October 2021 - Alsa-devel - mailman.alsa-project.org

[PATCH] ASoC: cs42l42: Prevent NULL pointer deref in interrupt handler
by Richard Fitzgerald 25 Oct '21

25 Oct '21

The interrupt handling code was getting the struct device* from a struct snd_soc_component* stored in struct cs42l42_private. If the interrupt was asserted before ASoC calls component_probe() the snd_soc_component* will be NULL. The stored snd_soc_component* is not actually used for anything other than indirectly getting the struct device*. Remove it, and store the struct device* in struct cs42l42_private. Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com> --- sound/soc/codecs/cs42l42.c | 28 +++++++++------------------- sound/soc/codecs/cs42l42.h | 2 +- 2 files changed, 10 insertions(+), 20 deletions(-) diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c index 0dbe4e23194b..a8fff274ec63 100644 --- a/sound/soc/codecs/cs42l42.c +++ b/sound/soc/codecs/cs42l42.c @@ -526,17 +526,7 @@ static int cs42l42_set_jack(struct snd_soc_component *component, struct snd_soc_ return 0; } -static int cs42l42_component_probe(struct snd_soc_component *component) -{ - struct cs42l42_private *cs42l42 = snd_soc_component_get_drvdata(component); - - cs42l42->component = component; - - return 0; -} - static const struct snd_soc_component_driver soc_component_dev_cs42l42 = { - .probe = cs42l42_component_probe, .set_jack = cs42l42_set_jack, .dapm_widgets = cs42l42_dapm_widgets, .num_dapm_widgets = ARRAY_SIZE(cs42l42_dapm_widgets), @@ -1207,7 +1197,7 @@ static void cs42l42_process_hs_type_detect(struct cs42l42_private *cs42l42) */ if (cs42l42->hs_type == CS42L42_PLUG_INVALID || cs42l42->hs_type == CS42L42_PLUG_HEADPHONE) { - dev_dbg(cs42l42->component->dev, "Running Manual Detection Fallback\n"); + dev_dbg(cs42l42->dev, "Running Manual Detection Fallback\n"); cs42l42_manual_hs_type_detect(cs42l42); } @@ -1506,19 +1496,19 @@ static int cs42l42_handle_button_press(struct cs42l42_private *cs42l42) switch (bias_level) { case 1: /* Function C button press */ bias_level = SND_JACK_BTN_2; - dev_dbg(cs42l42->component->dev, "Function C button press\n"); + dev_dbg(cs42l42->dev, "Function C button press\n"); break; case 2: /* Function B button press */ bias_level = SND_JACK_BTN_1; - dev_dbg(cs42l42->component->dev, "Function B button press\n"); + dev_dbg(cs42l42->dev, "Function B button press\n"); break; case 3: /* Function D button press */ bias_level = SND_JACK_BTN_3; - dev_dbg(cs42l42->component->dev, "Function D button press\n"); + dev_dbg(cs42l42->dev, "Function D button press\n"); break; case 4: /* Function A button press */ bias_level = SND_JACK_BTN_0; - dev_dbg(cs42l42->component->dev, "Function A button press\n"); + dev_dbg(cs42l42->dev, "Function A button press\n"); break; default: bias_level = 0; @@ -1592,7 +1582,6 @@ static const struct cs42l42_irq_params irq_params_table[] = { static irqreturn_t cs42l42_irq_thread(int irq, void *data) { struct cs42l42_private *cs42l42 = (struct cs42l42_private *)data; - struct snd_soc_component *component = cs42l42->component; unsigned int stickies[12]; unsigned int masks[12]; unsigned int current_plug_status; @@ -1639,7 +1628,7 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data) default: break; } - dev_dbg(component->dev, "Auto detect done (%d)\n", cs42l42->hs_type); + dev_dbg(cs42l42->dev, "Auto detect done (%d)\n", cs42l42->hs_type); } } @@ -1673,7 +1662,7 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data) SND_JACK_BTN_0 | SND_JACK_BTN_1 | SND_JACK_BTN_2 | SND_JACK_BTN_3); - dev_dbg(component->dev, "Unplug event\n"); + dev_dbg(cs42l42->dev, "Unplug event\n"); } break; @@ -1689,7 +1678,7 @@ static irqreturn_t cs42l42_irq_thread(int irq, void *data) CS42L42_M_HSBIAS_HIZ_MASK)) { if (current_button_status & CS42L42_M_DETECT_TF_MASK) { - dev_dbg(component->dev, "Button released\n"); + dev_dbg(cs42l42->dev, "Button released\n"); report = 0; } else if (current_button_status & CS42L42_M_DETECT_FT_MASK) { report = cs42l42_handle_button_press(cs42l42); @@ -2043,6 +2032,7 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client, if (!cs42l42) return -ENOMEM; + cs42l42->dev = &i2c_client->dev; i2c_set_clientdata(i2c_client, cs42l42); cs42l42->regmap = devm_regmap_init_i2c(i2c_client, &cs42l42_regmap); diff --git a/sound/soc/codecs/cs42l42.h b/sound/soc/codecs/cs42l42.h index dd4744de9e0a..f45bcc9a3a62 100644 --- a/sound/soc/codecs/cs42l42.h +++ b/sound/soc/codecs/cs42l42.h @@ -833,7 +833,7 @@ static const char *const cs42l42_supply_names[CS42L42_NUM_SUPPLIES] = { struct cs42l42_private { struct regmap *regmap; - struct snd_soc_component *component; + struct device *dev; struct regulator_bulk_data supplies[CS42L42_NUM_SUPPLIES]; struct gpio_desc *reset_gpio; struct completion pdn_done; -- 2.11.0

