November 2017 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] ASoC: rt5645: reset RT5645_AD_DA_MIXER at probe
by Bard Liao 22 Nov '17

22 Nov '17

RT5645_AD_DA_MIXER (0x29) register will not be reset to default after SW reset. So we have to write it to its default value in i2c_probe. Signed-off-by: Bard Liao <bardliao(a)realtek.com> --- sound/soc/codecs/rt5645.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index b7eef6a..27a3d3d 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -3815,6 +3815,8 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, regmap_read(regmap, RT5645_VENDOR_ID, &val); rt5645->v_id = val & 0xff; + regmap_write(rt5645->regmap, RT5645_AD_DA_MIXER, 0x8080); + ret = regmap_register_patch(rt5645->regmap, init_list, ARRAY_SIZE(init_list)); if (ret != 0) -- 2.7.4

1 0

[alsa-devel] [PATCH RFC] ARM: dts: bcm283x: Fix probing of bcm2835-i2s
by Stefan Wahren 21 Nov '17

21 Nov '17

Since 517e7a1537a ("ASoC: bcm2835: move to use the clock framework") the bcm2835-i2s requires a clock as DT property. Unfortunately the necessary DT change has never been applied. While we are at it also fix the first PCM register range to cover the PCM_GRAY register. This patch also fixes the dt-bindings accordlingly. Signed-off-by: Stefan Wahren <stefan.wahren(a)i2se.com> --- Documentation/devicetree/bindings/dma/brcm,bcm2835-dma.txt | 4 ++-- Documentation/devicetree/bindings/sound/brcm,bcm2835-i2s.txt | 9 ++++----- arch/arm/boot/dts/bcm283x.dtsi | 4 ++-- 3 files changed, 8 insertions(+), 9 deletions(-) Hi, this is only probe tested with a RPi 1B. I don't have the sound hardware to test the drivers function. diff --git a/Documentation/devicetree/bindings/dma/brcm,bcm2835-dma.txt b/Documentation/devicetree/bindings/dma/brcm,bcm2835-dma.txt index baf9b34..b6a8cc0 100644 --- a/Documentation/devicetree/bindings/dma/brcm,bcm2835-dma.txt +++ b/Documentation/devicetree/bindings/dma/brcm,bcm2835-dma.txt @@ -74,8 +74,8 @@ Example: bcm2835_i2s: i2s@7e203000 { compatible = "brcm,bcm2835-i2s"; - reg = < 0x7e203000 0x20>, - < 0x7e101098 0x02>; + reg = < 0x7e203000 0x24>; + clocks = <&clocks BCM2835_CLOCK_PCM>; dmas = <&dma 2>, <&dma 3>; diff --git a/Documentation/devicetree/bindings/sound/brcm,bcm2835-i2s.txt b/Documentation/devicetree/bindings/sound/brcm,bcm2835-i2s.txt index 65783de..7bb0362 100644 --- a/Documentation/devicetree/bindings/sound/brcm,bcm2835-i2s.txt +++ b/Documentation/devicetree/bindings/sound/brcm,bcm2835-i2s.txt @@ -2,9 +2,8 @@ Required properties: - compatible: "brcm,bcm2835-i2s" -- reg: A list of base address and size entries: - * The first entry should cover the PCM registers - * The second entry should cover the PCM clock registers +- reg: Should contain PCM registers location and length. +- clocks: the (PCM) clock to use - dmas: List of DMA controller phandle and DMA request line ordered pairs. - dma-names: Identifier string for each DMA request line in the dmas property. These strings correspond 1:1 with the ordered pairs in dmas. @@ -16,8 +15,8 @@ Example: bcm2835_i2s: i2s@7e203000 { compatible = "brcm,bcm2835-i2s"; - reg = <0x7e203000 0x20>, - <0x7e101098 0x02>; + reg = <0x7e203000 0x24>; + clocks = <&clocks BCM2835_CLOCK_PCM>; dmas = <&dma 2>, <&dma 3>; diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi index 431dcfc..01733a9 100644 --- a/arch/arm/boot/dts/bcm283x.dtsi +++ b/arch/arm/boot/dts/bcm283x.dtsi @@ -391,8 +391,8 @@ i2s: i2s@7e203000 { compatible = "brcm,bcm2835-i2s"; - reg = <0x7e203000 0x20>, - <0x7e101098 0x02>; + reg = <0x7e203000 0x24>; + clocks = <&clocks BCM2835_CLOCK_PCM>; dmas = <&dma 2>, <&dma 3>; -- 2.7.4

