February 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH 2/3] ASoC: add hikey960-i2s DT bindings
by Pengcheng Li 10 Apr '19

10 Apr '19

From: Youlin Wang <wangyoulin1(a)hisilicon.com> Adds DT bindings documentation for the hikey960-i2s driver and audio card device. Signed-off-by: Youlin Wang <wangyoulin1(a)hisilicon.com> Signed-off-by: Tanglei Han <hantanglei(a)huawei.com> Signed-off-by: Guangke Ji <jiguangke(a)huawei.com> Signed-off-by: Feng Chen <puck.chen(a)hisilicon.com> Signed-off-by: Kaihua Zhong <zhongkaihua(a)huawei.com> Signed-off-by: Jun Chen <chenjun14(a)huawei.com> Signed-off-by: John Stultz <john.stultz(a)linaro.org> Signed-off-by: Yiping Xu <xuyiping(a)hisilicon.com> Signed-off-by: Pengcheng Li <lipengcheng8(a)huawei.com> --- .../bindings/sound/hisilicon,hi3660-i2s.txt | 49 ++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/hisilicon,hi3660-i2s.txt diff --git a/Documentation/devicetree/bindings/sound/hisilicon,hi3660-i2s.txt b/Documentation/devicetree/bindings/sound/hisilicon,hi3660-i2s.txt new file mode 100644 index 0000000..654c234 --- /dev/null +++ b/Documentation/devicetree/bindings/sound/hisilicon,hi3660-i2s.txt @@ -0,0 +1,49 @@ +* Hisilicon 6210 i2s controller + +Required properties: + +- compatible: should be one of the following: + - "hisilicon,hi3660-i2s-1.0" +- reg: physical base address of the i2s controller unit and length of + memory mapped region. +- interrupts: should contain the i2s interrupt. +- clocks: a list of phandle + clock-specifier pairs, one for each entry + in clock-names. +- clock-names: should contain following: + - "dacodec" + - "i2s-base" +- dmas: DMA specifiers for tx dma. See the DMA client binding, + Documentation/devicetree/bindings/dma/dma.txt +- dma-names: should be "tx" and "rx" +- hisilicon,sysctrl-syscon: phandle to sysctrl syscon +- #sound-dai-cells: Should be set to 1 (for multi-dai) + +Example for the hi3660 i2s controller: + + i2s2: hisi_i2s { + compatible = "hisilicon,hi3660-i2s-1.0"; + reg = <0x0 0xe804f800 0x0 0x400>, + <0x0 0xe804e000 0x0 0x400>; + pinctrl-names = "default"; + pinctrl-0 = <&i2s2_pmx_func &i2s2_cfg_func>; + dmas = <&asp_dmac 18 &asp_dmac 19>; + dma-names = "rx", "tx"; + #sound-dai-cells = <0>; + }; + + sound { + compatible = "simple-audio-card"; + simple-audio-card,name = "hikey-hdmi"; + simple-audio-card,format = "i2s"; + + simple-audio-card,bitclock-master = <&sound_master>; + simple-audio-card,frame-master = <&sound_master>; + + sound_master: simple-audio-card,cpu { + sound-dai = <&i2s2>; + }; + + simple-audio-card,codec { + sound-dai = <&adv7533>; + }; + }; -- 2.8.0

2 1

[alsa-devel] [PATCH 1/3] ASoC: wcd9335: fix a leaked reference by adding missing of_node_put
by Wen Yang 05 Apr '19