2 1

[PATCH] ASoC: wm8962: Convert to devm_clk_get_optional()
by Geert Uytterhoeven 25 Oct '21

25 Oct '21

Use the existing devm_clk_get_optional() helper instead of building a similar construct on top of devm_clk_get() that fails to handle all errors but -EPROBE_DEFER. Signed-off-by: Geert Uytterhoeven <geert+renesas(a)glider.be> --- Compile-tested only. --- sound/soc/codecs/wm8962.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c index ba16bdf9e478ca5f..a5584ba962dcf005 100644 --- a/sound/soc/codecs/wm8962.c +++ b/sound/soc/codecs/wm8962.c @@ -3538,9 +3538,8 @@ static int wm8962_set_pdata_from_of(struct i2c_client *i2c, pdata->gpio_init[i] = 0x0; } - pdata->mclk = devm_clk_get(&i2c->dev, NULL); - - return 0; + pdata->mclk = devm_clk_get_optional(&i2c->dev, NULL); + return PTR_ERR_OR_ZERO(pdata->mclk); } static int wm8962_i2c_probe(struct i2c_client *i2c, @@ -3572,14 +3571,6 @@ static int wm8962_i2c_probe(struct i2c_client *i2c, return ret; } - /* Mark the mclk pointer to NULL if no mclk assigned */ - if (IS_ERR(wm8962->pdata.mclk)) { - /* But do not ignore the request for probe defer */ - if (PTR_ERR(wm8962->pdata.mclk) == -EPROBE_DEFER) - return -EPROBE_DEFER; - wm8962->pdata.mclk = NULL; - } - for (i = 0; i < ARRAY_SIZE(wm8962->supplies); i++) wm8962->supplies[i].supply = wm8962_supply_names[i]; -- 2.25.1

3 2

[PATCH] ASoC: amd: acp: Add acp_machine struct for renoir platform.
by Ajit Kumar Pandey 25 Oct '21

