May 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH][next] ASoC: cx2072x: fix integer overflow on unsigned int multiply
by Colin King 28 May '19

28 May '19

From: Colin Ian King <colin.king(a)canonical.com> In the case where frac_div larger than 96 the result of an unsigned multiplication overflows an unsigned int. For example, this can happen when the sample_rate is 192000 and pll_input is 122. Fix this by casing the first term of the mutiply to a u64. Also remove the extraneous parentheses around the expression. Addresses-Coverity: ("Unintentional integer overflow") Fixes: a497a4363706 ("ASoC: Add support for Conexant CX2072X CODEC") Signed-off-by: Colin Ian King <colin.king(a)canonical.com> --- sound/soc/codecs/cx2072x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/codecs/cx2072x.c b/sound/soc/codecs/cx2072x.c index c11a585bbf70..e8e6fd2e97b6 100644 --- a/sound/soc/codecs/cx2072x.c +++ b/sound/soc/codecs/cx2072x.c @@ -627,7 +627,7 @@ static int cx2072x_config_pll(struct cx2072x_priv *cx2072x) if (frac_div) { frac_div *= 1000; frac_div /= pll_input; - frac_num = ((4000 + frac_div) * ((1 << 20) - 4)); + frac_num = (u64)(4000 + frac_div) * ((1 << 20) - 4); do_div(frac_num, 7); frac = ((u32)frac_num + 499) / 1000; } -- 2.20.1

3 2

[alsa-devel] [PATCH][next] ASoC: cx2072x: fix spelling mistake "configued" -> "configured"
by Colin King 28 May '19

28 May '19

From: Colin Ian King <colin.king(a)canonical.com> There is a spelling mistake in a dev_err error message. Fit it. Signed-off-by: Colin Ian King <colin.king(a)canonical.com> --- sound/soc/codecs/cx2072x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/codecs/cx2072x.c b/sound/soc/codecs/cx2072x.c index e8e6fd2e97b6..f25376789c5c 100644 --- a/sound/soc/codecs/cx2072x.c +++ b/sound/soc/codecs/cx2072x.c @@ -933,7 +933,7 @@ static int cx2072x_hw_params(struct snd_pcm_substream *substream, return frame_size; if (cx2072x->mclk_rate == 0) { - dev_err(dev, "Master clock rate is not configued\n"); + dev_err(dev, "Master clock rate is not configured\n"); return -EINVAL; } -- 2.20.1

3 2

[alsa-devel] [PATCH] ASoC: fsl: sai: Fix clock source for mclk0
by Daniel Baluta 28 May '19

28 May '19

SAI provide multiple master clock source options selectable via bit MSEL of TCR2/RCR2. All possible master clock sources are stored in sai->mclk_clk array. Current implementation assumes that MCLK0 source is always busclk, but this is wrong! For example, on i.MX8QM we have: 00b - Bus Clock selected. 01b - Master Clock (MCLK) 1 option selected. 10b - Master Clock (MCLK) 2 option selected. 11b - Master Clock (MCLK) 3 option selected. while on i.MX6SX we have: 00b - Master Clock (MCLK) 1 option selected. 01b - Master Clock (MCLK) 1 option selected. 10b - Master Clock (MCLK) 2 option selected. 11b - Master Clock (MCLK) 3 option selected. So, this patch will read mclk0 source clock from device tree. Signed-off-by: Shengjiu Wang <shengjiu.wang(a)nxp.com> Signed-off-by: Daniel Baluta <daniel.baluta(a)nxp.com> --- sound/soc/fsl/fsl_sai.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c index d2a4dc744fd7..faa8de87ff83 100644 --- a/sound/soc/fsl/fsl_sai.c +++ b/sound/soc/fsl/fsl_sai.c @@ -829,8 +829,7 @@ static int fsl_sai_probe(struct platform_device *pdev) sai->bus_clk = NULL; } - sai->mclk_clk[0] = sai->bus_clk; - for (i = 1; i < FSL_SAI_MCLK_MAX; i++) { + for (i = 0; i < FSL_SAI_MCLK_MAX; i++) { sprintf(tmp, "mclk%d", i); sai->mclk_clk[i] = devm_clk_get(&pdev->dev, tmp); if (IS_ERR(sai->mclk_clk[i])) { -- 2.17.1

