July 2020 - Alsa-devel - mailman.alsa-project.org

[PATCH] ALSA: usb-audio: Fix race against the error recovery URB submission
by Takashi Iwai 10 Jul '20

10 Jul '20

USB MIDI driver has an error recovery mechanism to resubmit the URB in the delayed timer handler, and this may race with the standard start / stop operations. Although both start and stop operations themselves don't race with each other due to the umidi->mutex protection, but this isn't applied to the timer handler. For fixing this potential race, the following changes are applied: - Since the timer handler can't use the mutex, we apply the umidi->disc_lock protection at each input stream URB submission; this also needs to change the GFP flag to GFP_ATOMIC - Add a check of the URB refcount and skip if already submitted - Move the timer cancel call at disconnection to the beginning of the procedure; this assures the in-flight timer handler is gone properly before killing all pending URBs Reported-by: syzbot+0f4ecfe6a2c322c81728(a)syzkaller.appspotmail.com Reported-by: syzbot+5f1d24c49c1d2c427497(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/usb/midi.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index 047b90595d65..354f57692938 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1499,6 +1499,8 @@ void snd_usbmidi_disconnect(struct list_head *p) spin_unlock_irq(&umidi->disc_lock); up_write(&umidi->disc_rwsem); + del_timer_sync(&umidi->error_timer); + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; if (ep->out) @@ -1525,7 +1527,6 @@ void snd_usbmidi_disconnect(struct list_head *p) ep->in = NULL; } } - del_timer_sync(&umidi->error_timer); } EXPORT_SYMBOL(snd_usbmidi_disconnect); @@ -2301,16 +2302,22 @@ void snd_usbmidi_input_stop(struct list_head *p) } EXPORT_SYMBOL(snd_usbmidi_input_stop); -static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep) +static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi, + struct snd_usb_midi_in_endpoint *ep) { unsigned int i; + unsigned long flags; if (!ep) return; for (i = 0; i < INPUT_URBS; ++i) { struct urb *urb = ep->urbs[i]; - urb->dev = ep->umidi->dev; - snd_usbmidi_submit_urb(urb, GFP_KERNEL); + spin_lock_irqsave(&umidi->disc_lock, flags); + if (!atomic_read(&urb->use_count)) { + urb->dev = ep->umidi->dev; + snd_usbmidi_submit_urb(urb, GFP_ATOMIC); + } + spin_unlock_irqrestore(&umidi->disc_lock, flags); } } @@ -2326,7 +2333,7 @@ void snd_usbmidi_input_start(struct list_head *p) if (umidi->input_running || !umidi->opened[1]) return; for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) - snd_usbmidi_input_start_ep(umidi->endpoints[i].in); + snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in); umidi->input_running = 1; } EXPORT_SYMBOL(snd_usbmidi_input_start); -- 2.16.4

1 0

[PATCH 0/6] ASoC: mediatek: mt8183: support DP audio
by Tzung-Bi Shih 10 Jul '20

10 Jul '20

This series is a follow up for a long time ago series (https://patchwork.kernel.org/cover/11204303/). The old series bound too much on the patches of DRM bridge and ASoC machine driver. And unluckily, the dependencies (https://lore.kernel.org/patchwork/patch/1126819/) have not applied. Revewing the ASoC patches in the old series, I found that they could be decoupled from the DRM bridge patches. And they are harmless as it is an optional attribute ("hdmi-codec") in DTS. This series arranges and rebases the harmless ASoC patches for mt8183-mt6358-ts3a227-max98357 and mt8183-da7219-max98357. The 1st and 4th patch add an optional DT property. The 1st patch was acked long time ago (https://patchwork.kernel.org/patch/11204321/). The 2nd and 5th patch add DAI link for using hdmi-codec. The 3rd and 6th patch support the HDMI jack reporting. Tzung-Bi Shih (6): ASoC: dt-bindings: mt8183: add a property "mediatek,hdmi-codec" ASoC: mediatek: mt8183: use hdmi-codec ASoC: mediatek: mt8183: support HDMI jack reporting ASoC: dt-bindings: mt8183-da7219: add a property "mediatek,hdmi-codec" ASoC: mediatek: mt8183-da7219: use hdmi-codec ASoC: mediatek: mt8183-da7219: support HDMI jack reporting .../bindings/sound/mt8183-da7219-max98357.txt | 4 +++ .../sound/mt8183-mt6358-ts3a227-max98357.txt | 2 ++ sound/soc/mediatek/Kconfig | 2 ++ .../mediatek/mt8183/mt8183-da7219-max98357.c | 29 +++++++++++++++++-- .../mt8183/mt8183-mt6358-ts3a227-max98357.c | 29 +++++++++++++++++-- 5 files changed, 60 insertions(+), 6 deletions(-) -- 2.27.0.383.g050319c2ae-goog

