August 2016 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] ALSA: seq: initialize whole fields of automatic variable with union type
by Takashi Sakamoto 30 Aug '16

30 Aug '16

Currently, automatic variable of 'union ioctl_arg' type is initialized by designated initialization. Although, the actual effect is interpretation of early element of int type and initialization of 'int pversion'. Therefore the first field corresponding to int type is initialized to zero. This is against my expectation to initialize whole fields. This commit uses memset() to initialize the variable, instead of designated initialization. Fixes: 04a56dd8ed0d ('ALSA: seq: change ioctl command operation to get data in kernel space') Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> --- sound/core/seq/seq_clientmgr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 286394b..fd50c38 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -2100,7 +2100,7 @@ static long snd_seq_ioctl(struct file *file, unsigned int cmd, struct snd_seq_client_pool client_pool; struct snd_seq_remove_events remove_events; struct snd_seq_query_subs query_subs; - } buf = {0}; + } buf; const struct ioctl_handler *handler; unsigned long size; int err; @@ -2114,6 +2114,9 @@ static long snd_seq_ioctl(struct file *file, unsigned int cmd, } if (handler->cmd == 0) return -ENOTTY; + + memset(&buf, 0, sizeof(union ioctl_arg)); + /* * All of ioctl commands for ALSA sequencer get an argument of size * within 13 bits. We can safely pick up the size from the command. -- 2.7.4

2 2

[alsa-devel] [PATCH 0/2] alsabat: add power management S3 test
by keqiao.zhang＠intel.com 30 Aug '16

30 Aug '16

From: "Keqiao, Zhang" <keqiao.zhang(a)intel.com> The patch set provide a method for QA to quick test audio during system S3 The first patch fix -86 error when system suspend/resume The second patch provide a test script Keqiao, Zhang (2): alsabat: fix alsabat -86 error alsabat: add system power management S3 test bat/alsa.c | 10 ++++++++++ bat/alsabat-test.sh | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+) -- 2.5.0

2 3

[alsa-devel] [PATCH] ALSA: hda - Add headset mic quirk for Dell Inspiron 5468
by Shrirang Bagul 30 Aug '16

30 Aug '16

This patch enables headset microphone on some variants of Dell Inspiron 5468. (Dell SSID 0x07ad) BugLink: https://bugs.launchpad.net/bugs/1617900 Signed-off-by: Shrirang Bagul <shrirang.bagul(a)canonical.com> --- sound/pci/hda/patch_realtek.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 7100f05..02fd252 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -5895,6 +5895,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { {0x12, 0x90a60170}, {0x14, 0x90170120}, {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60180}, + {0x14, 0x90170120}, + {0x21, 0x02211030}), SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ALC256_STANDARD_PINS), SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, -- 2.7.4

3 2

[alsa-devel] [PATCH v9 0/2] sun4i-codec: Add Line-In, FM-In, Mic 2, Capture Source, Differential Line-In
by Danny Milosavljevic 30 Aug '16

30 Aug '16

This patch adds support for some mixer controls: - Line-In - FM-In - Mic 2 - Capture Source - Differential Line-In v9 changes compared to v8 are: - added Line Differential Capture Switch. - split Capture Source into Left Capture Select, Right Capture Select. - added Line Capture Volume. - rename "sun4i_codec_widgets" to "sun4i_codec_controls" for consistency with the struct field it's used in. - rename "Line-In" to "Line". - rename "Power Amplifier Playback Volume" to "Headphone Playback Volume". v8 changes compared to v7 are: - fixed the routes for line and mic capturing. v7 changes compared to v6 are: - preparation for different A20, A10 controls is now in an extra patch. - all register definitions are now at the top. - sun7i-specific things (A20-specific things) are now less grouped-together. - rename "Power Amplifier Volume" to "Power Amplifier Playback Volume". v6 changes compared to v5 are: - Mic preamplifier special cases for A20 and A10 now are now not icky: There are two different _widget arrays and the probe() function now selects the right one to pass to snd_soc_register_codec() unmodified. - sun7i-specific things (A20-specific things) are now grouped together. v5 changes compared to v4 are: - Mic preamplifier controls have more common names now. - Mic preamplifier scale has a 0 dB entry as well now, as documented in the A20 user manual. - Mic preamplifier has special cases for A20 and A10 now. - Gain controls have "Gain" in the name now. v4 changes compared to v3 are: - names of the input are not uppercase anymore. - bit index constants are now named as in the A20 user manual v1.4. - added Mic1-In, Mac2-In. - added Mic1 and Mic2 Pre-Amplifiers. v3 changes compared to v2 are: - added DAPM routes. v2 changes compared to v1 are: - moved Line-In and FM-In playback switches to their respective sun4i_codec_*_mixer_controls. v1 changes: - added linein, fmin output volumes and switches. Danny Milosavljevic (2): ASoC: sun4i-codec: Distinguish sun4i from sun7i Add mixer controls: Line-In, FM-In, Mic 2, Capture Source, Differential Line-In. sound/soc/sunxi/sun4i-codec.c | 278 +++++++++++++++++++++++++++++++++++++++--- 1 file changed, 259 insertions(+), 19 deletions(-)

