November 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] motu microbook iic
by thomas rost 26 Feb '20

26 Feb '20

Hello, can anybody help me get the 'class compliant' motu microbook iic to run? this is my alsa-info.sh output: http://alsa-project.org/db/?f=0fd9a8df7bae3400d83b6af8b75c45aa0760d84d thanks in advance. thomas

2 1

[alsa-devel] [PATCH] ASoC: Intel: mrfld: fix incorrect check on p->sink
by Colin King 25 Feb '20

25 Feb '20

From: Colin Ian King <colin.king(a)canonical.com> The check on p->sink looks bogus, I believe it should be p->source since the following code blocks are related to p->source. Fix this by replacing p->sink with p->source. Addresses-Coverity: ("Copy-paste error") Fixes: 24c8d14192cc ("ASoC: Intel: mrfld: add DSP core controls") Signed-off-by: Colin Ian King <colin.king(a)canonical.com> --- [ Note: this has not been tested ] --- sound/soc/intel/atom/sst-atom-controls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/intel/atom/sst-atom-controls.c b/sound/soc/intel/atom/sst-atom-controls.c index baef461a99f1..f883c9340eee 100644 --- a/sound/soc/intel/atom/sst-atom-controls.c +++ b/sound/soc/intel/atom/sst-atom-controls.c @@ -1333,7 +1333,7 @@ int sst_send_pipe_gains(struct snd_soc_dai *dai, int stream, int mute) dai->capture_widget->name); w = dai->capture_widget; snd_soc_dapm_widget_for_each_source_path(w, p) { - if (p->connected && !p->connected(w, p->sink)) + if (p->connected && !p->connected(w, p->source)) continue; if (p->connect && p->source->power && -- 2.24.0

3 2

[alsa-devel] [PATCH v9] ASoC: pxa: switch to new ac97 bus support
by Robert Jarzmik 24 Feb '20

