April 2016 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH v2 0/6] ASoC: davinci-mcbsp: add binding for McBSP
by Petr Kulhavy 21 Apr '16

21 Apr '16

This series of patches adds devicetree support for the davinci McBSP audio interface. Changes in version 2 of the patch: * add missing TC channel in dmas properties (for compatibility with the new EDMA3 binding) * remove "-audio" postfix from the compatible string * remove "channel-combine" property * of_match_table renamed consistently with the rest of the file (davinci_i2s_match) * devicetree DMA configuration in probe simplified

4 15

[alsa-devel] [PATCH 0/2] Yet more hardening of ALSA hrtimer races
by Takashi Iwai 21 Apr '16

21 Apr '16

Hi, this is a resubmission of patches for hardening the ALSA hrtimer backend against open/close races. Takashi === Takashi Iwai (2): ALSA: timer: Allow backend disabling start/stop from handler ALSA: hrtimer: Use manual start/stop in callback include/sound/timer.h | 12 +++++++++++- sound/core/hrtimer.c | 51 ++++++++++++++++++++++++++++++++++++++------------- sound/core/timer.c | 24 ++++++++++++++++++------ 3 files changed, 67 insertions(+), 20 deletions(-) -- 2.8.1

1 2

[alsa-devel] [PATCH v3 0/2] sti: add audio interface to the hdmi driver
by Arnaud Pouliquen 21 Apr '16

21 Apr '16

This patchset implements audio interface in HDMI drm driver. Implementation is based on ASoC generic hdmi codec driver( https://patchwork.kernel.org/patch/8713141/). It also proposes helper functions to compute N and CTS parameters according to HDMI 1.4b specification. V3: - video: hdmi: add helper function for N and CTS Also used on Mediatek platform (https://patchwork.kernel.org/patch/8887341) delta vs V2: - typo fixes - if/else code optimisation - drm: sti: Add ASoC generic hdmi codec support. - typo fixes - add audio registers in debugfs information V2: RFC https://patchwork.kernel.org/patch/8091531/("video: hdmi: add helper function for N and CTS") https://patchwork.kernel.org/patch/8091561/("ASoC: hdmi-codec: Add hdmi-codec for external HDMI-encoders") - patch: video: hdmi: add helper function for N and CTS Fixes based on Russel King remarks - Duplicate function to have a separte treatment for coherent and non-coherent clocks - Add ratio field for alternate CTS value - Clock frequency in Hz for TMDS and audio clocks - Add information concerning clocks and CTS calculation. V1: This RFC is the implementation of audio HDMI on sti platform based on generic hdmi-codec driver: https://patchwork.kernel.org/patch/7215271/ ("ASoC: hdmi-codec: Add hdmi-codec for external HDMI-encoders") https://patchwork.kernel.org/patch/8062611/ ("video: hdmi: add helper function for N and CTS") Arnaud Pouliquen (2): drm: sti: Add ASoC generic hdmi codec support. video: hdmi: add helper function for N and CTS drivers/gpu/drm/sti/Kconfig | 1 + drivers/gpu/drm/sti/sti_hdmi.c | 248 ++++++++++++++++++++++++++++++++++++++--- drivers/gpu/drm/sti/sti_hdmi.h | 13 +++ drivers/video/hdmi.c | 202 +++++++++++++++++++++++++++++++++ include/linux/hdmi.h | 22 ++++ 5 files changed, 469 insertions(+), 17 deletions(-) -- 1.9.1

2 4

[alsa-devel] [PATCH v5 0/4] Propagate errors out from compressed streams
by Charles Keepax 21 Apr '16

21 Apr '16

If the DSP suffers an unrecoverable error, the driver likely knows about this, however the framework may not get informed because errors returned from pointer requests are ignored within the framework. Things work out fine if user-space is doing a read as reads return error status back to user-space so the user can find out that things have gone bad. However, if user-space is doing an avail request there is no path for the error to come back up to user-space. The pointer request returns zero available data, so a read never happens and we basically just end up sitting waiting for data on a stream that we know full well has died. This patch set attempts to address this and ensure that errors are fully propagated to user-space and we don't ever end up wait for data that will never come. Changes since v4: - Fix issue noticed by Vinod whereby the error state was being overwritten when snd_compr_stop was called It might be easiest to put the ASoC changes through Mark's tree as there are some merge conflicts otherwise, as such I have based this series on Mark's tree. Thanks, Charles Charles Keepax (4): ALSA: compress: Replace complex if statement with switch ALSA: compress: Add function to indicate the stream has gone bad ASoC: wm_adsp: Use new snd_compr_stop_error to signal stream failure ASoC: compress: Pass error out of soc_compr_pointer include/sound/compress_driver.h | 5 +++ sound/core/compress_offload.c | 79 ++++++++++++++++++++++++++++++++++++++--- sound/soc/codecs/wm_adsp.c | 11 ++++-- sound/soc/soc-compress.c | 5 +-- 4 files changed, 91 insertions(+), 9 deletions(-) -- 2.1.4

