November 2017 - Alsa-devel - mailman.alsa-project.org

Re: [alsa-devel] BUG: soft lockup
by Dmitry Vyukov 06 Nov '17

06 Nov '17

On Wed, Nov 1, 2017 at 10:54 PM, syzbot <bot+63583aefef5457348dcfa06b87d4fd1378b26b09(a)syzkaller.appspotmail.com> wrote: > Hello, > > syzkaller hit the following crash on > 1d53d908b79d7870d89063062584eead4cf83448 > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > C reproducer is attached > syzkaller reproducer is attached. See https://goo.gl/kgGztJ > for information about syzkaller reproducers > > > watchdog: BUG: soft lockup - CPU#3 stuck for 210s! [syzkaller355698:2995] > Modules linked in: > irq event stamp: 23090 > hardirqs last enabled at (23089): [<ffffffff8155d77c>] > __raw_spin_lock_init+0x1c/0x100 kernel/locking/spinlock_debug.c:23 > hardirqs last disabled at (23090): [<ffffffff84d3eb58>] > apic_timer_interrupt+0x98/0xb0 arch/x86/entry/entry_64.S:577 > softirqs last enabled at (1838): [<ffffffff84d4496d>] > __do_softirq+0x74d/0xbd0 kernel/softirq.c:310 > softirqs last disabled at (1825): [<ffffffff81415033>] invoke_softirq > kernel/softirq.c:364 [inline] > softirqs last disabled at (1825): [<ffffffff81415033>] irq_exit+0x1d3/0x210 > kernel/softirq.c:405 > CPU: 3 PID: 2995 Comm: syzkaller355698 Not tainted 4.13.0-rc7-next-20170901+ > #13 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > task: ffff88006b8fc580 task.stack: ffff880069df8000 > RIP: 0010:clear_page_rep+0x7/0x10 arch/x86/lib/clear_page_64.S:19 > RSP: 0000:ffff880069dff6f8 EFLAGS: 00010246 ORIG_RAX: ffffffffffffff10 > RAX: 0000000000000000 RBX: 0000000000000057 RCX: 0000000000000178 > RDX: 0000000000000000 RSI: ffff88006b8fc580 RDI: ffff880064657440 > RBP: ffff880069dff760 R08: 0000000000029190 R09: 0000000000000000 > R10: ffffffffffffffe8 R11: 0000000000000000 R12: dffffc0000000000 > R13: ffff88006b8fc580 R14: ffff88006b8fc580 R15: ffff88006b8fc580 > FS: 0000000000f65880(0000) GS:ffff88006df00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000020c67ff1 CR3: 000000006741d000 CR4: 00000000000006e0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline] > do_huge_pmd_anonymous_page+0x59c/0x1ba0 mm/huge_memory.c:728 > create_huge_pmd mm/memory.c:3802 [inline] > __handle_mm_fault+0x1827/0x39c0 mm/memory.c:4005 > handle_mm_fault+0x3bb/0x860 mm/memory.c:4071 > __do_page_fault+0x4f6/0xb60 arch/x86/mm/fault.c:1445 > do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1520 > do_async_page_fault+0x72/0xc0 arch/x86/kernel/kvm.c:266 > async_page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1069 > RIP: 0033:0x4012c8 > RSP: 002b:00007ffc12d93e10 EFLAGS: 00010286 > RAX: ffffffffffffffff RBX: ffffffffffffffff RCX: 0000000000439779 > RDX: 0000000000000000 RSI: 000000002076e000 RDI: ffffffffffffffff > RBP: 00327265636e6575 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000286 R12: 7165732f7665642f > R13: 646e732f7665642f R14: 0030656c69662f2e R15: 0000000000000000 > Code: 60 39 d1 fc e9 8d fd ff ff be 08 00 00 00 4c 89 ff e8 2e 39 d1 fc e9 > 1c fd ff ff 90 90 90 90 90 90 90 90 90 b9 00 02 00 00 31 c0 <f3> 48 ab c3 0f > 1f 44 00 00 31 c0 b9 40 00 00 00 66 0f 1f 84 00 > Kernel panic - not syncing: softlockup: hung tasks > CPU: 3 PID: 2995 Comm: syzkaller355698 Tainted: G L > 4.13.0-rc7-next-20170901+ #13 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Call Trace: > <IRQ> > __dump_stack lib/dump_stack.c:16 [inline] > dump_stack+0x194/0x257 lib/dump_stack.c:52 > panic+0x1e4/0x417 kernel/panic.c:181 > watchdog_timer_fn+0x401/0x410 kernel/watchdog.c:433 > __run_hrtimer kernel/time/hrtimer.c:1213 [inline] > __hrtimer_run_queues+0x349/0xe10 kernel/time/hrtimer.c:1277 > hrtimer_interrupt+0x1d4/0x5f0 kernel/time/hrtimer.c:1311 > local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1021 [inline] > smp_apic_timer_interrupt+0x156/0x710 arch/x86/kernel/apic/apic.c:1046 > apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:577 > </IRQ> > RIP: 0010:clear_page_rep+0x7/0x10 arch/x86/lib/clear_page_64.S:19 > RSP: 0000:ffff880069dff6f8 EFLAGS: 00010246 ORIG_RAX: ffffffffffffff10 > RAX: 0000000000000000 RBX: 0000000000000057 RCX: 0000000000000178 > RDX: 0000000000000000 RSI: ffff88006b8fc580 RDI: ffff880064657440 > RBP: ffff880069dff760 R08: 0000000000029190 R09: 0000000000000000 > R10: ffffffffffffffe8 R11: 0000000000000000 R12: dffffc0000000000 > R13: ffff88006b8fc580 R14: ffff88006b8fc580 R15: ffff88006b8fc580 > __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline] > do_huge_pmd_anonymous_page+0x59c/0x1ba0 mm/huge_memory.c:728 > create_huge_pmd mm/memory.c:3802 [inline] > __handle_mm_fault+0x1827/0x39c0 mm/memory.c:4005 > handle_mm_fault+0x3bb/0x860 mm/memory.c:4071 > __do_page_fault+0x4f6/0xb60 arch/x86/mm/fault.c:1445 > do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1520 > do_async_page_fault+0x72/0xc0 arch/x86/kernel/kvm.c:266 > async_page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1069 > RIP: 0033:0x4012c8 > RSP: 002b:00007ffc12d93e10 EFLAGS: 00010286 > RAX: ffffffffffffffff RBX: ffffffffffffffff RCX: 0000000000439779 > RDX: 0000000000000000 RSI: 000000002076e000 RDI: ffffffffffffffff > RBP: 00327265636e6575 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000286 R12: 7165732f7665642f > R13: 646e732f7665642f R14: 0030656c69662f2e R15: 0000000000000000 > Dumping ftrace buffer: > (ftrace buffer empty) > Kernel Offset: disabled > Rebooting in 86400 seconds.. Looking at the reproducer it looks more sound-related, so +alsa maintainers. This reproducer on linux-next 36ef71cae353f88fd6e095e2aaa3e5953af1685d (Oct 20) as well. INFO: rcu_sched detected stalls on CPUs/tasks: 3-...0: (1 GPs behind) idle=d3e/1/4611686018427387906 softirq=4046/4046 fqs=31231 (detected by 2, t=125002 jiffies, g=2422, c=2421, q=5593) Sending NMI from CPU 2 to CPUs 3: NMI backtrace for cpu 3 CPU: 3 PID: 3082 Comm: a.out Not tainted 4.14.0-rc5-next-20171018 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880063ed4140 task.stack: ffff880063a98000 RIP: 0010:snd_timer_user_interrupt+0x68/0x3f0 sound/core/timer.c:1220 RSP: 0000:ffff88006cb87730 EFLAGS: 00000802 RAX: 0000000000000000 RBX: ffff8800646727c0 RCX: 0000000000000000 RDX: 1ffff1000c8ce4fd RSI: 0000000000000001 RDI: ffff8800646727e8 RBP: ffff88006cb87768 R08: 0000000000000008 R09: 00000000000022df R10: ffff880063ed49d8 R11: ffff880063ed4140 R12: dffffc0000000000 R13: ffff88006b842410 R14: ffff880064672808 R15: 0000000000000001 FS: 0000000001def880(0000) GS:ffff88006cb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000203a2000 CR3: 000000006b29f006 CR4: 00000000001606e0 Call Trace: <IRQ> snd_timer_interrupt+0xae5/0x1510 sound/core/timer.c:808 snd_hrtimer_callback+0x211/0x3b0 sound/core/hrtimer.c:64 __run_hrtimer kernel/time/hrtimer.c:1213 [inline] __hrtimer_run_queues+0x38f/0x1000 kernel/time/hrtimer.c:1277 hrtimer_interrupt+0x1e2/0x650 kernel/time/hrtimer.c:1311 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline] smp_apic_timer_interrupt+0x153/0x6d0 arch/x86/kernel/apic/apic.c:1050 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:577 </IRQ> RIP: 0010:clear_page_erms+0x7/0x10 arch/x86/lib/clear_page_64.S:49 RSP: 0000:ffff880063a9f680 EFLAGS: 00010246 ORIG_RAX: ffffffffffffff11 RAX: 0000000000000000 RBX: 0000000000000034 RCX: 0000000000000040 RDX: ffff880063ed4140 RSI: 0000160000000000 RDI: ffff88005bd78fc0 RBP: ffff880063a9f6d0 R08: ffff880063ed4140 R09: 0000000000000000 R10: ffffffffffffffe2 R11: 0000000000000000 R12: dffffc0000000000 R13: ffffea00016f0000 R14: 0000000000000144 R15: 000000000000005e __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline] do_huge_pmd_anonymous_page+0x8ad/0x1e70 mm/huge_memory.c:728 create_huge_pmd mm/memory.c:3828 [inline] __handle_mm_fault+0x261d/0x3eb0 mm/memory.c:4031 handle_mm_fault+0x395/0xa10 mm/memory.c:4097 __do_page_fault+0x63f/0xff0 arch/x86/mm/fault.c:1438 do_page_fault+0xee/0x880 arch/x86/mm/fault.c:1514 do_async_page_fault+0x37/0x80 arch/x86/kernel/kvm.c:273 async_page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1069 RIP: 0033:0x427449 RSP: 002b:00007ffd9a2f3568 EFLAGS: 00010202 RAX: 00000000203a2000 RBX: 00000000004002c8 RCX: 0030656c69662f2e RDX: 0000000000000008 RSI: 000000000049813d RDI: 00000000203a2000 RBP: 00007ffd9a2f3580 R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000000032 R11: 0000000000000246 R12: 0000000000000000 R13: 00000000004068d0 R14: 0000000000406960 R15: 0000000000000000 