24 Feb '20

Switch to the new ac97 bus support in sound/ac97 instead of the legacy snd_ac97 one. Signed-off-by: Robert Jarzmik <robert.jarzmik(a)free.fr> --- Since v8: fixed the trivial compilation error v7 was in https://patchwork.kernel.org/patch/9951919/ --- sound/arm/Kconfig | 1 - sound/soc/pxa/Kconfig | 5 ++--- sound/soc/pxa/pxa2xx-ac97.c | 48 +++++++++++++++++++++++---------------------- 3 files changed, 27 insertions(+), 27 deletions(-) diff --git a/sound/arm/Kconfig b/sound/arm/Kconfig index 65171f6657a2..f1f25704fe52 100644 --- a/sound/arm/Kconfig +++ b/sound/arm/Kconfig @@ -36,7 +36,6 @@ endif # SND_ARM config SND_PXA2XX_LIB tristate - select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97 select SND_DMAENGINE_PCM config SND_PXA2XX_LIB_AC97 diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig index 484ab3c2ad67..1a0b55beb282 100644 --- a/sound/soc/pxa/Kconfig +++ b/sound/soc/pxa/Kconfig @@ -20,13 +20,12 @@ config SND_MMP_SOC config SND_PXA2XX_AC97 tristate - select SND_AC97_CODEC config SND_PXA2XX_SOC_AC97 tristate - select AC97_BUS + select AC97_BUS_NEW select SND_PXA2XX_LIB_AC97 - select SND_SOC_AC97_BUS + select SND_SOC_AC97_BUS_NEW config SND_PXA2XX_SOC_I2S tristate diff --git a/sound/soc/pxa/pxa2xx-ac97.c b/sound/soc/pxa/pxa2xx-ac97.c index 1b41c0f2a8fb..80e4757176d8 100644 --- a/sound/soc/pxa/pxa2xx-ac97.c +++ b/sound/soc/pxa/pxa2xx-ac97.c @@ -17,6 +17,7 @@ #include <linux/dmaengine.h> #include <linux/dma/pxa-dma.h> +#include <sound/ac97/controller.h> #include <sound/core.h> #include <sound/ac97_codec.h> #include <sound/soc.h> @@ -27,43 +28,35 @@ #include <mach/regs-ac97.h> #include <mach/audio.h> -static void pxa2xx_ac97_warm_reset(struct snd_ac97 *ac97) +static void pxa2xx_ac97_warm_reset(struct ac97_controller *adrv) { pxa2xx_ac97_try_warm_reset(); pxa2xx_ac97_finish_reset(); } -static void pxa2xx_ac97_cold_reset(struct snd_ac97 *ac97) +static void pxa2xx_ac97_cold_reset(struct ac97_controller *adrv) { pxa2xx_ac97_try_cold_reset(); pxa2xx_ac97_finish_reset(); } -static unsigned short pxa2xx_ac97_legacy_read(struct snd_ac97 *ac97, - unsigned short reg) +static int pxa2xx_ac97_read_actrl(struct ac97_controller *adrv, int slot, + unsigned short reg) { - int ret; - - ret = pxa2xx_ac97_read(ac97->num, reg); - if (ret < 0) - return 0; - else - return (unsigned short)(ret & 0xffff); + return pxa2xx_ac97_read(slot, reg); } -static void pxa2xx_ac97_legacy_write(struct snd_ac97 *ac97, - unsigned short reg, unsigned short val) +static int pxa2xx_ac97_write_actrl(struct ac97_controller *adrv, int slot, + unsigned short reg, unsigned short val) { - int ret; - - ret = pxa2xx_ac97_write(ac97->num, reg, val); + return pxa2xx_ac97_write(slot, reg, val); } -static struct snd_ac97_bus_ops pxa2xx_ac97_ops = { - .read = pxa2xx_ac97_legacy_read, - .write = pxa2xx_ac97_legacy_write, +static struct ac97_controller_ops pxa2xx_ac97_ops = { + .read = pxa2xx_ac97_read_actrl, + .write = pxa2xx_ac97_write_actrl, .warm_reset = pxa2xx_ac97_warm_reset, .reset = pxa2xx_ac97_cold_reset, }; @@ -219,6 +212,9 @@ static const struct snd_soc_component_driver pxa_ac97_component = { static int pxa2xx_ac97_dev_probe(struct platform_device *pdev) { int ret; + struct ac97_controller *ctrl; + pxa2xx_audio_ops_t *pdata = pdev->dev.platform_data; + void **codecs_pdata; if (pdev->id != -1) { dev_err(&pdev->dev, "PXA2xx has only one AC97 port.\n"); @@ -231,10 +227,14 @@ static int pxa2xx_ac97_dev_probe(struct platform_device *pdev) return ret; } - ret = snd_soc_set_ac97_ops(&pxa2xx_ac97_ops); - if (ret != 0) - return ret; + codecs_pdata = pdata ? pdata->codec_pdata : NULL; + ctrl = snd_ac97_controller_register(&pxa2xx_ac97_ops, &pdev->dev, + AC97_SLOTS_AVAILABLE_ALL, + codecs_pdata); + if (IS_ERR(ctrl)) + return PTR_ERR(ctrl); + platform_set_drvdata(pdev, ctrl); /* Punt most of the init to the SoC probe; we may need the machine * driver to do interesting things with the clocking to get us up * and running. @@ -245,8 +245,10 @@ static int pxa2xx_ac97_dev_probe(struct platform_device *pdev) static int pxa2xx_ac97_dev_remove(struct platform_device *pdev) { + struct ac97_controller *ctrl = platform_get_drvdata(pdev); + snd_soc_unregister_component(&pdev->dev); - snd_soc_set_ac97_ops(NULL); + snd_ac97_controller_unregister(ctrl); pxa2xx_ac97_hw_remove(pdev); return 0; } -- 2.11.0

2 1

[alsa-devel] ALSA 1.0.29 release
by Jaroslav Kysela 19 Feb '20

19 Feb '20

Hello all, all userspace packages (except alsa-oss) were released today. You may download them from the ALSA website http://www.alsa-project.org or directly from the FTP server ftp://ftp.alsa-project.org/pub . Full list of changes: http://www.alsa-project.org/main/index.php/Changes_v1.0.28_v1.0.29 Have fun, Jaroslav -- Jaroslav Kysela <perex(a)perex.cz> Linux Kernel Sound Maintainer ALSA Project; Red Hat, Inc.

