November 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] Several problems when trying to run alsa-info.sh
by Rolf Eike Beer 12 Nov '19

12 Nov '19

Greetings, I had the need to run alsa-info.sh --stdout from 1.1.9 on our embedded device. There were multiple things I noticed: -it requires /bin/bash, but seems to run ok with just /bin/sh. We don't have bash. -it requires pgrep, which we don't have, but replacing all calls with pidof seems to work well enough -it requires whereis, and does not use that -at least in stdout mode the absence of lspci should not be a fatal error Greetings Eike -- Rolf Eike Beer, emlix GmbH, http://www.emlix.com Fon +49 551 30664-0, Fax +49 551 30664-11 Gothaer Platz 3, 37083 Göttingen, Germany Sitz der Gesellschaft: Göttingen, Amtsgericht Göttingen HR B 3160 Geschäftsführung: Heike Jordan, Dr. Uwe Kracke – Ust-IdNr.: DE 205 198 055 emlix - smart embedded open source

2 1

[alsa-devel] [PATCH] ALSA: au88x0: Fix incorrect device pointer for preallocation
by Takashi Iwai 12 Nov '19

12 Nov '19

The code change in commit 6974f8ad4494 ("ALSA: pci: Avoid non-standard macro usage") contained an incorrect conversion, which left the invalid pointer passed to the allocator for au88x0 driver. Fix it. Fixes: 6974f8ad4494 ("ALSA: pci: Avoid non-standard macro usage") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/pci/au88x0/au88x0_pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/pci/au88x0/au88x0_pcm.c b/sound/pci/au88x0/au88x0_pcm.c index 1012e8da29e7..a2dcf43beedf 100644 --- a/sound/pci/au88x0/au88x0_pcm.c +++ b/sound/pci/au88x0/au88x0_pcm.c @@ -637,7 +637,7 @@ static int snd_vortex_new_pcm(vortex_t *chip, int idx, int nr) /* pre-allocation of Scatter-Gather buffers */ snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV_SG, - &chip->pci_dev, + &chip->pci_dev->dev, 0x10000, 0x10000); switch (VORTEX_PCM_TYPE(pcm)) { -- 2.16.4

1 0

[alsa-devel] KASAN: use-after-free Read in snd_timer_open
by syzbot 12 Nov '19

12 Nov '19

Hello, syzbot found the following crash on: HEAD commit: 6980b7f6 Add linux-next specific files for 20191111 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=101679e6e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=2af7db1972ec750e dashboard link: https://syzkaller.appspot.com/bug?extid=4476917c053f60112c99 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=108fbfece00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1055d5aae00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+4476917c053f60112c99(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in __list_add_valid+0x9a/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff88809fccee78 by task syz-executor075/8825 CPU: 0 PID: 8825 Comm: syz-executor075 Not tainted 5.4.0-rc6-next-20191111 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:634 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 __list_add_valid+0x9a/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:60 [inline] list_add_tail include/linux/list.h:93 [inline] snd_timer_open+0x245/0x1150 sound/core/timer.c:268 snd_timer_user_tselect sound/core/timer.c:1738 [inline] __snd_timer_user_ioctl.isra.0+0x7ed/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x444f39 Code: e8 fc ab 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb cd fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffd1d1e3c98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000444f39 RDX: 0000000020029fcc RSI: 0000000040345410 RDI: 0000000000000003 RBP: 00000000000102a7 R08: 0000000000000004 R09: 00000000004002e0 R10: 000000000000000f R11: 0000000000000246 R12: 0000000000402180 R13: 0000000000402210 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 8824: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:510 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:483 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:524 kmem_cache_alloc_trace+0x158/0x790 mm/slab.c:3551 kmalloc include/linux/slab.h:556 [inline] kzalloc include/linux/slab.h:670 [inline] snd_timer_instance_new+0x4a/0x300 sound/core/timer.c:96 snd_timer_user_tselect sound/core/timer.c:1725 [inline] __snd_timer_user_ioctl.isra.0+0x665/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 8824: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] kasan_set_free_info mm/kasan/common.c:332 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:471 kasan_slab_free+0xe/0x10 mm/kasan/common.c:480 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x2c0 mm/slab.c:3757 snd_timer_instance_free sound/core/timer.c:120 [inline] snd_timer_instance_free+0x7c/0xa0 sound/core/timer.c:114 snd_timer_user_tselect sound/core/timer.c:1740 [inline] __snd_timer_user_ioctl.isra.0+0x160d/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88809fccee00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 120 bytes inside of 256-byte region [ffff88809fccee00, ffff88809fccef00) The buggy address belongs to the page: page:ffffea00027f3380 refcount:1 mapcount:0 mapping:ffff8880aa4008c0 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea00027f2e08 ffff8880aa401648 ffff8880aa4008c0 raw: 0000000000000000 ffff88809fcce000 0000000100000008 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809fcced00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88809fcced80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff88809fccee00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809fccee80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809fccef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 1