05 Apr '19

The call to of_parse_phandle returns a node pointer with refcount incremented thus it must be explicitly decremented after the last usage. Detected by coccinelle with the following warnings: ./sound/soc/codecs/wcd9335.c:5193:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 5183, but without a correspon ding object release within this function. Signed-off-by: Wen Yang <wen.yang99(a)zte.com.cn> Cc: Liam Girdwood <lgirdwood(a)gmail.com> Cc: Mark Brown <broonie(a)kernel.org> Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Cc: Vinod Koul <vkoul(a)kernel.org> Cc: Dan Carpenter <dan.carpenter(a)oracle.com> (commit_signer:1/11=9%,authored:1/11=9%) Cc: alsa-devel(a)alsa-project.org Cc: linux-kernel(a)vger.kernel.org --- sound/soc/codecs/wcd9335.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c index 981f88a..a04a7ce 100644 --- a/sound/soc/codecs/wcd9335.c +++ b/sound/soc/codecs/wcd9335.c @@ -5188,6 +5188,7 @@ static int wcd9335_slim_status(struct slim_device *sdev, wcd->slim = sdev; wcd->slim_ifc_dev = of_slim_get_device(sdev->ctrl, ifc_dev_np); + of_node_put(ifc_dev_np); if (!wcd->slim_ifc_dev) { dev_err(dev, "Unable to get SLIM Interface device\n"); return -EINVAL; -- 2.9.5

2 3

[alsa-devel] [RFC 0/2] Add MICFIL DAI support
by Cosmin Samoila 27 Mar '19

27 Mar '19

PDM is a popular way to deliver audio from microphones to the processor in several applications, such as mobile telephones. However, current digital-audio systems use multibit audio signal (also known as multibit PCM) to represent the signal. For this purpose a set of FIR, CIC or/and Half Band filters are usually implemented on DSPs or software. This block implements the required digital interface to provide a 16-bit audio signal from a PDM microphone bitstream in a configurable output sampling rate. The implementation of this digital interface is based on the application of digital signal processing techniques in hardware. The PDM Microphone Interface architecture was designed to gate saving and minimal power consumption. It implements a bunch of filters to transform a 1-bit PDM bitstream to a 16-bit PCM signal in the audio band. To avoid aliasing frequencies in passband, the overall filter has 80 dB stopband attenuation and passband ripple less than 0.2dB. The whole module is implemented to work in a multichannel mode. All channels have the same configuration but each input channel could be turned on/off independently. Cosmin-Gabriel Samoila (2): ASoC: micfil: Add bindings for MICFIL DAI ASoC: Add MICFIL SoC Digital Audio Interface driver. .../devicetree/bindings/sound/fsl,micfil.txt | 38 + sound/soc/fsl/Kconfig | 9 + sound/soc/fsl/Makefile | 2 + sound/soc/fsl/fsl_micfil.c | 2451 ++++++++++++++++++++ sound/soc/fsl/fsl_micfil.h | 317 +++ 5 files changed, 2817 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/fsl,micfil.txt create mode 100644 sound/soc/fsl/fsl_micfil.c create mode 100644 sound/soc/fsl/fsl_micfil.h -- 2.7.4

6 18

[alsa-devel] [PATCH RFC 00/26] Kill set_fs() in ALSA codes
by Takashi Iwai 27 Mar '19