3 6

[alsa-devel] [PATCH 1/3][V2] lib: fix match_string() helper on -1 array size
by Alexandru Ardelean 28 May '19

28 May '19

The documentation the `_match_string()` helper mentions that `n` should be: * @n: number of strings in the array or -1 for NULL terminated arrays The behavior of the function is different, in the sense that it exits on the first NULL element in the array, regardless of whether `n` is -1 or a positive number. This patch changes the behavior, to exit the loop when a NULL element is found and n == -1. Essentially, this aligns the behavior with the doc-string. There are currently many users of `match_string()`, and so, in order to go through them, the next patches in the series will focus on doing some cosmetic changes, which are aimed at grouping the users of `match_string()`. Signed-off-by: Alexandru Ardelean <alexandru.ardelean(a)analog.com> --- Changelog v1 -> v2: * split the initial series into just 3 patches that fix the `match_string()` helper and start introducing a new version of this helper, which computes array-size of static arrays lib/string.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/string.c b/lib/string.c index 6016eb3ac73d..e2cf5acc83bd 100644 --- a/lib/string.c +++ b/lib/string.c @@ -681,8 +681,11 @@ int match_string(const char * const *array, size_t n, const char *string) for (index = 0; index < n; index++) { item = array[index]; - if (!item) + if (!item) { + if (n != (size_t)-1) + continue; break; + } if (!strcmp(item, string)) return index; } -- 2.20.1

1 2

[alsa-devel] [PATCH v2 0/5] ALSA: line6 fixes and cleanups
by Takashi Iwai 28 May '19

28 May '19

Hi, this is a patchset I forgot to merge for fixing and impriving LINE6 drivers. The v2 is rebased after the latest toneport fix, and contains a cleanup with container_of(), too. Takashi === Takashi Iwai (5): ALSA: line6: pod: Rewrite complex timer & work combo with a delayed work ALSA: line6: podhd: Rewrite complex timer & work combo with a delayed work ALSA: line6: variax: Rewrite complex timer & work combo with a delayed work ALSA: line6: Drop superfluous timer helper function ALSA: line6: Use container_of() sound/usb/line6/driver.c | 11 ---- sound/usb/line6/driver.h | 9 --- sound/usb/line6/pod.c | 108 +++++++++++------------------------ sound/usb/line6/podhd.c | 80 ++++---------------------- sound/usb/line6/toneport.c | 14 ++--- sound/usb/line6/variax.c | 138 ++++++++++++++------------------------------- 6 files changed, 94 insertions(+), 266 deletions(-) -- 2.16.4

1 5

[alsa-devel] [PATCH] ALSA: line6: Assure canceling delayed work at disconnection
by Takashi Iwai 28 May '19

