April 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] BUG: corrupted list in snd_info_free_entry
by syzbot 16 Apr '19

16 Apr '19

Hello, syzbot found the following crash on: HEAD commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan/tree/usb-fuzzer console output: https://syzkaller.appspot.com/x/log.txt?x=14edefa7200000 kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15 dashboard link: https://syzkaller.appspot.com/bug?extid=90cf07b4a2473213d16b compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15aba2b7200000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+90cf07b4a2473213d16b(a)syzkaller.appspotmail.com snd_usb_toneport: probe of 6-1:0.0 failed with error -71 snd_usb_toneport 2-1:0.0: Line 6 POD Studio UX2 now disconnected usb 5-1: USB disconnect, device number 5 list_del corruption. prev->next should be ffff8880a725e9a8, but was ffff8880a725e228 ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:51! invalid opcode: 0000 [#1] SMP KASAN PTI usb 6-1: USB disconnect, device number 5 CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.1.0-rc4-319354-g9a33b36 #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event RIP: 0010:__list_del_entry_valid.cold+0xf/0x55 lib/list_debug.c:51 Code: e8 69 e7 e9 fd 0f 0b 48 89 f1 48 c7 c7 00 94 b3 8e 4c 89 e6 e8 55 e7 e9 fd 0f 0b 48 89 ee 48 c7 c7 a0 95 b3 8e e8 44 e7 e9 fd <0f> 0b 4c 89 ea 48 89 ee 48 c7 c7 e0 94 b3 8e e8 30 e7 e9 fd 0f 0b RSP: 0018:ffff8880a84b7118 EFLAGS: 00010282 RAX: 0000000000000054 RBX: ffff8880a725e8b0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815b1e42 RDI: ffffed1015096e15 RBP: ffff8880a725e9a8 R08: 0000000000000054 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809cb90868 R13: ffff8880a7068e98 R14: ffff8880a725e8b0 R15: ffff8880a725e998 FS: 0000000000000000(0000) GS:ffff8880ad000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff9de9dfc8 CR3: 00000000963ea000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_del_entry include/linux/list.h:117 [inline] list_del include/linux/list.h:125 [inline] snd_info_free_entry+0x137/0x340 sound/core/info.c:795 snd_info_card_free+0x43/0x90 sound/core/info.c:606 snd_card_do_free sound/core/init.c:469 [inline] release_card_device+0x8b/0x100 sound/core/init.c:156 device_release+0x7d/0x210 drivers/base/core.c:1064 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:67 [inline] kobject_put+0x1df/0x4f0 lib/kobject.c:708 put_device+0x21/0x30 drivers/base/core.c:2205 snd_card_free_when_closed+0x3a/0x50 sound/core/init.c:493 line6_disconnect.cold+0xa3/0xbc sound/usb/line6/driver.c:833 line6_probe+0xb23/0x1150 sound/usb/line6/driver.c:799 usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021 generic_probe+0xa2/0xda drivers/usb/core/generic.c:210 usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 usb 1-1: new high-speed USB device number 6 using dummy_hcd bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 usb 6-1: new high-speed USB device number 6 using dummy_hcd usb 5-1: new high-speed USB device number 6 using dummy_hcd bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534 hub_port_connect drivers/usb/core/hub.c:5089 [inline] hub_port_connect_change drivers/usb/core/hub.c:5204 [inline] port_event drivers/usb/core/hub.c:5350 [inline] hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432 process_one_work+0x90f/0x1580 kernel/workqueue.c:2269 process_scheduled_works kernel/workqueue.c:2331 [inline] worker_thread+0x7b0/0xe20 kernel/workqueue.c:2417 kthread+0x313/0x420 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Modules linked in: ---[ end trace 8111524f564d7b8a ]--- RIP: 0010:__list_del_entry_valid.cold+0xf/0x55 lib/list_debug.c:51 Code: e8 69 e7 e9 fd 0f 0b 48 89 f1 48 c7 c7 00 94 b3 8e 4c 89 e6 e8 55 e7 e9 fd 0f 0b 48 89 ee 48 c7 c7 a0 95 b3 8e e8 44 e7 e9 fd <0f> 0b 4c 89 ea 48 89 ee 48 c7 c7 e0 94 b3 8e e8 30 e7 e9 fd 0f 0b RSP: 0018:ffff8880a84b7118 EFLAGS: 00010282 RAX: 0000000000000054 RBX: ffff8880a725e8b0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815b1e42 RDI: ffffed1015096e15 RBP: ffff8880a725e9a8 R08: 0000000000000054 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809cb90868 R13: ffff8880a7068e98 R14: ffff8880a725e8b0 R15: ffff8880a725e998 FS: 0000000000000000(0000) GS:ffff8880ad000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff9de9dfc8 CR3: 00000000963ea000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 1

