August 2020 - Alsa-devel - mailman.alsa-project.org

[PATCH] ASoC: core: remove artificial component and DAI name constraint
by Dmitry Baryshkov 28 Aug '20

28 Aug '20

Current fmt_single_name code limits maximum name of a DAI or component to 32 bytes. On some systems corresponding device names might be longer than that (e.g. 17300000.remoteproc:glink-edge:apr:apr-service@8:routing). This will result in duplicate DAI/component names. Rewrite fmt_single_name() to remove such length limitations. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> --- sound/soc/soc-core.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 2fe1b2ec7c8f..4f2e2270a0d3 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -44,8 +44,6 @@ #define CREATE_TRACE_POINTS #include <trace/events/asoc.h> -#define NAME_SIZE 32 - static DEFINE_MUTEX(client_mutex); static LIST_HEAD(component_list); static LIST_HEAD(unbind_card_list); @@ -2218,13 +2216,14 @@ EXPORT_SYMBOL_GPL(snd_soc_unregister_card); */ static char *fmt_single_name(struct device *dev, int *id) { - char *found, name[NAME_SIZE]; + const char *devname = dev_name(dev); + char *found, *name; int id1, id2; - if (dev_name(dev) == NULL) + if (devname == NULL) return NULL; - strlcpy(name, dev_name(dev), NAME_SIZE); + name = devm_kstrdup(dev, devname, GFP_KERNEL); /* are we a "%s.%d" name (platform and SPI components) */ found = strstr(name, dev->driver->name); @@ -2237,23 +2236,21 @@ static char *fmt_single_name(struct device *dev, int *id) found[strlen(dev->driver->name)] = '\0'; } - } else { - /* I2C component devices are named "bus-addr" */ - if (sscanf(name, "%x-%x", &id1, &id2) == 2) { - char tmp[NAME_SIZE]; + /* I2C component devices are named "bus-addr" */ + } else if (sscanf(name, "%x-%x", &id1, &id2) == 2) { - /* create unique ID number from I2C addr and bus */ - *id = ((id1 & 0xffff) << 16) + id2; + /* create unique ID number from I2C addr and bus */ + *id = ((id1 & 0xffff) << 16) + id2; - /* sanitize component name for DAI link creation */ - snprintf(tmp, NAME_SIZE, "%s.%s", dev->driver->name, - name); - strlcpy(name, tmp, NAME_SIZE); - } else - *id = 0; + devm_kfree(dev, name); + + /* sanitize component name for DAI link creation */ + name = devm_kasprintf(dev, GFP_KERNEL, "%s.%s", dev->driver->name, devname); + } else { + *id = 0; } - return devm_kstrdup(dev, name, GFP_KERNEL); + return name; } /* -- 2.28.0

2 4

[PATCH 0/4] regmap: add SoundWire 1.2 MBQ support
by Pierre-Louis Bossart 28 Aug '20

28 Aug '20

In preparation of the upstream contribution of SDCA (SoundWire Device Class for Audio) ASoC codec drivers [1] [2], add regmap support SoundWire 1.2 MBQ support. The MBQ (Multi-Byte Quantity) registers need to be handled in a different way from regular 8-bit SoundWire registers, their main application is going to be for volume/gain controls. The 3rd patch was initially suggested for inclusion in the SoundWire tree, and was modified to add more background information in the commit message as requested by Vinod Koul. Pierre-Louis Bossart (4): regmap: sdw: move to -EOPNOTSUPP regmap: sdw: add required header files soundwire: SDCA: add helper macro to access controls regmap: sdw: add support for SoundWire 1.2 MBQ drivers/base/regmap/Kconfig | 6 +- drivers/base/regmap/Makefile | 1 + drivers/base/regmap/regmap-sdw-mbq.c | 102 ++++++++++++++++++++++++ drivers/base/regmap/regmap-sdw.c | 8 +- include/linux/regmap.h | 20 +++++ include/linux/soundwire/sdw_registers.h | 13 +++ 6 files changed, 146 insertions(+), 4 deletions(-) create mode 100644 drivers/base/regmap/regmap-sdw-mbq.c base-commit: 9123e3a74ec7b934a4a099e98af6a61c2f80bbf5 -- 2.25.1