2 16

[alsa-devel] [PATCH] ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen
by Jaroslav Kysela 11 Feb '20

11 Feb '20

The auto-parser assigns the bass speaker to DAC3 (NID 0x06) which is without the volume control. I do not see a reason to use DAC2, because the shared output to all speakers produces the sufficient and well balanced sound. The stereo support is enough for this purpose (laptop). Signed-off-by: Jaroslav Kysela <perex(a)perex.cz> --- sound/pci/hda/patch_realtek.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index d2bf70a1d2fd..a596790d4245 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -5544,6 +5544,16 @@ static void alc295_fixup_disable_dac3(struct hda_codec *codec, } } +/* force NID 0x17 (Bass Speaker) to DAC1 to share it with the main speaker */ +static void alc285_fixup_speaker2_to_dac1(struct hda_codec *codec, + const struct hda_fixup *fix, int action) +{ + if (action == HDA_FIXUP_ACT_PRE_PROBE) { + hda_nid_t conn[1] = { 0x02 }; + snd_hda_override_conn_list(codec, 0x17, 1, conn); + } +} + /* Hook to update amp GPIO4 for automute */ static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, struct hda_jack_callback *jack) @@ -5846,6 +5856,7 @@ enum { ALC225_FIXUP_DISABLE_MIC_VREF, ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ALC295_FIXUP_DISABLE_DAC3, + ALC285_FIXUP_SPEAKER2_TO_DAC1, ALC280_FIXUP_HP_HEADSET_MIC, ALC221_FIXUP_HP_FRONT_MIC, ALC292_FIXUP_TPT460, @@ -6646,6 +6657,10 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc295_fixup_disable_dac3, }, + [ALC285_FIXUP_SPEAKER2_TO_DAC1] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_speaker2_to_dac1, + }, [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl[]) { @@ -7221,6 +7236,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1), SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), @@ -7405,6 +7421,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { {.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"}, {.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc225-dell1"}, {.id = ALC295_FIXUP_DISABLE_DAC3, .name = "alc295-disable-dac3"}, + {.id = ALC285_FIXUP_SPEAKER2_TO_DAC1, .name = "alc285-speaker2-to-dac1"}, {.id = ALC280_FIXUP_HP_HEADSET_MIC, .name = "alc280-hp-headset"}, {.id = ALC221_FIXUP_HP_FRONT_MIC, .name = "alc221-hp-mic"}, {.id = ALC298_FIXUP_SPK_VOLUME, .name = "alc298-spk-volume"}, -- 2.20.1

4 7

[alsa-devel] [PATCH v2 0/2] Update FE/BE trigger order based on the command
by Ranjani Sridharan 09 Feb '20