[alsa-devel] [PATCH] ALSA: isa/wavefront: Fix potential Spectre v1 vulnerabilities
by Gustavo A. R. Silva 16 Apr '19

16 Apr '19

header->number and i are indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: sound/isa/wavefront/wavefront_synth.c:792 wavefront_send_patch() warn: potential spectre issue 'dev->patch_status' [w] (local cap) sound/isa/wavefront/wavefront_synth.c:819 wavefront_send_program() warn: potential spectre issue 'dev->prog_status' [w] (local cap) sound/isa/wavefront/wavefront_synth.c:1197 wavefront_send_alias() warn: potential spectre issue 'dev->sample_status' [w] sound/isa/wavefront/wavefront_synth.c:1248 wavefront_send_multisample() warn: potential spectre issue 'dev->sample_status' [w] sound/isa/wavefront/wavefront_synth.c:1548 wavefront_synth_control() warn: potential spectre issue 'dev->sample_status' [r] (local cap) Fix this by sanitizing header->number and i before using them to index dev->patch_status, dev->prog_status, dev->sample_status. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable(a)vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo(a)embeddedor.com> --- sound/isa/wavefront/wavefront_synth.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c index 0b1e4b34b299..a78e125dfdf9 100644 --- a/sound/isa/wavefront/wavefront_synth.c +++ b/sound/isa/wavefront/wavefront_synth.c @@ -31,6 +31,7 @@ #include <linux/moduleparam.h> #include <linux/slab.h> #include <linux/module.h> +#include <linux/nospec.h> #include <sound/core.h> #include <sound/snd_wavefront.h> #include <sound/initval.h> @@ -788,6 +789,8 @@ wavefront_send_patch (snd_wavefront_t *dev, wavefront_patch_info *header) if (header->number >= ARRAY_SIZE(dev->patch_status)) return -EINVAL; + header->number = array_index_nospec(header->number, + ARRAY_SIZE(dev->patch_status)); dev->patch_status[header->number] |= WF_SLOT_FILLED; @@ -815,6 +818,8 @@ wavefront_send_program (snd_wavefront_t *dev, wavefront_patch_info *header) if (header->number >= ARRAY_SIZE(dev->prog_status)) return -EINVAL; + header->number = array_index_nospec(header->number, + ARRAY_SIZE(dev->prog_status)); dev->prog_status[header->number] = WF_SLOT_USED; @@ -1194,6 +1199,11 @@ wavefront_send_alias (snd_wavefront_t *dev, wavefront_patch_info *header) return -EIO; } + if (header->number >= ARRAY_SIZE(dev->sample_status)) + return -EINVAL; + header->number = array_index_nospec(header->number, + ARRAY_SIZE(dev->sample_status)); + dev->sample_status[header->number] = (WF_SLOT_FILLED|WF_ST_ALIAS); return (0); @@ -1245,6 +1255,12 @@ wavefront_send_multisample (snd_wavefront_t *dev, wavefront_patch_info *header) return -EIO; } + if (header->number >= ARRAY_SIZE(dev->sample_status)) { + kfree(msample_hdr); + return -EINVAL; + } + header->number = array_index_nospec(header->number, + ARRAY_SIZE(dev->sample_status)); dev->sample_status[header->number] = (WF_SLOT_FILLED|WF_ST_MULTISAMPLE); kfree(msample_hdr); @@ -1545,6 +1561,7 @@ wavefront_synth_control (snd_wavefront_card_t *acard, wc->status = EINVAL; return -EINVAL; } + i = array_index_nospec(i, WF_MAX_SAMPLE); wc->rbuf[0] = dev->sample_status[i]; wc->status = 0; return 0; -- 2.21.0