5 25

[PATCH v1] ASoC: core: Replace dma_request_slave_channel() with dma_request_chan()
by Andy Shevchenko 28 Aug '20

28 Aug '20

Drivers should use dma_request_chan() instead of dma_request_slave_channel(). dma_request_slave_channel() is a simple wrapper for dma_request_chan() eating up the error code for channel request failure and makes deferred probing impossible. Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> --- sound/soc/soc-generic-dmaengine-pcm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c index fb95c1464e66..ab13e08cd636 100644 --- a/sound/soc/soc-generic-dmaengine-pcm.c +++ b/sound/soc/soc-generic-dmaengine-pcm.c @@ -249,8 +249,7 @@ static int dmaengine_pcm_new(struct snd_soc_component *component, continue; if (!pcm->chan[i] && config && config->chan_names[i]) - pcm->chan[i] = dma_request_slave_channel(dev, - config->chan_names[i]); + pcm->chan[i] = dma_request_chan(dev, config->chan_names[i]); if (!pcm->chan[i] && (pcm->flags & SND_DMAENGINE_PCM_FLAG_COMPAT)) { pcm->chan[i] = dmaengine_pcm_compat_request_channel( -- 2.28.0

1 1

[PATCH 0/7] Allwinner A64 digital audio codec fixes
by Samuel Holland 28 Aug '20

28 Aug '20

This series fixes a couple of issues with the digital audio codec in the Allwinner A64 SoC: 1) Left/right channels were swapped when playing/recording audio 2) DAPM topology was wrong, breaking some kcontrols This is the minimum set of changes necessary to fix these issues in a backward-compatible way. For that reason, some DAPM widgets still have incorrect or confusing names; those and other issues will be fixed in later patch sets. Samuel Holland (7): ASoC: dt-bindings: Add a new compatible for the A64 codec ASoC: sun8i-codec: Fix DAPM to match the hardware topology ASoC: sun8i-codec: Add missing mixer routes ASoC: sun8i-codec: Add a quirk for LRCK inversion ARM: dts: sun8i: a33: Update codec widget names arm64: dts: allwinner: a64: Update codec widget names arm64: dts: allwinner: a64: Update the audio codec compatible .../sound/allwinner,sun8i-a33-codec.yaml | 6 +- arch/arm/boot/dts/sun8i-a33-olinuxino.dts | 4 +- arch/arm/boot/dts/sun8i-a33.dtsi | 4 +- .../dts/allwinner/sun50i-a64-bananapi-m64.dts | 8 +- .../dts/allwinner/sun50i-a64-orangepi-win.dts | 8 +- .../boot/dts/allwinner/sun50i-a64-pine64.dts | 8 +- .../dts/allwinner/sun50i-a64-pinebook.dts | 8 +- .../dts/allwinner/sun50i-a64-pinephone.dtsi | 8 +- .../boot/dts/allwinner/sun50i-a64-pinetab.dts | 8 +- .../allwinner/sun50i-a64-sopine-baseboard.dts | 8 +- .../boot/dts/allwinner/sun50i-a64-teres-i.dts | 8 +- arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 11 +- sound/soc/sunxi/sun8i-codec.c | 137 ++++++++++++++---- 13 files changed, 155 insertions(+), 71 deletions(-) -- 2.26.2

5 14

[PATCH v2 0/3] soundwire: fix port_ready[] dynamic allocation
by Bard Liao 28 Aug '20

28 Aug '20

The existing code allocates memory for the total number of ports. This only works if the ports are contiguous, but will break if e.g. a Devices uses port0, 1, and 14. The port_ready[] array would contain 3 elements, which would lead to an out-of-bounds access. Conversely in other cases, the wrong port index would be used leading to timeouts on prepare. This can be fixed by allocating for the worst-case of 15 ports (DP0..DP14). In addition since the number is now fixed, we can use an array instead of a dynamic allocation. Changes in v2: - Split patches into sdw and asoc patches. Please note that "soundwire: fix port_ready[] dynamic allocation in mipi_disco" and "ASoC: codecs: fix port_ready[] dynamic allocation in ASoC codecs" should be merged at the same time. Pierre-Louis Bossart (3): soundwire: add definition for maximum number of ports soundwire: fix port_ready[] dynamic allocation in mipi_disco ASoC: codecs: fix port_ready[] dynamic allocation in ASoC codecs drivers/soundwire/mipi_disco.c | 18 +----------------- drivers/soundwire/slave.c | 4 ++++ include/linux/soundwire/sdw.h | 5 +++-- sound/soc/codecs/max98373-sdw.c | 15 +-------------- sound/soc/codecs/rt1308-sdw.c | 14 +------------- sound/soc/codecs/rt5682-sdw.c | 15 +-------------- sound/soc/codecs/rt700-sdw.c | 15 +-------------- sound/soc/codecs/rt711-sdw.c | 15 +-------------- sound/soc/codecs/rt715-sdw.c | 33 +-------------------------------- 9 files changed, 14 insertions(+), 120 deletions(-) -- 2.17.1