[alsa-devel] [PATCH] ASoC: rt5645: Fixed buddy jack support.
by Jacob Rasmussen 11 Nov '19

11 Nov '19

The headphone jack on buddy was broken with the following commit: commit 6b5da66322c5 ("ASoC: rt5645: read jd1_1 status for jd detection"). This changes the jd_mode for buddy to 4 so buddy can read from the same register that was used in the working version of this driver without affecting any other devices that might use this, since no other device uses jd_mode = 4. To test this I plugged and uplugged the headphone jack, verifying audio works. Signed-off-by: Jacob Rasmussen <jacobraz(a)google.com> --- sound/soc/codecs/rt5645.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index a15e4ecd2a24..046f339a9f00 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -3270,6 +3270,9 @@ static void rt5645_jack_detect_work(struct work_struct *work) snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); return; + case 4: + val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x002; + break; default: /* read rt5645 jd1_1 status */ val = snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x1000; break; @@ -3603,7 +3606,7 @@ static const struct rt5645_platform_data intel_braswell_platform_data = { static const struct rt5645_platform_data buddy_platform_data = { .dmic1_data_pin = RT5645_DMIC_DATA_GPIO5, .dmic2_data_pin = RT5645_DMIC_DATA_IN2P, - .jd_mode = 3, + .jd_mode = 4, .level_trigger_irq = true, }; @@ -4012,6 +4015,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, RT5645_JD1_MODE_1); break; case 3: + case 4: regmap_update_bits(rt5645->regmap, RT5645_A_JD_CTRL1, RT5645_JD1_MODE_MASK, RT5645_JD1_MODE_2); -- 2.24.0.432.g9d3f5f5b63-goog

3 3

[alsa-devel] Applied "ASoC: rt5645: Fixed buddy jack support." to the asoc tree
by Mark Brown 11 Nov '19

11 Nov '19

The patch ASoC: rt5645: Fixed buddy jack support. has been applied to the asoc tree at https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark >From e7cfd867fd9842f346688f28412eb83dec342900 Mon Sep 17 00:00:00 2001 From: Jacob Rasmussen <jacobraz(a)chromium.org> Date: Mon, 11 Nov 2019 11:59:57 -0700 Subject: [PATCH] ASoC: rt5645: Fixed buddy jack support. The headphone jack on buddy was broken with the following commit: commit 6b5da66322c5 ("ASoC: rt5645: read jd1_1 status for jd detection"). This changes the jd_mode for buddy to 4 so buddy can read from the same register that was used in the working version of this driver without affecting any other devices that might use this, since no other device uses jd_mode = 4. To test this I plugged and uplugged the headphone jack, verifying audio works. Signed-off-by: Jacob Rasmussen <jacobraz(a)google.com> Reviewed-by: Ross Zwisler <zwisler(a)google.com> Link: https://lore.kernel.org/r/20191111185957.217244-1-jacobraz@google.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Cc: stable(a)vger.kernel.org --- sound/soc/codecs/rt5645.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c index 1c06b3b9218c..902ac98a3fbe 100644 --- a/sound/soc/codecs/rt5645.c +++ b/sound/soc/codecs/rt5645.c @@ -3270,6 +3270,9 @@ static void rt5645_jack_detect_work(struct work_struct *work) snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); return; + case 4: + val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x002; + break; default: /* read rt5645 jd1_1 status */ val = snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x1000; break; @@ -3603,7 +3606,7 @@ static const struct rt5645_platform_data intel_braswell_platform_data = { static const struct rt5645_platform_data buddy_platform_data = { .dmic1_data_pin = RT5645_DMIC_DATA_GPIO5, .dmic2_data_pin = RT5645_DMIC_DATA_IN2P, - .jd_mode = 3, + .jd_mode = 4, .level_trigger_irq = true, }; @@ -3999,6 +4002,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, RT5645_JD1_MODE_1); break; case 3: + case 4: regmap_update_bits(rt5645->regmap, RT5645_A_JD_CTRL1, RT5645_JD1_MODE_MASK, RT5645_JD1_MODE_2); -- 2.20.1