2 7

[PATCH 0/2] ASoC: fsl_spdif: Clear the validity bit for TX
by Shengjiu Wang 10 Jul '20

10 Jul '20

Clear the validity bit for TX Add kctl for configuring TX validity bit Shengjiu Wang (2): ASoC: fsl_spdif: Clear the validity bit for TX ASoC: fsl_spdif: Add kctl for configuring TX validity bit sound/soc/fsl/fsl_spdif.c | 51 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 47 insertions(+), 4 deletions(-) -- 2.21.0

2 3

[PATCH] ASoC: Intel: cht_bsw_rt5672: Improve dai-set-fmt comment in cht_codec_fixup()
by Hans de Goede 10 Jul '20

10 Jul '20

As Pierre-Louis Bossart pointed out, saying that the default mode for the SSP is TDM 4 slot is not entirely accurate. There really are 2 default modes: The default mode for the SSP configuration is TDM 4 slot for the cpu-dai (hard-coded in DSP firmware), The default mode for the SSP configuration is I2S for the codec-dai (hard-coded in the 'SSP2-Codec" .dai_fmt masks, so far unused). This commit updates the comment in cht_codec_fixup() to properly reflect this. Suggested-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- sound/soc/intel/boards/cht_bsw_rt5672.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/sound/soc/intel/boards/cht_bsw_rt5672.c b/sound/soc/intel/boards/cht_bsw_rt5672.c index 1470c3de7895..1812b786d33b 100644 --- a/sound/soc/intel/boards/cht_bsw_rt5672.c +++ b/sound/soc/intel/boards/cht_bsw_rt5672.c @@ -253,13 +253,17 @@ static int cht_codec_fixup(struct snd_soc_pcm_runtime *rtd, params_set_format(params, SNDRV_PCM_FORMAT_S24_LE); /* - * Default mode for SSP configuration is TDM 4 slot. One board/design, - * the Lenovo Miix 2 10 uses not 1 but 2 codecs connected to SSP2. The - * second piggy-backed, output-only codec is inside the keyboard-dock - * (which has extra speakers). Unlike the main rt5672 codec, we cannot - * configure this codec, it is hard coded to use 2 channel 24 bit I2S. - * Since we only support 2 channels anyways, there is no need for TDM - * on any cht-bsw-rt5672 designs. So we simply use I2S 2ch everywhere. + * The default mode for the cpu-dai is TDM 4 slot. The default mode + * for the codec-dai is I2S. So we need to either set the cpu-dai to + * I2S mode to match the codec-dai, or set the codec-dai to TDM 4 slot + * (or program both to yet another mode). + * One board, the Lenovo Miix 2 10, uses not 1 but 2 codecs connected + * to SSP2. The second piggy-backed, output-only codec is inside the + * keyboard-dock (which has extra speakers). Unlike the main rt5672 + * codec, we cannot configure this codec, it is hard coded to use + * 2 channel 24 bit I2S. For this to work we must use I2S mode on this + * board. Since we only support 2 channels anyways, there is no need + * for TDM on any cht-bsw-rt5672 designs. So we use I2S 2ch everywhere. */ ret = snd_soc_dai_set_fmt(asoc_rtd_to_cpu(rtd, 0), SND_SOC_DAIFMT_I2S | -- 2.26.2