4 12

[alsa-devel] [PATCH 0/2 v6] ASoC: mediatek: Add second I2S on mt8173-rt5650 machine driver
by PC Liao 21 Apr '16

21 Apr '16

Because applied patch (commit 0beeb8d0b434b8b007ac8058fb2cac5997fff6df "ASoC: mediatek: Add second I2S on mt8173-rt5650 machine driver") is dropped, I upload new version which include dependent patch. Changes since v5: - add "ASoC: core: export snd_soc_get_dai_name" patch. Because snd_soc_of_get_dai_name() fix the property name "sound-dai". Our patch needs to change name to use, so export snd_soc_get_dai_name() which is included in snd_soc_of_get_dai_name(). Changes since v4: Change name from "sound-dai" to "capture-dai" to determine the capture path Changes since v2,v3: Fix unclear code and use sound-dai to determine the capture path Changes since v1: Use codec dai name to determine the capture path. Jean-Francois Moine (1): ASoC: core: export snd_soc_get_dai_name PC Liao (1): ASoC: mediatek: Add second I2S on mt8173-rt5650 machine driver .../devicetree/bindings/sound/mt8173-rt5650.txt | 6 +++ include/sound/soc.h | 2 + sound/soc/mediatek/mt8173-rt5650.c | 44 ++++++++++++++++++-- sound/soc/soc-core.c | 5 ++- 4 files changed, 52 insertions(+), 5 deletions(-) -- 1.7.9.5

3 9

[alsa-devel] [PATCH v8 0/2] ASoc: sun4i-codec: Add FM, Line and Mic inputs
by Danny Milosavljevic 21 Apr '16

21 Apr '16

Hi, this is the eighth version of the patch set that adds inputs to sun4i-codec. Changes compared to v7 are: - fix the routes for line and mic capturing. The patches are on top of the branch "sunxi-next" in <git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git>. Regards, Danny --- Danny Milosavljevic (2): sun4i-codec: Add FM, Line and Mic inputs sun4i-codec: make it possible to use different codec_widgets for A10 and A20. b/sound/soc/sunxi/sun4i-codec.c | 230 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 215 insertions(+), 15 deletions(-)

4 19

[alsa-devel] sound: use-after-free in snd_timer_interrupt
by Dmitry Vyukov 21 Apr '16

