November 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] usb-audio: not submit urb for stopped endpoint
by Henry Lin 13 Nov '19

13 Nov '19

While output urb's snd_complete_urb() is executing, calling prepare_outbound_urb() may cause endpoint stopped before prepare_outbound_urb() returns and result in next urb submitted to stopped endpoint. usb-audio driver cannot re-use it afterwards as the urb is still hold by usb stack. This change checks EP_FLAG_RUNNING flag after prepare_outbound_urb() again to let snd_complete_urb() know the endpoint already stopped and does not submit next urb. We observed two scenario have this issue: 1. While executing snd_complete_urb() to complete an output urb, calling prepare_outbound_urb() let deactive_urbs() get called to unlink all active urbs. [ 268.097066] [<ffffffc000af7638>] deactivate_urbs+0xd4/0x108 [ 268.102633] [<ffffffc000af87fc>] snd_usb_endpoint_stop+0x30/0x58 [ 268.108636] [<ffffffc000b0272c>] snd_usb_substream_playback_trigger+0xa4/0xf4 [ 268.115765] [<ffffffc000acdbd0>] snd_pcm_do_stop+0x4c/0x58 [ 268.121245] [<ffffffc000acda24>] snd_pcm_action_single+0x40/0x88 [ 268.127245] [<ffffffc000ace984>] snd_pcm_action+0x30/0xf0 [ 268.132632] [<ffffffc000acea68>] snd_pcm_stop+0x24/0x2c [ 268.137851] [<ffffffc000ad5e14>] xrun+0x60/0x6c [ 268.142374] [<ffffffc000ad7a98>] snd_pcm_update_state+0xa8/0x10c [ 268.148374] [<ffffffc000ad7e24>] snd_pcm_update_hw_ptr0+0x328/0x344 [ 268.154635] [<ffffffc000ad7ed8>] snd_pcm_period_elapsed+0x98/0xb0 [ 268.160723] [<ffffffc000b02510>] prepare_playback_urb+0x46c/0x488 [ 268.166810] [<ffffffc000af7d60>] prepare_outbound_urb+0x60/0x1d4 [ 268.172805] [<ffffffc000af8d60>] snd_complete_urb+0x244/0x264 [ 268.178548] [<ffffffc00081fb38>] __usb_hcd_giveback_urb+0x94/0x104 [ 268.184721] [<ffffffc00081fbe4>] usb_hcd_giveback_urb+0x3c/0x114 [ 268.190724] [<ffffffc00084d4b4>] handle_tx_event+0x1304/0x1434 [ 268.196552] [<ffffffc00084dbc0>] xhci_handle_event+0x5dc/0x788 [ 268.202378] [<ffffffc00084dee4>] xhci_irq+0x178/0x280 2. Userspace application stops playback from sound subsystem with below call stack: [ 28.506477] CPU: 5 PID: 1274 Comm: AudioOut_25 Not tainted 4.4.38-tegra #31 [ 28.513430] Hardware name: quill (DT) [ 28.517085] Call trace: [ 28.519531] [<ffffffc000089a84>] dump_backtrace+0x0/0xf8 [ 28.524837] [<ffffffc000089c44>] show_stack+0x14/0x1c [ 28.529885] [<ffffffc000401c54>] dump_stack+0xac/0xe0 [ 28.534931] [<ffffffc000b35f94>] deactivate_urbs+0x148/0x180 [ 28.540578] [<ffffffc000b37160>] snd_usb_endpoint_stop+0x30/0x58 [ 28.546571] [<ffffffc000b410d8>] snd_usb_substream_playback_trigger+0xa4/0xf4 [ 28.553699] [<ffffffc000b0c160>] snd_pcm_do_stop+0x4c/0x58 [ 28.559179] [<ffffffc000b0bfb4>] snd_pcm_action_single+0x40/0x88 [ 28.565178] [<ffffffc000b0cf14>] snd_pcm_action+0x30/0xf0 [ 28.570568] [<ffffffc000b0fbc8>] snd_pcm_drop+0xac/0x140 [ 28.575873] [<ffffffc000b0fc84>] snd_pcm_release_substream+0x28/0xb0 [ 28.582212] [<ffffffc000b0fd48>] snd_pcm_release+0x3c/0x98 [ 28.587686] [<ffffffc0001e3210>] __fput+0xe0/0x1ac [ 28.592469] [<ffffffc0001e3334>] ____fput+0xc/0x14 [ 28.597253] [<ffffffc0000c2904>] task_work_run+0xa0/0xc0 [ 28.602558] [<ffffffc0000897bc>] do_notify_resume+0x48/0x60 [ 28.608123] [<ffffffc000084ee8>] work_pending+0x1c/0x20 In the call path, snd_pcm_stream spinlock has been acquired in snd_pcm_drop(). If an output urb is completed between the spinlock acquired and deactivate_urbs() clears EP_FLAG_RUNNING for the endpoint, its executing of snd_complete_urb() will be blocked for acquiring snd_pcm_stream spinlock in snd_pcm_period_elapsed() until the lock is released in snd_pcm_drop(). When snd_complete_urb() continues, all jobs for deactivate_urbs() are finished. Signed-off-by: Henry Lin <henryl(a)nvidia.com> --- sound/usb/endpoint.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c index a2ab8e8d3a93..4a9a2f6ef5a4 100644 --- a/sound/usb/endpoint.c +++ b/sound/usb/endpoint.c @@ -388,6 +388,9 @@ static void snd_complete_urb(struct urb *urb) } prepare_outbound_urb(ep, ctx); + /* can be stopped during prepare callback */ + if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags))) + goto exit_clear; } else { retire_inbound_urb(ep, ctx); /* can be stopped during retire callback */ -- 2.17.1

