April 2022 - Alsa-devel - mailman.alsa-project.org

[RFC PATCH 0/5] Apple Macs machine-level ASoC driver
by Martin Povišer 25 Apr '22

25 Apr '22

Hi, I put together a machine-level ASoC driver for recent Apple Macs (the ones with ARM64 SoCs) and want to gauge opinions. Commit 1 is the binding. It is some subset of simple-audio-card with the extra distinction of allowing multiple CPU/CODEC DAIs per a DAI link. I want to draw special attention to the issue of describing speaker topologies. The way it now works is that the driver expects the speakers to be declared in a fixed order in the sound-dai= list. This populates a topology the driver expects on a particular machine model. Mark (in CC) has made the suggestion of keeping the topology descriptions with the codec nodes themselves in some generic manner, akin to how sound-name-prefix= already helps identify codecs to the user. Commit 2 adds a new ASoC card method (filter_controls) to let the card prevent some codec kcontrols from being visible to userspace. For example the TAS2770 speaker amp driver would be happy to expose TDM slot selection and ISENSE/VSENSE enables which is ridiculous. I am all ears on how to make the patch acceptable to upstream. Commit 3 makes ASoC tolerate N-to-M DAI links, not sure what the right (simple) approach should be there. Commit 4 adds some utility function and commit 5 is the driver itself. Let me know what you think. Martin Martin Povišer (5): dt-bindings: sound: Add Apple Macs sound system HACK: ASoC: Add card->filter_controls hook HACK: ASoC: Tolerate N-cpus-to-M-codecs links ASoC: Introduce snd_soc_of_get_dai_link_cpus ASoC: Add macaudio machine driver .../bindings/sound/apple,macaudio.yaml | 103 +++ include/sound/soc.h | 7 + sound/soc/apple/Kconfig | 10 + sound/soc/apple/Makefile | 3 + sound/soc/apple/macaudio.c | 597 ++++++++++++++++++ sound/soc/soc-core.c | 125 +++- sound/soc/soc-dapm.c | 34 +- sound/soc/soc-pcm.c | 3 + 8 files changed, 860 insertions(+), 22 deletions(-) create mode 100644 Documentation/devicetree/bindings/sound/apple,macaudio.yaml create mode 100644 sound/soc/apple/Kconfig create mode 100644 sound/soc/apple/Makefile create mode 100644 sound/soc/apple/macaudio.c -- 2.33.0

4 19

[PATCH 0/2] ASoC: Add macros for signed TLV controls with callbacks
by Richard Fitzgerald 25 Apr '22

25 Apr '22

This adds SOC_DOUBLE_R_S_EXT_TLV and SOC_SINGLE_S_EXT_TLV macros for signed TLV controls that need custom get/put callbacks. These will be needed by future Cirrus codec drivers, but are not particularly exotic so could be useful for others. Richard Fitzgerald (1): ASoC: soc.h: Add SOC_SINGLE_S_EXT_TLV macro Simon Trimmer (1): ASoC: soc.h: Introduce SOC_DOUBLE_R_S_EXT_TLV() macro include/sound/soc.h | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) -- 2.30.2

2 4

[PATCH -next] ARM: pxa: pxa2xx-ac97-lib: fix return value check of platform_get_irq()
by Yang Yingliang 25 Apr '22

25 Apr '22

platform_get_irq() returns negative error number on failure, fix the return value check in pxa2xx_ac97_hw_probe() and assign the error code to 'ret'. Fixes: 2548e6c76ebf ("ARM: pxa: pxa2xx-ac97-lib: use IRQ resource") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- sound/arm/pxa2xx-ac97-lib.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/arm/pxa2xx-ac97-lib.c b/sound/arm/pxa2xx-ac97-lib.c index e55c0421718b..2ca33fd5a575 100644 --- a/sound/arm/pxa2xx-ac97-lib.c +++ b/sound/arm/pxa2xx-ac97-lib.c @@ -402,8 +402,10 @@ int pxa2xx_ac97_hw_probe(struct platform_device *dev) goto err_clk2; irq = platform_get_irq(dev, 0); - if (!irq) + if (irq < 0) { + ret = irq; goto err_irq; + } ret = request_irq(irq, pxa2xx_ac97_irq, 0, "AC97", NULL); if (ret < 0) -- 2.25.1