09 Feb '20

Currently, the trigger orders SND_SOC_DPCM_TRIGGER_PRE/POST determine the order in which FE DAI and BE DAI are triggered. In the case of SND_SOC_DPCM_TRIGGER_PRE, the FE DAI is triggered before the BE DAI and in the case of SND_SOC_DPCM_TRIGGER_POST, the BE DAI is triggered before the FE DAI. And this order remains the same irrespective of the trigger command. In the case of the SOF driver, during playback, the FW expects the BE DAI to be triggered before the FE DAI during the START trigger. The BE DAI trigger handles the starting of Link DMA and so it must be started before the FE DAI is started to prevent xruns during pause/release. This can be addressed by setting the trigger order for the FE dai link to SND_SOC_DPCM_TRIGGER_POST. But during the STOP trigger, the FW expects the FE DAI to be triggered before the BE DAI. Retaining the same order during the START and STOP commands, results in FW error as the DAI component in the FW is still active. The issue can be fixed by mirroring the trigger order of FE and BE DAI's during the START and STOP trigger. So, with the trigger order set to SND_SOC_DPCM_TRIGGER_PRE, the FE DAI will be trigger first during SNDRV_PCM_TRIGGER_START/STOP/RESUME and the BE DAI will be triggered first during the STOP/SUSPEND/PAUSE commands. Conversely, with the trigger order set to SND_SOC_DPCM_TRIGGER_POST, the BE DAI will be triggered first during the SNDRV_PCM_TRIGGER_START/STOP/RESUME commands and the FE DAI will be triggered first during the SNDRV_PCM_TRIGGER_STOP/SUSPEND/PAUSE commands. The above change has been tested with the Skylake driver on the Kabylake based chromebook and legacy HDA driver on Kabylake based Dell XPS13. It has also been tested on all platforms with SOF CI without any regressions for the past 3 weeks. More details on the issue can be found here: https://github.com/thesofproject/linux/issues/1160 Changes in v2: Fixed comments on function name and consolidating the switch cases. Ranjani Sridharan (2): ASoC: pcm: update FE/BE trigger order based on the command ASoC: SOF: topology: set trigger order for FE DAI link sound/soc/soc-pcm.c | 95 ++++++++++++++++++++++++++++------------ sound/soc/sof/topology.c | 4 ++ 2 files changed, 72 insertions(+), 27 deletions(-) -- 2.17.1

4 7

[alsa-devel] [PATCH v3 0/4] ALSA: hda - Add DP-MST support for NVIDIA codecs
by Nikhil Mahale 03 Feb '20

03 Feb '20

Today, DisplayPort multi-stream transport (DP-MST) audio is not supported on codec drivers which don't use the audio component (acomp) binding. The commit ade49db337a9 (ALSA: hda/hdmi - Allow audio component for AMD/ATI and Nvidia HDMI) added the DRM audio component binding for the NVIDIA codec drivers, but the traditional HD-audio unsolicited event code path is still in use by the proprietary NVIDIA graphics driver. This patch set adds DP-MST audio support for non-acomp codec drivers which use the traditional HD-audio unsolicited event code path. This patch set adds DP-MST support for NVIDIA codecs. The patch set has been tested for HDMI/DP-SST/DP-MST(4 dp-mst audio streams) configurations on NVIDIA Kepler and Maxwell GPUs, using both the nouveau driver and the proprietary NVIDIA graphics driver. Nikhil Mahale (4): ALSA: hda - Rename snd_hda_pin_sense to snd_hda_jack_pin_sense ALSA: hda - Add DP-MST jack support ALSA: hda - Add DP-MST support for non-acomp codecs ALSA: hda - Add DP-MST support for NVIDIA codecs sound/pci/hda/hda_jack.c | 151 ++++++++++++++++++-------- sound/pci/hda/hda_jack.h | 107 ++++++++++++++++-- sound/pci/hda/patch_hdmi.c | 263 +++++++++++++++++++++++++++++++-------------- 3 files changed, 385 insertions(+), 136 deletions(-) -- 2.16.4