3 5

[alsa-devel] [PATCH 0/2] ALSA: fireworks/firewire-tascam: accessing to user space outside spinlock
by Takashi Sakamoto 30 Aug '16

30 Aug '16

Hi, In ALSA fireworks driver and firewire-tascam driver, current implementation for hwdep interface have issues for page fault handling. For example, when using single core processor, after executing lock_page() in page fault handler and call task scheduler, then the context never run again, because any interrupts are disabled by these drivers and the context can't catch waiting event. This patchset fixes the issues. The issues were reported by Vaishali Thakkar, with a help of coccinelle. Thanks a lot for his care to these minor drivers. http://mailman.alsa-project.org/pipermail/alsa-devel/2016-August/111887.html Takashi Sakamoto (2): ALSA: fireworks: accessing to user space outside spinlock ALSA: firewire-tascam: accessing to user space outside spinlock sound/firewire/fireworks/fireworks_hwdep.c | 20 ++++++++++++++----- sound/firewire/tascam/tascam-hwdep.c | 32 ++++++++++-------------------- 2 files changed, 25 insertions(+), 27 deletions(-) -- 2.7.4

2 4

[alsa-devel] Translating USB device names to ALSA client numbers
by Dejay 29 Aug '16

29 Aug '16

Hello, I'm trying to write some udev wrappers to automatically connect USB MIDI devices to each other. My logic could be really robust if I had a way of mapping ALSA client numbers (e.g. from 'aconnect -l', such as '20:0') to physical USB devices (either by bus ID, /dev/ symlink name, /proc/asound/ files, etc.) My ultimate goal is so that when a udev rule executes upon hotplugging a MIDI device, I can reference that MIDI device by client number and then execute an aconnect command. Thus, I need some way to map USB device information to the ALSA client numbers that get reported by aconnect. Is there any way to accomplish this? I tried to review the ALSA source code, but my eyes got jumbly after awhile. Thanks, Dejay

1 1

[alsa-devel] [PATCH] ASoC: wm8962: fix spelling mistake "mesurement" -> "measurement"
by Colin King 29 Aug '16

29 Aug '16

From: Colin Ian King <colin.king(a)canonical.com> Trivial fix to spelling mistake in dev_err message. Signed-off-by: Colin Ian King <colin.king(a)canonical.com> --- sound/soc/codecs/wm8962.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c index f3109da..97b0228 100644 --- a/sound/soc/codecs/wm8962.c +++ b/sound/soc/codecs/wm8962.c @@ -3713,7 +3713,7 @@ static int wm8962_i2c_probe(struct i2c_client *i2c, ARRAY_SIZE(wm8962_dc_measure)); if (ret != 0) dev_err(&i2c->dev, - "Failed to configure for DC mesurement: %d\n", + "Failed to configure for DC measurement: %d\n", ret); } -- 2.9.3

2 1

[alsa-devel] [RFC PATCH v2 0/7] AC97 device/driver model revamp
by Robert Jarzmik 29 Aug '16