1 0

[PATCH 0/3] firewire: fixes for kernel v4.9 or later
by Takashi Sakamoto 25 Apr '22

25 Apr '22

Hi, This patchset respins patches posted before to fix some bugs for Linux FireWire subsystem. I expect them to be sent to Linus via pull request by maintainer of Linux sound subsystem since the path appears to be available after a short conversation with the maintainer. This patchset is expected to be applied to 'for-linus' branch for v5.18 kernel, and to stable kernels based on v4.9 or later. This patchset includes below patches: * [PATCH V2] drivers/firewire: use struct_size over open coded arithmetic * https://lore.kernel.org/lkml/20220210060805.1608198-1-chi.minghao@zte.com.c… * [PATCH] firewire: core: extend card->lock in fw_core_handle_bus_reset * https://lore.kernel.org/lkml/20220303183038.54126-1-dossche.niels@gmail.com/ * [PATCH] firewire: remove check of list iterator against head past the loop body * https://lore.kernel.org/lkml/20220331223601.902329-1-jakobkoschel@gmail.com/ Chengfeng Ye (1): firewire: fix potential uaf in outbound_phy_packet_callback() Jakob Koschel (1): firewire: remove check of list iterator against head past the loop body Niels Dossche (1): firewire: core: extend card->lock in fw_core_handle_bus_reset drivers/firewire/core-card.c | 3 +++ drivers/firewire/core-cdev.c | 4 +++- drivers/firewire/core-topology.c | 9 +++------ drivers/firewire/core-transaction.c | 30 +++++++++++++++-------------- drivers/firewire/sbp2.c | 13 +++++++------ 5 files changed, 32 insertions(+), 27 deletions(-) -- 2.34.1

2 4

[PATCH] ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes
by Takashi Sakamoto 25 Apr '22

25 Apr '22

ALSA fireworks driver has a bug in its initial state to return count shorter than expected by 4 bytes to userspace applications when handling response frame for Echo Audio Fireworks transaction. It's due to missing addition of the size for the type of event in ALSA firewire stack. Fixes: 555e8a8f7f14 ("ALSA: fireworks: Add command/response functionality into hwdep interface") Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> --- sound/firewire/fireworks/fireworks_hwdep.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c index 626c0c34b0b6..3a53914277d3 100644 --- a/sound/firewire/fireworks/fireworks_hwdep.c +++ b/sound/firewire/fireworks/fireworks_hwdep.c @@ -34,6 +34,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained, type = SNDRV_FIREWIRE_EVENT_EFW_RESPONSE; if (copy_to_user(buf, &type, sizeof(type))) return -EFAULT; + count += sizeof(type); remained -= sizeof(type); buf += sizeof(type); -- 2.34.1

2 1

[PATCH] ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers
by Zihao Wang 25 Apr '22

25 Apr '22

Lenovo Yoga Duet 7 13ITL6 has Realtek ALC287 and built-in speakers do not work out of the box. The fix developed for Yoga 7i 14ITL5 also enables speaker output for this model. Signed-off-by: Zihao Wang <wzhd(a)ustc.edu> --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index c65d3dbc6cc96..cf531c1efa132 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -9247,6 +9247,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS), SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940", ALC298_FIXUP_LENOVO_SPK_VOLUME), SND_PCI_QUIRK(0x17aa, 0x3819, "Lenovo 13s Gen2 ITL", ALC287_FIXUP_13S_GEN2_SPEAKERS), + SND_PCI_QUIRK(0x17aa, 0x3820, "Yoga Duet 7 13ITL6", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS), SND_PCI_QUIRK(0x17aa, 0x3824, "Legion Y9000X 2020", ALC285_FIXUP_LEGION_Y9000X_SPEAKERS), SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF), SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS), -- 2.30.2