3 6

[alsa-devel] [PATCH 0/4] Harden USB-audio parsers
by Takashi Iwai 21 Nov '17

21 Nov '17

Hi, as recently spotted by syzkaller, the parser codes in USB audio driver don't check the length of the descriptor unit before actually accessing the extra field, which may lead to out-of-bound access error. This patchset tries to address these by adding proper sanity checks. Takashi === Takashi Iwai (4): ALSA: usb-audio: Add sanity checks to FE parser ALSA: usb-audio: Fix potential out-of-bound access at parsing SU ALSA: usb-audio: Fix potential zero-division at parsing FU ALSA: usb-audio: Add sanity checks in v2 clock parsers sound/usb/clock.c | 9 ++++++--- sound/usb/mixer.c | 19 ++++++++++++++++--- 2 files changed, 22 insertions(+), 6 deletions(-) -- 2.15.0

1 4

[alsa-devel] usb/sound: use-after-free in __uac_clock_find_source
by Andrey Konovalov 21 Nov '17

21 Nov '17

Hi! I've got the following report while fuzzing the kernel with syzkaller. On commit e1d1ea549b57790a3d8cf6300e6ef86118d692a3 (4.15-rc1). This actually looks more like an out-of-bounds with large offset than a use-after-free due to unrelated alloc and free stack traces. ================================================================== BUG: KASAN: use-after-free in __uac_clock_find_source+0xddd/0xe40 Read of size 1 at addr ffff8800699ca00f by task kworker/1:0/18 CPU: 1 PID: 18 Comm: kworker/1:0 Not tainted 4.14.0-57501-g9284d204d604 #119 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:17 dump_stack+0xe1/0x157 lib/dump_stack.c:53 print_address_description+0x71/0x234 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 kasan_report+0x173/0x270 mm/kasan/report.c:409 __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427 __uac_clock_find_source+0xddd/0xe40 sound/usb/clock.c:221 snd_usb_clock_find_source+0x41/0x50 sound/usb/clock.c:276 set_sample_rate_v2 sound/usb/clock.c:367 snd_usb_init_sample_rate+0x3b6/0xa40 sound/usb/clock.c:430 create_fixed_stream_quirk+0x510/0x8f0 sound/usb/quirks.c:192 snd_usb_create_quirk+0xa6/0x120 sound/usb/quirks.c:560 create_composite_quirk+0x1e0/0x420 sound/usb/quirks.c:59 snd_usb_create_quirk+0xa6/0x120 sound/usb/quirks.c:560 usb_audio_probe+0x1220/0x1f70 sound/usb/card.c:618 usb_probe_interface+0x324/0x940 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:424 driver_probe_device+0x564/0x820 drivers/base/dd.c:566 __device_attach_driver+0x25d/0x2d0 drivers/base/dd.c:662 bus_for_each_drv+0xff/0x160 drivers/base/bus.c:463 __device_attach+0x1ab/0x2a0 drivers/base/dd.c:719 device_initial_probe+0x1f/0x30 drivers/base/dd.c:766 bus_probe_device+0x1fc/0x2a0 drivers/base/bus.c:523 device_add+0xc27/0x15a0 drivers/base/core.c:1835 usb_set_configuration+0xd55/0x17a0 drivers/usb/core/message.c:1967 generic_probe+0xbb/0x120 drivers/usb/core/generic.c:174 usb_probe_device+0xab/0x100 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:424 driver_probe_device+0x564/0x820 