2 1

[PATCH v4 00/10] ASoC: Clean-up W=1 build warnings - part2
by Pierre-Louis Bossart 10 Jul '20

10 Jul '20

Both Lee Jones and I submitted separate series, this is the second part of the merged result, for which no feedback was provided. I picked Lee's patches for rt5659 and ak4458 and added the pxa and ux500 that I didn't fix. The rest is largely identical between our respective series, with the exception of the sunxi which I documented and Lee removed. I don't have any specific preference and will go with the flow on this. Changes since v3: Improved commit subjects from 'fix kernel-doc' as suggested by Lee Jones. In a couple of cases I just reverted to Lee's patches when the code was identical. Added a couple of CC: tags from Lee's patches. Added Arnaud Pouliquen's Acked-by tag in first patch. Lee Jones (6): ASoC: sunxi: sun4i-spdif: Fix misspelling of 'reg_dac_txdata' in kernel-doc ASoC: pxa: pxa-ssp: Demote seemingly unintentional kerneldoc header ASoC: ux500: ux500_msp_i2s: Remove unused variables 'reg_val_DR' and 'reg_val_TSTDR' ASoC: codecs: rt5659: Remove many unused const variables ASoC: codecs: tlv320aic26: Demote seemingly unintentional kerneldoc header ASoC: codecs: ak4458: Remove set but never checked variable 'ret' Pierre-Louis Bossart (4): ASoC: sti: uniperif: fix 'defined by not used' warning ASoC: qcom: qdsp6: q6asm: Provide documentation for 'codec_profile' ASoC: sunxi: sun4i-i2s: add missing clock and format arguments in kernel-doc ASoC: codecs: rt5631: fix spurious kernel-doc start and missing arguments sound/soc/codecs/ak4458.c | 6 +++--- sound/soc/codecs/rt5631.c | 8 +++++-- sound/soc/codecs/rt5659.c | 37 --------------------------------- sound/soc/codecs/tlv320aic26.c | 2 +- sound/soc/pxa/pxa-ssp.c | 2 +- sound/soc/qcom/qdsp6/q6asm.c | 2 +- sound/soc/sti/uniperif.h | 2 +- sound/soc/sunxi/sun4i-i2s.c | 10 ++++++++- sound/soc/sunxi/sun4i-spdif.c | 2 +- sound/soc/ux500/ux500_msp_i2s.c | 8 +++---- 10 files changed, 27 insertions(+), 52 deletions(-) base-commit: 6940701c715e193282cf8b31f970b2ea6eb26341 -- 2.25.1

2 11

[PATCH v3 00/10] ASoC: Clean-up W=1 build warnings - part2
by Pierre-Louis Bossart 10 Jul '20

10 Jul '20

Both Lee Jones and I submitted separate series, this is the second part of the merged result, for which no feedback was provided. I picked Lee's patches for rt5659 and ak4458 and added the pxa and ux500 that I didn't fix. The rest is largely identical between our respective series, with the exception of the sunxi which I documented and Lee removed. I don't have any specific preference and will go with the flow on this. Lee Jones (4): ASoC: pxa: pxa-ssp: Demote seemingly unintentional kerneldoc header ASoC: ux500: ux500_msp_i2s: Remove unused variables 'reg_val_DR' and 'reg_val_TSTDR' ASoC: codecs: rt5659: Remove many unused const variables ASoC: codecs: ak4458: Remove set but never checked variable 'ret' Pierre-Louis Bossart (6): ASoC: qcom: q6asm: fix kernel-doc ASoC: sunxi: sun4i-i2s: fix kernel-doc ASoC: sunxi: sun4i-spdif: fix kernel-doc ASoC: sti: uniperif: fix 'defined by not used' warning ASoC: codecs: rt5631: fix kernel-doc ASoC: codecs: tlv320aic26: fix kernel-doc warning sound/soc/codecs/ak4458.c | 6 +++--- sound/soc/codecs/rt5631.c | 8 +++++-- sound/soc/codecs/rt5659.c | 37 --------------------------------- sound/soc/codecs/tlv320aic26.c | 2 +- sound/soc/pxa/pxa-ssp.c | 2 +- sound/soc/qcom/qdsp6/q6asm.c | 2 +- sound/soc/sti/uniperif.h | 2 +- sound/soc/sunxi/sun4i-i2s.c | 10 ++++++++- sound/soc/sunxi/sun4i-spdif.c | 2 +- sound/soc/ux500/ux500_msp_i2s.c | 8 +++---- 10 files changed, 27 insertions(+), 52 deletions(-) -- 2.25.1