2 1

[PATCH] ALSA: pcm: Check for null pointer of pointer substream before dereferencing it
by Colin Ian King 25 Apr '22

25 Apr '22

Pointer substream is being dereferenced on the assignment of pointer card before substream is being null checked with the macro PCM_RUNTIME_CHECK. Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the the pointer check before card is assigned. Fixes: commit d4cfb30fce03 ("ALSA: pcm: Set per-card upper limit of PCM buffer allocations") Signed-off-by: Colin Ian King <colin.i.king(a)gmail.com> --- sound/core/pcm_memory.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/core/pcm_memory.c b/sound/core/pcm_memory.c index 8848d2f3160d..b8296b6eb2c1 100644 --- a/sound/core/pcm_memory.c +++ b/sound/core/pcm_memory.c @@ -453,7 +453,6 @@ EXPORT_SYMBOL(snd_pcm_lib_malloc_pages); */ int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream) { - struct snd_card *card = substream->pcm->card; struct snd_pcm_runtime *runtime; if (PCM_RUNTIME_CHECK(substream)) @@ -462,6 +461,8 @@ int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream) if (runtime->dma_area == NULL) return 0; if (runtime->dma_buffer_p != &substream->dma_buffer) { + struct snd_card *card = substream->pcm->card; + /* it's a newly allocated buffer. release it now. */ do_free_pages(card, runtime->dma_buffer_p); kfree(runtime->dma_buffer_p); -- 2.35.1

2 1

[PATCH v2] selftests: alsa: Start validating control names
by Mark Brown 25 Apr '22

25 Apr '22

Not much of a test but we keep on getting problems with boolean controls not being called Switches so let's add a few basic checks to help people spot problems. Signed-off-by: Mark Brown <broonie(a)kernel.org> --- v2: - Make strend() static. - Check for " Switch" rather than "Switch" at the end of the name. tools/testing/selftests/alsa/mixer-test.c | 41 ++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c index eb2213540fe3..a38b89c28030 100644 --- a/tools/testing/selftests/alsa/mixer-test.c +++ b/tools/testing/selftests/alsa/mixer-test.c @@ -27,7 +27,7 @@ #include "../kselftest.h" -#define TESTS_PER_CONTROL 6 +#define TESTS_PER_CONTROL 7 struct card_data { snd_ctl_t *handle; @@ -456,6 +456,44 @@ static void test_ctl_get_value(struct ctl_data *ctl) ctl->card->card, ctl->elem); } +static bool strend(const char *haystack, const char *needle) +{ + size_t haystack_len = strlen(haystack); + size_t needle_len = strlen(needle); + + if (needle_len > haystack_len) + return false; + return strcmp(haystack + haystack_len - needle_len, needle) == 0; +} + +static void test_ctl_name(struct ctl_data *ctl) +{ + bool name_ok = true; + bool check; + + /* Only boolean controls should end in Switch */ + if (strend(ctl->name, " Switch")) { + if (snd_ctl_elem_info_get_type(ctl->info) != SND_CTL_ELEM_TYPE_BOOLEAN) { + ksft_print_msg("%d.%d %s ends in Switch but is not boolean\n", + ctl->card->card, ctl->elem, ctl->name); + name_ok = false; + } + } + + /* Writeable boolean controls should end in Switch */ + if (snd_ctl_elem_info_get_type(ctl->info) == SND_CTL_ELEM_TYPE_BOOLEAN && + snd_ctl_elem_info_is_writable(ctl->info)) { + if (!strend(ctl->name, " Switch")) { + ksft_print_msg("%d.%d %s is a writeable boolean but not a Switch\n", + ctl->card->card, ctl->elem, ctl->name); + name_ok = false; + } + } + + ksft_test_result(name_ok, "name.%d.%d\n", + ctl->card->card, ctl->elem); +} + static bool show_mismatch(struct ctl_data *ctl, int index, snd_ctl_elem_value_t *read_val, snd_ctl_elem_value_t *expected_val) @@ -1062,6 +1100,7 @@ int main(void) * test stores the default value for later cleanup. */ test_ctl_get_value(ctl); + test_ctl_name(ctl); test_ctl_write_default(ctl); test_ctl_write_valid(ctl); test_ctl_write_invalid(ctl); -- 2.30.2