drivers/base/dd.c:566 __device_attach_driver+0x25d/0x2d0 drivers/base/dd.c:662 bus_for_each_drv+0xff/0x160 drivers/base/bus.c:463 __device_attach+0x1ab/0x2a0 drivers/base/dd.c:719 device_initial_probe+0x1f/0x30 drivers/base/dd.c:766 bus_probe_device+0x1fc/0x2a0 drivers/base/bus.c:523 device_add+0xc27/0x15a0 drivers/base/core.c:1835 usb_new_device+0x7fa/0x1090 drivers/usb/core/hub.c:2538 hub_port_connect drivers/usb/core/hub.c:5000 hub_port_connect_change drivers/usb/core/hub.c:5106 port_event drivers/usb/core/hub.c:5212 hub_event_impl+0x17bc/0x3440 drivers/usb/core/hub.c:5324 hub_event+0x38/0x50 drivers/usb/core/hub.c:5222 process_one_work+0x944/0x15f0 kernel/workqueue.c:2112 worker_thread+0xef/0x10d0 kernel/workqueue.c:2246 kthread+0x367/0x420 kernel/kthread.c:238 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:437 Allocated by task 5253: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:551 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 slab_post_alloc_hook mm/slab.h:442 slab_alloc_node mm/slub.c:2725 slab_alloc mm/slub.c:2733 kmem_cache_alloc+0xd3/0x270 mm/slub.c:2738 kmem_cache_zalloc ./include/linux/slab.h:678 get_empty_filp+0xac/0x350 fs/file_table.c:123 path_openat+0x36/0x2860 fs/namei.c:3505 do_filp_open+0x13f/0x1d0 fs/namei.c:3563 do_sys_open+0x362/0x4c0 fs/open.c:1059 SYSC_open fs/open.c:1077 SyS_open+0x32/0x40 fs/open.c:1072 entry_SYSCALL_64_fastpath+0x23/0x9a arch/x86/entry/entry_64.S:203 Freed by task 17: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 slab_free_hook mm/slub.c:1391 slab_free_freelist_hook mm/slub.c:1412 slab_free mm/slub.c:2968 kmem_cache_free+0xb7/0x2f0 mm/slub.c:2990 file_free_rcu+0x67/0x90 fs/file_table.c:50 __rcu_reclaim kernel/rcu/rcu.h:195 rcu_do_batch kernel/rcu/tree.c:2758 invoke_rcu_callbacks kernel/rcu/tree.c:3012 __rcu_process_callbacks kernel/rcu/tree.c:2979 rcu_process_callbacks+0x4df/0xcf0 kernel/rcu/tree.c:2996 __do_softirq+0x2e0/0x88e kernel/softirq.c:285 The buggy address belongs to the object at ffff8800699ca000 which belongs to the cache filp of size 488 The buggy address is located 15 bytes inside of 488-byte region [ffff8800699ca000, ffff8800699ca1e8) The buggy address belongs to the page: page:ffffea0001a67280 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 flags: 0x100000000008100(slab|head) raw: 0100000000008100 0000000000000000 0000000000000000 00000001000c000c raw: dead000000000100 dead000000000200 ffff88006ca97980 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8800699c9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800699c9f80: 00 00 05 fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8800699ca000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800699ca080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800699ca100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

2 1

[alsa-devel] usb/sound: slab-out-of-bounds in parse_audio_unit
by Andrey Konovalov 21 Nov '17