2 6

[alsa-devel] [PATCH 0/9] ASoC: soc-core: cleanup step5
by Kuninori Morimoto 13 Nov '19

13 Nov '19

Hi Mark These are soc-core cleanup step5. My apology that it is randomly cleanupping. Kuninori Morimoto (9): ASoC: soc-core: remove soc_is_dai_link_bound() ASoC: soc-core: merge snd_soc_register_dai() and soc_add_dai() ASoC: soc-core: merge snd_soc_unregister_dai() and soc_del_dai() ASoC: soc-core: merge snd_soc_add_dai_link() and soc_bind_dai_link() ASoC: soc-core: merge snd_soc_remove_dai_link() and soc_unbind_dai_link() ASoC: soc-core: merge soc_remove_component() and soc_cleanup_component() ASoC: soc-core: merge snd_soc_bind_card() and snd_soc_instantiate_card() ASoC: soc-core: tidyup soc_probe_aux_devices() ASoC: soc-core: call snd_soc_dapm_shutdown() at soc_cleanup_card_resources() sound/soc/soc-core.c | 281 ++++++++++++++++++++------------------------------- 1 file changed, 107 insertions(+), 174 deletions(-) -- 2.7.4

3 24

[alsa-devel] [PATCH] dt-bindings: vendor-prefixes: Add 'fsi[ab]' to the list of non-vendor prefixes
by Rob Herring 12 Nov '19

12 Nov '19

'fsia' and 'fsib' property prefixes were added as schema in commit 2f52475bac7e ("ASoC: fsi: switch to yaml base Documentation"). Unfortunately to do checks on actual vendor prefixes, we have to track the handful of prefixes which are not vendors like 'fsia' and 'fsib'. Fixes: 2f52475bac7e ASoC: fsi: switch to yaml base Documentation Cc: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Cc: Mark Brown <broonie(a)kernel.org> Signed-off-by: Rob Herring <robh(a)kernel.org> --- Seems to be an old binding, but there aren't any upstream dts files using these properties. If there's not backwards compatibility concerns, another option would be to rename these properties. Mark, probably should go via your tree as that is where the error is introduced. Rob Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml index 967e78c5ec0a..67b89db54aa2 100644 --- a/Documentation/devicetree/bindings/vendor-prefixes.yaml +++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml @@ -16,7 +16,7 @@ properties: {} patternProperties: # Prefixes which are not vendors, but followed the pattern # DO NOT ADD NEW PROPERTIES TO THIS LIST - "^(at25|devbus|dmacap|dsa|exynos|gpio-fan|gpio|gpmc|hdmi|i2c-gpio),.*": true + "^(at25|devbus|dmacap|dsa|exynos|fsi[ab]|gpio-fan|gpio|gpmc|hdmi|i2c-gpio),.*": true "^(keypad|m25p|max8952|max8997|max8998|mpmc),.*": true "^(pinctrl-single|#pinctrl-single|PowerPC),.*": true "^(pl022|pxa-mmc|rcar_sound|rotary-encoder|s5m8767|sdhci),.*": true -- 2.20.1