29 Aug '16

It all started in the pxa device-tree submission here : https://lkml.org/lkml/2016/2/25/965 It will be maintained in : git fetch https://github.com/rjarzmik/linux.git work/ac97 And now it transformed into this RFC, which would bring a ground for AC'97 devices closer to the linux device/driver model. The driving ideas are still the same, and I put them in [1] for memory. This is the second opus of the RFC. I'm intending to stop the RFC cycle here if possible and have a true PATCH v1 submission after this RFC v2 unless there is a deep design flaw uncovered. I took into account Mark's and Takashi's remarks, I hope I forgot none. All the changes should be documented in the first 2 patches mainly. I also added : - the AC97 link clock For now, bus code doesn't disable it in suspend and re-enable in resume, leaving the controller decide. I'm still pondering if for S2RAM (as opposed to runtime suspend), bus code should disable the clock. - the .h guards I'm not particularly happy with my naming even for v2, feel free to propose anything better, the codec.h is particularly ugly. - statics and namespace pollution I made more functions static, limiting further the namespace pollution. - Kconfig/Makefile layout change I get the feeling that the KConfig "select" flavor would have better been a "depends on" one. And yet I didn't find a good way to enforce it, because of the way sound/soc/codecs/Kconfig is designed, and I'm afraid to break the structure by doing a "depends on AC97_BUS_NEW" in WM9713 configuration. Let's have another review cycle, that will let me test this serie more thoroughly, especially the suspend/resume and the reset in the resume, which doesn't work, and requires me to test more deeply. I'll also test by removing the wm9713 change to see how robust the implementation is. Happy review. -- Robert Robert Jarzmik (7): ALSA: ac97: split out the generic ac97 registers ALSA: ac97: add an ac97 bus ASoC: add new ac97 bus support ASoC: wm9713: add ac97 new bus support ASoC: pxa: switch to new ac97 bus support ARM: pxa: mioa701 convert to the new AC97 bus ASoC: mioa701_wm9713: convert to new ac97 bus arch/arm/mach-pxa/mioa701.c | 12 +- include/sound/ac97/codec.h | 111 ++++++++++++ include/sound/ac97/compat.h | 21 +++ include/sound/ac97/controller.h | 80 +++++++++ include/sound/ac97/regs.h | 262 +++++++++++++++++++++++++++ include/sound/ac97_codec.h | 239 +------------------------ include/sound/pxa2xx-lib.h | 15 +- sound/Kconfig | 2 + sound/Makefile | 1 + sound/ac97/Kconfig | 18 ++ sound/ac97/Makefile | 8 + sound/ac97/ac97_core.h | 10 ++ sound/ac97/bus.c | 381 ++++++++++++++++++++++++++++++++++++++++ sound/ac97/codec.c | 15 ++ sound/ac97/snd_ac97_compat.c | 104 +++++++++++ sound/arm/Kconfig | 1 - sound/arm/pxa2xx-ac97-lib.c | 39 ++-- sound/soc/Kconfig | 4 + sound/soc/codecs/Kconfig | 1 + sound/soc/codecs/wm9713.c | 62 ++++++- sound/soc/pxa/Kconfig | 4 +- sound/soc/pxa/mioa701_wm9713.c | 4 +- sound/soc/pxa/pxa2xx-ac97.c | 20 ++- 23 files changed, 1132 insertions(+), 282 deletions(-) create mode 100644 include/sound/ac97/codec.h create mode 100644 include/sound/ac97/compat.h create mode 100644 include/sound/ac97/controller.h create mode 100644 include/sound/ac97/regs.h create mode 100644 sound/ac97/Kconfig create mode 100644 sound/ac97/Makefile create mode 100644 sound/ac97/ac97_core.h create mode 100644 sound/ac97/bus.c create mode 100644 sound/ac97/codec.c create mode 100644 sound/ac97/snd_ac97_compat.c -- 2.1.4 [1] RFC PATCH reminder: Amongst the driving ideas behind this RFC : - use device/driver model for AC'97 device/driver binding is based on vendor_id{1,2} - use auto-probe of the AC'97 bus to enumerate codecs and create devices - be compatible with previous platform_data model for codecs => this enables a smooth transition, where a codec (here wm9713) can be used either through platform_device or automatic discovery - struct snd_ac97 is not used This structure is really heavy, and doesn't represent an AC97 device, but rather an AC'97 codec internals IIUC. I think it's right place would be in include/sound/ac97/codec.h. This is also a problem for regmap adherence, hence the include/sound/ac97/compat.h. - a new AC'97 bus Kconfig is created This was done for a smooth transition ... let's see if it's a good idea. - split the AC'97 into : - the codec - the digital controller - the bus Amongst the things that are not all touched yet : - ac97_codec.c The generic AC'97 codec in sound/pci/ac97/ac97_codec.c has really a lot features, which are not at all PCI related. They could be transfered to sound/ac97, without the pci specific field. => this deserves a deep ahead thinking, which I'll do if the current approach is accepted by the communauty. The most important patch is 2/7 "ALSA: ac97: add an ac97 bus". This is the main evaluation point for the serie, the others are here so that I can test it all. Well, this is a long term effort, which might need a complete rewrite according to the comments it'll get. Let's expose it for comments and see how I can progress with it.