1 0

[alsa-devel] [PATCH] ALSA: timer: Fix the breakage of slave link open
by Takashi Iwai 11 Nov '19

11 Nov '19

A silly mistake was made while applying the fix for potential races in commit 6a34367e52ca ("ALSA: timer: Fix possible race at assigning a timer instance"): when a slave PCM is opened and succeeds, it doesn't return but proceeds to the master timer open code instead. Plug the hole and beautify a bit. Fixes: 6a34367e52ca ("ALSA: timer: Fix possible race at assigning a timer instance") Reported-by: syzbot+4476917c053f60112c99(a)syzkaller.appspotmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/timer.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/sound/core/timer.c b/sound/core/timer.c index 9091030f4a89..24fed5c78273 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -268,8 +268,7 @@ int snd_timer_open(struct snd_timer_instance *timeri, list_add_tail(&timeri->open_list, &snd_timer_slave_list); num_slaves++; err = snd_timer_check_slave(timeri); - if (err < 0) - goto close; + goto list_added; } /* open a master instance */ @@ -324,7 +323,7 @@ int snd_timer_open(struct snd_timer_instance *timeri, list_add_tail(&timeri->open_list, &timer->open_list_head); timer->num_instances++; err = snd_timer_check_master(timeri); - close: +list_added: if (err < 0) snd_timer_close_locked(timeri, &card_dev_to_put); -- 2.16.4

1 0

[alsa-devel] [RESEND PATCH v4 1/6] ASoC: amd:Create multiple I2S platform device Endpoint
by Ravulapati Vishnu vardhan rao 11 Nov '19