2 1

Re: [syzbot] possible deadlock in _snd_pcm_stream_lock_irqsave (3)
by syzbot 24 Apr '22

24 Apr '22

syzbot has found a reproducer for the following issue on: HEAD commit: 13bc32bad705 Merge tag 'drm-fixes-2022-04-23' of git://ano.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=11371798f00000 kernel config: https://syzkaller.appspot.com/x/.config?x=71bf5c8488a4e33a dashboard link: https://syzkaller.appspot.com/bug?extid=58740f570d9b0dacf2a3 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=129b3992f00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17a6b6fcf00000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+58740f570d9b0dacf2a3(a)syzkaller.appspotmail.com ======================================================== WARNING: possible irq lock inversion dependency detected 5.18.0-rc3-syzkaller-00218-g13bc32bad705 #0 Not tainted -------------------------------------------------------- swapper/0/0 just changed the state of lock: ffff888022e8b110 (&group->lock){..-.}-{2:2}, at: _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170 but this lock took another, SOFTIRQ-READ-unsafe lock in the past: (tasklist_lock){.+.+}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Chain exists of: &group->lock --> &timer->lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&group->lock); lock(&timer->lock); <Interrupt> lock(&group->lock); *** DEADLOCK *** no locks held by swapper/0/0. the shortest dependencies between 2nd lock and 1st lock: -> (tasklist_lock){.+.+}-{2:2} { HARDIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228 do_wait+0x284/0xce0 kernel/exit.c:1508 kernel_wait+0x9c/0x150 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 SOFTIRQ-ON-R at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228 do_wait+0x284/0xce0 kernel/exit.c:1508 kernel_wait+0x9c/0x150 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x32/0x50 kernel/locking/spinlock.c:326 copy_process+0x4364/0x6fe0 kernel/fork.c:2368 kernel_clone+0xe7/0xab0 kernel/fork.c:2639 kernel_thread+0xb5/0xf0 kernel/fork.c:2691 rest_init+0x23/0x3e0 init/main.c:691 start_kernel+0x47f/0x4a0 init/main.c:1140 secondary_startup_64_no_verify+0xc3/0xcb INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228 do_wait+0x284/0xce0 kernel/exit.c:1508 kernel_wait+0x9c/0x150 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xf5/0x180 kernel/umh.c:166 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 } ... key at: [<ffffffff8ba0a098>] tasklist_lock+0x18/0x40 ... acquired at: __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x5b/0x70 kernel/locking/spinlock.c:228 send_sigio+0xab/0x380 fs/fcntl.c:792 dnotify_handle_event+0x148/0x280 fs/notify/dnotify/dnotify.c:115 fsnotify_handle_inode_event.isra.0+0x209/0x350 fs/notify/fsnotify.c:264 fsnotify_handle_event fs/notify/fsnotify.c:323 [inline] send_to_group fs/notify/fsnotify.c:377 [inline] fsnotify+0xeaf/0x13d0 fs/notify/fsnotify.c:564 fsnotify_name include/linux/fsnotify.h:36 [inline] fsnotify_name include/linux/fsnotify.h:29 [inline] fsnotify_dirent include/linux/fsnotify.h:42 [inline] fsnotify_create include/linux/fsnotify.h:207 [inline] open_last_lookups fs/namei.c:3402 [inline] path_openat+0x1232/0x2910 fs/namei.c:3606 do_filp_open+0x1aa/0x400 fs/namei.c:3636 do_sys_openat2+0x16d/0x4c0 fs/open.c:1213 do_sys_open fs/open.c:1229 [inline] __do_sys_creat fs/open.c:1305 [inline] __se_sys_creat fs/open.c:1299 [inline] __x64_sys_creat+0xc9/0x120 fs/open.c:1299 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae -> (&f->f_owner.lock){....