21 Apr '16

Hello, I am hitting the following use-after-free while running syzkaller fuzzer on commit 8e0f93cda48ed054e1216bab5c60017e1a5fc1e8 ================================================================== BUG: KASAN: use-after-free in __list_del_entry+0x1d3/0x1e0 at addr ffff88002ebf6e20 Read of size 8 by task syz-executor/7684 ============================================================================= BUG kmalloc-256 (Not tainted): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in snd_timer_instance_new+0x52/0x3a0 age=5 cpu=0 pid=7693 [< none >] ___slab_alloc+0x578/0x5d0 mm/slub.c:2464 [< none >] __slab_alloc+0x66/0xc0 mm/slub.c:2493 [< inline >] slab_alloc_node mm/slub.c:2556 [< inline >] slab_alloc mm/slub.c:2598 [< none >] kmem_cache_alloc_trace+0x242/0x3b0 mm/slub.c:2615 [< inline >] kmalloc include/linux/slab.h:463 [< inline >] kzalloc include/linux/slab.h:607 [< none >] snd_timer_instance_new+0x52/0x3a0 sound/core/timer.c:106 [< none >] snd_timer_open+0x522/0xd20 sound/core/timer.c:289 [< inline >] snd_timer_user_tselect sound/core/timer.c:1612 [< inline >] __snd_timer_user_ioctl sound/core/timer.c:1888 [< none >] snd_timer_user_ioctl+0x8f4/0x2490 sound/core/timer.c:1918 [< inline >] vfs_ioctl fs/ioctl.c:43 [< none >] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [< none >] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 INFO: Freed in snd_timer_close+0x3ee/0x750 age=9 cpu=0 pid=7693 [< none >] __slab_free+0x1fc/0x320 mm/slub.c:2674 [< inline >] slab_free mm/slub.c:2829 [< none >] kfree+0x2f5/0x370 mm/slub.c:3660 [< none >] snd_timer_close+0x3ee/0x750 sound/core/timer.c:375 [< inline >] snd_timer_user_tselect sound/core/timer.c:1602 [< inline >] __snd_timer_user_ioctl sound/core/timer.c:1888 [< none >] snd_timer_user_ioctl+0x7cd/0x2490 sound/core/timer.c:1918 [< inline >] vfs_ioctl fs/ioctl.c:43 [< none >] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [< none >] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 INFO: Slab 0xffffea0000bafd00 objects=22 used=11 fp=0xffff88002ebf6d80 flags=0x1fffc0000004080 INFO: Object 0xffff88002ebf6d80 @offset=11648 fp=0xffff88002ebf5110 CPU: 3 PID: 7684 Comm: syz-executor Tainted: G B 4.5.0-rc7+ #337 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 ffffffff87b7d480 ffff88006d707bb0 ffffffff82c2125f ffffffff00bafd00 fffffbfff0f6fa90 ffff88003e807000 ffff88002ebf6d80 ffff88002ebf4000 ffffea0000bafd00 ffff88002ebf6e18 ffff88006d707be0 ffffffff8176dcc4 Call Trace: [<ffffffff81777e4e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295 [<ffffffff82c88f63>] __list_del_entry+0x1d3/0x1e0 lib/list_debug.c:48 [< inline >] list_del_init include/linux/list.h:145 [<ffffffff852942f9>] snd_timer_interrupt+0x5b9/0xc80 sound/core/timer.c:791 [<ffffffff8529acc9>] snd_hrtimer_callback+0x169/0x230 sound/core/hrtimer.c:54 [< inline >] __run_hrtimer kernel/time/hrtimer.c:1248 [<ffffffff814c3911>] __hrtimer_run_queues+0x331/0xe90 kernel/time/hrtimer.c:1312 [<ffffffff814c62e2>] hrtimer_interrupt+0x182/0x430 kernel/time/hrtimer.c:1346 [<ffffffff81255ec2>] local_apic_timer_interrupt+0x72/0xe0 arch/x86/kernel/apic/apic.c:907 [<ffffffff812593e9>] smp_apic_timer_interrupt+0x79/0xa0 arch/x86/kernel/apic/apic.c:931 [<ffffffff866d256c>] apic_timer_interrupt+0x8c/0xa0 arch/x86/entry/entry_64.S:520 [< inline >] spin_unlock_irqrestore include/linux/spinlock.h:362 [<ffffffff8177369e>] __slab_free+0x1ae/0x320 mm/slub.c:2681 [< inline >] slab_free mm/slub.c:2829 [<ffffffff81773ed8>] kmem_cache_free+0x318/0x440 mm/slub.c:2838 [<ffffffff81704cb8>] ptlock_free+0x38/0x50 mm/memory.c:3912 [< inline >] pgtable_pmd_page_dtor include/linux/mm.h:1702 [<ffffffff812951ca>] ___pmd_free_tlb+0xaa/0x110 arch/x86/mm/pgtable.c:74 [< inline >] __pmd_free_tlb ./arch/x86/include/asm/pgalloc.h:106 [< inline >] free_pmd_range mm/memory.c:432 [< inline >] free_pud_range mm/memory.c:450 [<ffffffff816f4dc3>] free_pgd_range+0x973/0xbe0 mm/memory.c:526 [<ffffffff816f52f5>] free_pgtables+0x2c5/0x3b0 mm/memory.c:558 [<ffffffff817137c3>] exit_mmap+0x233/0x410 mm/mmap.c:2868 [<ffffffff813543f5>] mmput+0x95/0x230 kernel/fork.c:706 [< inline >] exit_mm kernel/exit.c:436 [<ffffffff81366eb2>] do_exit+0x7b2/0x2d00 kernel/exit.c:735 [<ffffffff81369578>] do_group_exit+0x108/0x330 kernel/exit.c:878 [<ffffffff8138cf14>] get_signal+0x634/0x15e0 