28 May '19

The current code performs the cancel of a delayed work at the late stage of disconnection procedure, which may lead to the access to the already cleared state. This patch assures to call cancel_delayed_work_sync() at the beginning of the disconnection procedure for avoiding that race. The delayed work object is now assigned in the common line6 object instead of its derivative, so that we can call cancel_delayed_work_sync(). Along with the change, the startup function is called via the new callback instead. This will make it easier to port other LINE6 drivers to use the delayed work for startup in later patches. Reported-by: syzbot+5255458d5e0a2b10bbb9(a)syzkaller.appspotmail.com Fixes: 7f84ff68be05 ("ALSA: line6: toneport: Fix broken usage of timer for delayed execution") Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/usb/line6/driver.c | 12 ++++++++++++ sound/usb/line6/driver.h | 4 ++++ sound/usb/line6/toneport.c | 15 +++------------ 3 files changed, 19 insertions(+), 12 deletions(-) diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index b61f65bed4e4..2b57854335b3 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -720,6 +720,15 @@ static int line6_init_cap_control(struct usb_line6 *line6) return 0; } +static void line6_startup_work(struct work_struct *work) +{ + struct usb_line6 *line6 = + container_of(work, struct usb_line6, startup_work.work); + + if (line6->startup) + line6->startup(line6); +} + /* Probe USB device. */ @@ -755,6 +764,7 @@ int line6_probe(struct usb_interface *interface, line6->properties = properties; line6->usbdev = usbdev; line6->ifcdev = &interface->dev; + INIT_DELAYED_WORK(&line6->startup_work, line6_startup_work); strcpy(card->id, properties->id); strcpy(card->driver, driver_name); @@ -825,6 +835,8 @@ void line6_disconnect(struct usb_interface *interface) if (WARN_ON(usbdev != line6->usbdev)) return; + cancel_delayed_work(&line6->startup_work); + if (line6->urb_listen != NULL) line6_stop_listen(line6); diff --git a/sound/usb/line6/driver.h b/sound/usb/line6/driver.h index 61425597eb61..650d909c9c4f 100644 --- a/sound/usb/line6/driver.h +++ b/sound/usb/line6/driver.h @@ -178,11 +178,15 @@ struct usb_line6 { fifo; } messages; + /* Work for delayed PCM startup */ + struct delayed_work startup_work; + /* If MIDI is supported, buffer_message contains the pre-processed data; * otherwise the data is only in urb_listen (buffer_incoming). */ void (*process_message)(struct usb_line6 *); void (*disconnect)(struct usb_line6 *line6); + void (*startup)(struct usb_line6 *line6); }; extern char *line6_alloc_sysex_buffer(struct usb_line6 *line6, int code1, diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c index e28368d8eba2..55865f7e437d 100644 --- a/sound/usb/line6/toneport.c +++ b/sound/usb/line6/toneport.c @@ -54,9 +54,6 @@ struct usb_line6_toneport { /* Firmware version (x 100) */ u8 firmware_version; - /* Work for delayed PCM startup */ - struct delayed_work pcm_work; - /* Device type */ enum line6_device_type type; @@ -241,12 +238,8 @@ static int snd_toneport_source_put(struct snd_kcontrol *kcontrol, return 1; } -static void toneport_start_pcm(struct work_struct *work) +static void toneport_startup(struct usb_line6 *line6) { - struct usb_line6_toneport *toneport = - container_of(work, struct usb_line6_toneport, pcm_work.work); - struct usb_line6 *line6 = &toneport->line6; - line6_pcm_acquire(line6->line6pcm, LINE6_STREAM_MONITOR, true); } @@ -394,7 +387,7 @@ static int toneport_setup(struct usb_line6_toneport *toneport) if (toneport_has_led(toneport)) toneport_update_led(toneport); - schedule_delayed_work(&toneport->pcm_work, + schedule_delayed_work(&toneport->line6.startup_work, msecs_to_jiffies(TONEPORT_PCM_DELAY * 1000)); return 0; } @@ -407,8 +400,6 @@ static void line6_toneport_disconnect(struct usb_line6 *line6) struct usb_line6_toneport *toneport = (struct usb_line6_toneport *)line6; - cancel_delayed_work_sync(&toneport->pcm_work); - if (toneport_has_led(toneport)) toneport_remove_leds(toneport); } @@ -424,9 +415,9 @@ static int toneport_init(struct usb_line6 *line6, struct usb_line6_toneport *toneport = (struct usb_line6_toneport *) line6; toneport->type = id->driver_info; - INIT_DELAYED_WORK(&toneport->pcm_work, toneport_start_pcm); line6->disconnect = line6_toneport_disconnect; + line6->startup = toneport_startup; /* initialize PCM subsystem: */ err = line6_init_pcm(line6, &toneport_pcm_properties); -- 2.16.4