Code: 00 00 48 8b 5b 40 4c 8d 73 48 4c 89 f7 e8 41 32 1b 01 48 8d 7b 28 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 <84> c0 74 08 3c 03 0f 8e ed 02 00 00 44 8b 63 28 31 ff 44 89 e6 I've sampled cpu stacks before stall message and it seems sound interrupts happen too frequently: Sending NMI from CPU 2 to CPUs 0-1,3: NMI backtrace for cpu 3 CPU: 3 PID: 3082 Comm: a.out Not tainted 4.14.0-rc5-next-20171018 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880063ed4140 task.stack: ffff880063a98000 RIP: 0010:__lock_acquire+0xaa8/0x4480 kernel/locking/lockdep.c:3373 RSP: 0000:ffff88006cb87110 EFLAGS: 00000046 RAX: 0000000000000003 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffff88006b125120 RBP: ffff88006cb875e0 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: ffff880063ed4140 R12: 0000000000000000 R13: ffff88006b125120 R14: 0000000000000000 R15: 0000000000000001 FS: 0000000001def880(0000) GS:ffff88006cb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000203a2000 CR3: 000000006b29f006 CR4: 00000000001606e0 Call Trace: <IRQ> lock_acquire+0x1d3/0x520 kernel/locking/lockdep.c:3991 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:149 spin_lock include/linux/spinlock.h:314 [inline] snd_timer_user_interrupt+0x4f/0x3f0 sound/core/timer.c:1219 snd_timer_interrupt+0xae5/0x1510 sound/core/timer.c:808 snd_hrtimer_callback+0x211/0x3b0 sound/core/hrtimer.c:64 __run_hrtimer kernel/time/hrtimer.c:1213 [inline] __hrtimer_run_queues+0x38f/0x1000 kernel/time/hrtimer.c:1277 hrtimer_interrupt+0x1e2/0x650 kernel/time/hrtimer.c:1311 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline] smp_apic_timer_interrupt+0x153/0x6d0 arch/x86/kernel/apic/apic.c:1050 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:577 </IRQ> RIP: 0010:clear_page_erms+0x7/0x10 arch/x86/lib/clear_page_64.S:49 RSP: 0000:ffff880063a9f680 EFLAGS: 00010246 ORIG_RAX: ffffffffffffff11 RAX: 0000000000000000 RBX: 0000000000000034 RCX: 0000000000000040 RDX: ffff880063ed4140 RSI: 0000160000000000 RDI: ffff88005bd78fc0 RBP: ffff880063a9f6d0 R08: ffff880063ed4140 R09: 0000000000000000 R10: ffffffffffffffe2 R11: 0000000000000000 R12: dffffc0000000000 R13: ffffea00016f0000 R14: 0000000000000144 R15: 000000000000005e __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline] do_huge_pmd_anonymous_page+0x8ad/0x1e70 mm/huge_memory.c:728 create_huge_pmd mm/memory.c:3828 [inline] __handle_mm_fault+0x261d/0x3eb0 mm/memory.c:4031 handle_mm_fault+0x395/0xa10 mm/memory.c:4097 __do_page_fault+0x63f/0xff0 arch/x86/mm/fault.c:1438 do_page_fault+0xee/0x880 arch/x86/mm/fault.c:1514 do_async_page_fault+0x37/0x80 arch/x86/kernel/kvm.c:273 async_page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1069 RIP: 0033:0x427449 RSP: 002b:00007ffd9a2f3568 EFLAGS: 00010202 RAX: 00000000203a2000 RBX: 00000000004002c8 RCX: 0030656c69662f2e RDX: 0000000000000008 RSI: 000000000049813d RDI: 00000000203a2000 RBP: 00007ffd9a2f3580 R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000000032 R11: 0000000000000246 R12: 0000000000000000 R13: 00000000004068d0 R14: 0000000000406960 R15: 0000000000000000 Code: ff df 49 8d 7c dd 08 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 61 35 00 00 49 8b 44 dd 08 48 85 c0 0f 85 77 f7 ff ff e9 27 f7 ff ff <48> c7 c7 40 c4 0c 86 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 NMI backtrace for cpu 0 CPU: 0 PID: 3086 Comm: a.out Not tainted 4.14.0-rc5-next-20171018 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88006391a7c0 task.stack: ffff880062800000 RIP: 0010:__lock_is_held+0x37/0x140 kernel/locking/lockdep.c:3808 RSP: 0000:ffff880062807578 EFLAGS: 00000806 RAX: dffffc0000000000 RBX: 0000000000000286 RCX: ffffffff81a04fa8 RDX: 1ffff1000c723605 RSI: 00000000ffffffff RDI: ffffffff8613d500 RBP: ffff8800628075b8 R08: ffff88006391a7c0 R09: 0000000000000000 R10: ffffffffffffffe2 R11: 0000000000000000 R12: ffff88006391a7c0 R13: ffffffff8613d500 R14: 00000000000011e5 R15: 000000000000005d FS: 0000000001def880(0000) GS:ffff88006ca00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000205a3fcc CR3: 000000006ae36002 CR4: 00000000001606f0 Call Trace: lock_is_held_type+0x118/0x210 kernel/locking/lockdep.c:4029 lock_is_held