11 Nov '19

Creates Platform Device endpoints for multiple I2S instances: SP and BT endpoints device. Pass PCI resources like MMIO, irq to the platform devices. Signed-off-by: Ravulapati Vishnu vardhan rao <Vishnuvardhanrao.Ravulapati(a)amd.com> --- sound/soc/amd/raven/acp3x.h | 5 +++ sound/soc/amd/raven/pci-acp3x.c | 78 +++++++++++++++++++++++++++++------------ 2 files changed, 60 insertions(+), 23 deletions(-) diff --git a/sound/soc/amd/raven/acp3x.h b/sound/soc/amd/raven/acp3x.h index 4f2cadd..2f15fe1 100644 --- a/sound/soc/amd/raven/acp3x.h +++ b/sound/soc/amd/raven/acp3x.h @@ -7,10 +7,15 @@ #include "chip_offset_byte.h" +#define ACP3x_DEVS 3 #define ACP3x_PHY_BASE_ADDRESS 0x1240000 #define ACP3x_I2S_MODE 0 #define ACP3x_REG_START 0x1240000 #define ACP3x_REG_END 0x1250200 +#define ACP3x_I2STDM_REG_START 0x1242400 +#define ACP3x_I2STDM_REG_END 0x1242410 +#define ACP3x_BT_TDM_REG_START 0x1242800 +#define ACP3x_BT_TDM_REG_END 0x1242810 #define I2S_MODE 0x04 #define BT_TX_THRESHOLD 26 #define BT_RX_THRESHOLD 25 diff --git a/sound/soc/amd/raven/pci-acp3x.c b/sound/soc/amd/raven/pci-acp3x.c index facec24..fe37160c 100644 --- a/sound/soc/amd/raven/pci-acp3x.c +++ b/sound/soc/amd/raven/pci-acp3x.c @@ -16,16 +16,16 @@ struct acp3x_dev_data { void __iomem *acp3x_base; bool acp3x_audio_mode; struct resource *res; - struct platform_device *pdev; + struct platform_device *pdev[ACP3x_DEVS]; }; static int snd_acp3x_probe(struct pci_dev *pci, const struct pci_device_id *pci_id) { int ret; - u32 addr, val; + u32 addr, val, i; struct acp3x_dev_data *adata; - struct platform_device_info pdevinfo; + struct platform_device_info pdevinfo[ACP3x_DEVS]; unsigned int irqflags; if (pci_enable_device(pci)) { @@ -68,7 +68,7 @@ static int snd_acp3x_probe(struct pci_dev *pci, switch (val) { case I2S_MODE: adata->res = devm_kzalloc(&pci->dev, - sizeof(struct resource) * 2, + sizeof(struct resource) * 4, GFP_KERNEL); if (!adata->res) { ret = -ENOMEM; @@ -80,28 +80,52 @@ static int snd_acp3x_probe(struct pci_dev *pci, adata->res[0].start = addr; adata->res[0].end = addr + (ACP3x_REG_END - ACP3x_REG_START); - adata->res[1].name = "acp3x_i2s_irq"; - adata->res[1].flags = IORESOURCE_IRQ; - adata->res[1].start = pci->irq; - adata->res[1].end = pci->irq; + adata->res[1].name = "acp3x_i2s_sp"; + adata->res[1].flags = IORESOURCE_MEM; + adata->res[1].start = addr + ACP3x_I2STDM_REG_START; + adata->res[1].end = addr + ACP3x_I2STDM_REG_END; + + adata->res[2].name = "acp3x_i2s_bt"; + adata->res[2].flags = IORESOURCE_MEM; + adata->res[2].start = addr + ACP3x_BT_TDM_REG_START; + adata->res[2].end = addr + ACP3x_BT_TDM_REG_END; + + adata->res[3].name = "acp3x_i2s_irq"; + adata->res[3].flags = IORESOURCE_IRQ; + adata->res[3].start = pci->irq; + adata->res[3].end = adata->res[3].start; adata->acp3x_audio_mode = ACP3x_I2S_MODE; memset(&pdevinfo, 0, sizeof(pdevinfo)); - pdevinfo.name = "acp3x_rv_i2s"; - pdevinfo.id = 0; - pdevinfo.parent = &pci->dev; - pdevinfo.num_res = 2; - pdevinfo.res = adata->res; - pdevinfo.data = &irqflags; - pdevinfo.size_data = sizeof(irqflags); - - adata->pdev = platform_device_register_full(&pdevinfo); - if (IS_ERR(adata->pdev)) { - dev_err(&pci->dev, "cannot register %s device\n", - pdevinfo.name); - ret = PTR_ERR(adata->pdev); - goto unmap_mmio; + pdevinfo[0].name = "acp3x_rv_i2s_dma"; + pdevinfo[0].id = 0; + pdevinfo[0].parent = &pci->dev; + pdevinfo[0].num_res = 4; + pdevinfo[0].res = &adata->res[0]; + pdevinfo[0].data = &irqflags; + pdevinfo[0].size_data = sizeof(irqflags); + + pdevinfo[1].name = "acp3x_i2s_playcap"; + pdevinfo[1].id = 0; + pdevinfo[1].parent = &pci->dev; + pdevinfo[1].num_res = 1; + pdevinfo[1].res = &adata->res[1]; + + pdevinfo[2].name = "acp3x_i2s_playcap"; + pdevinfo[2].id = 1; + pdevinfo[2].parent = &pci->dev; + pdevinfo[2].num_res = 1; + pdevinfo[2].res = &adata->res[2]; + for (i = 0; i < ACP3x_DEVS ; i++) { + adata->pdev[i] = + platform_device_register_full(&pdevinfo[i]); + IS_ERR(adata->pdev[i]) { + dev_err(&pci->dev, "cannot register %s device\n", + pdevinfo[i].name); + ret = -ENODEV; + goto unmap_mmio; + } } break; default: @@ -113,6 +137,9 @@ static int snd_acp3x_probe(struct pci_dev *pci, unmap_mmio: pci_disable_msi(pci); + for (i = 0 ; i < ACP3x_DEVS ; i++) + platform_device_unregister(adata->pdev[i]); + kfree(adata->res); iounmap(adata->acp3x_base); release_regions: pci_release_regions(pci); @@ -124,9 +151,13 @@ static int snd_acp3x_probe(struct pci_dev *pci, static void snd_acp3x_remove(struct pci_dev *pci) { + int i; struct acp3x_dev_data *adata = pci_get_drvdata(pci); - platform_device_unregister(adata->pdev); + if (adata->acp3x_audio_mode == ACP3x_I2S_MODE) { + for (i = 0 ; i < ACP3x_DEVS ; i++) + platform_device_unregister(adata->pdev[i]); + } iounmap(adata->acp3x_base); pci_disable_msi(pci); @@ -151,6 +182,7 @@ static struct pci_driver acp3x_driver = { module_pci_driver(acp3x_driver); +MODULE_AUTHOR("Vishnuvardhanrao.Ravulapati(a)amd.com"); MODULE_AUTHOR("Maruthi.Bayyavarapu(a)amd.com"); MODULE_DESCRIPTION("AMD ACP3x PCI driver"); MODULE_LICENSE("GPL v2"); -- 2.7.4