1 0

[alsa-devel] [PATCH 1/5] ALSA: hda - Force polling mode on CNL for fixing codec communication
by Bard liao 28 May '19

28 May '19

From: Bard Liao <yung-chuan.liao(a)linux.intel.com> We observed the same issue as reported by commit a8d7bde23e7130686b7662 ("ALSA: hda - Force polling mode on CFL for fixing codec communication") We don't have a better solution. So apply the same workaround to CNL. Signed-off-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> --- sound/pci/hda/hda_intel.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 2ec91085fa3e..a93468ffb85c 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -375,6 +375,7 @@ enum { #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98) #define IS_CFL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa348) +#define IS_CNL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9dc8) static char *driver_short_names[] = { [AZX_DRIVER_ICH] = "HDA Intel", @@ -1700,8 +1701,8 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci, else chip->bdl_pos_adj = bdl_pos_adj[dev]; - /* Workaround for a communication error on CFL (bko#199007) */ - if (IS_CFL(pci)) + /* Workaround for a communication error on CFL (bko#199007) and CNL */ + if (IS_CFL(pci) || IS_CNL(pci)) chip->polling_mode = 1; err = azx_bus_init(chip, model[dev], &pci_hda_io_ops); -- 2.17.1

3 7

[alsa-devel] KASAN: null-ptr-deref Write in submit_audio_out_urb
by syzbot 27 May '19

27 May '19

Hello, syzbot found the following crash on: HEAD commit: 69bbe8c7 usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git usb-fuzzer console output: https://syzkaller.appspot.com/x/log.txt?x=118b0aa2a00000 kernel config: https://syzkaller.appspot.com/x/.config?x=c309d28e15db39c5 dashboard link: https://syzkaller.appspot.com/bug?extid=5255458d5e0a2b10bbb9 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11f4064ca00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14d51982a00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+5255458d5e0a2b10bbb9(a)syzkaller.appspotmail.com snd_usb_toneport 1-1:0.0: read request failed (error -110) snd_usb_toneport 1-1:0.0: read request failed (error -110) snd_usb_toneport 1-1:0.0: write request failed (error -110) usb 1-1: send failed (error -110) usb 1-1: send failed (error -110) snd_usb_toneport 1-1:0.0: Line 6 POD Studio UX2 now attached ================================================================== BUG: KASAN: null-ptr-deref in memset include/linux/string.h:344 [inline] BUG: KASAN: null-ptr-deref in submit_audio_out_urb+0x919/0x1780 sound/usb/line6/playback.c:246 Write of size 20 at addr 0000000000000010 by task kworker/1:2/2466 CPU: 1 PID: 2466 Comm: kworker/1:2 Not tainted 5.2.0-rc1+ #9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events toneport_start_pcm Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 __kasan_report.cold+0x5/0x32 mm/kasan/report.c:321 kasan_report+0xe/0x20 mm/kasan/common.c:614 memset+0x20/0x40 mm/kasan/common.c:107 memset include/linux/string.h:344 [inline] submit_audio_out_urb+0x919/0x1780 sound/usb/line6/playback.c:246 line6_submit_audio_out_all_urbs+0xc9/0x120 sound/usb/line6/playback.c:295 line6_stream_start+0x156/0x1f0 sound/usb/line6/pcm.c:199 line6_pcm_acquire+0x134/0x210 sound/usb/line6/pcm.c:322 process_one_work+0x90a/0x1580 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x30e/0x420 kernel/kthread.c:254 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 ================================================================== Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 2466 Comm: kworker/1:2 Tainted: G B 5.2.0-rc1+ #9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events toneport_start_pcm Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 panic+0x292/0x6df kernel/panic.c:218 end_report+0x43/0x49 mm/kasan/report.c:95 __kasan_report.cold+0xd/0x32 mm/kasan/report.c:324 kasan_report+0xe/0x20 mm/kasan/common.c:614 memset+0x20/0x40 mm/kasan/common.c:107 memset include/linux/string.h:344 [inline] submit_audio_out_urb+0x919/0x1780 sound/usb/line6/playback.c:246 line6_submit_audio_out_all_urbs+0xc9/0x120 sound/usb/line6/playback.c:295 line6_stream_start+0x156/0x1f0 sound/usb/line6/pcm.c:199 line6_pcm_acquire+0x134/0x210 sound/usb/line6/pcm.c:322 process_one_work+0x90a/0x1580 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x30e/0x420 kernel/kthread.c:254 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Kernel Offset: disabled Rebooting in 86400 seconds.. --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 0