include/linux/lockdep.h:436 [inline] rcu_preempt_sleep_check include/linux/rcupdate.h:301 [inline] ___might_sleep+0x295/0x370 kernel/sched/core.c:6012 clear_huge_page+0x3b5/0x750 mm/memory.c:4581 __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline] do_huge_pmd_anonymous_page+0x8ad/0x1e70 mm/huge_memory.c:728 create_huge_pmd mm/memory.c:3828 [inline] __handle_mm_fault+0x261d/0x3eb0 mm/memory.c:4031 handle_mm_fault+0x395/0xa10 mm/memory.c:4097 __do_page_fault+0x63f/0xff0 arch/x86/mm/fault.c:1438 do_page_fault+0xee/0x880 arch/x86/mm/fault.c:1514 do_async_page_fault+0x37/0x80 arch/x86/kernel/kvm.c:273 async_page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1069 RIP: 0033:0x401355 RSP: 002b:00007ffd9a2f3570 EFLAGS: 00010202 RAX: 00000000205a3fcc RBX: 00000000004002c8 RCX: 0000000000401620 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffd9a2f3140 RBP: 00007ffd9a2f3580 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000010 R11: 0000000000000246 R12: 0000000000000000 R13: 00000000004068d0 R14: 0000000000406960 R15: 0000000000000000 Code: 65 4c 8b 24 25 c0 64 01 00 49 8d 84 24 68 08 00 00 53 48 89 c2 48 83 ec 18 48 89 45 c8 48 c1 ea 03 48 b8 00 00 00 00 00 fc ff df <48> 89 7d d0 0f b6 04 02 89 75 c4 84 c0 74 08 3c 03 0f 8e c7 00 NMI backtrace for cpu 1 CPU: 1 PID: 3084 Comm: a.out Not tainted 4.14.0-rc5-next-20171018 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880063f44780 task.stack: ffff880063380000 RIP: 0010:clear_page_erms+0x9/0x10 arch/x86/lib/clear_page_64.S:50 RSP: 0000:ffff880063387680 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000047 RCX: 0000000000000000 RDX: ffff880063f44780 RSI: 0000160000000000 RDI: ffff88005e448000 RBP: ffff8800633876d0 R08: ffff880063f44780 R09: 0000000000000000 R10: ffffffffffffffe2 R11: 0000000000000000 R12: 0000000000000000 R13: ffffea0001790000 R14: dffffc0000000000 R15: 0000000000000000 FS: 0000000001def880(0000) GS:ffff88006ca80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000fe0 CR3: 000000006b4ef005 CR4: 00000000001606e0 Call Trace: __do_huge_pmd_anonymous_page mm/huge_memory.c:570 [inline] do_huge_pmd_anonymous_page+0x8ad/0x1e70 mm/huge_memory.c:728 create_huge_pmd mm/memory.c:3828 [inline] __handle_mm_fault+0x261d/0x3eb0 mm/memory.c:4031 handle_mm_fault+0x395/0xa10 mm/memory.c:4097 __do_page_fault+0x63f/0xff0 arch/x86/mm/fault.c:1438 do_page_fault+0xee/0x880 arch/x86/mm/fault.c:1514 do_async_page_fault+0x37/0x80 arch/x86/kernel/kvm.c:273 async_page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1069 RIP: 0033:0x4012af RSP: 002b:00007ffd9a2f3570 EFLAGS: 00010246 RAX: 0000000020000fe0 RBX: 00000000004002c8 RCX: 0030656c69662f2e RDX: 0000000000000000 RSI: 0000000000498145 RDI: 00000000203a2008 RBP: 00007ffd9a2f3580 R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000000032 R11: 0000000000000246 R12: 0000000000000000 R13: 00000000004068d0 R14: 0000000000406960 R15: 0000000000000000 Code: 89 47 18 48 89 47 20 48 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d9 90 c3 0f 1f 80 00 00 00 00 b9 00 10 00 00 31 c0 f3 aa <c3> 90 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 > --- > This bug is generated by a dumb bot. It may contain errors. > See https://goo.gl/tpsmEJ for details. > Direct all questions to syzkaller(a)googlegroups.com. > Please credit me with: Reported-by: syzbot <syzkaller(a)googlegroups.com> > > syzbot will keep track of this bug report. > Once a fix for this bug is committed, please reply to this email with: > #syz fix: exact-commit-title > To mark this as a duplicate of another syzbot report, please reply with: > #syz dup: exact-subject-of-another-report > If it's a one-off invalid bug report, please reply with: > #syz invalid > Note: if the crash happens again, it will cause creation of a new bug > report. > Note: all commands must start from beginning of the line. > > -- > You received this message because you are subscribed to the Google Groups > "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to syzkaller-bugs+unsubscribe(a)googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/syzkaller-bugs/94eb2c19df188b1926055cf13c…. > For more options, visit https://groups.google.com/d/optout.