21 Nov '17

Hi! I've got the following report while fuzzing the kernel with syzkaller. On commit e1d1ea549b57790a3d8cf6300e6ef86118d692a3 (4.15-rc1). ================================================================== BUG: KASAN: slab-out-of-bounds in parse_audio_unit+0x2e08/0x31d0 Read of size 1 at addr ffff88006998ff20 by task kworker/1:1/1495 CPU: 1 PID: 1495 Comm: kworker/1:1 Not tainted 4.14.0-57501-g9284d204d604 #119 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:17 dump_stack+0xe1/0x157 lib/dump_stack.c:53 print_address_description+0x71/0x234 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 kasan_report+0x173/0x270 mm/kasan/report.c:409 __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427 parse_audio_feature_unit sound/usb/mixer.c:1472 parse_audio_unit+0x2e08/0x31d0 sound/usb/mixer.c:2213 snd_usb_mixer_controls+0x2ec/0x750 sound/usb/mixer.c:2320 snd_usb_create_mixer+0x209/0xbe0 sound/usb/mixer.c:2566 create_standard_mixer_quirk+0x61/0x80 sound/usb/quirks.c:516 snd_usb_create_quirk+0xa6/0x120 sound/usb/quirks.c:560 create_composite_quirk+0x1e0/0x420 sound/usb/quirks.c:59 snd_usb_create_quirk+0xa6/0x120 sound/usb/quirks.c:560 usb_audio_probe+0x1220/0x1f70 sound/usb/card.c:618 usb_probe_interface+0x324/0x940 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:424 driver_probe_device+0x564/0x820 drivers/base/dd.c:566 __device_attach_driver+0x25d/0x2d0 drivers/base/dd.c:662 bus_for_each_drv+0xff/0x160 drivers/base/bus.c:463 __device_attach+0x1ab/0x2a0 drivers/base/dd.c:719 device_initial_probe+0x1f/0x30 drivers/base/dd.c:766 bus_probe_device+0x1fc/0x2a0 drivers/base/bus.c:523 device_add+0xc27/0x15a0 drivers/base/core.c:1835 usb_set_configuration+0xd55/0x17a0 drivers/usb/core/message.c:1967 generic_probe+0xbb/0x120 drivers/usb/core/generic.c:174 usb_probe_device+0xab/0x100 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:424 driver_probe_device+0x564/0x820 drivers/base/dd.c:566 __device_attach_driver+0x25d/0x2d0 drivers/base/dd.c:662 bus_for_each_drv+0xff/0x160 drivers/base/bus.c:463 __device_attach+0x1ab/0x2a0 drivers/base/dd.c:719 device_initial_probe+0x1f/0x30 drivers/base/dd.c:766 bus_probe_device+0x1fc/0x2a0 drivers/base/bus.c:523 device_add+0xc27/0x15a0 drivers/base/core.c:1835 usb_new_device+0x7fa/0x1090 drivers/usb/core/hub.c:2538 hub_port_connect drivers/usb/core/hub.c:5000 hub_port_connect_change drivers/usb/core/hub.c:5106 port_event drivers/usb/core/hub.c:5212 hub_event_impl+0x17bc/0x3440 drivers/usb/core/hub.c:5324 hub_event+0x38/0x50 drivers/usb/core/hub.c:5222 process_one_work+0x944/0x15f0 kernel/workqueue.c:2112 worker_thread+0xef/0x10d0 kernel/workqueue.c:2246 kthread+0x367/0x420 kernel/kthread.c:238 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:437 Allocated by task 1495: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:551 __kmalloc+0x1bc/0x300 mm/slub.c:3762 kmalloc ./include/linux/slab.h:504 usb_get_configuration+0x299/0x4e60 drivers/usb/core/config.c:856 usb_enumerate_device drivers/usb/core/hub.c:2371 usb_new_device+0xab1/0x1090 drivers/usb/core/hub.c:2507 hub_port_connect drivers/usb/core/hub.c:5000 hub_port_connect_change drivers/usb/core/hub.c:5106 port_event drivers/usb/core/hub.c:5212 hub_event_impl+0x17bc/0x3440 drivers/usb/core/hub.c:5324 hub_event+0x38/0x50 drivers/usb/core/hub.c:5222 process_one_work+0x944/0x15f0 kernel/workqueue.c:2112 worker_thread+0xef/0x10d0 kernel/workqueue.c:2246 kthread+0x367/0x420 kernel/kthread.c:238 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:437 Freed by task 5251: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 slab_free_hook mm/slub.c:1391 slab_free_freelist_hook mm/slub.c:1412 slab_free mm/slub.c:2968 kfree+0xf2/0x2e0 mm/slub.c:3899 kzfree+0x2d/0x40 mm/slab_common.c:1482 aa_free_task_context+0x13a/0x170 security/apparmor/context.c:54 apparmor_cred_free+0x38/0x70 security/apparmor/lsm.c:58 security_cred_free+0x4d/0x90 security/security.c:995 put_cred_rcu+0x72/0x2a0 kernel/cred.c:117 __rcu_reclaim kernel/rcu/rcu.h:195 rcu_do_batch kernel/rcu/tree.c:2758 invoke_rcu_callbacks kernel/rcu/tree.c:3012 __rcu_process_callbacks kernel/rcu/tree.c:2979 rcu_process_callbacks+0x4df/0xcf0 kernel/rcu/tree.c:2996 __do_softirq+0x2e0/0x88e kernel/softirq.c:285 The buggy address belongs to the object at ffff88006998ff00 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes to the right of 32-byte region [ffff88006998ff00, ffff88006998ff20) The buggy address belongs to the page: page:ffffea0001a663c0 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x100000000000100(slab) raw: 0100000000000100 0000000000000000 0000000000000000 0000000180550055 raw: ffffea0001aea900 0000000200000002 ffff88006c803980 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88006998fe00: fc fc fb fb fb fb fc fc 00 00 00 fc fc fc fb fb ffff88006998fe80: fb fb fc fc fb fb fb fb fc fc fb fb fb fb fc fc >ffff88006998ff00: 00 00 00 00 fc fc fb fb fb fb fc fc fb fb fb fb ^ ffff88006998ff80: fc fc 00 00 00 00 fc fc fb fb fb fb fc fc fc fc ffff880069990000: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc ==================================================================