2 10

[alsa-devel] [PATCH 1/1] ASoC: Intel: Atom: add a missing star in a memcpy call
by Nicolas Iooss 28 Aug '16

28 Aug '16

In sst_prepare_and_post_msg(), when a response is received in "block", the following code gets executed: *data = kzalloc(block->size, GFP_KERNEL); memcpy(data, (void *) block->data, block->size); The memcpy() call overwrites the content of the *data pointer instead of filling the newly-allocated memory (which pointer is hold by *data). Fix this by using *data in the memcpy() call. Fixes: 60dc8dbacb00 ("ASoC: Intel: sst: Add some helper functions") Cc: stable(a)vger.kernel.org # 3.19.x Signed-off-by: Nicolas Iooss <nicolas.iooss_linux(a)m4x.org> --- sound/soc/intel/atom/sst/sst_pvt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/intel/atom/sst/sst_pvt.c b/sound/soc/intel/atom/sst/sst_pvt.c index adb32fefd693..7c398b7c9d4b 100644 --- a/sound/soc/intel/atom/sst/sst_pvt.c +++ b/sound/soc/intel/atom/sst/sst_pvt.c @@ -289,7 +289,7 @@ int sst_prepare_and_post_msg(struct intel_sst_drv *sst, ret = -ENOMEM; goto out; } else - memcpy(data, (void *) block->data, block->size); + memcpy(*data, (void *) block->data, block->size); } } out: -- 2.9.3

3 8

[alsa-devel] sound: division by 0 in snd_hrtimer_callback
by Dmitry Vyukov 28 Aug '16