25 Oct '21

Add acpi_mach struct for renoir platform to select machine driver based on codec and amp ACPI id. Signed-off-by: Ajit Kumar Pandey <AjitKumar.Pandey(a)amd.com> --- sound/soc/amd/acp/acp-renoir.c | 19 +++++++++++++++++++ sound/soc/amd/acp/amd.h | 1 - 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/sound/soc/amd/acp/acp-renoir.c b/sound/soc/amd/acp/acp-renoir.c index 82faae1b110b..9b321a055b52 100644 --- a/sound/soc/amd/acp/acp-renoir.c +++ b/sound/soc/amd/acp/acp-renoir.c @@ -25,6 +25,25 @@ #define DRV_NAME "acp_asoc_renoir" +static struct snd_soc_acpi_codecs amp_rt1019 = { + .num_codecs = 1, + .codecs = {"10EC1019"} +}; + +static struct snd_soc_acpi_mach snd_soc_acpi_amd_acp_machines[] = { + { + .id = "10EC5682", + .drv_name = "rn_rt5682_rt1019", + .machine_quirk = snd_soc_acpi_codec_list, + .quirk_data = &amp_rt1019, + }, + { + .id = "AMDI1019", + .drv_name = "renoir-acp", + }, + {}, +}; + static struct snd_soc_dai_driver acp_renoir_dai[] = { { .name = "acp-i2s-sp", diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h index 3532f4d3ccff..8eee3d34774b 100644 --- a/sound/soc/amd/acp/amd.h +++ b/sound/soc/amd/acp/amd.h @@ -102,7 +102,6 @@ int acp_platform_register(struct device *dev); int acp_platform_unregister(struct device *dev); int acp_machine_select(struct acp_dev_data *adata); -extern struct snd_soc_acpi_mach snd_soc_acpi_amd_acp_machines[]; static inline u64 acp_get_byte_count(struct acp_dev_data *adata, int dai_id, int direction) { -- 2.25.1

2 1

[PATCH] ASoc: wm8900: Drop empty spi_driver remove callback
by Uwe Kleine-König 25 Oct '21

25 Oct '21

A driver with a remove callback that just returns 0 behaves identically to a driver with no remove callback at all. So simplify accordingly. Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> --- sound/soc/codecs/wm8900.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/sound/soc/codecs/wm8900.c b/sound/soc/codecs/wm8900.c index a9a6d766a176..bf3a4415a85f 100644 --- a/sound/soc/codecs/wm8900.c +++ b/sound/soc/codecs/wm8900.c @@ -1252,17 +1252,11 @@ static int wm8900_spi_probe(struct spi_device *spi) return ret; } -static int wm8900_spi_remove(struct spi_device *spi) -{ - return 0; -} - static struct spi_driver wm8900_spi_driver = { .driver = { .name = "wm8900", }, .probe = wm8900_spi_probe, - .remove = wm8900_spi_remove, }; #endif /* CONFIG_SPI_MASTER */ -- 2.30.2

3 2

[PATCH] ALSA: firewire-motu: fix invalid memory access when operating hwdep character device
by Takashi Sakamoto 25 Oct '21