2 1

Re: [alsa-devel] WARNING in snd_timer_user_info_compat
by Takashi Iwai 21 Nov '17

21 Nov '17

On Tue, 21 Nov 2017 16:27:58 +0100, syzbot wrote: > > Hello, > > syzkaller hit the following crash on > c8a0739b185d11d6e2ca7ad9f5835841d1cfc765 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > C reproducer is attached > syzkaller reproducer is attached. See https://goo.gl/kgGztJ > for information about syzkaller reproducers > > > Kernel panic - not syncing: panic_on_warn set ... > > CPU: 1 PID: 3039 Comm: syzkaller881964 Not tainted 4.14.0+ #98 > Hardware name: Google Google Compute Engine/Google Compute Engine, > BIOS Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:17 [inline] > dump_stack+0x194/0x257 lib/dump_stack.c:53 > panic+0x1e4/0x41c kernel/panic.c:183 > __warn+0x1dc/0x200 kernel/panic.c:547 > report_bug+0x211/0x2d0 lib/bug.c:184 > fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:177 > fixup_bug arch/x86/kernel/traps.c:246 [inline] > do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:295 > do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314 > invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:926 > RIP: 0010:snd_timer_user_info_compat.isra.6+0x3be/0x490 > sound/core/timer_compat.c:69 Aha, it's a superfluous WARN_ON() usage from snd_BUG_ON(). Now syzkaller turned on CONFIG_SND_DEBUG=y, so this surfaced. The fix patch is below. I'm going to queue this. #syz fix: ALSA: timer: Remove kernel warning at compat ioctl error paths thanks, Takashi --- From: Takashi Iwai <tiwai(a)suse.de> Subject: [PATCH] ALSA: timer: Remove kernel warning at compat ioctl error paths Some timer compat ioctls have NULL checks of timer instance with snd_BUG_ON() that bring up WARN_ON() when the debug option is set. Actually the condition can be met in the normal situation and it's confusing and bad to spew kernel warnings with stack trace there. Let's remove snd_BUG_ON() invocation and replace with the simple checks. Also, correct the error code to EBADFD to follow the native ioctl error handling. Reported-by: syzbot <syzkaller(a)googlegroups.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/timer_compat.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c index 59127b6ef39e..e00f7e399e46 100644 --- a/sound/core/timer_compat.c +++ b/sound/core/timer_compat.c @@ -66,11 +66,11 @@ static int snd_timer_user_info_compat(struct file *file, struct snd_timer *t; tu = file->private_data; - if (snd_BUG_ON(!tu->timeri)) - return -ENXIO; + if (!tu->timeri) + return -EBADFD; t = tu->timeri->timer; - if (snd_BUG_ON(!t)) - return -ENXIO; + if (!t) + return -EBADFD; memset(&info, 0, sizeof(info)); info.card = t->card ? t->card->number : -1; if (t->hw.flags & SNDRV_TIMER_HW_SLAVE) @@ -99,8 +99,8 @@ static int snd_timer_user_status_compat(struct file *file, struct snd_timer_status32 status; tu = file->private_data; - if (snd_BUG_ON(!tu->timeri)) - return -ENXIO; + if (!tu->timeri) + return -EBADFD; memset(&status, 0, sizeof(status)); status.tstamp.tv_sec = tu->tstamp.tv_sec; status.tstamp.tv_nsec = tu->tstamp.tv_nsec; -- 2.15.0