3 5

[PATCH] ASoC: soc-core: add snd_soc_find_dai_with_mutex()
by Kuninori Morimoto 28 Aug '20

28 Aug '20

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> commit 25612477d20b52 ("ASoC: soc-dai: set dai_link dpcm_ flags with a helper") added snd_soc_dai_link_set_capabilities(). But it is using snd_soc_find_dai() (A) which is required client_mutex (B). And client_mutex is soc-core.c local. struct snd_soc_dai *snd_soc_find_dai(xxx) { ... (B) lockdep_assert_held(&client_mutex); ... } void snd_soc_dai_link_set_capabilities(xxx) { ... for_each_pcm_streams(direction) { ... for_each_link_cpus(dai_link, i, cpu) { (A) dai = snd_soc_find_dai(cpu); ... } ... for_each_link_codecs(dai_link, i, codec) { (A) dai = snd_soc_find_dai(codec); ... } } ... } Because of these background, we will get WARNING if .config has CONFIG_LOCKDEP. WARNING: CPU: 2 PID: 53 at sound/soc/soc-core.c:814 snd_soc_find_dai+0xf8/0x100 CPU: 2 PID: 53 Comm: kworker/2:1 Not tainted 5.7.0-rc1+ #328 Hardware name: Renesas H3ULCB Kingfisher board based on r8a77951 (DT) Workqueue: events deferred_probe_work_func pstate: 60000005 (nZCv daif -PAN -UAO) pc : snd_soc_find_dai+0xf8/0x100 lr : snd_soc_find_dai+0xf4/0x100 ... Call trace: snd_soc_find_dai+0xf8/0x100 snd_soc_dai_link_set_capabilities+0xa0/0x16c graph_dai_link_of_dpcm+0x390/0x3c0 graph_for_each_link+0x134/0x200 graph_probe+0x144/0x230 platform_drv_probe+0x5c/0xb0 really_probe+0xe4/0x430 driver_probe_device+0x60/0xf4 snd_soc_find_dai() will be used from (X) CPU/Codec/Platform driver with mutex lock, and (Y) Card driver without mutex lock. This snd_soc_dai_link_set_capabilities() is for Card driver, this means called without mutex. This patch adds snd_soc_find_dai_with_mutex() to solve it. Fixes: 25612477d20b52 ("ASoC: soc-dai: set dai_link dpcm_ flags with a helper") Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> --- This patch was originally "ASoC: soc-core: move snd_soc_dai_link_set_capabilities() to soc-core.c". This is for asoc/for-5.9 branch include/sound/soc.h | 2 ++ sound/soc/soc-core.c | 13 +++++++++++++ sound/soc/soc-dai.c | 4 ++-- 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/include/sound/soc.h b/include/sound/soc.h index 5e3919ffb00c..4176071f61bf 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -1361,6 +1361,8 @@ void snd_soc_unregister_dai(struct snd_soc_dai *dai); struct snd_soc_dai *snd_soc_find_dai( const struct snd_soc_dai_link_component *dlc); +struct snd_soc_dai *snd_soc_find_dai_with_mutex( + const struct snd_soc_dai_link_component *dlc); #include <sound/soc-dai.h> diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 2fe1b2ec7c8f..fe11856d7a63 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -834,6 +834,19 @@ struct snd_soc_dai *snd_soc_find_dai( } EXPORT_SYMBOL_GPL(snd_soc_find_dai); +struct snd_soc_dai *snd_soc_find_dai_with_mutex( + const struct snd_soc_dai_link_component *dlc) +{ + struct snd_soc_dai *dai; + + mutex_lock(&client_mutex); + dai = snd_soc_find_dai(dlc); + mutex_unlock(&client_mutex); + + return dai; +} +EXPORT_SYMBOL_GPL(snd_soc_find_dai_with_mutex); + static int soc_dai_link_sanity_check(struct snd_soc_card *card, struct snd_soc_dai_link *link) { diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c index 91a2551e4cef..0dbd312aad08 100644 --- a/sound/soc/soc-dai.c +++ b/sound/soc/soc-dai.c @@ -412,14 +412,14 @@ void snd_soc_dai_link_set_capabilities(struct snd_soc_dai_link *dai_link) supported_codec = false; for_each_link_cpus(dai_link, i, cpu) { - dai = snd_soc_find_dai(cpu); + dai = snd_soc_find_dai_with_mutex(cpu); if (dai && snd_soc_dai_stream_valid(dai, direction)) { supported_cpu = true; break; } } for_each_link_codecs(dai_link, i, codec) { - dai = snd_soc_find_dai(codec); + dai = snd_soc_find_dai_with_mutex(codec); if (dai && snd_soc_dai_stream_valid(dai, direction)) { supported_codec = true; break; -- 2.25.1