kernel/signal.c:2307 [<ffffffff811a7db3>] do_signal+0x83/0x1c90 arch/x86/kernel/signal.c:712 [<ffffffff81006685>] exit_to_usermode_loop+0x1a5/0x210 arch/x86/entry/common.c:247 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:282 [<ffffffff8100866a>] syscall_return_slowpath+0x2ba/0x340 arch/x86/entry/common.c:344 [<ffffffff866d18e2>] int_ret_from_sys_call+0x25/0x9f arch/x86/entry/entry_64.S:281 ================================================================== kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN Modules linked in: CPU: 3 PID: 7684 Comm: syz-executor Tainted: G B 4.5.0-rc7+ #337 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880061062f80 ti: ffff88005ee10000 task.ti: ffff88005ee10000 RIP: 0010:[<ffffffff82c88e16>] [<ffffffff82c88e16>] __list_del_entry+0x86/0x1e0 RSP: 0018:ffff88006d707cd0 EFLAGS: 00010046 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88002ebf6e18 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffff88006d707cf0 R08: ffffffff89cbcf00 R09: 0000000000000000 R10: ffffed000dae0f8c R11: 0000000000000000 R12: ffff88005ee0d120 R13: ffff8800670a2298 R14: ffff88005ee0d110 R15: ffff88002ebf6e18 FS: 0000000000000000(0000) GS:ffff88006d700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00000000006e0000 CR3: 0000000007ae9000 CR4: 00000000000006e0 Stack: ffff88006d707cf0 ffff88002ebf6e18 dffffc0000000000 ffff88005ee0d120 ffff88006d707db0 ffffffff852942f9 ffff8800670a2368 0000000000000082 dffffc0000000000 ffff8800670a234c ffffffff87b7d480 ffffed000ce1446d Call Trace: <IRQ> [< inline >] list_del_init include/linux/list.h:145 [<ffffffff852942f9>] snd_timer_interrupt+0x5b9/0xc80 sound/core/timer.c:791 [<ffffffff8529acc9>] snd_hrtimer_callback+0x169/0x230 sound/core/hrtimer.c:54 [< inline >] __run_hrtimer kernel/time/hrtimer.c:1248 [<ffffffff814c3911>] __hrtimer_run_queues+0x331/0xe90 kernel/time/hrtimer.c:1312 [<ffffffff814c62e2>] hrtimer_interrupt+0x182/0x430 kernel/time/hrtimer.c:1346 [<ffffffff81255ec2>] local_apic_timer_interrupt+0x72/0xe0 arch/x86/kernel/apic/apic.c:907 [<ffffffff812593e9>] smp_apic_timer_interrupt+0x79/0xa0 arch/x86/kernel/apic/apic.c:931 [<ffffffff866d256c>] apic_timer_interrupt+0x8c/0xa0 arch/x86/entry/entry_64.S:520 <EOI> [< inline >] spin_unlock_irqrestore include/linux/spinlock.h:362 [<ffffffff8177369e>] __slab_free+0x1ae/0x320 mm/slub.c:2681 [< inline >] slab_free mm/slub.c:2829 [<ffffffff81773ed8>] kmem_cache_free+0x318/0x440 mm/slub.c:2838 [<ffffffff81704cb8>] ptlock_free+0x38/0x50 mm/memory.c:3912 [< inline >] pgtable_pmd_page_dtor include/linux/mm.h:1702 [<ffffffff812951ca>] ___pmd_free_tlb+0xaa/0x110 arch/x86/mm/pgtable.c:74 [< inline >] __pmd_free_tlb ./arch/x86/include/asm/pgalloc.h:106 [< inline >] free_pmd_range mm/memory.c:432 [< inline >] free_pud_range mm/memory.c:450 [<ffffffff816f4dc3>] free_pgd_range+0x973/0xbe0 mm/memory.c:526 [<ffffffff816f52f5>] free_pgtables+0x2c5/0x3b0 mm/memory.c:558 [<ffffffff817137c3>] exit_mmap+0x233/0x410 mm/mmap.c:2868 [<ffffffff813543f5>] mmput+0x95/0x230 kernel/fork.c:706 [< inline >] exit_mm kernel/exit.c:436 [<ffffffff81366eb2>] do_exit+0x7b2/0x2d00 kernel/exit.c:735 [<ffffffff81369578>] do_group_exit+0x108/0x330 kernel/exit.c:878 [<ffffffff8138cf14>] get_signal+0x634/0x15e0 kernel/signal.c:2307 [<ffffffff811a7db3>] do_signal+0x83/0x1c90 arch/x86/kernel/signal.c:712 [<ffffffff81006685>] exit_to_usermode_loop+0x1a5/0x210 arch/x86/entry/common.c:247 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:282 [<ffffffff8100866a>] syscall_return_slowpath+0x2ba/0x340 arch/x86/entry/common.c:344 [<ffffffff866d18e2>] int_ret_from_sys_call+0x25/0x9f arch/x86/entry/entry_64.S:281 Code: c0 0f 84 91 00 00 00 48 b8 00 02 00 00 00 00 ad de 48 39 c3 0f 84 9f 00 00 00 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 f6 00 00 00 4c 8b 23 4c 39 e1 0f 85 95 00 00 RIP [<ffffffff82c88e16>] __list_del_entry+0x86/0x1e0 lib/list_debug.c:57 RSP <ffff88006d707cd0> ---[ end trace fd16e1eaa1720656 ]--- Kernel panic - not syncing: Fatal exception in interrupt Shutting down cpus with NMI Kernel Offset: disabled ---[ end Kernel panic - not syncing: Fatal exception in interrupt It is not easily reproducible. I've hit several times while running fuzzer for a week. Here is one of the logs for the record: https://gist.githubusercontent.com/dvyukov/c84798ee55721563ecb537c4d51dc9f5…