5 13

Re: [alsa-devel] Line 6 Helix quirks
by nick83ola 25 Jan '20

25 Jan '20

Hi I verified on my hx_stomp with the latest driver and I can confirm tha the quirks works here Sadly I don't have an helix to verify it What model it is? you can try to recompile the kernel adding the line with you usb device to the see my patch https://lkml.org/lkml/2019/7/1/850 + case USB_ID(0x0E41, 0x4244): /* HELIX */ + case USB_ID(0x0E41, 0x4246): /* HX STOMP */ + case USB_ID(0x0E41, 0x4248): /* what kind of HELIX ???????? */ Cheers Nicola Lunghi On Sat, 19 Oct 2019 at 06:34, Carlo Calica <carlo(a)calica.com> wrote: > > Hi, > > I'm attempting to use my Helix with the newish 5.3.x kernel. It isn't working. Looks like the quirk isn't enabled for the idProduct (4248) of my Helix. My Helix's firmware is 2.81.0. I have yet to compile the kernel to see if adding the id is enough. Thanks. If you need any more info, please let me know. > > dmesg gives: > > [89014.296954] usb 3-2: new high-speed USB device number 2 using xhci_hcd > [89014.521720] usb 3-2: New USB device found, idVendor=0e41, idProduct=4248, bcdDevice= 2.00 > [89014.521723] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 > [89014.521724] usb 3-2: Product: HELIX > [89014.521726] usb 3-2: Manufacturer: LINE 6 > [89014.521727] usb 3-2: SerialNumber: 2796112 > [89014.555715] usb 3-2: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 16) > [89014.559724] usb 3-2: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 16) > [89014.575990] input: LINE 6 HELIX as /devices/pci0000:00/0000:00:01.3/0000:03:00.2/0000:16:08.0/0000:1c:00.0/usb3/3-2/3-2:1.5/0003:0E41:4248.000C/input/input50 > [89014.628069] hid-generic 0003:0E41:4248.000C: input,hidraw8: USB HID v1.11 Keyboard [LINE 6 HELIX ] on usb-0000:1c:00.0-2/input5 > > > -- > Carlo J. Calica

4 7

[alsa-devel] [PATCH] fix segfault on x32, 64-bit time_t-related format strings
by Thorsten Glaser 23 Jan '20

23 Jan '20

Hi everyone, here are two patches I’ve been rebasing with each new upload of alsa-lib to Debian to make things work for my x32 desktop. The small one fixes it misdetecting x32 as amd64, which leads to an immediate segfault. The other one fixes issues related to printing time_t values on platforms where time_t is 64 bit wide and long 32 bit wide (various BSDs and all new 32-bit and *64ilp32 Linux platforms). The Debian packager of alsa-lib hasn’t found it necessary to forward them upstream, so I’m doing it with this. I hope they can be included in the next releases. The patches were last updated for 1.1.8 although I need to update them to 1.1.9 which was recently introduced to Debian… usually they apply still. Thanks in advance, //mirabilos -- tarent solutions GmbH Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/ Tel: +49 228 54881-393 • Fax: +49 228 54881-235 HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941 Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg ********** Mit der tarent Academy bieten wir auch Trainings und Schulungen in den Bereichen Softwareentwicklung, Agiles Arbeiten und Zukunftstechnologien an. Besuchen Sie uns auf www.tarent.de/academy. Wir freuen uns auf Ihren Kontakt. **********

3 7

[alsa-devel] KASAN: slab-out-of-bounds Read in build_audio_procunit (2)
by syzbot 23 Jan '20