27 Mar '19

Hi, this is a slightly lengthy patchset, basically targeted for 4.13, thus it's still in RFC. The main purpose of this patchset is to get rid of get_fs() / set_fs() usages in ALSA codes. The patchset starts from a patch that looks fairly irrelevant with the goal (the conversion of HD-audio bind-mute code), but it's a step for the long trail. The biggest change in the patchset is the conversion of copy & silence PCM ops into the new copy_silence ops. It helped for reducing the code size and for handling the in-kernel buffer copies. The current patches are found in topic/kill-set_fs branch of my sound.git tree. thanks, Takashi === Takashi Iwai (26): ALSA: hda - Simplify bound-beep mute control for ALC268 ALSA: hda - Move bind-mixer switch codes to generic parser ALSA: hda - Remove the generic bind ctl helpers ALSA: hda - Remove the use of set_fs() ALSA: hda - Fix a typo in comment ALSA: hda - Remove superfluous header inclusions ALSA: opl3: Kill unused set_fs() ALSA: emu10k1: Get rid of set_fs() usage ALSA: pcm: Remove set_fs() in PCM core code ALSA: pcm: Introduce copy_silence PCM ops ALSA: Update document about copy_silence PCM ops ALSA: dummy: Convert to copy_silence ops ALSA: es1938: Convert to copy_silence ops ALSA: korg1212: Convert to copy_silence ops ALSA: nm256: Convert to copy_silence ops ALSA: rme32: Convert to copy_silence ops ALSA: rme96: Convert to copy_silence ops ALSA: rme9652: Convert to copy_silence ops ALSA: hdsp: Convert to copy_silence ops ALSA: gus: Convert to copy_silence ops ALSA: sb: Convert to copy_silence ops ALSA: sh: Convert to copy_silence ops ASoC: blackfin: Convert to copy_silence ops [media] solo6x10: Convert to copy_silence ops ALSA: pcm: Drop the old copy and silence ops ALSA: pcm: Kill set_fs() usage in OSS layer and USB gadget .../sound/kernel-api/writing-an-alsa-driver.rst | 110 +++++---- drivers/media/pci/solo6x10/solo6x10-g723.c | 11 +- drivers/usb/gadget/function/u_uac1.c | 8 +- include/sound/pcm.h | 19 +- sound/core/oss/pcm_oss.c | 62 ++--- sound/core/pcm_compat.c | 22 +- sound/core/pcm_lib.c | 174 +++++++++----- sound/core/pcm_native.c | 122 ++++++---- sound/drivers/dummy.c | 13 +- sound/drivers/opl3/opl3_oss.c | 14 -- sound/isa/gus/gus_pcm.c | 43 +--- sound/isa/sb/emu8000_pcm.c | 99 +++----- sound/pci/emu10k1/emufx.c | 127 ++++++----- sound/pci/es1938.c | 11 +- sound/pci/hda/hda_codec.c | 251 +++------------------ sound/pci/hda/hda_generic.c | 46 +++- sound/pci/hda/hda_local.h | 61 ----- sound/pci/hda/patch_realtek.c | 37 ++- sound/pci/korg1212/korg1212.c | 128 +++-------- sound/pci/nm256/nm256.c | 35 ++- sound/pci/rme32.c | 49 ++-- sound/pci/rme96.c | 52 ++--- sound/pci/rme9652/hdsp.c | 44 ++-- sound/pci/rme9652/rme9652.c | 46 ++-- sound/sh/sh_dac_audio.c | 40 +--- sound/soc/blackfin/bf5xx-ac97-pcm.c | 6 +- sound/soc/blackfin/bf5xx-ac97.c | 18 +- sound/soc/blackfin/bf5xx-i2s-pcm.c | 46 ++-- sound/soc/soc-pcm.c | 3 +- 29 files changed, 696 insertions(+), 1001 deletions(-) -- 2.12.2

3 40

[alsa-devel] [PATCH v4 0/3] Add NXP AUDMIX device and machine drivers
by Viorel Suman 26 Mar '19

26 Mar '19

The patchset adds NXP Audio Mixer (AUDMIX) device and machine drivers and related DT bindings documentation. Changes since V3: 1. Removed machine driver DT bindings documentation. 2. Trigger machine driver probe from device driver as suggested by Nicolin. Changes since V2: 1. Moved "dais" node from machine driver DTS node to device driver DTS node as suggested by Rob. Changes since V1: 1. Original patch split into distinct patches for the device driver and DT binding documentation. 2. Replaced AMIX with AUDMIX in both code and file names as it looks more RM-compliant. 3. Removed polarity control from CPU DAI driver as suggested by Nicolin. 4. Added machine driver and related DT binding documentation. Viorel Suman (3): ASoC: fsl: Add Audio Mixer CPU DAI driver ASoC: add fsl_audmix DT binding documentation ASoC: fsl: Add Audio Mixer machine driver .../devicetree/bindings/sound/fsl,audmix.txt | 54 ++ sound/soc/fsl/Kconfig | 16 + sound/soc/fsl/Makefile | 5 + sound/soc/fsl/fsl_audmix.c | 576 +++++++++++++++++++++ sound/soc/fsl/fsl_audmix.h | 102 ++++ sound/soc/fsl/imx-audmix.c | 327 ++++++++++++ 6 files changed, 1080 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/fsl,audmix.txt create mode 100644 sound/soc/fsl/fsl_audmix.c create mode 100644 sound/soc/fsl/fsl_audmix.h create mode 100644 sound/soc/fsl/imx-audmix.c -- 2.7.4