2 3

[alsa-devel] IEEE 1394 isoc library, libhinoko v0.1.0 release
by Takashi Sakamoto 15 Apr '19

15 Apr '19

Hi all, As ALSA firewire stack includes more drivers to expand support for audio and music units on IEEE 1394 bus, I realized that some devices generate periodical short noises in its output sound, and some users reports the issue. I wrote my previous report[1] for Dice ASIC, however today I realize the other type of device has the similar issue. Furthermore, even if using the same ASIC, one has the issue but another has none. For further investigation, the sequence of packet for long period is required to analyze inclination of the content; e.g. several tens minutes. However, it requires tons of memory for the content of captured packets. As long as I know, there's no protocol analyzer with so much memories. Unlike asynchronous communication on IEEE 1394 bus, any isochronous communication on the bus can be captured by IR context of 1394 OHCI[2]. This enables to use Linux system for packet capture with large memory/storage. In the diagram below, two physical machines are connected by two 1394 OHCI controller, and target device is connected to one of the controller. Windows (or macOS) machine +-----------------+ | proprietary | | unit driver | | | | | proprietary | | ohci driver | | | | | 1394 OHCI | +---- + - + -----+ | | | +---- target device | +---- + ---------+ | 1394 OHCI | | | | | firewire-ohci | | firewire-core | | /dev/fw* | | | | | libhinoko | | | | | applications | |(Python 3 script)| +-----------------+ Linux machine In this case, the two controllers and the device are on the same bus. When an unit driver in one side (Windows OS) communicates to the device by isochronous packet, the packets from both of the unit driver and the device can be captured in another side (with Linux OS). Today I released libhinoko[3] to assist this kind of work. This I/O library produces a series of API to operate 1394 OHCI controller via UAPI of Linux FireWire subsystem for any isochronous context; i.e. IR and IT. Especially, IR context with buffer-fill mode is useful for the kind of work. For the implementation, I got great help from Clemens[4]. Like a sister project (libhinawa[5]), the library supports GObject Introspection[6] as well for dynamic language bindings. As a result, interpreter language is available to write libhinoko application (e.g. Python 3). This is good for prototyping of program adapted to vendor-dependent and model-dependent inclinations. You can see some Python 3 examples in `samples` directory (PyGObject[7] is required to run). If you're interests in libhinoko and its application, please refer to introduction section of documentation[8]. Please ensure that public APIs of the library are not stable yet. I need more time for the investigation, but wish to propose better implementation against the issue and to write a paper in this year. [1] [alsa-devel] Dice packet sequence quirk and ALSA firewire stack in Linux 4.6 https://mailman.alsa-project.org/pipermail/alsa-devel/2016-May/107715.html [2] 1394 Open Host Controller Interface Specification https://ieee1394.wiki.kernel.org/index.php/Specifications#1394_Open_Host_Co… [3] Release version 0.1.0 release · takaswie/libhinoko https://github.com/takaswie/libhinoko/releases/tag/v0.1.0 [4] Overview — GObject Introspection https://gi.readthedocs.io/en/latest/ [5] IEEE 1394 for Linux / Content of buffer for receive_multichannel ctx in userspace https://sourceforge.net/p/linux1394/mailman/message/36579137/ [6] takaswie/libhinawa https://github.com/takaswie/libhinawa [7] Overview — PyGObject https://pygobject.readthedocs.io/en/latest/ [8] Hinoko Reference Manual: Hinoko Reference Manual https://takaswie.github.io/libhinoko-docs/ Regards Takashi Sakamoto