28 Aug '16

Hello, The following program triggers divide error in snd_hrtimer_callback: divide error: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 3 PID: 17469 Comm: syz-executor Not tainted 4.8.0-rc3+ #33 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88003dc4a640 task.stack: ffff88003c690000 RIP: 0010:[<ffffffff8575b49c>] [< inline >] ktime_divns ./include/linux/ktime.h:195 [<ffffffff8575b49c>] snd_hrtimer_callback+0x1bc/0x3c0 sound/core/hrtimer.c:62 RSP: 0018:ffff88006d507d98 EFLAGS: 00010006 RAX: 0000000000005f28 RBX: ffff88006c4acb48 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88006c4acb60 RDI: ffffffff884b7a68 RBP: ffff88006d507df0 R08: 000000687d030efd R09: ffff88007fff70c8 R10: ffff88007fff70d8 R11: ffff88007fff70d0 R12: ffff88003cda70c0 R13: ffff88003cda7174 R14: ffff88003cda71f0 R15: ffff88006c4acb40 FS: 00007f131f945700(0000) GS:ffff88006d500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000451ed0 CR3: 000000005bb88000 CR4: 00000000000006e0 Stack: 0000000000000000 ffff88006c4acb60 ffff88003cda7178 0000000000005f28 ffff88006c4acba0 0000000000000000 ffff88006c4acb48 0000000000000003 ffff88006d51b400 dffffc0000000000 dffffc0000000000 ffff88006d507ee8 Call Trace: <IRQ> [< inline >] __run_hrtimer kernel/time/hrtimer.c:1238 [<ffffffff814f48b5>] __hrtimer_run_queues+0x325/0xe70 kernel/time/hrtimer.c:1302 [<ffffffff814f726b>] hrtimer_interrupt+0x18b/0x420 kernel/time/hrtimer.c:1336 [<ffffffff81268f8f>] local_apic_timer_interrupt+0x6f/0xe0 arch/x86/kernel/apic/apic.c:933 [<ffffffff86c27d96>] smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:957 [<ffffffff86c26e4c>] apic_timer_interrupt+0x8c/0xa0 arch/x86/entry/entry_64.S:455 <EOI> [< inline >] spin_unlock_irqrestore ./include/linux/spinlock.h:362 [<ffffffff85750f7d>] snd_timer_start1+0xdd/0x590 sound/core/timer.c:464 [<ffffffff857532b5>] snd_timer_continue+0x45/0x80 sound/core/timer.c:593 [< inline >] snd_timer_user_continue sound/core/timer.c:1821 [< inline >] __snd_timer_user_ioctl sound/core/timer.c:1888 [<ffffffff85758ce9>] snd_timer_user_ioctl+0xe99/0x2470 sound/core/timer.c:1903 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff8186f1fc>] do_vfs_ioctl+0x18c/0x1080 fs/ioctl.c:675 [< inline >] SYSC_ioctl fs/ioctl.c:690 [<ffffffff8187017f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:681 [<ffffffff86c25480>] entry_SYSCALL_64_fastpath+0x23/0xc1 arch/x86/entry/entry_64.S:207 Code: 6b 45 e5 fb 8b 0d e5 ca 64 05 48 0f af 4d d0 48 85 c9 0f 88 6a 01 00 00 48 89 4d a8 e8 4e 45 e5 fb 48 8b 45 c0 48 8b 4d a8 48 99 <48> f7 f9 48 01 45 d0 e8 38 45 e5 fb 4c 89 fa 48 b8 00 00 00 00 RIP [< inline >] ktime_divns ./include/linux/ktime.h:195 RIP [<ffffffff8575b49c>] snd_hrtimer_callback+0x1bc/0x3c0 sound/core/hrtimer.c:62 RSP <ffff88006d507d98> ---[ end trace b12f88d370b1ccee ]--- Kernel panic - not syncing: Fatal exception in interrupt On commit 61c04572de404e52a655a36752e696bbcb483cf5 (Aug 25). // autogenerated by syzkaller (http://github.com/google/syzkaller) #ifndef __NR_mmap #define __NR_mmap 9 #endif #ifndef __NR_syz_open_dev #define __NR_syz_open_dev 1000001 #endif #ifndef __NR_ioctl #define __NR_ioctl 16 #endif #ifndef __NR_syz_fuse_mount #define __NR_syz_fuse_mount 1000003 #endif #ifndef __NR_syz_fuseblk_mount #define __NR_syz_fuseblk_mount 1000004 #endif #ifndef __NR_syz_open_pts #define __NR_syz_open_pts 1000002 #endif #include <fcntl.h> #include <pthread.h> #include <setjmp.h> #include <signal.h> #include <stddef.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/ioctl.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <unistd.h> __thread int skip_segv; __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* uctx) { if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED)) _longjmp(segv_env, 1); exit(sig); } static void install_segv_handler() { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) \ { \ __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \ if (_setjmp(segv_env) == 0) { \ __VA_ARGS__; \ } \ __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \ } static uintptr_t syz_open_dev(uintptr_t a0, uintptr_t a1, uintptr_t a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf)); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } static uintptr_t syz_open_pts(uintptr_t a0, uintptr_t a1) { int ptyno = 0; if (ioctl(a0, TIOCGPTN, &ptyno)) return -1; char buf[128]; sprintf(buf, "/dev/pts/%d", ptyno); return open(buf, a1, 0); } static uintptr_t syz_fuse_mount(uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5) { uint64_t target = a0; uint64_t