1 0

Re: [alsa-devel] KASAN: use-after-free Read in snd_timer_user_info_compat
by Takashi Iwai 21 Nov '17

21 Nov '17

On Fri, 27 Oct 2017 10:34:01 +0200, syzbot wrote: > > Hello, > > syzkaller hit the following crash on > 33d930e59a98fa10a0db9f56c7fa2f21a4aef9b9 > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > > syzkaller reproducer is attached. See https://goo.gl/kgGztJ > for information about syzkaller reproducers > > > BUG: KASAN: use-after-free in > snd_timer_user_info_compat.isra.6+0x46c/0x480 > sound/core/timer_compat.c:71 > Read of size 8 at addr ffff8801d0dd9d00 by task syz-executor0/3342 OK, this is a real bug, and obviously a forgotten code path from the previous fixes. The patch below should address it, but I checked only compile-tested, so far. Let me know if it really works. thanks, Takashi -- 8< -- From: Takashi Iwai <tiwai(a)suse.de> Subject: [PATCH] ALSA: timer: Add missing mutex lock for compat ioctls The races among ioctl and other operations were protected by the commit af368027a49a ("ALSA: timer: Fix race among timer ioctls") and later fixes, but one code path was forgotten in the scenario: the 32bit compat ioctl. As syzkaller recently spotted, a very similar use-after-free may happen with the combination of compat ioctls. The fix is simply to apply the same ioctl_lock to the compat_ioctl callback, too. Fixes: af368027a49a ("ALSA: timer: Fix race among timer ioctls") Reference: http://lkml.kernel.org/r/089e082686ac9b482e055c832617@google.com Reported-by: syzbot <bot+e5f3c9783e7048a74233054febbe9f1bdf54b6da(a)syzkaller.appspotmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/timer_compat.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c index 6a437eb66115..59127b6ef39e 100644 --- a/sound/core/timer_compat.c +++ b/sound/core/timer_compat.c @@ -133,7 +133,8 @@ enum { #endif /* CONFIG_X86_X32 */ }; -static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) +static long __snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, + unsigned long arg) { void __user *argp = compat_ptr(arg); @@ -153,7 +154,7 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns case SNDRV_TIMER_IOCTL_PAUSE: case SNDRV_TIMER_IOCTL_PAUSE_OLD: case SNDRV_TIMER_IOCTL_NEXT_DEVICE: - return snd_timer_user_ioctl(file, cmd, (unsigned long)argp); + return __snd_timer_user_ioctl(file, cmd, (unsigned long)argp); case SNDRV_TIMER_IOCTL_GPARAMS32: return snd_timer_user_gparams_compat(file, argp); case SNDRV_TIMER_IOCTL_INFO32: @@ -167,3 +168,15 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns } return -ENOIOCTLCMD; } + +static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, + unsigned long arg) +{ + struct snd_timer_user *tu = file->private_data; + long ret; + + mutex_lock(&tu->ioctl_lock); + ret = __snd_timer_user_ioctl_compat(file, cmd, arg); + mutex_unlock(&tu->ioctl_lock); + return ret; +} -- 2.14.2

2 1

[alsa-devel] [PATCH] SoC: intel: byt: Introduce new custom IN2 map
by Carlo Caione 21 Nov '17