5 22

Weird jack detection on ASRock B450M Pro4
by Arun Raghavan 10 Jul '20

10 Jul '20

Hi folks, I ran into some weird behaviour on this motherboard. First, alsa-info is here: http://alsa-project.org/db/?f=f48105f391d848b34b3779f27369130ca024f417 The weird behaviour is that the HDA card is picked up fine, but jack detection is broken on boot. However, this gets "fixed" after you run alsa-info. The before/after codec info is at: https://arunraghavan.net/temp/alsa-codecs-before.txt https://arunraghavan.net/temp/alsa-codecs-after.txt The key delta is: ---- @@ -133,24 +133,24 @@ Node 0x02 [Audio Output] wcaps 0x41d: Stereo Amp-Out Control: name="Front Playback Volume", index=0, device=0 ControlAmp: chs=3, dir=Out, idx=0, ofs=0 Device: name="ALC892 Analog", type="Audio", device=0 Amp-Out caps: ofs=0x40, nsteps=0x40, stepsize=0x03, mute=0 - Amp-Out vals: [0x34 0x34] - Converter: stream=0, channel=0 + Amp-Out vals: [0x29 0x29] + Converter: stream=5, channel=0 PCM: rates [0x560]: 44100 48000 96000 192000 bits [0xe]: 16 20 24 formats [0x1]: PCM Power states: D0 D1 D2 D3 EPSS Power: setting=D0, actual=D0 Node 0x03 [Audio Output] wcaps 0x41d: Stereo Amp-Out Control: name="Surround Playback Volume", index=0, device=0 ControlAmp: chs=3, dir=Out, idx=0, ofs=0 Amp-Out caps: ofs=0x40, nsteps=0x40, stepsize=0x03, mute=0 - Amp-Out vals: [0x34 0x34] - Converter: stream=0, channel=0 + Amp-Out vals: [0x29 0x29] + Converter: stream=5, channel=0 PCM: rates [0x560]: 44100 48000 96000 192000 bits [0xe]: 16 20 24 formats [0x1]: PCM Power states: D0 D1 D2 D3 EPSS @@ -159,12 +159,12 @@ Control: name="Center Playback Volume", index=0, device=0 ControlAmp: chs=1, dir=Out, idx=0, ofs=0 Control: name="LFE Playback Volume", index=0, device=0 ControlAmp: chs=2, dir=Out, idx=0, ofs=0 Amp-Out caps: ofs=0x40, nsteps=0x40, stepsize=0x03, mute=0 - Amp-Out vals: [0x34 0x34] - Converter: stream=0, channel=0 + Amp-Out vals: [0x29 0x29] + Converter: stream=5, channel=0 PCM: rates [0x560]: 44100 48000 96000 192000 bits [0xe]: 16 20 24 formats [0x1]: PCM Power states: D0 D1 D2 D3 EPSS @@ -172,11 +172,11 @@ Node 0x05 [Audio Output] wcaps 0x41d: Stereo Amp-Out Control: name="Headphone Playback Volume", index=0, device=0 ControlAmp: chs=3, dir=Out, idx=0, ofs=0 Amp-Out caps: ofs=0x40, nsteps=0x40, stepsize=0x03, mute=0 Amp-Out vals: [0x00 0x00] - Converter: stream=0, channel=0 + Converter: stream=5, channel=0 PCM: rates [0x560]: 44100 48000 96000 192000 bits [0xe]: 16 20 24 formats [0x1]: PCM Power states: D0 D1 D2 D3 EPSS ---- Any thoughts on what's changing that, and how this should be fixed? Cheers, Arun