2 8

[alsa-devel] linux-4.6-rc4/sound/pci/ens1370.c:1551: possible bad expression ?
by David Binderman 21 Apr '16

21 Apr '16

Hello there, [linux-4.6-rc4/sound/pci/ens1370.c:1551]: (style) Expression '(X & 0xf0000)>= 0x4' is always false. Source code is if ((ensoniq->ctrl & ES_1371_GPIO_OUTM)>= 4) val = 1; Regards David Binderman

3 3

[alsa-devel] [PATCH 0/4] ASoC: topology: configure more on DAI & DAI links
by mengdong.lin＠linux.intel.com 21 Apr '16

21 Apr '16

From: Mengdong Lin <mengdong.lin(a)linux.intel.com> There is no ABI change in this series. Two patches are small changes in ASoC core, to allow topology to further configure DAI and DAI links. In the other two patches, topology will configure more on FE DAI links. Guneshwor Singh (1): ASoC: topology: Set CPU DAI name and enable DPCM by default for FE link Mengdong Lin (3): ASoC: Export snd_soc_find_dai() ASoC: Change DAI link's be_id to a generic id ASoC: topology: Set the link ID when creating a FE DAI link include/sound/soc.h | 5 ++++- include/uapi/sound/asoc.h | 2 +- sound/soc/intel/boards/broadwell.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 2 +- sound/soc/intel/boards/bytcr_rt5651.c | 2 +- sound/soc/intel/boards/cht_bsw_max98090_ti.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5645.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5672.c | 2 +- sound/soc/intel/boards/haswell.c | 2 +- sound/soc/intel/boards/skl_nau88l25_max98357a.c | 12 ++++++------ sound/soc/intel/boards/skl_nau88l25_ssm4567.c | 12 ++++++------ sound/soc/intel/boards/skl_rt286.c | 10 +++++----- sound/soc/soc-core.c | 3 ++- sound/soc/soc-topology.c | 11 +++++++++++ 14 files changed, 42 insertions(+), 27 deletions(-) -- 2.5.0

3 10

Re: [alsa-devel] Sound: BUG: KASAN: use-after-free in kill_fasync
by Baozeng Ding 21 Apr '16