2 2

[alsa-devel] [PATCH] ASoC: rt5682: cancel jack_detect_work if hs_jack is set to null
by Pierre-Louis Bossart 12 Nov '19

12 Nov '19

From: Bard liao <yung-chuan.liao(a)linux.intel.com> jack_detect_work will be triggered by rt5682_irq. We should cancel it if hs_jack is set to null. Signed-off-by: Bard liao <yung-chuan.liao(a)linux.intel.com> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> --- sound/soc/codecs/rt5682.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c index 35dcec135c8a..0d8e9866c01a 100644 --- a/sound/soc/codecs/rt5682.c +++ b/sound/soc/codecs/rt5682.c @@ -1003,6 +1003,7 @@ static int rt5682_set_jack_detect(struct snd_soc_component *component, RT5682_JD1_EN_MASK, RT5682_JD1_DIS); regmap_update_bits(rt5682->regmap, RT5682_RC_CLK_CTRL, RT5682_POW_JDH | RT5682_POW_JDL, 0); + cancel_delayed_work_sync(&rt5682->jack_detect_work); return 0; } -- 2.20.1

2 1

[alsa-devel] [PATCH 0/4] ASoC: SOF: Intel: only use D0i3 if needed
by Pierre-Louis Bossart 12 Nov '19

12 Nov '19

The earlier patches for D0i3/S0ix support went one bridge too far, and forced the use of D0i3 even when it was not needed, which also had the side effect of breaking some of our s2idle suspend/resume stress tests. Add documentation on supported transitions and only use D0i3 if necessary. Keyon Jie (4): ASoC: SOF: PM: add state machine to comments ASoC: SOF: PM: add check before setting d0_substate ASoC: SOF: add helper to check if we should enter d0i3 suspend ASoC: SOF: PM: only suspend to D0I3 when needed sound/soc/sof/core.c | 13 +++++++++++++ sound/soc/sof/pm.c | 39 +++++++++++++++++++++++++++++++++++++-- sound/soc/sof/sof-priv.h | 2 ++ 3 files changed, 52 insertions(+), 2 deletions(-) -- 2.20.1

2 8

[alsa-devel] [PATCH] ASoC: SOF: topology: free kcontrol memory on error
by Pierre-Louis Bossart 12 Nov '19