25 Oct '21

ALSA firewire-motu driver recently got support for event notification via ALSA HwDep interface for register DSP models. However, when polling ALSA HwDep cdev, the driver can cause null pointer dereference for the other models due to accessing to unallocated memory or uninitialized memory. This commit fixes the bug by check the type of model before accessing to the memory. Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model") Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> --- sound/firewire/motu/motu-hwdep.c | 72 ++++++++++++++++++++------------ 1 file changed, 45 insertions(+), 27 deletions(-) diff --git a/sound/firewire/motu/motu-hwdep.c b/sound/firewire/motu/motu-hwdep.c index 9c2e457ce692..ae2d01ddc8d3 100644 --- a/sound/firewire/motu/motu-hwdep.c +++ b/sound/firewire/motu/motu-hwdep.c @@ -16,6 +16,47 @@ #include "motu.h" +static bool has_dsp_event(struct snd_motu *motu) +{ + if (motu->spec->flags & SND_MOTU_SPEC_REGISTER_DSP) + return (snd_motu_register_dsp_message_parser_count_event(motu) > 0); + else + return false; +} + +// NOTE: Take care of page fault due to accessing to userspace. +static long copy_dsp_event_to_user(struct snd_motu *motu, char __user *buf, long count, + struct snd_firewire_event_motu_register_dsp_change *event) +{ + if (motu->spec->flags & SND_MOTU_SPEC_REGISTER_DSP) { + size_t consumed = 0; + u32 __user *ptr; + u32 ev; + + // Header is filled later. + consumed += sizeof(*event); + + while (consumed < count && + snd_motu_register_dsp_message_parser_copy_event(motu, &ev)) { + ptr = (u32 __user *)(buf + consumed); + if (put_user(ev, ptr)) + return -EFAULT; + consumed += sizeof(ev); + } + + event->type = SNDRV_FIREWIRE_EVENT_MOTU_REGISTER_DSP_CHANGE; + event->count = (consumed - sizeof(*event)) / 4; + if (copy_to_user(buf, &event, sizeof(*event))) + return -EFAULT; + + count = consumed; + } else { + count = 0; + } + + return count; +} + static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, loff_t *offset) { @@ -25,8 +66,7 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, spin_lock_irq(&motu->lock); - while (!motu->dev_lock_changed && motu->msg == 0 && - snd_motu_register_dsp_message_parser_count_event(motu) == 0) { + while (!motu->dev_lock_changed && motu->msg == 0 && !has_dsp_event(motu)) { prepare_to_wait(&motu->hwdep_wait, &wait, TASK_INTERRUPTIBLE); spin_unlock_irq(&motu->lock); schedule(); @@ -55,31 +95,10 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, count = min_t(long, count, sizeof(event)); if (copy_to_user(buf, &event, count)) return -EFAULT; - } else if (snd_motu_register_dsp_message_parser_count_event(motu) > 0) { - size_t consumed = 0; - u32 __user *ptr; - u32 ev; - + } else if (has_dsp_event(motu)) { spin_unlock_irq(&motu->lock); - // Header is filled later. - consumed += sizeof(event.motu_register_dsp_change); - - while (consumed < count && - snd_motu_register_dsp_message_parser_copy_event(motu, &ev)) { - ptr = (u32 __user *)(buf + consumed); - if (put_user(ev, ptr)) - return -EFAULT; - consumed += sizeof(ev); - } - - event.motu_register_dsp_change.type = SNDRV_FIREWIRE_EVENT_MOTU_REGISTER_DSP_CHANGE; - event.motu_register_dsp_change.count = - (consumed - sizeof(event.motu_register_dsp_change)) / 4; - if (copy_to_user(buf, &event, sizeof(event.motu_register_dsp_change))) - return -EFAULT; - - count = consumed; + count = copy_dsp_event_to_user(motu, buf, count, &event.motu_register_dsp_change); } return count; @@ -94,8 +113,7 @@ static __poll_t hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_wait(file, &motu->hwdep_wait, wait); spin_lock_irq(&motu->lock); - if (motu->dev_lock_changed || motu->msg || - snd_motu_register_dsp_message_parser_count_event(motu) > 0) + if (motu->dev_lock_changed || motu->msg || has_dsp_event(motu)) events = EPOLLIN | EPOLLRDNORM; else events = 0; -- 2.30.2

3 3

[PATCH v3 0/2] Add code to manage DSP clocks and provide dts-binding document
by YC Hung 25 Oct '21

25 Oct '21

From: "yc.hung" <yc.hung(a)mediatek.com> This code is based on top of SOF topic/sof-dev branch and we want to have a review with ALSA and device Tree communities the it will be merged to SOF tree and then merged into ALSA tree. It provides two patches, one is for mt8195 dsp clocks related. Another is for mt8195 dsp dts binding decription. YC Hung (2): ASoC: SOF: mediatek: Add mt8195 dsp clock support dt-bindings: dsp: mediatek: Add mt8195 DSP binding support .../bindings/dsp/mtk,mt8195-dsp.yaml | 139 +++++++++++++++ sound/soc/sof/mediatek/adsp_helper.h | 2 +- sound/soc/sof/mediatek/mt8195/Makefile | 2 +- sound/soc/sof/mediatek/mt8195/mt8195-clk.c | 163 ++++++++++++++++++ sound/soc/sof/mediatek/mt8195/mt8195-clk.h | 28 +++ sound/soc/sof/mediatek/mt8195/mt8195.c | 22 ++- 6 files changed, 352 insertions(+), 4 deletions(-) create mode 100644 Documentation/devicetree/bindings/dsp/mtk,mt8195-dsp.yaml create mode 100644 sound/soc/sof/mediatek/mt8195/mt8195-clk.c create mode 100644 sound/soc/sof/mediatek/mt8195/mt8195-clk.h -- 2.18.0