21 Apr '16

On 2016/4/6 19:37, Baozeng Ding wrote: > > > On 2016/4/5 22:18, Takashi Iwai wrote: >> On Tue, 05 Apr 2016 15:51:30 +0200, >> Baozeng Ding wrote: >>> Hi all, >>> I've got the following report (use-after-free in kill_fasync) while >>> running syzkaller. >>> Unfortunately no reproducer.The kernel version is 4.5 (on Mar 16 commit >>> 09fd671ccb2475436bd5f597f751ca4a7d177aea). >>> >>> ================================================================== >>> BUG: KASAN: use-after-free in kill_fasync+0x3fb/0x420 at addr >>> ffff880067691d88 >>> Read of size 8 by task swapper/2/0 >>> ============================================================================= >>> >>> BUG kmalloc-2048 (Not tainted): kasan: bad access detected >>> ----------------------------------------------------------------------------- >>> >>> >>> Disabling lock debugging due to kernel taint >>> INFO: Allocated in 0xbbbbbbbbbbbbbbbb age=18446678412249576073 >>> cpu=2245704320 pid=-1 >>> [< inline >] kmalloc /kernel/include/linux/slab.h:472 >>> [< inline >] kzalloc /kernel/include/linux/slab.h:616 >>> [< none >] snd_pcm_attach_substream+0x3b4/0xb10 >>> /kernel/sound/core/pcm.c:966 >>> [< none >] ___slab_alloc+0x4c7/0x500 /kernel/mm/slub.c:2446 >>> [< none >] __slab_alloc+0x4c/0x90 /kernel/mm/slub.c:2475 >>> [< inline >] slab_alloc_node /kernel/mm/slub.c:2538 >>> [< inline >] slab_alloc /kernel/mm/slub.c:2580 >>> [< none >] kmem_cache_alloc_trace+0x262/0x300 >>> /kernel/mm/slub.c:2597 >>> [< inline >] kmalloc /kernel/include/linux/slab.h:472 >>> [< inline >] kzalloc /kernel/include/linux/slab.h:616 >>> [< none >] snd_pcm_attach_substream+0x3b4/0xb10 >>> /kernel/sound/core/pcm.c:966 >>> [< none >] snd_pcm_open_substream+0x84/0x450 >>> /kernel/sound/core/pcm_native.c:2262 >>> [< inline >] snd_pcm_oss_open_file >>> /kernel/sound/core/oss/pcm_oss.c:2346 >>> [< none >] snd_pcm_oss_open.part.17+0x5a4/0x1100 >>> /kernel/sound/core/oss/pcm_oss.c:2428 >>> [< none >] snd_pcm_oss_open+0x35/0x50 >>> /kernel/sound/core/oss/pcm_oss.c:2392 >>> [< none >] soundcore_open+0x30f/0x640 >>> /kernel/sound/sound_core.c:639 >>> [< none >] chrdev_open+0x22a/0x4c0 /kernel/fs/char_dev.c:388 >>> [< none >] do_dentry_open+0x6a2/0xcb0 /kernel/fs/open.c:736 >>> [< none >] vfs_open+0x17b/0x1f0 /kernel/fs/open.c:853 >>> [< inline >] do_last /kernel/fs/namei.c:3258 >>> [< none >] path_openat+0x4837/0x5830 /kernel/fs/namei.c:3394 >>> [< none >] do_filp_open+0x18e/0x250 /kernel/fs/namei.c:3429 >>> [< none >] do_sys_open+0x201/0x420 /kernel/fs/open.c:1022 >>> [< inline >] SYSC_open /kernel/fs/open.c:1040 >>> [< none >] SyS_open+0x2d/0x40 /kernel/fs/open.c:1035 >>> INFO: Freed in 0x10000b076 age=18446678416544543380 cpu=0 pid=0 >>> [< none >] snd_pcm_detach_substream+0x134/0x280 >>> /kernel/sound/core/pcm.c:1017 >>> [< none >] __slab_free+0x1e8/0x300 /kernel/mm/slub.c:2657 >>> [< inline >] slab_free /kernel/mm/slub.c:2810 >>> [< none >] kfree+0x24e/0x2d0 /kernel/mm/slub.c:3661 >>> [< none >] snd_pcm_detach_substream+0x134/0x280 >>> /kernel/sound/core/pcm.c:1017 >>> [< none >] snd_pcm_release_substream.part.38+0x219/0x2f0 >>> /kernel/sound/core/pcm_native.c:2250 >>> [< none >] snd_pcm_release_substream+0x59/0x70 >>> /kernel/sound/core/pcm_native.c:2251 >>> [< none >] snd_pcm_oss_release_file+0x45/0xb0 >>> /kernel/sound/core/oss/pcm_oss.c:2305 >>> [< none >] snd_pcm_oss_release+0xfa/0x250 >>> /kernel/sound/core/oss/pcm_oss.c:2485 >>> [< none >] __fput+0x236/0x780 /kernel/fs/file_table.c:208 >>> [< none >] ____fput+0x15/0x20 /kernel/fs/file_table.c:244 >>> [< none >] task_work_run+0x16b/0x200 >>> /kernel/kernel/task_work.c:115 >>> [< inline >] exit_task_work >>> /kernel/include/linux/task_work.h:21 >>> [< none >] do_exit+0x87f/0x2c90 /kernel/kernel/exit.c:748 >>> [< none >] do_group_exit+0x108/0x330 >>> /kernel/kernel/exit.c:878 >>> [< inline >] SYSC_exit_group /kernel/kernel/exit.c:889 >>> [< none >] SyS_exit_group+0x1d/0x20 /kernel/kernel/exit.c:887 >>> [< none >] entry_SYSCALL_64_fastpath+0x23/0xc1 >>> /kernel/arch/x86/entry/entry_64.S:207 >>> INFO: Slab 0xffffea00019da400 objects=13 used=8 fp=0xffff880067691be0 >>> flags=0x5fffc0000004080 >>> INFO: Object 0xffff880067691bd8 @offset=7128 fp=0xbbbbbbbbbbbbbbbb >>> Call Trace: >>> <IRQ> [< inline >] __dump_stack /kernel/lib/dump_stack.c:15 >>> <IRQ> [<ffffffff82945051>] dump_stack+0xb3/0x112 >>> /kernel/lib/dump_stack.c:51 >>> [<ffffffff817009ad>] print_trailer+0x10d/0x190 /kernel/mm/slub.c:668 >>> [<ffffffff817074af>] object_err+0x2f/0x40 /kernel/mm/slub.c:675 >>> [< inline >] print_address_description >>> /kernel/mm/kasan/report.c:138 >>> [<ffffffff81709ca5>] kasan_report_error+0x215/0x530 >>> /kernel/mm/kasan/report.c:236 >>> [< inline >] ? spin_lock >>> /kernel/include/linux/spinlock.h:302 >>> [<ffffffff84a1c550>] ? snd_pcm_stream_lock+0x80/0xd0 >>> /kernel/sound/core/pcm_native.c:104 >>> [< inline >] kasan_report /kernel/mm/kasan/report.c:259 >>> [<ffffffff8170a0be>] __asan_report_load8_noabort+0x3e/0x40 >>> /kernel/mm/kasan/report.c:280 >>> [<ffffffff81792a0b>] ? kill_fasync+0x3fb/0x420 >>> /kernel/fs/fcntl.c:729 >>> [<ffffffff81792a0b>] kill_fasync+0x3fb/0x420 /kernel/fs/fcntl.c:729 >>> [<ffffffff84a36e08>] snd_pcm_period_elapsed+0x1c8/0x230 >>> /kernel/sound/core/pcm_lib.c:1890 >>> [<ffffffff84b6e2e0>] ? get_bound_vga.isra.21.part.22+0x140/0x140 >>> /kernel/sound/pci/hda/hda_intel.c:1327 >>> [<ffffffff84b0637d>] stream_update+0xad/0xe0 >>> /kernel/sound/pci/hda/hda_controller.c:923 >>> [<ffffffff84c1583e>] snd_hdac_bus_handle_stream_irq+0x24e/0x350 >>> /kernel/sound/hda/hdac_controller.c:449 >>> [<ffffffff84b062d0>] ? azx_init_chip+0x100/0x100 >>> /kernel/sound/pci/hda/hda_controller.c:890 >>> [<ffffffff84b04d24>] ? azx_interrupt+0x14/0x4d0 >>> /kernel/sound/pci/hda/hda_controller.c:929 >>> [<ffffffff84b04eee>] azx_interrupt+0x1de/0x4d0 >>> /kernel/sound/pci/hda/hda_controller.c:954 >>> [<ffffffff84b04d10>] ? azx_stop_chip+0x20/0x20 >>> /kernel/sound/pci/hda/hda_controller.c:908 >>> [<ffffffff8143d9e3>] handle_irq_event_percpu+0xf3/0x790 >>> /kernel/kernel/irq/handle.c:145 >>> [<ffffffff8143e127>] handle_irq_event+0xa7/0x140 >>> /kernel/kernel/irq/handle.c:192 >>> [<ffffffff81447f81>] handle_edge_irq+0x1e1/0x8d0 >>> /kernel/kernel/irq/chip.c:623 >>> [< inline >] generic_handle_irq_desc >>> /kernel/include/linux/irqdesc.h:146 >>> [<ffffffff811ad739>] handle_irq+0x109/0x2a0 >>> /kernel/arch/x86/kernel/irq_64.c:78 >>> [< inline >] ? rcu_lock_release >>> /kernel/include/linux/rcupdate.h:491 >>> [< inline >] ? rcu_read_unlock >>> /kernel/include/linux/rcupdate.h:926 >>> [< inline >] ? __atomic_notifier_call_chain >>> /kernel/kernel/notifier.c:184 >>> [<ffffffff81369c4f>] ? atomic_notifier_call_chain+0xbf/0x140 >>> /kernel/kernel/notifier.c:193 >>> [<ffffffff81369b90>] ? __atomic_notifier_call_chain+0x150/0x150 >>> /kernel/include/linux/rcupdate.h:922 >>> [<ffffffff811ac36d>] do_IRQ+0x7d/0x1a0 >>> /kernel/arch/x86/kernel/irq.c:240 >>> [<ffffffff85dac40c>] common_interrupt+0x8c/0x8c >>> /kernel/arch/x86/entry/entry_64.S:454 >>> <EOI> [<ffffffff812245c6>] ? native_safe_halt+0x6/0x10 >>> /kernel/./arch/x86/include/asm/irqflags.h:49 >>> [<ffffffff81405ced>] ? trace_hardirqs_on+0xd/0x10 >>> /kernel/kernel/locking/lockdep.c:2635 >>> [< inline >] arch_safe_halt >>> /kernel/./arch/x86/include/asm/paravirt.h:117 >>> [<ffffffff811bf152>] default_idle+0x22/0x2d0 >>> /kernel/arch/x86/kernel/process.c:307 >>> [<ffffffff811c053a>] arch_cpu_idle+0xa/0x10 >>> /kernel/arch/x86/kernel/process.c:298 >>> [<ffffffff813eb618>] default_idle_call+0x48/0x70 >>> /kernel/kernel/sched/idle.c:93 >>> [< inline >] cpuidle_idle_call >>> /kernel/kernel/sched/idle.c:151 >>> [< inline >] cpu_idle_loop /kernel/kernel/sched/idle.c:242 >>> [<ffffffff813ebaa7>] cpu_startup_entry+0x467/0x600 >>> /kernel/kernel/sched/idle.c:291 >>> [<ffffffff81201432>] start_secondary+0x2b2/0x380 >>> /kernel/arch/x86/kernel/smpboot.c:259 >>> [<ffffffff81201180>] ? set_cpu_sibling_map+0x18a0/0x18a0 >>> /kernel/include/linux/topology.h:80 >>> Memory state around the buggy address: >>> ffff880067691c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> ffff880067691d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> >ffff880067691d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> ^ >>> ffff880067691e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> ffff880067691e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> ================================================================== >>> >>> It seems that in function snd_pcm_detach_substream, when freeing >>> runtime >>> structure, it did not handle its fasync >>> data pointer. Any ideas? Thanks. >> Well, fasync doesn't need a cleanup usually. Do you have a proper >> reproducer code? > Sorry, I cannot reproduce it. I will apply your patch and test it. I > will tell you the result whether it is okay a few days later. > Thanks. > >> In anyway, try the patch below. I'm not sure whether this would help, >> but if the path is via kill_fasync(), it'd be good to put in the >> protected context. >> During the last few weeks, I have not seen the bug any more after applying your patch. Thanks. >> >> Takashi >> >> --- >> diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c >> index 3a9b66c6e09c..0aca39762ed0 100644 >> --- a/sound/core/pcm_lib.c >> +++ b/sound/core/pcm_lib.c >> @@ -1886,8 +1886,8 @@ void snd_pcm_period_elapsed(struct >> snd_pcm_substream *substream) >> snd_timer_interrupt(substream->timer, 1); >> #endif >> _end: >> - snd_pcm_stream_unlock_irqrestore(substream, flags); >> kill_fasync(&runtime->fasync, SIGIO, POLL_IN); >> + snd_pcm_stream_unlock_irqrestore(substream, flags); >> } >> EXPORT_SYMBOL(snd_pcm_period_elapsed); >

2 1