2 3

[PATCH 1/3] mfd: madera: Simplify with dev_err_probe()
by Krzysztof Kozlowski 28 Aug '20

28 Aug '20

Common pattern of handling deferred probe can be simplified with dev_err_probe(). Less code and also it prints the error value. Signed-off-by: Krzysztof Kozlowski <krzk(a)kernel.org> --- drivers/mfd/madera-core.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c index 8a8d733fdce5..4ed6ad8ce002 100644 --- a/drivers/mfd/madera-core.c +++ b/drivers/mfd/madera-core.c @@ -369,19 +369,14 @@ EXPORT_SYMBOL_GPL(madera_of_match); static int madera_get_reset_gpio(struct madera *madera) { struct gpio_desc *reset; - int ret; if (madera->pdata.reset) return 0; reset = devm_gpiod_get_optional(madera->dev, "reset", GPIOD_OUT_LOW); - if (IS_ERR(reset)) { - ret = PTR_ERR(reset); - if (ret != -EPROBE_DEFER) - dev_err(madera->dev, "Failed to request /RESET: %d\n", - ret); - return ret; - } + if (IS_ERR(reset)) + return dev_err_probe(madera->dev, PTR_ERR(reset), + "Failed to request /RESET"); /* * A hard reset is needed for full reset of the chip. We allow running -- 2.17.1

3 6

[PATCH] ALSA: Realtek: Early Forbid of runtime PM
by Harsha Priya 28 Aug '20

28 Aug '20

For Realtek codecs, pm_runtime_forbid() is called in the probe function after the build_controls(). In a stress test, occasionally the runtime PM calls are invoked before controls are built. This causes the codec to be runtime suspended before probe completes. Because of this, not all controls are enumerated correctly and audio does not work until system is rebooted. This patch calls pm_runtime_forbid() early to fix the issue. Multiple stress tests of 2000+ cycles has been done to test the fix. Signed-off-by: Harsha Priya <harshapriya.n(a)intel.com> Signed-off-by: Emmanuel Jillela <emmanuel.jillela(a)intel.com> Reviewed-by: Kailang Yang <kailang(a)realtek.com> --- sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 98789691a479..30ea07fd6735 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -8418,6 +8418,7 @@ static int patch_alc269(struct hda_codec *codec) { struct alc_spec *spec; int err; + struct device *dev = hda_codec_dev(codec); err = alc_alloc_spec(codec, 0x0b); if (err < 0) @@ -8430,6 +8431,8 @@ static int patch_alc269(struct hda_codec *codec) #ifdef CONFIG_PM codec->patch_ops.suspend = alc269_suspend; codec->patch_ops.resume = alc269_resume; + pm_runtime_dont_use_autosuspend(dev); + pm_runtime_forbid(dev); #endif spec->shutup = alc_default_shutup; spec->init_hook = alc_default_init; -- 2.17.1