2 3

[PATCH 0/3] Rockchip S/PDIF Reciever Driver
by Yunhao Tian 25 Oct '21

25 Oct '21

From: Yunhao Tian <t123yh.xyz(a)gmail.com> Hello, This patch series adds support for S/PDIF receiver found on RK3308. The code is based on Rockchip Kernel 4.4. Several ALSA controls such as synchronization status, sample rate and channel status bits are added. Also some basic error handling such as parity error or BMC decode error are performed. The implementation took stm32-spdifrx and mchp-spdifrx as reference. The driver is tested to be working on my custom board based on Firefly CORE-3308Y, with a TOSLINK receiver. This is my first time submitting a new driver to kernel, so I'll appreciate it if I can be corrected for anything wrong. Yunhao Tian (3): ASoC: rockchip: add support for spdifrx receiver ASoC: dt-bindings: rockchip: add spdifrx bindings arm64: dts: rockchip: add spdifrx support to rk3308.dtsi .../bindings/sound/rockchip-spdifrx.yaml | 80 +++ MAINTAINERS | 7 + arch/arm64/boot/dts/rockchip/rk3308.dtsi | 16 + sound/soc/rockchip/Kconfig | 8 + sound/soc/rockchip/Makefile | 2 + sound/soc/rockchip/rockchip_spdifrx.c | 660 ++++++++++++++++++ sound/soc/rockchip/rockchip_spdifrx.h | 90 +++ 7 files changed, 863 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/rockchip-spdifrx.yaml create mode 100644 sound/soc/rockchip/rockchip_spdifrx.c create mode 100644 sound/soc/rockchip/rockchip_spdifrx.h -- 2.25.1

2 4

[v5 1/2] ASoC: dt-bindings: max98520: add initial bindings
by George Song 25 Oct '21

25 Oct '21

add initial bindings for max98520 audio amplifier Signed-off-by: George Song <george.song(a)maximintegrated.com> --- .../bindings/sound/maxim,max98520.yaml | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/maxim,max98520.yaml diff --git a/Documentation/devicetree/bindings/sound/maxim,max98520.yaml b/Documentation/devicetree/bindings/sound/maxim,max98520.yaml new file mode 100644 index 000000000000..b6509cb2c8e0 --- /dev/null +++ b/Documentation/devicetree/bindings/sound/maxim,max98520.yaml @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/sound/maxim,max98520.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Maxim Integrated MAX98520 Speaker Amplifier Driver + +maintainers: + - George Song <george.song(a)maximintegrated.com> + +properties: + compatible: + const: maxim,max98520 + + reg: + maxItems: 1 + description: I2C address of the device. + +required: + - compatible + - reg + +additionalProperties: false + +examples: + - | + i2c { + #address-cells = <1>; + #size-cells = <0>; + max98520: amplifier@38 { + compatible = "maxim,max98520"; + reg = <0x38>; + }; + }; + -- 2.25.1

2 2

Mute LED on HP OMEN 15 needs a fixup in hda_intel
by Влад Макаров 24 Oct '21

24 Oct '21

Greetings everyone I am not sure if this is the right place to ask, but I don't know where else to look for help. I have a laptop (HP Omen 15 2020 amd) which has a mute button (Fn + F5) which works great, however, the LED indicator on it doesn't light up. With the help of this article <https://asus-linux.org/blog/sound-2021-01-11/> I managed to figure out that I can trigger the LED with the following command: sudo hda-verb /dev/snd/hwC1D0 0x20 0x500 0x0B && sudo hda-verb /dev/snd/hwC1D0 0x20 0x400 0x7778 And disable it with sudo hda-verb /dev/snd/hwC1D0 0x20 0x500 0x0B && sudo hda-verb /dev/snd/hwC1D0 0x20 0x400 0x777 I think that a fix should be added to patch_realtek.c <https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/sound…> (to change those values when mute button is pressed) but this requires knowledge of C and kernel stuff. I don't have much experience with those so I would be very grateful if anyone could help me. I have also filed a kernel bug report <https://bugzilla.kernel.org/show_bug.cgi?id=214735> (with some useful attachments) but nobody responded there. Thanks in advance