4 7

[alsa-devel] [PATCH v4] ALSA: core: Allow drivers to set R/W wait time.
by Liam Girdwood 26 Mar '19

26 Mar '19

Currently ALSA core blocks userspace for about 10 seconds for PCM R/W IO. This needs to be configurable for modern hardware like DSPs where no pointer update in milliseconds can indicate terminal DSP errors. Add a substream variable to set the wait time in ms. This allows userspace and drivers to recover more quickly from terminal DSP errors. Signed-off-by: Liam Girdwood <liam.r.girdwood(a)linux.intel.com> --- Changes since V1 :- o Remove API method and alow drivers to set directly. o Validate time is driver supplied times. V2 :- o Max wait calc now in ms. o checkpatch. v3:- o Remove driver supplied time validation. include/sound/pcm.h | 1 + sound/core/pcm_lib.c | 17 ++++++++++++----- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/include/sound/pcm.h b/include/sound/pcm.h index e054c583d3b3..fcdf358a25f0 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -462,6 +462,7 @@ struct snd_pcm_substream { /* -- timer section -- */ struct snd_timer *timer; /* timer */ unsigned timer_running: 1; /* time is running */ + long wait_time; /* time in ms for R/W to wait for avail */ /* -- next substream -- */ struct snd_pcm_substream *next; /* -- linked substreams -- */ diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c index 44b5ae833082..eecbfdc7a2c9 100644 --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -1832,12 +1832,19 @@ static int wait_for_avail(struct snd_pcm_substream *substream, if (runtime->no_period_wakeup) wait_time = MAX_SCHEDULE_TIMEOUT; else { - wait_time = 10; - if (runtime->rate) { - long t = runtime->period_size * 2 / runtime->rate; - wait_time = max(t, wait_time); + /* use wait time from substream if available */ + if (substream->wait_time) { + wait_time = substream->wait_time; + } else { + wait_time = 10; + + if (runtime->rate) { + long t = runtime->period_size * 2 / + runtime->rate; + wait_time = max(t, wait_time); + } + wait_time = msecs_to_jiffies(wait_time * 1000); } - wait_time = msecs_to_jiffies(wait_time * 1000); } for (;;) { -- 2.17.1

3 2

[alsa-devel] [PATCH V4] ASoC: fsl_esai: fix channel swap issue when stream starts
by S.j. Wang 21 Mar '19