1 1

ASoC: rt5670/cht_bsw_rt5672: Some bugfixes and cleanups
by Hans de Goede 10 Jul '20

10 Jul '20

Hi All, This series is mainly the result of me working on fixing the extra set of speakers in the Lenovo Miix 2 10 kbd dock not working with Linux (patches 1 and 3) while working on this I noticed some other bugs (patches 2 and 4) and I also ended up doing some generic cleanups (patches 5 and 6). For patches 1-3 or 1-4 it would be nice it they can go to a future 5.8-rc# 5-6 are mostly -next material. Regards, Hans

4 21

Re: KASAN: use-after-free Read in line6_submit_audio_in_all_urbs
by Alan Stern 10 Jul '20

10 Jul '20

On Fri, Jun 26, 2020 at 10:18:12AM -0700, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: fb574682 usbip: tools: fix module name in man page > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > console output: https://syzkaller.appspot.com/x/log.txt?x=156560b1100000 > kernel config: https://syzkaller.appspot.com/x/.config?x=63b40b2ae167bad6 > dashboard link: https://syzkaller.appspot.com/bug?extid=145012a46658ac00fc9e > compiler: gcc (GCC) 10.1.0-syz 20200507 > > Unfortunately, I don't have any reproducer for this crash yet. > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+145012a46658ac00fc9e(a)syzkaller.appspotmail.com > > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > snd_usb_toneport 5-1:0.0: URB in #0 submission failed (-19) > ================================================================== > BUG: KASAN: use-after-free in line6_submit_audio_in_all_urbs+0x10b/0x120 sound/usb/line6/capture.c:72 > Read of size 8 at addr ffff8881cffb1800 by task kworker/1:5/3257 > > CPU: 1 PID: 3257 Comm: kworker/1:5 Not tainted 5.8.0-rc1-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Workqueue: events line6_startup_work > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0xf6/0x16e lib/dump_stack.c:118 > print_address_description.constprop.0+0x1a/0x210 mm/kasan/report.c:383 > __kasan_report mm/kasan/report.c:513 [inline] > kasan_report.cold+0x37/0x7c mm/kasan/report.c:530 > line6_submit_audio_in_all_urbs+0x10b/0x120 sound/usb/line6/capture.c:72 > line6_stream_start+0x207/0x230 sound/usb/line6/pcm.c:197 > line6_pcm_acquire+0x161/0x210 sound/usb/line6/pcm.c:318 > line6_startup_work+0x42/0x50 sound/usb/line6/driver.c:734 > process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269 > worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 > kthread+0x392/0x470 kernel/kthread.c:291 > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 > > Allocated by task 76: > save_stack+0x1b/0x40 mm/kasan/common.c:48 > set_track mm/kasan/common.c:56 [inline] > __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:494 > kmalloc include/linux/slab.h:555 [inline] > kzalloc include/linux/slab.h:669 [inline] > line6_init_pcm+0x2a7/0x9e0 sound/usb/line6/pcm.c:533 > toneport_init+0xdd/0x6b0 sound/usb/line6/toneport.c:419 > line6_probe+0xaa0/0x1330 sound/usb/line6/driver.c:809 It look like the cancel_delayed_work() in line6_disconnect() needs to be cancel_delayed_work_sync(). Unfortunately we can't test this until syzbot is able to reproduce the bug. Alan Stern

2 1

Re: 回复: WARNING in submit_audio_out_urb/usb_submit_urb
by Takashi Iwai 10 Jul '20