}-{2:2} { INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0x32/0x50 kernel/locking/spinlock.c:326 f_modown+0x2a/0x390 fs/fcntl.c:91 __f_setown fs/fcntl.c:110 [inline] f_setown+0xd7/0x230 fs/fcntl.c:138 do_fcntl+0x748/0x10b0 fs/fcntl.c:377 __do_sys_fcntl fs/fcntl.c:454 [inline] __se_sys_fcntl fs/fcntl.c:439 [inline] __x64_sys_fcntl+0x15f/0x1d0 fs/fcntl.c:439 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 send_sigio+0x24/0x380 fs/fcntl.c:778 kill_fasync_rcu fs/fcntl.c:1003 [inline] kill_fasync fs/fcntl.c:1017 [inline] kill_fasync+0x1f8/0x470 fs/fcntl.c:1010 snd_timer_user_ccallback+0x298/0x330 sound/core/timer.c:1386 snd_timer_notify1+0x11c/0x3b0 sound/core/timer.c:516 snd_timer_start1+0x4d4/0x800 sound/core/timer.c:578 snd_timer_start sound/core/timer.c:696 [inline] snd_timer_start sound/core/timer.c:689 [inline] snd_timer_user_start.isra.0+0x1e3/0x260 sound/core/timer.c:1984 __snd_timer_user_ioctl.isra.0+0xda4/0x2490 sound/core/timer.c:2107 snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae } ... key at: [<ffffffff9061aa40>] __key.5+0x0/0x40 ... acquired at: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 send_sigio+0x24/0x380 fs/fcntl.c:778 kill_fasync_rcu fs/fcntl.c:1003 [inline] kill_fasync fs/fcntl.c:1017 [inline] kill_fasync+0x1f8/0x470 fs/fcntl.c:1010 snd_timer_user_ccallback+0x298/0x330 sound/core/timer.c:1386 snd_timer_notify1+0x11c/0x3b0 sound/core/timer.c:516 snd_timer_start1+0x4d4/0x800 sound/core/timer.c:578 snd_timer_start sound/core/timer.c:696 [inline] snd_timer_start sound/core/timer.c:689 [inline] snd_timer_user_start.isra.0+0x1e3/0x260 sound/core/timer.c:1984 __snd_timer_user_ioctl.isra.0+0xda4/0x2490 sound/core/timer.c:2107 snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae -> (&new->fa_lock){....}-{2:2} { INITIAL READ USE at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:996 [inline] kill_fasync fs/fcntl.c:1017 [inline] kill_fasync+0x136/0x470 fs/fcntl.c:1010 snd_timer_user_ccallback+0x298/0x330 sound/core/timer.c:1386 snd_timer_notify1+0x11c/0x3b0 sound/core/timer.c:516 snd_timer_start1+0x4d4/0x800 sound/core/timer.c:578 snd_timer_start sound/core/timer.c:696 [inline] snd_timer_start sound/core/timer.c:689 [inline] snd_timer_user_start.isra.0+0x1e3/0x260 sound/core/timer.c:1984 __snd_timer_user_ioctl.isra.0+0xda4/0x2490 sound/core/timer.c:2107 snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae } ... key at: [<ffffffff9061b820>] __key.0+0x0/0x40 ... acquired at: __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0x70/0x90 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:996 [inline] kill_fasync fs/fcntl.c:1017 [inline] kill_fasync+0x136/0x470 fs/fcntl.c:1010 snd_timer_user_ccallback+0x298/0x330 sound/core/timer.c:1386 snd_timer_notify1+0x11c/0x3b0 sound/core/timer.c:516 snd_timer_start1+0x4d4/0x800 sound/core/timer.c:578 snd_timer_start sound/core/timer.c:696 [inline] snd_timer_start sound/core/timer.c:689 [inline] snd_timer_user_start.isra.0+0x1e3/0x260 sound/core/timer.c:1984 __snd_timer_user_ioctl.isra.0+0xda4/0x2490 sound/core/timer.c:2107 snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae -> (&timer->lock){....