21 Mar '19

There is very low possibility ( < 0.1% ) that channel swap happened in beginning when multi output/input pin is enabled. The issue is that hardware can't send data to correct pin in the beginning with the normal enable flow. This is hardware issue, but there is no errata, the workaround flow is that: Each time playback/recording, firstly clear the xSMA/xSMB, then enable TE/RE, then enable xSMB and xSMA (xSMB must be enabled before xSMA). Which is to use the xSMA as the trigger start register, previously the xCR_TE or xCR_RE is the bit for starting. Fixes commit 43d24e76b698 ("ASoC: fsl_esai: Add ESAI CPU DAI driver") Cc: <stable(a)vger.kernel.org> Reviewed-by: Fabio Estevam <festevam(a)gmail.com> Acked-by: Nicolin Chen <nicoleotsuka(a)gmail.com> Signed-off-by: Shengjiu Wang <shengjiu.wang(a)nxp.com> --- sound/soc/fsl/fsl_esai.c | 47 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 37 insertions(+), 10 deletions(-) diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c index afe67c865330..3623aa9a6f2e 100644 --- a/sound/soc/fsl/fsl_esai.c +++ b/sound/soc/fsl/fsl_esai.c @@ -54,6 +54,8 @@ struct fsl_esai { u32 fifo_depth; u32 slot_width; u32 slots; + u32 tx_mask; + u32 rx_mask; u32 hck_rate[2]; u32 sck_rate[2]; bool hck_dir[2]; @@ -361,21 +363,13 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai *dai, u32 tx_mask, regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR, ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots)); - regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMA, - ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(tx_mask)); - regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMB, - ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(tx_mask)); - regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR, ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots)); - regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMA, - ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(rx_mask)); - regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMB, - ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(rx_mask)); - esai_priv->slot_width = slot_width; esai_priv->slots = slots; + esai_priv->tx_mask = tx_mask; + esai_priv->rx_mask = rx_mask; return 0; } @@ -596,6 +590,7 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd, bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; u8 i, channels = substream->runtime->channels; u32 pins = DIV_ROUND_UP(channels, esai_priv->slots); + u32 mask; switch (cmd) { case SNDRV_PCM_TRIGGER_START: @@ -608,15 +603,38 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd, for (i = 0; tx && i < channels; i++) regmap_write(esai_priv->regmap, REG_ESAI_ETDR, 0x0); + /* + * When set the TE/RE in the end of enablement flow, there + * will be channel swap issue for multi data line case. + * In order to workaround this issue, we switch the bit + * enablement sequence to below sequence + * 1) clear the xSMB & xSMA: which is done in probe and + * stop state. + * 2) set TE/RE + * 3) set xSMB + * 4) set xSMA: xSMA is the last one in this flow, which + * will trigger esai to start. + */ regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx), tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, tx ? ESAI_xCR_TE(pins) : ESAI_xCR_RE(pins)); + mask = tx ? esai_priv->tx_mask : esai_priv->rx_mask; + + regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx), + ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(mask)); + regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx), + ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(mask)); + break; case SNDRV_PCM_TRIGGER_SUSPEND: case SNDRV_PCM_TRIGGER_STOP: case SNDRV_PCM_TRIGGER_PAUSE_PUSH: regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx), tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, 0); + regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx), + ESAI_xSMA_xS_MASK, 0); + regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx), + ESAI_xSMB_xS_MASK, 0); /* Disable and reset FIFO */ regmap_update_bits(esai_priv->regmap, REG_ESAI_xFCR(tx), @@ -906,6 +924,15 @@ static int fsl_esai_probe(struct platform_device *pdev) return ret; } + esai_priv->tx_mask = 0xFFFFFFFF; + esai_priv->rx_mask = 0xFFFFFFFF; + + /* Clear the TSMA, TSMB, RSMA, RSMB */ + regmap_write(esai_priv->regmap, REG_ESAI_TSMA, 0); + regmap_write(esai_priv->regmap, REG_ESAI_TSMB, 0); + regmap_write(esai_priv->regmap, REG_ESAI_RSMA, 0); + regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0); + ret = devm_snd_soc_register_component(&pdev->dev, &fsl_esai_component, &fsl_esai_dai, 1); if (ret) { -- 1.9.1

2 3

[alsa-devel] [PATCH 0/2] arm64: allwinner: a64: Rename hpvcc-supply to cpvdd-supply
by Chen-Yu Tsai 21 Mar '19