1 0

[alsa-devel] [PATCH 0/2] soundwire: fix Kconfig select/depend issues
by Pierre-Louis Bossart 15 Apr '19

15 Apr '19

0-day/Kbuild starts complaining about missed module dependencies and compilation issues. Since codecs and soc drivers need to be compilable independently, let's fix this using the following model: SOUNDWIRE_INTEL ---- select ----------- | v REGMAP_SOUNDWIRE --- select ---> SOUNDWIRE_BUS Pierre-Louis Bossart (2): regmap: soundwire: fix Kconfig select/depend issue soundwire: fix SOUNDWIRE_BUS option drivers/base/regmap/Kconfig | 3 ++- drivers/soundwire/Kconfig | 1 - 2 files changed, 2 insertions(+), 2 deletions(-) -- 2.17.1

5 14

[alsa-devel] [PATCH] ALSA: usb-audio: Add quirk for Focusrite Scarlett Solo
by Roope Salmi 15 Apr '19

15 Apr '19

The device reports Synch: Synchronous on the playback interface. This causes regular audible napping on sample rates that are not multiples of 1 kHz. Fix to Synch: Asynchronous. Specifically observed on Focusrite Scarlett Solo 2nd generation. I assume the first generation model has a different device ID. A first generation Scarlett 2i2 I was able to test advertised Synch: Asynchronous by default. For example, with a sample rate of 44100 Hz, a silent sample is played every 40.96 seconds (likely 44.0 samples instead of 44.1 transmitted per USB frame on average, 4096 being the size of some internal buffer). There may be some other bug at play here since this doesn't happen on other platforms. However, a feedback endpoint is listed and using it fixes the issue. That is the only change in the quirk, but I didn't find a way to declare only it. Tested on two units and on two different computers. Signed-off-by: Roope Salmi <rpsalmi(a)gmail.com> diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h index 86e80916a..5525f9043 100644 --- a/sound/usb/quirks-table.h +++ b/sound/usb/quirks-table.h @@ -2770,6 +2770,90 @@ YAMAHA_DEVICE(0x7010, "UB99"), .type = QUIRK_MIDI_NOVATION } }, +{ + /* + * Focusrite Scarlett Solo 2nd generation + * Reports that playback should use Synch: Synchronous + * while still providing a feedback endpoint. Synchronous causes + * snapping on some sample rates. + * Force it to use Synch: Asynchronous. + */ + USB_DEVICE(0x1235, 0x8205), + .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + .ifnum = QUIRK_ANY_INTERFACE, + .type = QUIRK_COMPOSITE, + .data = (const struct snd_usb_audio_quirk[]) { + { + .ifnum = 1, + .type = QUIRK_AUDIO_FIXED_ENDPOINT, + .data = & (const struct audioformat) { + .formats = SNDRV_PCM_FMTBIT_S32_LE, + .channels = 2, + .iface = 1, + .altsetting = 1, + .altset_idx = 1, + .attributes = 0, + .endpoint = 0x01, + .ep_attr = USB_ENDPOINT_XFER_ISOC | + USB_ENDPOINT_SYNC_ASYNC, + .protocol = UAC_VERSION_2, + .rates = SNDRV_PCM_RATE_44100 | + SNDRV_PCM_RATE_48000 | + SNDRV_PCM_RATE_88200 | + SNDRV_PCM_RATE_96000 | + SNDRV_PCM_RATE_176400 | + SNDRV_PCM_RATE_192000, + .rate_min = 44100, + .rate_max = 192000, + .nr_rates = 6, + .rate_table = (unsigned int[]) { + 44100, 48000, 88200, + 96000, 176400, 192000 + }, + .clock = 41 + } + }, + { + .ifnum = 2, + .type = QUIRK_AUDIO_FIXED_ENDPOINT, + .data = & (const struct audioformat) { + .formats = SNDRV_PCM_FMTBIT_S32_LE, + .channels = 2, + .iface = 2, + .altsetting = 1, + .altset_idx = 1, + .attributes = 0, + .endpoint = 0x82, + .ep_attr = USB_ENDPOINT_XFER_ISOC | + USB_ENDPOINT_SYNC_ASYNC | + USB_ENDPOINT_USAGE_IMPLICIT_FB, + .protocol = UAC_VERSION_2, + .rates = SNDRV_PCM_RATE_44100 | + SNDRV_PCM_RATE_48000 | + SNDRV_PCM_RATE_88200 | + SNDRV_PCM_RATE_96000 | + SNDRV_PCM_RATE_176400 | + SNDRV_PCM_RATE_192000, + .rate_min = 44100, + .rate_max = 192000, + .nr_rates = 6, + .rate_table = (unsigned int[]) { + 44100, 48000, 88200, + 96000, 176400, 192000 + }, + .clock = 41 + } + }, + { + .ifnum = 3, + .type = QUIRK_IGNORE_INTERFACE + }, + { + .ifnum = -1 + } + } + } +}, /* Access Music devices */ { -- 2.17.1