3 4

[alsa-devel] ALSA trigger soft lockup since "ALSA: seq: Fix race at creating a queue"
by Jerome Glisse 06 Nov '17

06 Nov '17

On Wed, Nov 01, 2017 at 01:02:27PM -0700, Andrew Morton wrote: > Begin forwarded message: > > Date: Wed, 01 Nov 2017 12:54:16 -0700 > From: syzbot <bot+63583aefef5457348dcfa06b87d4fd1378b26b09(a)syzkaller.appspotmail.com> > To: aaron.lu(a)intel.com, akpm(a)linux-foundation.org, aneesh.kumar(a)linux.vnet.ibm.com, jack(a)suse.cz, kirill.shutemov(a)linux.intel.com, linux-kernel(a)vger.kernel.org, linux-mm(a)kvack.org, mhocko(a)suse.com, minchan(a)kernel.org, peterz(a)infradead.org, rientjes(a)google.com, sfr(a)canb.auug.org.au, shli(a)fb.com, syzkaller-bugs(a)googlegroups.com, willy(a)linux.intel.com, ying.huang(a)intel.com, zi.yan(a)cs.rutgers.edu > Subject: BUG: soft lockup > > > Hello, > > syzkaller hit the following crash on > 1d53d908b79d7870d89063062584eead4cf83448 > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > C reproducer is attached > syzkaller reproducer is attached. See https://goo.gl/kgGztJ > for information about syzkaller reproducers Sorry to be the bringer of bad news but after: 4842e98f26dd80be3623c4714a244ba52ea096a8 and 7e1d90f60a0d501c8503e636942ca704a454d910 The attached syzkaller repro trigger a softlockup in workqueue. I am unfamiliar with that code so some familiar in that domain is more likely to find a proper solution. Note with git revert 7e1d90f60a0d501c8503e636942ca704a454d910 git revert 4842e98f26dd80be3623c4714a244ba52ea096a8 fix the issue Cheers, Jérôme

2 6

[alsa-devel] HDA HDMI audio doesn't work on Intel Geminilake machines
by Hui Wang 06 Nov '17

06 Nov '17

We have several Geminilake laptop and desktop machines, on these machines, the HW configs are same and are as shown below: the HDA controller: 00:0e.0 Audio device [0403]: Intel Corporation Device [8086:3198] (rev 01) the HDMI codec: Vendor Id: 0x8086280d VGA controller: 00:02.0 VGA compatible controller [0300]: Intel Corporation Device [8086:3184] (rev 01) (prog-if 00 [VGA controller]) The problem is if we boot the system without plugging the HDMI monitor, the Linux kernel can't find HDMI codec at all. If we plug the HDMI monitor before booting up, the kernel can find the HDMI codec, but there are many errors (as shown below) and the HDMI audio can't play any sound. Codec: Intel Geminilake HDMI Address: 2 AFG Function Id: 0x1 (unsol 0) Vendor Id: 0x8086280d Subsystem Id: 0x80860101 Revision Id: 0x100000 No Modem Function Group found Default PCM: N/A Default Amp-In caps: N/A Default Amp-Out caps: N/A State of AFG node 0x01: Power: setting=UNKNOWN, actual=UNKNOWN, Error, Clock-stop-OK, Setting-reset Invalid AFG subtree --endcollapse-- [ 25.504069] snd_hda_intel 0000:00:0e.0: azx_get_response timeout, switching to polling mode: last cmd=0x20bf8100 [ 26.516125] snd_hda_intel 0000:00:0e.0: No response from codec, disabling MSI: last cmd=0x20bf8100 [ 27.528058] snd_hda_intel 0000:00:0e.0: azx_get_response timeout, switching to single_cmd mode: last cmd=0x20bf8100 [ 27.528259] azx_single_wait_for_response: 12 callbacks suppressed [ 27.547927] snd_hda_codec_hdmi hdaudioC0D2: Unable to sync register 0x2f0d00. -5 We have tested the latest mainline kernel, but the testing result is the same. So does the existing kernel driver support the HDMI audio well for Geminilake? If it does, what is wrong with those machines, HW issue or BIOS issue? Thanks in advance.