12 Nov '19

From: Dragos Tarcatu <dragos_tarcatu(a)mentor.com> The volume and bytes kcontrols are currently not freeing their memory on initialization failures. When an error occurs, all the widgets loaded so far are unloaded via sof_widget_unload(). But this only happens for the widgets that got successfully loaded. Fix that by kfree()-ing the allocated memory on load error. Fixes: 311ce4fe7637d ("ASoC: SOF: Add support for loading topologies") Reviewed-by: Paul Olaru <paul.olaru(a)nxp.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Signed-off-by: Dragos Tarcatu <dragos_tarcatu(a)mentor.com> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> --- sound/soc/sof/topology.c | 67 +++++++++++++++++++++++++++++----------- 1 file changed, 49 insertions(+), 18 deletions(-) diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c index 6096731e89ce..d82ab981e840 100644 --- a/sound/soc/sof/topology.c +++ b/sound/soc/sof/topology.c @@ -942,18 +942,22 @@ static int sof_control_load_volume(struct snd_soc_component *scomp, struct sof_ipc_ctrl_data *cdata; int tlv[TLV_ITEMS]; unsigned int i; - int ret; + int ret = 0; /* validate topology data */ - if (le32_to_cpu(mc->num_channels) > SND_SOC_TPLG_MAX_CHAN) - return -EINVAL; + if (le32_to_cpu(mc->num_channels) > SND_SOC_TPLG_MAX_CHAN) { + ret = -EINVAL; + goto out; + } /* init the volume get/put data */ scontrol->size = struct_size(scontrol->control_data, chanv, le32_to_cpu(mc->num_channels)); scontrol->control_data = kzalloc(scontrol->size, GFP_KERNEL); - if (!scontrol->control_data) - return -ENOMEM; + if (!scontrol->control_data) { + ret = -ENOMEM; + goto out; + } scontrol->comp_id = sdev->next_comp_id; scontrol->min_volume_step = le32_to_cpu(mc->min); @@ -963,7 +967,7 @@ static int sof_control_load_volume(struct snd_soc_component *scomp, /* set cmd for mixer control */ if (le32_to_cpu(mc->max) == 1) { scontrol->cmd = SOF_CTRL_CMD_SWITCH; - goto out; + goto skip; } scontrol->cmd = SOF_CTRL_CMD_VOLUME; @@ -971,14 +975,15 @@ static int sof_control_load_volume(struct snd_soc_component *scomp, /* extract tlv data */ if (get_tlv_data(kc->tlv.p, tlv) < 0) { dev_err(sdev->dev, "error: invalid TLV data\n"); - return -EINVAL; + ret = -EINVAL; + goto out_free; } /* set up volume table */ ret = set_up_volume_table(scontrol, tlv, le32_to_cpu(mc->max) + 1); if (ret < 0) { dev_err(sdev->dev, "error: setting up volume table\n"); - return ret; + goto out_free; } /* set default volume values to 0dB in control */ @@ -988,7 +993,7 @@ static int sof_control_load_volume(struct snd_soc_component *scomp, cdata->chanv[i].value = VOL_ZERO_DB; } -out: +skip: /* set up possible led control from mixer private data */ ret = sof_parse_tokens(scomp, &scontrol->led_ctl, led_tokens, ARRAY_SIZE(led_tokens), mc->priv.array, @@ -996,13 +1001,21 @@ static int sof_control_load_volume(struct snd_soc_component *scomp, if (ret != 0) { dev_err(sdev->dev, "error: parse led tokens failed %d\n", le32_to_cpu(mc->priv.size)); - return ret; + goto out_free_table; } dev_dbg(sdev->dev, "tplg: load kcontrol index %d chans %d\n", scontrol->comp_id, scontrol->num_channels); - return 0; + return ret; + +out_free_table: + if (le32_to_cpu(mc->max) > 1) + kfree(scontrol->volume_table); +out_free: + kfree(scontrol->control_data); +out: + return ret; } static int sof_control_load_enum(struct snd_soc_component *scomp, @@ -1047,6 +1060,7 @@ static int sof_control_load_bytes(struct snd_soc_component *scomp, container_of(hdr, struct snd_soc_tplg_bytes_control, hdr); struct soc_bytes_ext *sbe = (struct soc_bytes_ext *)kc->private_value; int max_size = sbe->max; + int ret = 0; /* init the get/put bytes data */ scontrol->size = sizeof(struct sof_ipc_ctrl_data) + @@ -1055,13 +1069,16 @@ static int sof_control_load_bytes(struct snd_soc_component *scomp, if (scontrol->size > max_size) { dev_err(sdev->dev, "err: bytes data size %d exceeds max %d.\n", scontrol->size, max_size); - return -EINVAL; + ret = -EINVAL; + goto out; } scontrol->control_data = kzalloc(max_size, GFP_KERNEL); cdata = scontrol->control_data; - if (!scontrol->control_data) - return -ENOMEM; + if (!scontrol->control_data) { + ret = -ENOMEM; + goto out; + } scontrol->comp_id = sdev->next_comp_id; scontrol->cmd = SOF_CTRL_CMD_BINARY; @@ -1076,23 +1093,32 @@ static int sof_control_load_bytes(struct snd_soc_component *scomp, if (cdata->data->magic != SOF_ABI_MAGIC) { dev_err(sdev->dev, "error: Wrong ABI magic 0x%08x.\n", cdata->data->magic); - return -EINVAL; + ret = -EINVAL; + goto out_free; } if (SOF_ABI_VERSION_INCOMPATIBLE(SOF_ABI_VERSION, cdata->data->abi)) { dev_err(sdev->dev, "error: Incompatible ABI version 0x%08x.\n", cdata->data->abi); - return -EINVAL; + ret = -EINVAL; + goto out_free; } if (cdata->data->size + sizeof(const struct sof_abi_hdr) != le32_to_cpu(control->priv.size)) { dev_err(sdev->dev, "error: Conflict in bytes vs. priv size.\n"); - return -EINVAL; + ret = -EINVAL; + goto out_free; } } - return 0; + + return ret; + +out_free: + kfree(scontrol->control_data); +out: + return ret; } /* external kcontrol init - used for any driver specific init */ @@ -1150,6 +1176,11 @@ static int sof_control_load(struct snd_soc_component *scomp, int index, return 0; } + if (ret < 0) { + kfree(scontrol); + return ret; + } + dobj->private = scontrol; list_add(&scontrol->list, &sdev->kcontrol_list); return ret; -- 2.20.1