[alsa-devel] [PATCH v3 0/7] Allwinner H6 SPDIF support
by Clément Péron 27 May '19

27 May '19

*H6 DMA support IS REQUIRED* Allwinner H6 SoC has a SPDIF controller called One Wire Audio (OWA) which is different from the previous H3 generation and not compatible. Difference are an increase of fifo sizes, some memory mapping are different and there is now the possibility to output the master clock on a pin. Actually all these features are unused and only a bit for flushing the TX fifo is required. Also this series requires the DMA working on H6, a first version has been submitted by Jernej Škrabec[1] but has not been accepted yet. [1] https://patchwork.kernel.org/project/linux-arm-kernel/list/?series=89011 Changes since v2: - Split quirks and H6 support patch - Add specific section for quirks comment Changes since v1: - Remove H3 compatible - Add TX fifo bit flush quirks - Add H6 bindings in SPDIF driver Clément Péron (7): dt-bindings: sound: sun4i-spdif: Add Allwinner H6 compatible ASoC: sun4i-spdif: Move quirks to the top ASoC: sun4i-spdif: Add TX fifo bit flush quirks ASoC: sun4i-spdif: Add support for H6 SoC arm64: dts: allwinner: Add SPDIF node for Allwinner H6 arm64: dts: allwinner: h6: Enable SPDIF for Beelink GS1 arm64: defconfig: Enable Sun4i SPDIF module .../bindings/sound/sunxi,sun4i-spdif.txt | 3 +- .../dts/allwinner/sun50i-h6-beelink-gs1.dts | 4 ++ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 38 ++++++++++++++ arch/arm64/configs/defconfig | 1 + sound/soc/sunxi/sun4i-spdif.c | 49 ++++++++++++++++--- 5 files changed, 88 insertions(+), 7 deletions(-) -- 2.20.1