23 Jan '20

Hello, syzbot found the following crash on: HEAD commit: d60bbfea usb: raw: add raw-gadget interface git tree: https://github.com/google/kasan.git usb-fuzzer console output: https://syzkaller.appspot.com/x/log.txt?x=132e5bcce00000 kernel config: https://syzkaller.appspot.com/x/.config?x=79de80330003b5f7 dashboard link: https://syzkaller.appspot.com/bug?extid=622d4ecb979f45c6a775 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1478c6b4e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117cbf8ae00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+622d4ecb979f45c6a775(a)syzkaller.appspotmail.com usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: syz usb 1-1: Manufacturer: syz usb 1-1: SerialNumber: syz usb 1-1: 0:2 : does not exist ================================================================== BUG: KASAN: slab-out-of-bounds in uac_extension_unit_iExtension include/uapi/linux/usb/audio.h:483 [inline] BUG: KASAN: slab-out-of-bounds in build_audio_procunit+0xeab/0x13f0 sound/usb/mixer.c:2434 Read of size 1 at addr ffff8881d4aaa735 by task kworker/1:2/83 CPU: 1 PID: 83 Comm: kworker/1:2 Not tainted 5.4.0-rc6+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 print_address_description.constprop.0+0x36/0x50 mm/kasan/report.c:374 __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:506 kasan_report+0xe/0x20 mm/kasan/common.c:634 uac_extension_unit_iExtension include/uapi/linux/usb/audio.h:483 [inline] build_audio_procunit+0xeab/0x13f0 sound/usb/mixer.c:2434 parse_audio_extension_unit sound/usb/mixer.c:2483 [inline] parse_audio_unit+0x1812/0x36f0 sound/usb/mixer.c:2761 snd_usb_mixer_controls+0x715/0xb90 sound/usb/mixer.c:3095 snd_usb_create_mixer+0x2b5/0x1890 sound/usb/mixer.c:3445 usb_audio_probe+0xc76/0x2010 sound/usb/card.c:653 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x6d0 drivers/base/dd.c:548 driver_probe_device+0x104/0x210 drivers/base/dd.c:721 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430 __device_attach+0x217/0x360 drivers/base/dd.c:894 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490 device_add+0xae6/0x16f0 drivers/base/core.c:2202 usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 really_probe+0x281/0x6d0 drivers/base/dd.c:548 driver_probe_device+0x104/0x210 drivers/base/dd.c:721 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:828 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:430 __device_attach+0x217/0x360 drivers/base/dd.c:894 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:490 device_add+0xae6/0x16f0 drivers/base/core.c:2202 usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2537 hub_port_connect drivers/usb/core/hub.c:5184 [inline] hub_port_connect_change drivers/usb/core/hub.c:5324 [inline] port_event drivers/usb/core/hub.c:5470 [inline] hub_event+0x1df8/0x3800 drivers/usb/core/hub.c:5552 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 83: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:510 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:483 kmalloc include/linux/slab.h:561 [inline] usb_get_configuration+0x311/0x3100 drivers/usb/core/config.c:862 usb_enumerate_device drivers/usb/core/hub.c:2370 [inline] usb_new_device+0xd3/0x160 drivers/usb/core/hub.c:2506 hub_port_connect drivers/usb/core/hub.c:5184 [inline] hub_port_connect_change drivers/usb/core/hub.c:5324 [inline] port_event drivers/usb/core/hub.c:5470 [inline] hub_event+0x1df8/0x3800 drivers/usb/core/hub.c:5552 process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 worker_thread+0x96/0xe20 kernel/workqueue.c:2415 kthread+0x318/0x420 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 211: save_stack+0x1b/0x80 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] kasan_set_free_info mm/kasan/common.c:332 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:471 slab_free_hook mm/slub.c:1424 [inline] slab_free_freelist_hook mm/slub.c:1475 [inline] slab_free mm/slub.c:3025 [inline] kfree+0xe4/0x320 mm/slub.c:3977 do_new_mount fs/namespace.c:2827 [inline] do_mount+0x68a/0x1bf0 fs/namespace.c:3143 ksys_mount+0xd7/0x150 fs/namespace.c:3352 __do_sys_mount fs/namespace.c:3366 [inline] __se_sys_mount fs/namespace.c:3363 [inline] __x64_sys_mount+0xba/0x150 fs/namespace.c:3363 do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881d4aaa600 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 53 bytes to the right of 256-byte region [ffff8881d4aaa600, ffff8881d4aaa700) The buggy address belongs to the page: page:ffffea000752aa80 refcount:1 mapcount:0 mapping:ffff8881da002780 index:0x0 compound_mapcount: 0 flags: 0x200000000010200(slab|head) raw: 0200000000010200 ffffea000752c900 0000000a0000000a ffff8881da002780 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881d4aaa600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881d4aaa680: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc > ffff8881d4aaa700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8881d4aaa780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881d4aaa800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

2 2