4 3

[alsa-devel] KASAN: use-after-free Read in check_matching_master_slave
by syzbot 11 Nov '19

11 Nov '19

Hello, syzbot found the following crash on: HEAD commit: 6980b7f6 Add linux-next specific files for 20191111 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=1658f9fce00000 kernel config: https://syzkaller.appspot.com/x/.config?x=2af7db1972ec750e dashboard link: https://syzkaller.appspot.com/bug?extid=5ab7470f121c0165470f compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+5ab7470f121c0165470f(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in __list_add_valid+0x9a/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff888095ac8078 by task syz-executor.0/4457 CPU: 1 PID: 4457 Comm: syz-executor.0 Not tainted 5.4.0-rc6-next-20191111 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:634 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 __list_add_valid+0x9a/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:60 [inline] list_add_tail include/linux/list.h:93 [inline] list_move_tail include/linux/list.h:214 [inline] check_matching_master_slave.part.0+0x116/0x550 sound/core/timer.c:179 check_matching_master_slave sound/core/timer.c:177 [inline] snd_timer_check_slave sound/core/timer.c:207 [inline] snd_timer_open+0x466/0x1150 sound/core/timer.c:270 snd_timer_user_tselect sound/core/timer.c:1738 [inline] __snd_timer_user_ioctl.isra.0+0x7ed/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45a219 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f41e77d2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219 RDX: 0000000020029fcc RSI: 0000000040345410 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f41e77d36d4 R13: 00000000004cf428 R14: 00000000004d9760 R15: 00000000ffffffff Allocated by task 4339: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:510 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:483 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:524 kmem_cache_alloc_trace+0x158/0x790 mm/slab.c:3551 kmalloc include/linux/slab.h:556 [inline] kzalloc include/linux/slab.h:670 [inline] snd_timer_instance_new+0x4a/0x300 sound/core/timer.c:96 snd_timer_user_tselect sound/core/timer.c:1725 [inline] __snd_timer_user_ioctl.isra.0+0x665/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 4339: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] kasan_set_free_info mm/kasan/common.c:332 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:471 kasan_slab_free+0xe/0x10 mm/kasan/common.c:480 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x2c0 mm/slab.c:3757 snd_timer_instance_free sound/core/timer.c:120 [inline] snd_timer_instance_free+0x7c/0xa0 sound/core/timer.c:114 snd_timer_user_tselect sound/core/timer.c:1740 [inline] __snd_timer_user_ioctl.isra.0+0x160d/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888095ac8000 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 120 bytes inside of 256-byte region [ffff888095ac8000, ffff888095ac8100) The buggy address belongs to the page: page:ffffea000256b200 refcount:1 mapcount:0 mapping:ffff8880aa4008c0 index:0xffff888095ac8c00 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea0001815608 ffffea0001eb9308 ffff8880aa4008c0 raw: ffff888095ac8c00 ffff888095ac8000 0000000100000005 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888095ac7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888095ac7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff888095ac8000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888095ac8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888095ac8100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0