10 Jul '20

On Fri, 10 Jul 2020 10:12:43 +0200, Zhang, Qiang wrote: > > > > ________________________________________ > 发件人: linux-kernel-owner(a)vger.kernel.org <linux-kernel-owner(a)vger.kernel.org> 代表 syzbot <syzbot+c190f6858a04ea7fbc52(a)syzkaller.appspotmail.com> > 发送时间: 2020年7月9日 21:34 > 收件人: andreyknvl(a)google.com; gregkh(a)linuxfoundation.org; ingrassia(a)epigenesys.com; linux-kernel(a)vger.kernel.org; linux-usb(a)vger.kernel.org; syzkaller-bugs(a)googlegroups.com > 主题: WARNING in submit_audio_out_urb/usb_submit_urb > > Hello, > > syzbot found the following crash on: > > HEAD commit: 768a0741 usb: dwc2: gadget: Remove assigned but never used.. > git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing > console output: https://syzkaller.appspot.com/x/log.txt?x=1568d11f100000 > kernel config: https://syzkaller.appspot.com/x/.config?x=999be4eb2478ffa5 > dashboard link: https://syzkaller.appspot.com/bug?extid=c190f6858a04ea7fbc52 > compiler: gcc (GCC) 10.1.0-syz 20200507 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=123aa2fb100000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+c190f6858a04ea7fbc52(a)syzkaller.appspotmail.com > > usb 1-1: send failed (error -32) > snd_usb_toneport 1-1:0.0: Line 6 TonePort GX now attached > ------------[ cut here ]------------ > usb 1-1: BOGUS urb xfer, pipe 0 != type 3 > WARNING: CPU: 0 PID: 12 at drivers/usb/core/urb.c:478 usb_submit_urb+0xa17/0x13e0 drivers/usb/core/urb.c:478 > Kernel panic - not syncing: panic_on_warn set ... > CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.8.0-rc3-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Workqueue: events line6_startup_work > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0xf6/0x16e lib/dump_stack.c:118 > panic+0x2aa/0x6e1 kernel/panic.c:231 > __warn.cold+0x20/0x50 kernel/panic.c:600 > report_bug+0x1bd/0x210 lib/bug.c:198 > handle_bug+0x41/0x80 arch/x86/kernel/traps.c:235 > exc_invalid_op+0x13/0x40 arch/x86/kernel/traps.c:255 > asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:563 > RIP: 0010:usb_submit_urb+0xa17/0x13e0 drivers/usb/core/urb.c:478 > Code: 84 e7 04 00 00 e8 a9 10 ca fd 4c 89 ef e8 41 79 12 ff 41 89 d8 44 89 e1 4c 89 f2 48 89 c6 48 c7 c7 80 a0 5d 86 e8 db 77 9e fd <0f> 0b e8 82 10 ca fd 0f b6 6c 24 08 48 c7 c6 e0 a1 5d 86 48 89 ef > RSP: 0018:ffff8881da227b10 EFLAGS: 00010086 > RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 > RDX: ffff8881da211900 RSI: ffffffff8129b4e3 RDI: ffffed103b444f54 > RBP: 0000000000000030 R08: 0000000000000001 R09: ffff8881db21fe8b > R10: 0000000000000000 R11: 0000000000000004 R12: 0000000000000000 > R13: ffff8881d6ecd0a0 R14: ffff8881d3d8c690 R15: ffff8881d54c4000 > submit_audio_out_urb+0x6d6/0x1a00 sound/usb/line6/playback.c:271 > line6_submit_audio_out_all_urbs+0xc9/0x120 sound/usb/line6/playback.c:291 > line6_stream_start+0x187/0x230 sound/usb/line6/pcm.c:195 > line6_pcm_acquire+0x137/0x210 sound/usb/line6/pcm.c:318 > line6_startup_work+0x42/0x50 sound/usb/line6/driver.c:734 > process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269 > worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 > kthread+0x392/0x470 kernel/kthread.c:291 > ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 > > It's like Alan Stern's reply to the email titled "KASAN: use-after-free Read in line6_submit_audio_in_all_urbs." It's also like a problem with asynchronous operations. can replace "cancel_delayed_work" with" cancel_delayed_work_sync" > in "line6_disconnect" func？ No, this looks a different problem. It's just a matter of the missing URB type check that leads to a USB warning. A typical issue with the USB fuzzing. I'll check it later. thanks, Takashi

1 1