21 Nov '17

From: Carlo Caione <carlo(a)endlessm.com> Introduce a new custom dapm routes map to quirk platforms with the internal mic connected to IN2P. Signed-off-by: Carlo Caione <carlo(a)endlessm.com> --- sound/soc/intel/boards/bytcr_rt5651.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c index 3076bfc0db5e..1dad5c98c9ef 100644 --- a/sound/soc/intel/boards/bytcr_rt5651.c +++ b/sound/soc/intel/boards/bytcr_rt5651.c @@ -37,6 +37,7 @@ enum { BYT_RT5651_DMIC_MAP, BYT_RT5651_IN1_MAP, + BYT_RT5651_IN2_MAP, }; #define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(7, 0)) @@ -58,6 +59,8 @@ static void log_quirks(struct device *dev) dev_info(dev, "quirk DMIC_MAP enabled"); if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) dev_info(dev, "quirk IN1_MAP enabled"); + if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) + dev_info(dev, "quirk IN2_MAP enabled"); if (byt_rt5651_quirk & BYT_RT5651_DMIC_EN) dev_info(dev, "quirk DMIC enabled"); if (byt_rt5651_quirk & BYT_RT5651_MCLK_EN) @@ -143,7 +146,6 @@ static const struct snd_soc_dapm_route byt_rt5651_audio_map[] = { {"ssp2 Rx", NULL, "AIF1 Capture"}, {"Headset Mic", NULL, "micbias1"}, /* lowercase for rt5651 */ - {"IN2P", NULL, "Headset Mic"}, {"Headphone", NULL, "HPOL"}, {"Headphone", NULL, "HPOR"}, {"Speaker", NULL, "LOUTL"}, @@ -151,15 +153,23 @@ static const struct snd_soc_dapm_route byt_rt5651_audio_map[] = { }; static const struct snd_soc_dapm_route byt_rt5651_intmic_dmic_map[] = { + {"IN2P", NULL, "Headset Mic"}, {"DMIC L1", NULL, "Internal Mic"}, {"DMIC R1", NULL, "Internal Mic"}, }; static const struct snd_soc_dapm_route byt_rt5651_intmic_in1_map[] = { {"Internal Mic", NULL, "micbias1"}, + {"IN2P", NULL, "Headset Mic"}, {"IN1P", NULL, "Internal Mic"}, }; +static const struct snd_soc_dapm_route byt_rt5651_intmic_in2_map[] = { + {"Internal Mic", NULL, "micbias1"}, + {"IN1P", NULL, "Headset Mic"}, + {"IN2P", NULL, "Internal Mic"}, +}; + static const struct snd_kcontrol_new byt_rt5651_controls[] = { SOC_DAPM_PIN_SWITCH("Headphone"), SOC_DAPM_PIN_SWITCH("Headset Mic"), @@ -246,6 +256,10 @@ static int byt_rt5651_init(struct snd_soc_pcm_runtime *runtime) custom_map = byt_rt5651_intmic_in1_map; num_routes = ARRAY_SIZE(byt_rt5651_intmic_in1_map); break; + case BYT_RT5651_IN2_MAP: + custom_map = byt_rt5651_intmic_in2_map; + num_routes = ARRAY_SIZE(byt_rt5651_intmic_in2_map); + break; default: custom_map = byt_rt5651_intmic_dmic_map; num_routes = ARRAY_SIZE(byt_rt5651_intmic_dmic_map); -- 2.14.2

3 5

[alsa-devel] [PATCH v2] ALSA: core: update tstamp only if audio_tstamp changed
by Henrik Eriksson 21 Nov '17