2 14

[alsa-devel] WARNING in line6_pcm_acquire
by syzbot 27 May '19

27 May '19

Hello, syzbot found the following crash on: HEAD commit: 43151d6c usb-fuzzer: main usb gadget fuzzer driver git tree: https://github.com/google/kasan.git usb-fuzzer console output: https://syzkaller.appspot.com/x/log.txt?x=169fe1f8a00000 kernel config: https://syzkaller.appspot.com/x/.config?x=95aff7278e7ff25e dashboard link: https://syzkaller.appspot.com/bug?extid=192a537b5c634febc6cf compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+192a537b5c634febc6cf(a)syzkaller.appspotmail.com ------------[ cut here ]------------ do not call blocking ops when !TASK_RUNNING; state=1 set at [<000000009424b595>] do_nanosleep+0x107/0x6a0 kernel/time/hrtimer.c:1675 WARNING: CPU: 0 PID: 4661 at kernel/sched/core.c:6136 __might_sleep+0x135/0x190 kernel/sched/core.c:6136 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 4661 Comm: syz-executor.4 Not tainted 5.1.0-rc3+ #8 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 panic+0x292/0x5e1 kernel/panic.c:214 __warn.cold+0x20/0x53 kernel/panic.c:571 report_bug+0x262/0x2a0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:179 [inline] fixup_bug arch/x86/kernel/traps.c:174 [inline] do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272 do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:6136 Code: 65 48 8b 1c 25 c0 de 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75 2b 48 8b 73 10 48 c7 c7 c0 ec c5 85 e8 c6 4b f6 ff <0f> 0b e9 46 ff ff ff e8 2f d0 45 00 e9 29 ff ff ff e8 25 d0 45 00 RSP: 0018:ffff8881db207b48 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8881c7d71800 RCX: 0000000000000000 RDX: 0000000000000100 RSI: ffffffff8127bbcd RDI: ffffed103b640f5b RBP: ffffffff85c622c0 R08: ffff8881c7d71800 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000038c R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff849f6d40 __mutex_lock_common kernel/locking/mutex.c:908 [inline] __mutex_lock+0xc8/0x12b0 kernel/locking/mutex.c:1072 line6_pcm_acquire+0x30/0x210 sound/usb/line6/pcm.c:311 call_timer_fn+0x15c/0x5e0 kernel/time/timer.c:1325 expire_timers kernel/time/timer.c:1362 [inline] __run_timers kernel/time/timer.c:1681 [inline] __run_timers kernel/time/timer.c:1649 [inline] run_timer_softirq+0x586/0x1400 kernel/time/timer.c:1694 __do_softirq+0x21f/0x8bc kernel/softirq.c:293 invoke_softirq kernel/softirq.c:374 [inline] irq_exit+0x17c/0x1a0 kernel/softirq.c:414 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0xf1/0x490 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 </IRQ> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:81 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x40/0x50 kernel/locking/spinlock.c:184 Code: e8 25 19 bc fb 48 89 ef e8 dd f7 bc fb f6 c7 02 75 11 53 9d e8 a1 fd d8 fb 65 ff 0d 0a 59 99 7a 5b 5d c3 e8 d2 fb d8 fb 53 9d <eb> ed 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 fd 65 ff RSP: 0018:ffff8881b13ffba8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000007 RBX: 0000000000000246 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000006 RDI: ffff8881c7d72034 RBP: ffff8881db224a80 R08: ffff8881c7d71800 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8881db224b00 R14: ffff8881db224b00 R15: ffff8881db224a80 unlock_hrtimer_base kernel/time/hrtimer.c:878 [inline] hrtimer_start_range_ns+0x5b0/0xad0 kernel/time/hrtimer.c:1109 hrtimer_start_expires include/linux/hrtimer.h:409 [inline] do_nanosleep+0x19b/0x6a0 kernel/time/hrtimer.c:1676 hrtimer_nanosleep+0x258/0x510 kernel/time/hrtimer.c:1733 __do_sys_nanosleep kernel/time/hrtimer.c:1767 [inline] __se_sys_nanosleep kernel/time/hrtimer.c:1754 [inline] __x64_sys_nanosleep+0x19d/0x220 kernel/time/hrtimer.c:1754 do_syscall_64+0xbd/0x500 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x486570 Code: 00 00 48 c7 c0 d4 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb be 66 0f 1f 44 00 00 83 3d e1 01 5d 00 00 75 14 b8 23 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 b4 e0 f8 ff c3 48 83 ec 08 e8 ea 53 fd ff RSP: 002b:00007ffc588bb088 EFLAGS: 00000246 ORIG_RAX: 0000000000000023 RAX: ffffffffffffffda RBX: 00000000000a95fa RCX: 0000000000486570 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffc588bb090 RBP: 00000000000002d5 R08: 0000000000000001 R09: 00000000027fc940 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 R13: 00007ffc588bb0e0 R14: 00000000000a8e2a R15: 00007ffc588bb0f0 Kernel Offset: disabled Rebooting in 86400 seconds.. --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0