21 Mar '19

Hi everyone, This is a small series to fix the CPVDD regulator supply name for the A64 codec. The datasheet specifies the name "CPVDD" for the supply rail for the audio codec's internal headphone amp charge pump. Somehow I managed to write "CPVDD" in the commit message and the device tree binding, but used "HPVCC" (which is the name used by the A33) in the device tree files and the device driver. (facepalm) This feature was just introduced in v5.0-rc1, so if we could merge this as fixes for v5.0 that would be great. Thanks, and sorry for the blunder on my part. Regards ChenYu Chen-Yu Tsai (2): ASoC: sunxi: sun50i-codec-analog: Rename hpvcc regulator supply to cpvdd arm64: dts: allwinner: a64: Rename hpvcc-supply to cpvdd-supply arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts | 2 +- arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts | 2 +- arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 2 +- arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi | 2 +- sound/soc/sunxi/sun50i-codec-analog.c | 4 ++-- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.20.1

3 5

[alsa-devel] KASAN: slab-out-of-bounds Read in default_write_copy_kernel
by syzbot 20 Mar '19

20 Mar '19

Hello, syzbot found the following crash on: HEAD commit: 7c98a4261827 Merge tag 'ceph-for-4.20-rc4' of https://gith.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=142c8893400000 kernel config: https://syzkaller.appspot.com/x/.config?x=73e2bc0cb6463446 dashboard link: https://syzkaller.appspot.com/bug?extid=d4503ae45b65c5bc1194 compiler: gcc (GCC) 8.0.1 20180413 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1789354d400000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=162ebe2b400000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+d4503ae45b65c5bc1194(a)syzkaller.appspotmail.com RDX: 0000000056da83a0 RSI: 00000000200000c0 RDI: 0000000000000004 RBP: 00000000006cf018 R08: 0000000000000001 R09: 0000000000000037 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 ================================================================== BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:352 [inline] BUG: KASAN: slab-out-of-bounds in default_write_copy_kernel+0xe1/0x140 sound/core/pcm_lib.c:1946 Read of size 64 at addr ffff8881cee03c40 by task syz-executor636/6021 CPU: 1 PID: 6021 Comm: syz-executor636 Not tainted 4.20.0-rc3+ #347 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 memcpy+0x23/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:352 [inline] default_write_copy_kernel+0xe1/0x140 sound/core/pcm_lib.c:1946 interleaved_copy+0xd1/0x110 sound/core/pcm_lib.c:2007 __snd_pcm_lib_xfer+0x115f/0x1f23 sound/core/pcm_lib.c:2227 snd_pcm_oss_write3+0xe9/0x220 sound/core/oss/pcm_oss.c:1237 io_playback_transfer+0x27d/0x310 sound/core/oss/io.c:47 