3 2

Re: [PATCH 4/5] soundwire: qcom: avoid dependency on CONFIG_SLIMBUS
by Dmitry Baryshkov 27 Aug '20

27 Aug '20

On 08/06/2020 23:43, Jonathan Marek wrote: > The driver may be used without slimbus, so don't depend on slimbus. > > Signed-off-by: Jonathan Marek <jonathan(a)marek.ca> > --- > drivers/soundwire/Kconfig | 1 - > drivers/soundwire/qcom.c | 5 +++++ > 2 files changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/soundwire/Kconfig b/drivers/soundwire/Kconfig > index fa2b4ab92ed9..d121cf739090 100644 > --- a/drivers/soundwire/Kconfig > +++ b/drivers/soundwire/Kconfig > @@ -33,7 +33,6 @@ config SOUNDWIRE_INTEL > > config SOUNDWIRE_QCOM > tristate "Qualcomm SoundWire Master driver" > - depends on SLIMBUS I'd suggest: depends on SLIMBUS || !SLIMBUS #if SLIMBUS=m, this can not be builtin This would allow building both SLIMBUS and SOUNDWIRE_QCOM as modules > depends on SND_SOC > help > SoundWire Qualcomm Master driver. > diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c > index 14334442615f..ac81c64768ea 100644 > --- a/drivers/soundwire/qcom.c > +++ b/drivers/soundwire/qcom.c > @@ -769,13 +769,18 @@ static int qcom_swrm_probe(struct platform_device *pdev) > if (!ctrl) > return -ENOMEM; > > +#ifdef CONFIG_SLIMBUS and then #if IS_ENABLED(CONFIG_SLIBMUS) here > if (dev->parent->bus == &slimbus_bus) { > +#else > + if (false) { > +#endif > ctrl->reg_read = qcom_swrm_ahb_reg_read; > ctrl->reg_write = qcom_swrm_ahb_reg_write; > ctrl->regmap = dev_get_regmap(dev->parent, NULL); > if (!ctrl->regmap) > return -EINVAL; > } else { > + > res = platform_get_resource(pdev, IORESOURCE_MEM, 0); > > ctrl->reg_read = qcom_swrm_cpu_reg_read; > -- With best wishes Dmitry