2 1

[alsa-devel] Several problems when trying to run alsa-info.sh
by Rolf Eike Beer 12 Nov '19

12 Nov '19

Greetings, I had the need to run alsa-info.sh --stdout from 1.1.9 on our embedded device. There were multiple things I noticed: -it requires /bin/bash, but seems to run ok with just /bin/sh. We don't have bash. -it requires pgrep, which we don't have, but replacing all calls with pidof seems to work well enough -it requires whereis, and does not use that -at least in stdout mode the absence of lspci should not be a fatal error Greetings Eike -- Rolf Eike Beer, emlix GmbH, http://www.emlix.com Fon +49 551 30664-0, Fax +49 551 30664-11 Gothaer Platz 3, 37083 Göttingen, Germany Sitz der Gesellschaft: Göttingen, Amtsgericht Göttingen HR B 3160 Geschäftsführung: Heike Jordan, Dr. Uwe Kracke – Ust-IdNr.: DE 205 198 055 emlix - smart embedded open source

2 1

[alsa-devel] [PATCH] ALSA: au88x0: Fix incorrect device pointer for preallocation
by Takashi Iwai 12 Nov '19

12 Nov '19

The code change in commit 6974f8ad4494 ("ALSA: pci: Avoid non-standard macro usage") contained an incorrect conversion, which left the invalid pointer passed to the allocator for au88x0 driver. Fix it. Fixes: 6974f8ad4494 ("ALSA: pci: Avoid non-standard macro usage") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/pci/au88x0/au88x0_pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/pci/au88x0/au88x0_pcm.c b/sound/pci/au88x0/au88x0_pcm.c index 1012e8da29e7..a2dcf43beedf 100644 --- a/sound/pci/au88x0/au88x0_pcm.c +++ b/sound/pci/au88x0/au88x0_pcm.c @@ -637,7 +637,7 @@ static int snd_vortex_new_pcm(vortex_t *chip, int idx, int nr) /* pre-allocation of Scatter-Gather buffers */ snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV_SG, - &chip->pci_dev, + &chip->pci_dev->dev, 0x10000, 0x10000); switch (VORTEX_PCM_TYPE(pcm)) { -- 2.16.4