2 3

[alsa-devel] [PATCH 0/4] ASoC: prepare for Component conversion - step [2/6]
by Kuninori Morimoto 06 Nov '17

06 Nov '17

Hi Mark One month passed. I will re-post prepare patches of "replace component" which is not yet accepted. Because it is big patch-set, to avoid sending patch bomb, I will repost it as small amount of patch set. To reviewing from big picture, please check below patch-set. Subject: Prepare to covert Codec/Platform into Component Date: Fri, 01 Sep 2017 14:18:11 +0900 I will continue to resend remainings if this small patch-sets were accepted. Total 6steps are needed Kuninori Morimoto (4): ASoC: add snd_soc_component_read32 ASoC: add snd_soc_component_xxx_bias_level() ASoC: add snd_soc_component_cache_sync() ASoC: add snd_soc_dapm_kcontrol_component() include/sound/soc.h | 78 ++++++++ sound/soc/soc-compress.c | 461 +++++++++++++++++++++++++++++++++++++++++++---- sound/soc/soc-core.c | 83 +++++---- sound/soc/soc-io.c | 14 ++ sound/soc/soc-pcm.c | 378 ++++++++++++++++++++++++++++++++++++-- 5 files changed, 929 insertions(+), 85 deletions(-) -- 1.9.1

1 4

[alsa-devel] [bug report] ASoC: rsnd: Request/Release DMA channel each time
by Dan Carpenter 06 Nov '17

06 Nov '17

Hello Kuninori Morimoto, The patch edce5c496c6a: "ASoC: rsnd: Request/Release DMA channel each time" from Nov 14, 2016, leads to the following static checker warning: sound/soc/sh/rcar/dma.c:214 rsnd_dmaen_nolock_start() warn: passing zero to 'PTR_ERR' sound/soc/sh/rcar/dma.c 192 static int rsnd_dmaen_nolock_start(struct rsnd_mod *mod, 193 struct rsnd_dai_stream *io, 194 struct rsnd_priv *priv) 195 { 196 struct rsnd_dma *dma = rsnd_mod_to_dma(mod); 197 struct rsnd_dmaen *dmaen = rsnd_dma_to_dmaen(dma); 198 struct device *dev = rsnd_priv_to_dev(priv); 199 200 if (dmaen->chan) { 201 dev_err(dev, "it already has dma channel\n"); 202 return -EIO; 203 } 204 205 /* 206 * DMAEngine request uses mutex lock. 207 * Thus, it shouldn't be called under spinlock. 208 * Let's call it under nolock_start 209 */ 210 dmaen->chan = rsnd_dmaen_request_channel(io, 211 dma->mod_from, 212 dma->mod_to); 213 if (IS_ERR_OR_NULL(dmaen->chan)) { 214 int ret = PTR_ERR(dmaen->chan); 215 216 dmaen->chan = NULL; 217 dev_err(dev, "can't get dma channel\n"); 218 return ret; PTR_ERR(NULL) is success. Normally when a function returns both NULL and error pointers, it means that NULL is not a error. For example, you call get_some_resource_pointer() and it returns NULL because your computer doesn't have one of those resources plugged in, but it returns an error pointer if it's defective or you're out of memory or whatever. In this case it really feels like NULL is returned on error so the right fix is to make rsnd_dmaen_request_channel() never return NULL and never be checked for NULL. 219 } 220 221 return 0; 222 } regards, dan carpenter

2 1

[alsa-devel] [alsa-tools][PATCH] echomixer: obsolete usage of dimension information
by Takashi Sakamoto 05 Nov '17