[alsa-devel] general protection fault in snd_timer_open
by syzbot 11 Nov '19

11 Nov '19

Hello, syzbot found the following crash on: HEAD commit: 6980b7f6 Add linux-next specific files for 20191111 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=149fae72e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=2af7db1972ec750e dashboard link: https://syzkaller.appspot.com/bug?extid=7a0ab45b9c1dc81c9e6b compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+7a0ab45b9c1dc81c9e6b(a)syzkaller.appspotmail.com kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 26749 Comm: syz-executor.4 Not tainted 5.4.0-rc6-next-20191111 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:snd_timer_check_master sound/core/timer.c:228 [inline] RIP: 0010:snd_timer_open+0x943/0x1150 sound/core/timer.c:326 Code: 48 89 85 58 ff ff ff 4c 89 f0 48 c1 e8 03 4c 01 e8 48 89 85 50 ff ff ff eb 36 e8 38 1e ee fb 48 8d 7b 78 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 f4 05 00 00 48 8b 43 78 49 89 dc 48 83 e8 78 RSP: 0018:ffff888057d978f8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffffffff88 RCX: ffffc9000e7ad000 RDX: 0000000000007655 RSI: ffffffff85855cd8 RDI: 0000000000000000 RBP: ffff888057d979c0 R08: ffff8880a180c240 R09: ffff8880a1b0f008 R10: ffffed1014361e08 R11: ffff8880a1b0f047 R12: ffff8880a8f40000 R13: dffffc0000000000 R14: ffff888097688600 R15: ffffffff00000002 FS: 00007f1c13a0a700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000075c000 CR3: 000000009f897000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: snd_seq_timer_open+0x27f/0x590 sound/core/seq/seq_timer.c:281 queue_use+0xf1/0x270 sound/core/seq/seq_queue.c:489 snd_seq_queue_alloc+0x2c5/0x4d0 sound/core/seq/seq_queue.c:176 snd_seq_ioctl_create_queue+0xb0/0x330 sound/core/seq/seq_clientmgr.c:1548 snd_seq_ioctl+0x21e/0x3e0 sound/core/seq/seq_clientmgr.c:2157 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45a219 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f1c13a09c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a219 RDX: 00000000200001c0 RSI: 00000000c08c5332 RDI: 0000000000000004 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1c13a0a6d4 R13: 00000000004ceed0 R14: 00000000004d93d0 R15: 00000000ffffffff Modules linked in: ---[ end trace fd34b5665372895c ]--- RIP: 0010:snd_timer_check_master sound/core/timer.c:228 [inline] RIP: 0010:snd_timer_open+0x943/0x1150 sound/core/timer.c:326 Code: 48 89 85 58 ff ff ff 4c 89 f0 48 c1 e8 03 4c 01 e8 48 89 85 50 ff ff ff eb 36 e8 38 1e ee fb 48 8d 7b 78 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 f4 05 00 00 48 8b 43 78 49 89 dc 48 83 e8 78 RSP: 0018:ffff888057d978f8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffffffff88 RCX: ffffc9000e7ad000 RDX: 0000000000007655 RSI: ffffffff85855cd8 RDI: 0000000000000000 RBP: ffff888057d979c0 R08: ffff8880a180c240 R09: ffff8880a1b0f008 R10: ffffed1014361e08 R11: ffff8880a1b0f047 R12: ffff8880a8f40000 R13: dffffc0000000000 R14: ffff888097688600 R15: ffffffff00000002 FS: 00007f1c13a0a700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f750abec110 CR3: 000000009f897000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0

[alsa-devel] KASAN: use-after-free Read in snd_timer_close_locked
by syzbot 11 Nov '19