2 1

[alsa-devel] [PATCH] ALSA: seq: Correct unlock sequence at snd_seq_client_ioctl_unlock()
by Takashi Iwai 15 Apr '19

15 Apr '19

The doubly unlock sequence at snd_seq_client_ioctl_unlock() is tricky. I took a direct unref call since I thought it would avoid misunderstanding, but rather this seems more confusing. Let's use snd_seq_client_unlock() consistently even if they look strange to be called twice, and add more comments for avoiding reader's confusion. Fixes: 6b580f523172 ("ALSA: seq: Protect racy pool manipulation from OSS sequencer") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/seq/seq_clientmgr.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 3acd80e718f2..c0227a672442 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -191,6 +191,7 @@ bool snd_seq_client_ioctl_lock(int clientid) if (!client) return false; mutex_lock(&client->ioctl_mutex); + /* The client isn't unrefed here; see snd_seq_client_ioctl_unlock() */ return true; } EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_lock); @@ -204,7 +205,11 @@ void snd_seq_client_ioctl_unlock(int clientid) if (WARN_ON(!client)) return; mutex_unlock(&client->ioctl_mutex); - snd_use_lock_free(&client->use_lock); + /* The doubly unrefs below are intentional; the first one releases the + * leftover from snd_seq_client_ioctl_lock() above, and the second one + * is for releasing snd_seq_client_use_ptr() in this function + */ + snd_seq_client_unlock(client); snd_seq_client_unlock(client); } EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_unlock); -- 2.16.4

2 2

[alsa-devel] [PATCH 0/3] ALSA: seq: Yet a few more fixes / cleanups
by Takashi Iwai 15 Apr '19

15 Apr '19

Hi, this is a series of fixes / cleanups of ALSA sequencer code, especially for OSS sequencer layer. One fix is yet another attempt to harden against the race of port deletions, while others are for racy OSS sequencer accesses. Takashi === Takashi Iwai (3): ALSA: seq: Cover unsubscribe_port() in list_mutex ALSA: seq: Simplify snd_seq_kernel_client_enqueue() helper ALSA: seq: Protect racy pool manipulation from OSS sequencer include/sound/seq_kernel.h | 3 +- sound/core/seq/oss/seq_oss_device.h | 10 ++++- sound/core/seq/oss/seq_oss_rw.c | 11 ++---- sound/core/seq/oss/seq_oss_writeq.c | 2 +- sound/core/seq/seq_clientmgr.c | 75 +++++++++++++++++++++---------------- sound/core/seq/seq_clientmgr.h | 8 ++-- sound/core/seq/seq_ports.c | 2 +- 7 files changed, 63 insertions(+), 48 deletions(-) -- 2.16.4