snd_pcm_plug_write_transfer+0x374/0x490 sound/core/oss/pcm_plugin.c:620 snd_pcm_oss_write2+0x25d/0x450 sound/core/oss/pcm_oss.c:1366 snd_pcm_oss_write1 sound/core/oss/pcm_oss.c:1432 [inline] snd_pcm_oss_write+0x567/0xa60 sound/core/oss/pcm_oss.c:2775 __vfs_write+0x119/0x9f0 fs/read_write.c:485 vfs_write+0x1fc/0x560 fs/read_write.c:549 ksys_write+0x101/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x444119 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffdf4510538 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000444119 RDX: 0000000056da83a0 RSI: 00000000200000c0 RDI: 0000000000000004 RBP: 00000000006cf018 R08: 0000000000000001 R09: 0000000000000037 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 Allocated by task 6021: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 __do_kmalloc_node mm/slab.c:3684 [inline] __kmalloc_node+0x50/0x70 mm/slab.c:3691 kmalloc_node include/linux/slab.h:589 [inline] kvmalloc_node+0x65/0xf0 mm/util.c:416 kvmalloc include/linux/mm.h:577 [inline] kvzalloc include/linux/mm.h:585 [inline] snd_pcm_plugin_alloc+0x577/0x770 sound/core/oss/pcm_plugin.c:70 snd_pcm_plug_alloc+0x218/0x340 sound/core/oss/pcm_plugin.c:117 snd_pcm_oss_change_params_locked+0x2209/0x3c60 sound/core/oss/pcm_oss.c:1038 snd_pcm_oss_make_ready_locked+0xbc/0x130 sound/core/oss/pcm_oss.c:1183 snd_pcm_oss_write1 sound/core/oss/pcm_oss.c:1397 [inline] snd_pcm_oss_write+0x51e/0xa60 sound/core/oss/pcm_oss.c:2775 __vfs_write+0x119/0x9f0 fs/read_write.c:485 vfs_write+0x1fc/0x560 fs/read_write.c:549 ksys_write+0x101/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 2446: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xcf/0x230 mm/slab.c:3817 blk_mq_hw_sysfs_release+0x42/0x60 block/blk-mq-sysfs.c:25 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:70 [inline] kobject_put.cold.9+0x287/0x2e4 lib/kobject.c:708 blk_mq_release+0xf2/0x210 block/blk-mq.c:2478 __blk_release_queue+0x228/0x510 block/blk-sysfs.c:862 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff8881cee03c40 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes inside of 32-byte region [ffff8881cee03c40, ffff8881cee03c60) The buggy address belongs to the page: page:ffffea00073b80c0 count:1 mapcount:0 mapping:ffff8881da8001c0 index:0xffff8881cee03fc1 flags: 0x2fffc0000000200(slab) raw: 02fffc0000000200 ffffea0007433308 ffff8881da801248 ffff8881da8001c0 raw: ffff8881cee03fc1 ffff8881cee03000 000000010000003f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881cee03b00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff8881cee03b80: fb fb fb fb fc fc fc fc 00 fc fc fc fc fc fc fc > ffff8881cee03c00: fb fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc ^ ffff8881cee03c80: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ffff8881cee03d00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 1