05 Nov '17

In current implementation for a series of echoaudio drivers, some control element set delivers information to use element values for multi-dimensional array. Essentially, ALSA control interface of asound.h has no common way to parse the information. As a result, the drivers forces 'echomixer' application to parse the information by several ways. This issue was reported by a commit 51db452df07b ('Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"') to Linux kernel. As a result of discussion at Linux miniconference 2017, usage of 'dimen' member of 'struct snd_ctl_elem_info' is going to be deprecated for future removal. According to the above decision, this commit obsoletes usage of 'dimen' information in 'echomixer' application. In a series of echoaudio drivers, a control element set named as 'Channels info' includes duplicated information of the dimension information on value array. Additionally, some of dimension information have fixed values. This commit utilizes them to obsolete usage of dimension information. This patch is tested with Echo Gina 3G. Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> --- echomixer/echomixer.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/echomixer/echomixer.c b/echomixer/echomixer.c index 54d1520..ac9b51a 100644 --- a/echomixer/echomixer.c +++ b/echomixer/echomixer.c @@ -525,6 +525,25 @@ void GetChannels(void) { nLOut=snd_ctl_elem_value_get_integer(control, 2); // Number of output channels fdOut=snd_ctl_elem_value_get_integer(control, 3); // First digital out nPOut=snd_ctl_elem_value_get_integer(control, 4); // Number of virtual output channels (==nLOut on non-vmixer cards) + + mixerControl.outputs = nLOut; + mixerControl.inputs = nIn; + + if (vmixerId) { + vmixerControl.outputs = nLOut; + vmixerControl.inputs = nPOut; + + /* For outputs and inputs. */ + metersStreams = 2; + } else { + /* For outputs, inputs and system outputs. */ + metersStreams = 3; + } + + /* For the number of channels. */ + metersNumber = 16; + /* For each of levels and peaks. */ + metersTypes = 2; } ClockMask=snd_ctl_elem_value_get_integer(control, 5); // Bitmask of available input clocks } @@ -1712,15 +1731,11 @@ int OpenControls(const char *card, const char *cardname) { if (!mixerId) { mixerId=numid; CTLID_DEBUG(("First Mixer id=%d\n", mixerId)); - mixerControl.outputs=snd_ctl_elem_info_get_dimension(info, 0); - mixerControl.inputs=snd_ctl_elem_info_get_dimension(info, 1); } } else if (!strcmp("VMixer Volume", snd_ctl_elem_id_get_name(id))) { if (!vmixerId) { vmixerId=vmixerControl.id=numid; CTLID_DEBUG(("First Vmixer id=%d\n", vmixerId)); - vmixerControl.outputs=snd_ctl_elem_info_get_dimension(info, 0); - vmixerControl.inputs=snd_ctl_elem_info_get_dimension(info, 1); } } else if (!strcmp("PCM Playback Volume", snd_ctl_elem_id_get_name(id))) { pcmoutId=pcmoutControl.id=numid; @@ -1789,9 +1804,6 @@ int OpenControls(const char *card, const char *cardname) { CTLID_DEBUG(("VU-meter switch id=%d\n", numid)); } else if (!strcmp("VU-meters", snd_ctl_elem_id_get_name(id))) { vumetersId=numid; - metersStreams=snd_ctl_elem_info_get_dimension(info, 0); // 2 or 3: output, input and (vmixer cards only) pcm - metersNumber=snd_ctl_elem_info_get_dimension(info, 1); // Number of channels - metersTypes=snd_ctl_elem_info_get_dimension(info, 2); // 2: level and peak CTLID_DEBUG(("VU-meters id=%d\n", numid)); } else if (!strcmp("Channels info", snd_ctl_elem_id_get_name(id))) { channelsId=numid; -- 2.11.0

2 1

[alsa-devel] How to handle jack detection through gpios
by Hans de Goede 03 Nov '17

03 Nov '17

Hi All, Umberto Izzo (in the Cc) mailed me to see if I could help with implementing headphone detection through GPIOS as I've been doing all kinds of Bay / Cherry Trail related work recently. Umberto found this commit: https://github.com/me176c-dev/kernel_asus_me176c/commit/498116d7e7b4718fa06… Which looks interesting, but is specific to the RT5640 driver. Looking at my own test devices I found a device with an ES8316 using a gpio for headphone detection. What Umberto and my device have in common is that the GPIO to use is listed in the ACPI tables under an AMCR0F28 device and that is also what the above commit binds too. So I was wondering if there is a way to have a headphone switch without tying it to a card, while userspace will still know what to do ? ### Another (non audio) problem is that the AMCR0F28 ACPI device seems to be present in the DSTD for almost all Bay / Cherry Trail devices, but its _STA method always returns 0 even on devices where we do need to use gpios for headphone-detection. I'm thinking about solving this by adding the AMCR0F28 device to the list of always present ACPI devices, so that the kernel ignores _STA and creates a platform device for it. And then in the platform driver for the AMCR0F28 platform device use a DMI whitelist, this is not the prettiest solution but it is the best I can come up with atm. As said not really audio related, Regards, Hans

3 6

[alsa-devel] [PATCH] ASoC: wm8741: Fix setting BCLK and LRCLK polarity
by Sergej Sawazki 03 Nov '17