2 7

[alsa-devel] Applied "ASoC: rsnd: Document r8a77470 bindings" to the asoc tree
by Mark Brown 15 Apr '19

15 Apr '19

The patch ASoC: rsnd: Document r8a77470 bindings has been applied to the asoc tree at https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-5.2 All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark >From d1d58766908aad18b1f967fc107702959da84f2b Mon Sep 17 00:00:00 2001 From: Cao Van Dong <cv-dong(a)jinso.co.jp> Date: Thu, 11 Apr 2019 16:54:18 +0900 Subject: [PATCH] ASoC: rsnd: Document r8a77470 bindings Document SoC specific bindings for R-Car RZ/G1C(r8a77470) SoC. Signed-off-by: Cao Van Dong <cv-dong(a)jinso.co.jp> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- Documentation/devicetree/bindings/sound/renesas,rsnd.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/Documentation/devicetree/bindings/sound/renesas,rsnd.txt b/Documentation/devicetree/bindings/sound/renesas,rsnd.txt index b34afa66fb00..5c52182f7dcf 100644 --- a/Documentation/devicetree/bindings/sound/renesas,rsnd.txt +++ b/Documentation/devicetree/bindings/sound/renesas,rsnd.txt @@ -266,6 +266,7 @@ Required properties: - "renesas,rcar_sound-r8a7743" (RZ/G1M) - "renesas,rcar_sound-r8a7744" (RZ/G1N) - "renesas,rcar_sound-r8a7745" (RZ/G1E) + - "renesas,rcar_sound-r8a77470" (RZ/G1C) - "renesas,rcar_sound-r8a774a1" (RZ/G2M) - "renesas,rcar_sound-r8a774c0" (RZ/G2E) - "renesas,rcar_sound-r8a7778" (R-Car M1A) -- 2.20.1

1 0

[alsa-devel] WARNING: proc registration bug in snd_info_register
by syzbot 15 Apr '19

15 Apr '19

Hello, syzbot found the following crash on: HEAD commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan/tree/usb-fuzzer console output: https://syzkaller.appspot.com/x/log.txt?x=1065d5bb200000 kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15 dashboard link: https://syzkaller.appspot.com/bug?extid=4d729bd9da724d0282dd compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+4d729bd9da724d0282dd(a)syzkaller.appspotmail.com usb 3-1: config 0 descriptor?? snd_usb_toneport 1-1:0.0: Line 6 POD Studio UX2 now attached usb 1-1: USB disconnect, device number 26 ------------[ cut here ]------------ proc_dir_entry 'asound/card4' already registered WARNING: CPU: 0 PID: 533 at fs/proc/generic.c:359 proc_register+0x3d9/0x550 fs/proc/generic.c:359 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 533 Comm: kworker/0:2 Not tainted 5.1.0-rc4-319354-g9a33b36 #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe8/0x16e lib/dump_stack.c:113 panic+0x29d/0x5f2 kernel/panic.c:214 __warn.cold+0x20/0x48 kernel/panic.c:571 report_bug+0x262/0x2a0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:179 [inline] fixup_bug arch/x86/kernel/traps.c:174 [inline] do_error_trap+0x130/0x1f0 arch/x86/kernel/traps.c:272 do_invalid_op+0x37/0x40 arch/x86/kernel/traps.c:291 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:proc_register+0x3d9/0x550 fs/proc/generic.c:359 Code: ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 61 01 00 00 48 8b 04 24 48 c7 c7 e0 a0 79 8e 48 8b b0 d0 00 00 00 e8 a7 9e 71 ff <0f> 0b 48 c7 c7 a0 90 91 91 e8 b9 10 34 0c 48 8b 4c 24 28 48 b8 00 RSP: 0018:ffff88809f59f018 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88821443f0c0 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff815b1e42 RDI: ffffed1013eb3df5 RBP: ffff8880a7b65780 R08: ffff88809f51c980 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: dffffc0000000000 R14: ffff88808f034ab8 R15: 0000000000000005 proc_mkdir_data+0x17b/0x230 fs/proc/generic.c:475 __snd_info_register sound/core/info.c:814 [inline] snd_info_register+0x2f8/0x3e0 sound/core/info.c:854 create_subdir+0x69/0xa0 sound/core/info.c:458 snd_info_card_create+0xcf/0x230 sound/core/info.c:528 snd_card_new+0x61d/0x920 sound/core/init.c:255 snd_usb_audio_create sound/usb/card.c:475 [inline] usb_audio_probe+0x10d9/0x1fa0 sound/usb/card.c:621 usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021 generic_probe+0xa2/0xda drivers/usb/core/generic.c:210 usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534 hub_port_connect drivers/usb/core/hub.c:5089 [inline] hub_port_connect_change drivers/usb/core/hub.c:5204 [inline] port_event drivers/usb/core/hub.c:5350 [inline] hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432 process_one_work+0x90f/0x1580 kernel/workqueue.c:2269 worker_thread+0x9b/0xe20 kernel/workqueue.c:2415 kthread+0x313/0x420 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Kernel Offset: disabled Rebooting in 86400 seconds.. --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 1