11 Nov '19

Hello, syzbot found the following crash on: HEAD commit: 6980b7f6 Add linux-next specific files for 20191111 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=16a82b9ae00000 kernel config: https://syzkaller.appspot.com/x/.config?x=2af7db1972ec750e dashboard link: https://syzkaller.appspot.com/bug?extid=4a89123a06517944d4c1 compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+4a89123a06517944d4c1(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in snd_timer_close_locked+0xb5f/0xbd0 sound/core/timer.c:380 Read of size 8 at addr ffff8880a906be78 by task syz-executor.4/9580 CPU: 1 PID: 9580 Comm: syz-executor.4 Not tainted 5.4.0-rc6-next-20191111 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:634 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 snd_timer_close_locked+0xb5f/0xbd0 sound/core/timer.c:380 snd_timer_close+0x88/0xf0 sound/core/timer.c:418 snd_seq_timer_close+0x91/0xe0 sound/core/seq/seq_timer.c:318 queue_delete+0x52/0xb0 sound/core/seq/seq_queue.c:134 snd_seq_queue_delete+0x4e/0x70 sound/core/seq/seq_queue.c:196 snd_seq_ioctl_delete_queue+0x6a/0x90 sound/core/seq/seq_clientmgr.c:1570 snd_seq_kernel_client_ctl+0xf8/0x140 sound/core/seq/seq_clientmgr.c:2353 delete_seq_queue.part.0+0xb6/0x120 sound/core/seq/oss/seq_oss_init.c:376 delete_seq_queue sound/core/seq/oss/seq_oss_init.c:372 [inline] snd_seq_oss_release+0x116/0x150 sound/core/seq/oss/seq_oss_init.c:421 odev_release+0x54/0x80 sound/core/seq/oss/seq_oss.c:140 __fput+0x2ff/0x890 fs/file_table.c:280 ____fput+0x16/0x20 fs/file_table.c:313 task_work_run+0x145/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x316/0x380 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x65f/0x760 arch/x86/entry/common.c:300 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x413db1 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007fffcff8b860 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000413db1 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 0000000000000001 R08: 00000000ca6eb3e2 R09: 00000000ca6eb3e6 R10: 00007fffcff8b940 R11: 0000000000000293 R12: 000000000075bf20 R13: 00000000000361f0 R14: 00000000007607e0 R15: 000000000075bf2c Allocated by task 9581: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:510 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:483 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:524 kmem_cache_alloc_trace+0x158/0x790 mm/slab.c:3551 kmalloc include/linux/slab.h:556 [inline] kzalloc include/linux/slab.h:670 [inline] snd_timer_instance_new+0x4a/0x300 sound/core/timer.c:96 snd_timer_user_tselect sound/core/timer.c:1725 [inline] __snd_timer_user_ioctl.isra.0+0x665/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 9581: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] kasan_set_free_info mm/kasan/common.c:332 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:471 kasan_slab_free+0xe/0x10 mm/kasan/common.c:480 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x2c0 mm/slab.c:3757 snd_timer_instance_free sound/core/timer.c:120 [inline] snd_timer_instance_free+0x7c/0xa0 sound/core/timer.c:114 snd_timer_user_tselect sound/core/timer.c:1740 [inline] __snd_timer_user_ioctl.isra.0+0x160d/0x2070 sound/core/timer.c:2008 snd_timer_user_ioctl+0x7a/0xa7 sound/core/timer.c:2038 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:545 [inline] do_vfs_ioctl+0x977/0x14e0 fs/ioctl.c:732 ksys_ioctl+0xab/0xd0 fs/ioctl.c:749 __do_sys_ioctl fs/ioctl.c:756 [inline] __se_sys_ioctl fs/ioctl.c:754 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:754 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880a906be00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 120 bytes inside of 256-byte region [ffff8880a906be00, ffff8880a906bf00) The buggy address belongs to the page: page:ffffea0002a41ac0 refcount:1 mapcount:0 mapping:ffff8880aa4008c0 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea00025db908 ffff8880aa401648 ffff8880aa4008c0 raw: 0000000000000000 ffff8880a906b000 0000000100000008 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a906bd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a906bd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff8880a906be00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880a906be80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a906bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0