03 Nov '17

After checking the code and the datasheet, it seems like we are handling the clock inversion (SND_SOC_DAIFMT_NB_IF and SND_SOC_DAIFMT_IB_IF) not correctly. >From the datasheet (Table 58): R5 Format Control, BITS[5:4], [BCP:LRP]: (0) 00 = normal BCLK, normal LRCLK (1) 01 = normal BCLK, inverted LRCLK <-- Fix this (2) 10 = inverted BCLK, normal LRCLK (3) 11 = inverted BCLK, inverted LRCLK <-- Fix this Signed-off-by: Sergej Sawazki <sergej(a)taudac.com> --- sound/soc/codecs/wm8741.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c index 3c96af0..a394dbe 100644 --- a/sound/soc/codecs/wm8741.c +++ b/sound/soc/codecs/wm8741.c @@ -333,13 +333,13 @@ static int wm8741_set_dai_fmt(struct snd_soc_dai *codec_dai, switch (fmt & SND_SOC_DAIFMT_INV_MASK) { case SND_SOC_DAIFMT_NB_NF: break; - case SND_SOC_DAIFMT_IB_IF: + case SND_SOC_DAIFMT_NB_IF: iface |= 0x10; break; case SND_SOC_DAIFMT_IB_NF: iface |= 0x20; break; - case SND_SOC_DAIFMT_NB_IF: + case SND_SOC_DAIFMT_IB_IF: iface |= 0x30; break; default: -- 2.7.4

3 7

[alsa-devel] [PATCH RESEND] ASoC: wm8741: Fix setting BCLK and LRCLK polarity
by Sergej Sawazki 03 Nov '17

03 Nov '17

After checking the code and the datasheet, it seems like we are handling the clock inversion (SND_SOC_DAIFMT_NB_IF and SND_SOC_DAIFMT_IB_IF) not correctly. >From the datasheet (Table 58): R5 Format Control, BITS[5:4], [BCP:LRP]: (0) 00 = normal BCLK, normal LRCLK (1) 01 = normal BCLK, inverted LRCLK <-- Fix this (2) 10 = inverted BCLK, normal LRCLK (3) 11 = inverted BCLK, inverted LRCLK <-- Fix this Signed-off-by: Sergej Sawazki <sergej(a)taudac.com> --- Based on 'for-next' (e678524) sound/soc/codecs/wm8741.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c index 3c96af0..a394dbe 100644 --- a/sound/soc/codecs/wm8741.c +++ b/sound/soc/codecs/wm8741.c @@ -333,13 +333,13 @@ static int wm8741_set_dai_fmt(struct snd_soc_dai *codec_dai, switch (fmt & SND_SOC_DAIFMT_INV_MASK) { case SND_SOC_DAIFMT_NB_NF: break; - case SND_SOC_DAIFMT_IB_IF: + case SND_SOC_DAIFMT_NB_IF: iface |= 0x10; break; case SND_SOC_DAIFMT_IB_NF: iface |= 0x20; break; - case SND_SOC_DAIFMT_NB_IF: + case SND_SOC_DAIFMT_IB_IF: iface |= 0x30; break; default: -- 2.7.4

2 5

[alsa-devel] [PATCH v2] ASoC: Intel: kbl: Modify map for Headset Playback to fix pop-noise
by Naveen Manohar 03 Nov '17

03 Nov '17

Patch fixes wrong path in commit 0b06122fc8d0 ("ASoC: Intel: kbl: Add map for new DAIs for Multi-Playback & Echo Ref") which resulted in pop noise. Current topology for Headset results in unwanted pop noise, while switching from spk->hs at the start of Headset Playback. Hence re-introduced mixin-mixout dsp module in topology for headset playback pipe to fix the regression. And the corresponding modification for headset route is updated here. Signed-off-by: Naveen Manohar <naveen.m(a)intel.com> Signed-off-by: Sathya Prakash M R <sathya.prakash.m.r(a)intel.com> --- v1->v2: updated commit message to suit the change more appropriately. sound/soc/intel/boards/kbl_rt5663_max98927.c | 2 +- sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/intel/boards/kbl_rt5663_max98927.c b/sound/soc/intel/boards/kbl_rt5663_max98927.c index 6f9a8bc..6dcad0a 100644 --- a/sound/soc/intel/boards/kbl_rt5663_max98927.c +++ b/sound/soc/intel/boards/kbl_rt5663_max98927.c @@ -101,7 +101,7 @@ enum { { "ssp0 Tx", NULL, "spk_out" }, { "AIF Playback", NULL, "ssp1 Tx" }, - { "ssp1 Tx", NULL, "hs_out" }, + { "ssp1 Tx", NULL, "codec1_out" }, { "hs_in", NULL, "ssp1 Rx" }, { "ssp1 Rx", NULL, "AIF Capture" }, diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c index 6072164..271ae3c 100644 --- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c @@ -109,7 +109,7 @@ enum { { "ssp0 Tx", NULL, "spk_out" }, { "AIF Playback", NULL, "ssp1 Tx" }, - { "ssp1 Tx", NULL, "hs_out" }, + { "ssp1 Tx", NULL, "codec1_out" }, { "hs_in", NULL, "ssp1 Rx" }, { "ssp1 Rx", NULL, "AIF Capture" }, -- 1.9.1

2 1