21 Nov '17

commit 3179f6200188 ("ALSA: core: add .get_time_info") had a side effect of changing the behaviour of the PCM runtime tstamp. Prior to this change tstamp was not updated by snd_pcm_update_hw_ptr0() unless the hw_ptr had moved, after this change tstamp was always updated. For an application using alsa-lib, doing snd_pcm_readi() followed by snd_pcm_status() to estimate the age of the read samples by subtracting status->avail * [sample rate] from status->tstamp this change degraded the accuracy of the estimate on devices where the pcm hw does not provide a granular hw_ptr, e.g., devices using soc-generic-dmaengine-pcm.c and a dma-engine with residue_granularity DMA_RESIDUE_GRANULARITY_DESCRIPTOR. The accuracy of the estimate depended on the latency between the PCM hw completing a period and the driver called snd_pcm_period_elapsed() to notify ALSA core, typically determined by interrupt handling latency. After the change the accuracy of the estimate depended on the latency between the PCM hw completing a period and the application calling snd_pcm_status(), determined by the scheduling of the application process. The maximum error of the estimate is one period length in both cases, but the error average and variance is smaller when it depends on interrupt latency. Instead of always updating tstamp, update it only if audio_tstamp changed. Fixes: 3179f6200188 ("ALSA: core: add .get_time_info") Suggested-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Henrik Eriksson <henrik.eriksson(a)axis.com> --- Changes since v1: - Use Pierre-Louis Bossart's suggested fix - Clean up commit log sound/core/pcm_lib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c index a93a4235a332..10e7ef7a8804 100644 --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -248,8 +248,10 @@ static void update_audio_tstamp(struct snd_pcm_substream *substream, runtime->rate); *audio_tstamp = ns_to_timespec(audio_nsecs); } - runtime->status->audio_tstamp = *audio_tstamp; - runtime->status->tstamp = *curr_tstamp; + if (!timespec_equal(&runtime->status->audio_tstamp, audio_tstamp)) { + runtime->status->audio_tstamp = *audio_tstamp; + runtime->status->tstamp = *curr_tstamp; + } /* * re-take a driver timestamp to let apps detect if the reference tstamp -- 2.11.0

2 1

[alsa-devel] [PATCH] ASoC: fsl_ssi: call _fsl_ssi_set_dai_fmt() just once in AC'97 mode
by Maciej S. Szmigiero 21 Nov '17

21 Nov '17

In AC'97 mode we configure and start SSI RX / TX on probe path via a call to _fsl_ssi_set_dai_fmt() function. We don't need to call this function again later and in fact don't want to do it since this function temporarily sets STCR, SRCR and SCR to some intermediate values. We need to make sure, however, that only proper channel slots are enabled at playback start time since some AC'97 CODECs (like VT1613) were observed requesting via SLOTREQ (and so enabling at SSI) spurious ones just after an AC'97 link is started but before the CODEC is configured by its driver. Theoretically, this should be necessary only for the very first playback but let's play safe here and make sure that no extra slots are enabled every time a playback is started. Signed-off-by: Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> --- sound/soc/fsl/fsl_ssi.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c index 48bb850a34d9..dad80b4b0cfc 100644 --- a/sound/soc/fsl/fsl_ssi.c +++ b/sound/soc/fsl/fsl_ssi.c @@ -630,12 +630,6 @@ static void fsl_ssi_setup_ac97(struct fsl_ssi_private *ssi_private) regmap_write(regs, CCSR_SSI_SACNT, CCSR_SSI_SACNT_AC97EN | CCSR_SSI_SACNT_FV); - /* no SACC{ST,EN,DIS} regs on imx21-class SSI */ - if (!ssi_private->soc->imx21regs) { - regmap_write(regs, CCSR_SSI_SACCDIS, 0xff); - regmap_write(regs, CCSR_SSI_SACCEN, 0x300); - } - /* * Enable SSI, Transmit and Receive. AC97 has to communicate with the * codec before a stream is started. @@ -1076,6 +1070,9 @@ static int fsl_ssi_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt) { struct fsl_ssi_private *ssi_private = snd_soc_dai_get_drvdata(cpu_dai); + if (fsl_ssi_is_ac97(ssi_private)) + return 0; + return _fsl_ssi_set_dai_fmt(cpu_dai->dev, ssi_private, fmt); } @@ -1149,9 +1146,16 @@ static int fsl_ssi_trigger(struct snd_pcm_substream *substream, int cmd, case SNDRV_PCM_TRIGGER_START: case SNDRV_PCM_TRIGGER_RESUME: case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: - if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { + /* no SACC{ST,EN,DIS} regs on imx21-class SSI */ + if (fsl_ssi_is_ac97(ssi_private) && + !ssi_private->soc->imx21regs) { + regmap_write(regs, CCSR_SSI_SACCDIS, 0xff); + regmap_write(regs, CCSR_SSI_SACCEN, 0x300); + } + fsl_ssi_tx_config(ssi_private, true); - else + } else fsl_ssi_rx_config(ssi_private, true); break;

2 4