[alsa-devel] KASAN: use-after-free Read in snd_info_free_entry
by syzbot 14 Apr '19

14 Apr '19

Hello, syzbot found the following crash on: HEAD commit: 9a33b369 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan/tree/usb-fuzzer console output: https://syzkaller.appspot.com/x/log.txt?x=14153823200000 kernel config: https://syzkaller.appspot.com/x/.config?x=23e37f59d94ddd15 dashboard link: https://syzkaller.appspot.com/bug?extid=48df349490c36f9f54ab compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12642f97200000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14a8f5af200000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+48df349490c36f9f54ab(a)syzkaller.appspotmail.com snd_usb_toneport: probe of 1-1:0.0 failed with error -71 snd_usb_toneport: probe of 5-1:0.0 failed with error -71 usb 1-1: USB disconnect, device number 72 snd_usb_toneport: probe of 4-1:0.0 failed with error -71 ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0xef lib/list_debug.c:51 Read of size 8 at addr ffff88809b8339a8 by task kworker/0:4/5492 CPU: 0 PID: 5492 Comm: kworker/0:4 Not tainted 5.1.0-rc4-319354-g9a33b36 #3 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe8/0x16e lib/dump_stack.c:113 print_address_description+0x6c/0x236 mm/kasan/report.c:187 kasan_report.cold+0x1a/0x3c mm/kasan/report.c:317 __list_del_entry_valid+0xe0/0xef lib/list_debug.c:51 __list_del_entry include/linux/list.h:117 [inline] list_del include/linux/list.h:125 [inline] snd_info_free_entry+0x137/0x340 sound/core/info.c:795 snd_info_card_free+0x43/0x90 sound/core/info.c:606 snd_card_do_free sound/core/init.c:469 [inline] release_card_device+0x8b/0x100 sound/core/init.c:156 device_release+0x7d/0x210 drivers/base/core.c:1064 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:67 [inline] kobject_put+0x1df/0x4f0 lib/kobject.c:708 put_device+0x21/0x30 drivers/base/core.c:2205 snd_card_free_when_closed+0x3a/0x50 sound/core/init.c:493 line6_disconnect.cold+0xa3/0xbc sound/usb/line6/driver.c:833 line6_probe+0xb23/0x1150 sound/usb/line6/driver.c:799 usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021 generic_probe+0xa2/0xda drivers/usb/core/generic.c:210 usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534 hub_port_connect drivers/usb/core/hub.c:5089 [inline] hub_port_connect_change drivers/usb/core/hub.c:5204 [inline] port_event drivers/usb/core/hub.c:5350 [inline] hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432 process_one_work+0x90f/0x1580 kernel/workqueue.c:2269 process_scheduled_works kernel/workqueue.c:2331 [inline] worker_thread+0x7b0/0xe20 kernel/workqueue.c:2417 kthread+0x313/0x420 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Allocated by task 5: set_track mm/kasan/common.c:87 [inline] __kasan_kmalloc mm/kasan/common.c:497 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:470 kmalloc include/linux/slab.h:547 [inline] kzalloc include/linux/slab.h:742 [inline] snd_info_create_entry+0x56/0x400 sound/core/info.c:701 snd_info_create_module_entry sound/core/info.c:737 [inline] create_subdir+0x27/0xa0 sound/core/info.c:454 snd_info_card_create+0xcf/0x230 sound/core/info.c:528 snd_card_new+0x61d/0x920 sound/core/init.c:255 line6_probe+0x135/0x1150 sound/usb/line6/driver.c:736 usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021 generic_probe+0xa2/0xda drivers/usb/core/generic.c:210 usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534 hub_port_connect drivers/usb/core/hub.c:5089 [inline] hub_port_connect_change drivers/usb/core/hub.c:5204 [inline] port_event drivers/usb/core/hub.c:5350 [inline] hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432 process_one_work+0x90f/0x1580 kernel/workqueue.c:2269 process_scheduled_works kernel/workqueue.c:2331 [inline] worker_thread+0x7b0/0xe20 kernel/workqueue.c:2417 kthread+0x313/0x420 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Freed by task 5: set_track mm/kasan/common.c:87 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:459 slab_free_hook mm/slub.c:1429 [inline] slab_free_freelist_hook+0x5e/0x140 mm/slub.c:1456 slab_free mm/slub.c:3003 [inline] kfree+0xce/0x290 mm/slub.c:3958 snd_info_free_entry+0x29a/0x340 sound/core/info.c:799 snd_info_card_free+0x43/0x90 sound/core/info.c:606 snd_card_do_free sound/core/init.c:469 [inline] release_card_device+0x8b/0x100 sound/core/init.c:156 device_release+0x7d/0x210 drivers/base/core.c:1064 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:67 [inline] kobject_put+0x1df/0x4f0 lib/kobject.c:708 put_device+0x21/0x30 drivers/base/core.c:2205 snd_card_free_when_closed+0x3a/0x50 sound/core/init.c:493 line6_disconnect.cold+0xa3/0xbc sound/usb/line6/driver.c:833 line6_probe+0xb23/0x1150 sound/usb/line6/driver.c:799 usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021 generic_probe+0xa2/0xda drivers/usb/core/generic.c:210 usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266 really_probe+0x2da/0xb10 drivers/base/dd.c:509 driver_probe_device+0x21d/0x350 drivers/base/dd.c:671 __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778 bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454 __device_attach+0x223/0x3a0 drivers/base/dd.c:844 bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514 device_add+0xad2/0x16e0 drivers/base/core.c:2106 usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534 hub_port_connect drivers/usb/core/hub.c:5089 [inline] hub_port_connect_change drivers/usb/core/hub.c:5204 [inline] port_event drivers/usb/core/hub.c:5350 [inline] hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432 process_one_work+0x90f/0x1580 kernel/workqueue.c:2269 process_scheduled_works kernel/workqueue.c:2331 [inline] worker_thread+0x7b0/0xe20 kernel/workqueue.c:2417 kthread+0x313/0x420 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff88809b8338c0 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 232 bytes inside of 256-byte region [ffff88809b8338c0, ffff88809b8339c0) The buggy address belongs to the page: page:ffffea00026e0cc0 count:1 mapcount:0 mapping:ffff88812c3f4e00 index:0x0 flags: 0xfff00000000200(slab) raw: 00fff00000000200 dead000000000100 dead000000000200 ffff88812c3f4e00 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809b833880: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff88809b833900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff88809b833980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88809b833a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809b833a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 0