1 0

INFO: task can't die in p9_fd_close
by syzbot 27 Aug '20

27 Aug '20

Hello, syzbot found the following issue on: HEAD commit: 494d311a Add linux-next specific files for 20200821 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=10615b36900000 kernel config: https://syzkaller.appspot.com/x/.config?x=a61d44f28687f508 dashboard link: https://syzkaller.appspot.com/bug?extid=fbe34b643e462f65e542 compiler: gcc (GCC) 10.1.0-syz 20200507 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15920a05900000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13a78539900000 The issue was bisected to: commit af3acca3e35c01920fe476f730dca7345d0a48df Author: Daniel Baluta <daniel.baluta(a)nxp.com> Date: Tue Feb 20 12:53:10 2018 +0000 ASoC: ak5558: Fix style for SPDX identifier bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12ea5d39900000 final oops: https://syzkaller.appspot.com/x/report.txt?x=11ea5d39900000 console output: https://syzkaller.appspot.com/x/log.txt?x=16ea5d39900000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+fbe34b643e462f65e542(a)syzkaller.appspotmail.com Fixes: af3acca3e35c ("ASoC: ak5558: Fix style for SPDX identifier") INFO: task syz-executor475:7005 can't die for more than 143 seconds. task:syz-executor475 state:D stack:27208 pid: 7005 ppid: 6875 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:3778 [inline] __schedule+0x8e5/0x21e0 kernel/sched/core.c:4527 schedule+0xd0/0x2a0 kernel/sched/core.c:4602 schedule_timeout+0x1d8/0x250 kernel/time/timer.c:1855 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x163/0x260 kernel/sched/completion.c:138 __flush_work+0x51f/0xab0 kernel/workqueue.c:3046 __cancel_work_timer+0x5de/0x700 kernel/workqueue.c:3133 p9_conn_destroy net/9p/trans_fd.c:889 [inline] p9_fd_close+0x305/0x520 net/9p/trans_fd.c:919 p9_client_destroy+0xbe/0x360 net/9p/client.c:1086 v9fs_session_close+0x45/0x2c0 fs/9p/v9fs.c:498 v9fs_kill_super+0x49/0x90 fs/9p/vfs_super.c:222 deactivate_locked_super+0x94/0x160 fs/super.c:335 v9fs_mount+0x77c/0x970 fs/9p/vfs_super.c:203 legacy_get_tree+0x105/0x220 fs/fs_context.c:592 vfs_get_tree+0x89/0x2f0 fs/super.c:1547 do_new_mount fs/namespace.c:2896 [inline] path_mount+0x1287/0x1e20 fs/namespace.c:3214 do_mount fs/namespace.c:3227 [inline] __do_sys_mount fs/namespace.c:3435 [inline] __se_sys_mount fs/namespace.c:3412 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3412 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x446eb9 Code: Bad RIP value. RSP: 002b:00007f6a133add98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00000000006dcc48 RCX: 0000000000446eb9 RDX: 0000000020000200 RSI: 0000000020000000 RDI: 0000000000000000 RBP: 00000000006dcc40 R08: 00000000200028c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc4c R13: 00000000200003c0 R14: 00000000004af538 R15: 0000000000000000 INFO: task syz-executor475:7005 blocked for more than 143 seconds. Not tainted 5.9.0-rc1-next-20200821-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor475 state:D stack:27208 pid: 7005 ppid: 6875 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:3778 [inline] __schedule+0x8e5/0x21e0 kernel/sched/core.c:4527 schedule+0xd0/0x2a0 kernel/sched/core.c:4602 schedule_timeout+0x1d8/0x250 kernel/time/timer.c:1855 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x163/0x260 kernel/sched/completion.c:138 __flush_work+0x51f/0xab0 kernel/workqueue.c:3046 __cancel_work_timer+0x5de/0x700 kernel/workqueue.c:3133 p9_conn_destroy net/9p/trans_fd.c:889 [inline] p9_fd_close+0x305/0x520 net/9p/trans_fd.c:919 p9_client_destroy+0xbe/0x360 net/9p/client.c:1086 v9fs_session_close+0x45/0x2c0 fs/9p/v9fs.c:498 v9fs_kill_super+0x49/0x90 fs/9p/vfs_super.c:222 deactivate_locked_super+0x94/0x160 fs/super.c:335 v9fs_mount+0x77c/0x970 fs/9p/vfs_super.c:203 legacy_get_tree+0x105/0x220 fs/fs_context.c:592 vfs_get_tree+0x89/0x2f0 fs/super.c:1547 do_new_mount fs/namespace.c:2896 [inline] path_mount+0x1287/0x1e20 fs/namespace.c:3214 do_mount fs/namespace.c:3227 [inline] __do_sys_mount fs/namespace.c:3435 [inline] __se_sys_mount fs/namespace.c:3412 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3412 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x446eb9 Code: Bad RIP value. RSP: 002b:00007f6a133add98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00000000006dcc48 RCX: 0000000000446eb9 RDX: 0000000020000200 RSI: 0000000020000000 RDI: 0000000000000000 RBP: 00000000006dcc40 R08: 00000000200028c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc4c R13: 00000000200003c0 R14: 00000000004af538 R15: 0000000000000000 Showing all locks held in the system: 1 lock held by khungtaskd/1173: #0: ffffffff89c675c0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:5825 1 lock held by in:imklog/6540: 2 locks held by kworker/0:1/6858: #0: ffff8880ae635dd8 (&rq->lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1292 [inline] #0: ffff8880ae635dd8 (&rq->lock){-.-.