1 0

[alsa-devel] KASAN: use-after-free Read in snd_timer_open
by syzbot 12 Nov '19

12 Nov '19

Hello, syzbot found the following crash on: HEAD commit: 6980b7f6 Add linux-next specific files for 20191111 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=101679e6e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=2af7db1972ec750e dashboard link: https://syzkaller.appspot.com/bug?extid=4476917c053f60112c99 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=108fbfece00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1055d5aae00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+4476917c053f60112c99(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in __list_add_valid+0x9a/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff88809fccee78 by task syz-executor075/8825 CPU: 0 PID: 8825 Comm: syz-executor075 Not tainted 5.4.0-rc6-next-20191111 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:634 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 __list_add_valid+0x9a/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:60 [inline] list_add_tail include/linux/list.h:93 [inline] snd_timer_open+0x245/0x1150 sound/core/timer.c:268 snd_timer_user_tselect sound/core/timer.c:1738 [inline] __snd_timer_user_ioctl.isra.0+0x7ed/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x444f39 Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb cd fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffd1d1e3c98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000444f39 RDX: 0000000020029fcc RSI: 0000000040345410 RDI: 0000000000000003 RBP: 00000000000102a7 R08: 0000000000000004 R09: 00000000004002e0 R10: 000000000000000f R11: 0000000000000246 R12: 0000000000402180 R13: 0000000000402210 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 8824: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:510 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:483 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:524 kmem_cache_alloc_trace+0x158/0x790 mm/slab.c:3551 kmalloc include/linux/slab.h:556 [inline] kzalloc include/linux/slab.h:670 [inline] snd_timer_instance_new+0x4a/0x300 sound/core/timer.c:96 snd_timer_user_tselect sound/core/timer.c:1725 [inline] __snd_timer_user_ioctl.isra.0+0x665/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 8824: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] kasan_set_free_info mm/kasan/common.c:332 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:471 kasan_slab_free+0xe/0x10 mm/kasan/common.c:480 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x2c0 mm/slab.c:3757 snd_timer_instance_free sound/core/timer.c:120 [inline] snd_timer_instance_free+0x7c/0xa0 sound/core/timer.c:114 snd_timer_user_tselect sound/core/timer.c:1740 [inline] __snd_timer_user_ioctl.isra.0+0x160d/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88809fccee00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 120 bytes inside of 256-byte region [ffff88809fccee00, ffff88809fccef00) The buggy address belongs to the page: page:ffffea00027f3380 refcount:1 mapcount:0 mapping:ffff8880aa4008c0 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea00027f2e08 ffff8880aa401648 ffff8880aa4008c0 raw: 0000000000000000 ffff88809fcce000 0000000100000008 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809fcced00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88809fcced80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff88809fccee00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809fccee80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809fccef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 1

[alsa-devel] [PATCH] ASoC: rt5645: Fixed buddy jack support.
by Jacob Rasmussen 11 Nov '19

11 Nov '19

The headphone jack on buddy was broken with the following commit: commit 6b5da66322c5 ("ASoC: rt5645: read jd1_1 status for jd detection"). This changes the jd_mode for buddy to 4 so buddy can read from the same register that was used in the working version of this driver without affecting any other devices that might use this, since no other device uses jd_mode = 4. To test this I plugged and uplugged the headphone jack, verifying audio works. Signed-off-by: Jacob Rasmussen <jacobraz(a)google.com> --- sound/soc/codecs/rt5645.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index a15e4ecd2a24..046f339a9f00 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -3270,6 +3270,9 @@ static void rt5645_jack_detect_work(struct work_struct *work) snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); return; + case 4: + val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x002; + break; default: /* read rt5645 jd1_1 status */ val = snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x1000; break; @@ -3603,7 +3606,7 @@ static const struct rt5645_platform_data intel_braswell_platform_data = { static const struct rt5645_platform_data buddy_platform_data = { .dmic1_data_pin = RT5645_DMIC_DATA_GPIO5, .dmic2_data_pin = RT5645_DMIC_DATA_IN2P, - .jd_mode = 3, + .jd_mode = 4, .level_trigger_irq = true, }; @@ -4012,6 +4015,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, RT5645_JD1_MODE_1); break; case 3: + case 4: regmap_update_bits(rt5645->regmap, RT5645_A_JD_CTRL1, RT5645_JD1_MODE_MASK, RT5645_JD1_MODE_2); -- 2.24.0.432.g9d3f5f5b63-goog

3 3