1 0

[syzbot] possible deadlock in snd_mixer_oss_ioctl1
by syzbot 24 Oct '21

24 Oct '21

Hello, syzbot found the following issue on: HEAD commit: cf6c9d12750c Add linux-next specific files for 20211022 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=15d3d4c4b00000 kernel config: https://syzkaller.appspot.com/x/.config?x=e694204255ade3a3 dashboard link: https://syzkaller.appspot.com/bug?extid=ace149a75a9a0a399ac7 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17c0530cb00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1129c952b00000 The issue was bisected to: commit 411cef6adfb38a5bb6bd9af3941b28198e7fb680 Author: Takashi Iwai <tiwai(a)suse.de> Date: Wed Oct 20 16:48:46 2021 +0000 ALSA: mixer: oss: Fix racy access to slots bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=167f6454b00000 final oops: https://syzkaller.appspot.com/x/report.txt?x=157f6454b00000 console output: https://syzkaller.appspot.com/x/log.txt?x=117f6454b00000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+ace149a75a9a0a399ac7(a)syzkaller.appspotmail.com Fixes: 411cef6adfb3 ("ALSA: mixer: oss: Fix racy access to slots") ============================================ WARNING: possible recursive locking detected 5.15.0-rc6-next-20211022-syzkaller #0 Not tainted -------------------------------------------- syz-executor206/6529 is trying to acquire lock: ffff888021ff09c8 (&mixer->reg_mutex){+.+.}-{3:3}, at: snd_mixer_oss_set_volume sound/core/oss/mixer_oss.c:316 [inline] ffff888021ff09c8 (&mixer->reg_mutex){+.+.}-{3:3}, at: snd_mixer_oss_ioctl1+0x630/0x19a0 sound/core/oss/mixer_oss.c:375 but task is already holding lock: ffff888021ff09c8 (&mixer->reg_mutex){+.+.}-{3:3}, at: snd_mixer_oss_set_volume sound/core/oss/mixer_oss.c:300 [inline] ffff888021ff09c8 (&mixer->reg_mutex){+.+.}-{3:3}, at: snd_mixer_oss_ioctl1+0x4b1/0x19a0 sound/core/oss/mixer_oss.c:375 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&mixer->reg_mutex); lock(&mixer->reg_mutex); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by syz-executor206/6529: #0: ffff888021ff09c8 (&mixer->reg_mutex){+.+.}-{3:3}, at: snd_mixer_oss_set_volume sound/core/oss/mixer_oss.c:300 [inline] #0: ffff888021ff09c8 (&mixer->reg_mutex){+.+.}-{3:3}, at: snd_mixer_oss_ioctl1+0x4b1/0x19a0 sound/core/oss/mixer_oss.c:375 stack backtrace: CPU: 0 PID: 6529 Comm: syz-executor206 Not tainted 5.15.0-rc6-next-20211022-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2956 [inline] check_deadlock kernel/locking/lockdep.c:2999 [inline] validate_chain kernel/locking/lockdep.c:3788 [inline] __lock_acquire.cold+0x149/0x3ab kernel/locking/lockdep.c:5027 lock_acquire kernel/locking/lockdep.c:5637 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5602 __mutex_lock_common kernel/locking/mutex.c:607 [inline] __mutex_lock+0x12f/0x12f0 kernel/locking/mutex.c:740 snd_mixer_oss_set_volume sound/core/oss/mixer_oss.c:316 [inline] snd_mixer_oss_ioctl1+0x630/0x19a0 sound/core/oss/mixer_oss.c:375 snd_mixer_oss_ioctl+0x40/0x50 sound/core/oss/mixer_oss.c:390 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f0c06979fe9 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffea97dd558 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0c06979fe9 RDX: 0000000020000080 RSI: 00000000c0044d00 RDI: 0000000000000003 RBP: 00007f0c0693dfd0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0c0693e060 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

2 1