mode = a1; uint64_t uid = a2; uint64_t gid = a3; uint64_t maxread = a4; uint64_t flags = a5; int fd = open("/dev/fuse", O_RDWR); if (fd == -1) return fd; char buf[1024]; sprintf(buf, "fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o", fd, (long)uid, (long)gid, (unsigned)mode & ~3u); if (maxread != 0) sprintf(buf + strlen(buf), ",max_read=%ld", (long)maxread); if (mode & 1) strcat(buf, ",default_permissions"); if (mode & 2) strcat(buf, ",allow_other"); syscall(SYS_mount, "", target, "fuse", flags, buf); return fd; } static uintptr_t syz_fuseblk_mount(uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7) { uint64_t target = a0; uint64_t blkdev = a1; uint64_t mode = a2; uint64_t uid = a3; uint64_t gid = a4; uint64_t maxread = a5; uint64_t blksize = a6; uint64_t flags = a7; int fd = open("/dev/fuse", O_RDWR); if (fd == -1) return fd; if (syscall(SYS_mknodat, AT_FDCWD, blkdev, S_IFBLK, makedev(7, 199))) return fd; char buf[256]; sprintf(buf, "fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o", fd, (long)uid, (long)gid, (unsigned)mode & ~3u); if (maxread != 0) sprintf(buf + strlen(buf), ",max_read=%ld", (long)maxread); if (blksize != 0) sprintf(buf + strlen(buf), ",blksize=%ld", (long)blksize); if (mode & 1) strcat(buf, ",default_permissions"); if (mode & 2) strcat(buf, ",allow_other"); syscall(SYS_mount, blkdev, target, "fuseblk", flags, buf); return fd; } static uintptr_t execute_syscall(int nr, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4, uintptr_t a5, uintptr_t a6, uintptr_t a7, uintptr_t a8) { switch (nr) { default: return syscall(nr, a0, a1, a2, a3, a4, a5); case __NR_syz_open_dev: return syz_open_dev(a0, a1, a2); case __NR_syz_open_pts: return syz_open_pts(a0, a1); case __NR_syz_fuse_mount: return syz_fuse_mount(a0, a1, a2, a3, a4, a5); case __NR_syz_fuseblk_mount: return syz_fuseblk_mount(a0, a1, a2, a3, a4, a5, a6, a7); } } long r[42]; int main() { install_segv_handler(); memset(r, -1, sizeof(r)); r[0] = execute_syscall(__NR_mmap, 0x20000000ul, 0xd000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul, 0, 0, 0); NONFAILING(memcpy( (void*)0x20003000, "\x2f\x64\x65\x76\x2f\x73\x6e\x64\x2f\x74\x69\x6d\x65\x72\x00", 15)); r[2] = execute_syscall(__NR_syz_open_dev, 0x20003000ul, 0x0ul, 0x1ul, 0, 0, 0, 0, 0, 0); NONFAILING(*(uint32_t*)0x2000bfcc = (uint32_t)0x1); NONFAILING(*(uint32_t*)0x2000bfd0 = (uint32_t)0x4); NONFAILING(*(uint32_t*)0x2000bfd4 = (uint32_t)0x2); NONFAILING(*(uint32_t*)0x2000bfd8 = (uint32_t)0x3); NONFAILING(*(uint32_t*)0x2000bfdc = (uint32_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe0 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe1 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe2 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe3 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe4 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe5 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe6 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe7 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe8 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfe9 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfea = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfeb = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfec = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfed = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfee = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfef = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff0 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff1 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff2 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff3 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff4 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff5 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff6 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff7 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff8 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bff9 = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bffa = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bffb = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bffc = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bffd = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bffe = (uint8_t)0x0); NONFAILING(*(uint8_t*)0x2000bfff = (uint8_t)0x0); r[40] = execute_syscall(__NR_ioctl, r[2], 0x40345410ul, 0x2000bfccul, 0, 0, 0, 0, 0, 0); r[41] = execute_syscall(__NR_ioctl, r[2], 0x54a2ul, 0, 0, 0, 0, 0, 0, 0); return 0; }

2 1