[alsa-devel] KASAN: slab-out-of-bounds Write in default_read_copy_kernel
by syzbot 19 Mar '19

19 Mar '19

Hello, syzbot found the following crash on: HEAD commit: abb8d6ecbd8f Merge tag 'trace-v4.20-rc5' of git://git.kern.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=17932f4d400000 kernel config: https://syzkaller.appspot.com/x/.config?x=b9cc5a440391cbfd dashboard link: https://syzkaller.appspot.com/bug?extid=12f17c177de05efea72d compiler: gcc (GCC) 8.0.1 20180413 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16c27125400000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=152a2a43400000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+12f17c177de05efea72d(a)syzkaller.appspotmail.com RDX: 0000000000000001 RSI: 0000000020001640 RDI: 0000000000000003 RBP: 00000000006cf018 R08: 0000000000000001 R09: 0000000000000037 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 ================================================================== BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:352 [inline] BUG: KASAN: slab-out-of-bounds in default_read_copy_kernel+0xe1/0x140 sound/core/pcm_lib.c:1988 Write of size 64 at addr ffff8881cec699c0 by task syz-executor520/6056 CPU: 1 PID: 6056 Comm: syz-executor520 Not tainted 4.20.0-rc5+ #365 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 memcpy+0x37/0x50 mm/kasan/kasan.c:303 memcpy include/linux/string.h:352 [inline] default_read_copy_kernel+0xe1/0x140 sound/core/pcm_lib.c:1988 interleaved_copy+0xd1/0x110 sound/core/pcm_lib.c:2007 __snd_pcm_lib_xfer+0x115f/0x1f23 sound/core/pcm_lib.c:2227 snd_pcm_oss_read3+0x1c8/0x410 sound/core/oss/pcm_oss.c:1274 io_capture_transfer+0x27d/0x310 sound/core/oss/io.c:73 snd_pcm_plug_read_transfer+0x1d7/0x3b0 sound/core/oss/pcm_plugin.c:651 snd_pcm_oss_read2+0x221/0x450 sound/core/oss/pcm_oss.c:1474 snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1531 [inline] snd_pcm_oss_read+0x638/0x830 sound/core/oss/pcm_oss.c:2752 do_loop_readv_writev fs/read_write.c:700 [inline] do_iter_read+0x4a3/0x650 fs/read_write.c:924 vfs_readv+0x175/0x1c0 fs/read_write.c:986 do_readv+0x11a/0x310 fs/read_write.c:1019 __do_sys_readv fs/read_write.c:1106 [inline] __se_sys_readv fs/read_write.c:1103 [inline] __x64_sys_readv+0x75/0xb0 fs/read_write.c:1103 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x444079 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc8067a328 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000444079 RDX: 0000000000000001 RSI: 0000000020001640 RDI: 0000000000000003 RBP: 00000000006cf018 R08: 0000000000000001 R09: 0000000000000037 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 Allocated by task 6056: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 __do_kmalloc_node mm/slab.c:3684 [inline] __kmalloc_node+0x50/0x70 mm/slab.c:3691 kmalloc_node include/linux/slab.h:589 [inline] kvmalloc_node+0x65/0xf0 mm/util.c:416 kvmalloc include/linux/mm.h:577 [inline] kvzalloc include/linux/mm.h:585 [inline] snd_pcm_plugin_alloc+0x577/0x770 sound/core/oss/pcm_plugin.c:70 snd_pcm_plug_alloc+0x149/0x340 sound/core/oss/pcm_plugin.c:129 snd_pcm_oss_change_params_locked+0x2209/0x3c60 sound/core/oss/pcm_oss.c:1038 snd_pcm_oss_make_ready_locked+0xbc/0x130 sound/core/oss/pcm_oss.c:1183 snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1507 [inline] snd_pcm_oss_read+0x417/0x830 sound/core/oss/pcm_oss.c:2752 do_loop_readv_writev fs/read_write.c:700 [inline] do_iter_read+0x4a3/0x650 fs/read_write.c:924 vfs_readv+0x175/0x1c0 fs/read_write.c:986 do_readv+0x11a/0x310 fs/read_write.c:1019 __do_sys_readv fs/read_write.c:1106 [inline] __se_sys_readv fs/read_write.c:1103 [inline] __x64_sys_readv+0x75/0xb0 fs/read_write.c:1103 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 9: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xcf/0x230 mm/slab.c:3817 kzfree+0x28/0x30 mm/slab_common.c:1564 aa_free_task_ctx security/apparmor/include/task.h:61 [inline] apparmor_task_free+0x13a/0x1e0 security/apparmor/lsm.c:95 security_task_free+0x4a/0x80 security/security.c:1007 __put_task_struct+0x195/0x620 kernel/fork.c:724 put_task_struct include/linux/sched/task.h:96 [inline] delayed_put_task_struct+0x2ff/0x4c0 kernel/exit.c:181 __rcu_reclaim kernel/rcu/rcu.h:240 [inline] rcu_do_batch kernel/rcu/tree.c:2437 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2716 [inline] rcu_process_callbacks+0x100a/0x1ac0 kernel/rcu/tree.c:2697 __do_softirq+0x308/0xb7e kernel/softirq.c:292 The buggy address belongs to the object at ffff8881cec699c0 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes inside of 32-byte region [ffff8881cec699c0, ffff8881cec699e0) The buggy address belongs to the page: page:ffffea00073b1a40 count:1 mapcount:0 mapping:ffff8881da8001c0 index:0xffff8881cec69fc1 flags: 0x2fffc0000000200(slab) raw: 02fffc0000000200 ffffea00073a3748 ffff8881da801248 ffff8881da8001c0 raw: ffff8881cec69fc1 ffff8881cec69000 000000010000003f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881cec69880: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff8881cec69900: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc > ffff8881cec69980: fb fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc ^ ffff8881cec69a00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff8881cec69a80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

2 2