 [<ffffffff817461bc>] snd_usb_pcm_close.isra.14+0x5c/0x90 [<ffffffff8174621f>] snd_usb_playback_close+0xf/0x20 [<ffffffff816ef58a>] snd_pcm_release_substream.part.36+0x3a/0x90 [<ffffffff816ef6b3>] snd_pcm_release+0xa3/0xb0 [<ffffffff816debb0>] snd_disconnect_release+0xd0/0xe0 [<ffffffff8114d417>] __fput+0x97/0x1d0 [<ffffffff8114d589>] ____fput+0x9/0x10 [<ffffffff8109e452>] task_work_run+0x72/0x90 [<ffffffff81088510>] do_exit+0x280/0xa80 [<ffffffff8108996a>] do_group_exit+0x3a/0xa0 [<ffffffff8109261f>] get_signal+0x1df/0x540 [<ffffffff81040903>] do_signal+0x23/0x620 [<ffffffff8114c128>] ? do_readv_writev+0x128/0x200 [<ffffffff810012e1>] prepare_exit_to_usermode+0x91/0xd0 [<ffffffff810013ba>] syscall_return_slowpath+0x9a/0x120 [<ffffffff817587cd>] ? __sys_recvmsg+0x5d/0x70 [<ffffffff810d2765>] ? ktime_get_ts64+0x45/0xe0 [<ffffffff8115dea0>] ? SyS_poll+0x60/0xf0 [<ffffffff818d2327>] int_ret_from_sys_call+0x25/0x8f We have already a check of disconnection in snd_usb_autoresume(), but the check is missing its counterpart. The fix is just to put the same check in snd_usb_autosuspend(), too. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109431 Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/usb/card.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/usb/card.c b/sound/usb/card.c index 18f56646ce86..1f09d9591276 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -675,6 +675,8 @@ int snd_usb_autoresume(struct snd_usb_audio *chip) void snd_usb_autosuspend(struct snd_usb_audio *chip) { + if (atomic_read(&chip->shutdown)) + return; if (atomic_dec_and_test(&chip->active)) usb_autopm_put_interface(chip->pm_intf); } -- 2.7.0

1 0