}-{2:2}, at: __schedule+0x232/0x21e0 kernel/sched/core.c:4445 #1: ffff8880ae620ec8 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x2fb/0x400 kernel/sched/psi.c:833 2 locks held by kworker/0:2/6898: #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline] #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline] #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff8880aa063d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 kernel/workqueue.c:2240 #1: ffffc90005577da8 ((work_completion)(&m->wq)){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 kernel/workqueue.c:2244 1 lock held by syz-executor475/6960: #0: ffff8880a7c7a0e0 (&type->s_umount_key#45/1){+.+.}-{3:3}, at: alloc_super+0x201/0xa90 fs/super.c:229 1 lock held by syz-executor475/7064: #0: ffff8880a6c9c0e0 (&type->s_umount_key#45/1){+.+.}-{3:3}, at: alloc_super+0x201/0xa90 fs/super.c:229 2 locks held by kworker/0:3/7070: #0: ffff8880aa073538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880aa073538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] #0: ffff8880aa073538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline] #0: ffff8880aa073538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline] #0: ffff8880aa073538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff8880aa073538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 kernel/workqueue.c:2240 #1: ffffc90006157da8 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 kernel/workqueue.c:2244 1 lock held by syz-executor475/7279: #0: ffff88809476e0e0 (&type->s_umount_key#45/1){+.+.}-{3:3}, at: alloc_super+0x201/0xa90 fs/super.c:229 1 lock held by syz-executor475/32328: #0: ffffffff89c6bc28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #0: ffffffff89c6bc28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x274/0x5f0 kernel/rcu/tree_exp.h:836 1 lock held by syz-executor475/32335: #0: ffffffff89c6bc28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #0: ffffffff89c6bc28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x274/0x5f0 kernel/rcu/tree_exp.h:836 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1173 Comm: khungtaskd Not tainted 5.9.0-rc1-next-20200821-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1b3/0x223 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:147 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:253 [inline] watchdog+0xd89/0xf30 kernel/hung_task.c:339 kthread+0x3b5/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 32335 Comm: syz-executor475 Not tainted 5.9.0-rc1-next-20200821-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:write_comp_data+0x0/0x80 kernel/kcov.c:212 Code: e8 ff ff cc cc cc cc cc cc cc 65 48 8b 04 25 c0 fe 01 00 48 8b 80 20 14 00 00 c3 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 <49> 89 f2 65 8b 05 76 90 8d 7e 65 48 8b 34 25 c0 fe 01 00 a9 00 01 RSP: 0018:ffffc90009c47ab8 EFLAGS: 00000086 RAX: 0000000000000000 RBX: ffff888096e0e000 RCX: ffffffff8134b5d6 RDX: ffff888116e0e000 RSI: ffff888096e0e000 RDI: 0000000000000006 RBP: ffff888116e0e000 R08: 0000000000000001 R09: ffff8880ae736dc7 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: ffff888096e0e000 R14: ffff8880ae632c80 R15: ffff8880a43f9f00 FS: 00007f6a133ae700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f19a2450710 CR3: 0000000097214000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __phys_addr+0x26/0x110 arch/x86/mm/physaddr.c:20 virt_to_head_page include/linux/mm.h:846 [inline] qlink_to_cache mm/kasan/quarantine.c:128 [inline] qlist_move_cache+0x72/0xd0 mm/kasan/quarantine.c:278 per_cpu_remove_cache+0x47/0x60 mm/kasan/quarantine.c:296 on_each_cpu+0xf0/0x240 kernel/smp.c:834 quarantine_remove_cache+0x40/0xd0 mm/kasan/quarantine.c:313 shutdown_cache mm/slab_common.c:449 [inline] kmem_cache_destroy+0x50/0x120 mm/slab_common.c:497 p9_client_destroy+0x24b/0x360 net/9p/client.c:1097 v9fs_session_close+0x45/0x2c0 fs/9p/v9fs.c:498 v9fs_kill_super+0x49/0x90 fs/9p/vfs_super.c:222 deactivate_locked_super+0x94/0x160 fs/super.c:335 v9fs_mount+0x77c/0x970 fs/9p/vfs_super.c:203 legacy_get_tree+0x105/0x220 fs/fs_context.c:592 vfs_get_tree+0x89/0x2f0 fs/super.c:1547 do_new_mount fs/namespace.c:2896 [inline] path_mount+0x1287/0x1e20 fs/namespace.c:3214 do_mount fs/namespace.c:3227 [inline] __do_sys_mount fs/namespace.c:3435 [inline] __se_sys_mount fs/namespace.c:3412 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3412 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x446eb9 Code: e8 dc e6 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab 05 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f6a133add98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00000000006dcc48 RCX: 0000000000446eb9 RDX: 0000000020000200 RSI: 0000000020000000 RDI: 0000000000000000 RBP: 00000000006dcc40 R08: 00000000200028c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc4c R13: 00000000200003c0 R14: 00000000004af538 R15: 0000000000000000 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

3 2