}-{2:2} { INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 snd_timer_resolution+0x55/0x100 sound/core/timer.c:489 snd_timer_user_params.isra.0+0x18e/0x8c0 sound/core/timer.c:1851 __snd_timer_user_ioctl.isra.0+0x101c/0x2490 sound/core/timer.c:2100 snd_timer_user_ioctl+0x77/0xb0 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae } ... key at: [<ffffffff909196a0>] __key.10+0x0/0x40 ... acquired at: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 snd_timer_notify sound/core/timer.c:1086 [inline] snd_timer_notify+0x10c/0x3d0 sound/core/timer.c:1073 snd_pcm_timer_notify sound/core/pcm_native.c:608 [inline] snd_pcm_post_start+0x24a/0x310 sound/core/pcm_native.c:1451 snd_pcm_action_single+0xf4/0x130 sound/core/pcm_native.c:1283 snd_pcm_action+0x6e/0x90 sound/core/pcm_native.c:1364 __snd_pcm_lib_xfer+0x14d0/0x1e10 sound/core/pcm_lib.c:2308 snd_pcm_oss_write3+0x103/0x250 sound/core/oss/pcm_oss.c:1253 snd_pcm_oss_write2+0x30e/0x3f0 sound/core/oss/pcm_oss.c:1393 snd_pcm_oss_sync1+0x187/0x440 sound/core/oss/pcm_oss.c:1627 snd_pcm_oss_sync+0x638/0x800 sound/core/oss/pcm_oss.c:1704 snd_pcm_oss_release+0x276/0x300 sound/core/oss/pcm_oss.c:2590 __fput+0x277/0x9d0 fs/file_table.c:317 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:37 [inline] do_exit+0xaff/0x2a00 kernel/exit.c:795 do_group_exit+0xd2/0x2f0 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae -> (&group->lock){..-.}-{2:2} { IN-SOFTIRQ-W at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170 snd_pcm_period_elapsed+0x1d/0x50 sound/core/pcm_lib.c:1848 dummy_hrtimer_callback+0x94/0x1b0 sound/drivers/dummy.c:377 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:645 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] acpi_safe_halt drivers/acpi/processor_idle.c:115 [inline] acpi_idle_do_entry+0x1c6/0x250 drivers/acpi/processor_idle.c:556 acpi_idle_enter+0x361/0x500 drivers/acpi/processor_idle.c:691 cpuidle_enter_state+0x1b1/0xc80 drivers/cpuidle/cpuidle.c:237 cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:351 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:236 [inline] do_idle+0x3e8/0x590 kernel/sched/idle.c:303 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400 start_kernel+0x47f/0x4a0 init/main.c:1140 secondary_startup_64_no_verify+0xc3/0xcb INITIAL USE at: lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0x32/0x50 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:374 [inline] snd_pcm_group_lock_irq sound/core/pcm_native.c:97 [inline] snd_pcm_stream_lock_irq sound/core/pcm_native.c:136 [inline] snd_pcm_hw_params+0x14b/0x19f0 sound/core/pcm_native.c:726 snd_pcm_kernel_ioctl+0x164/0x310 sound/core/pcm_native.c:3435 snd_pcm_oss_change_params_locked+0x14e2/0x3a70 sound/core/oss/pcm_oss.c:976 snd_pcm_oss_make_ready_locked+0xb3/0x130 sound/core/oss/pcm_oss.c:1198 snd_pcm_oss_write1 sound/core/oss/pcm_oss.c:1416 [inline] snd_pcm_oss_write+0x4ac/0x9c0 sound/core/oss/pcm_oss.c:2811 vfs_write+0x269/0xac0 fs/read_write.c:589 ksys_write+0x127/0x250 fs/read_write.c:644 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae } ... key at: [<ffffffff90919f00>] __key.8+0x0/0x40 ... acquired at: mark_lock kernel/locking/lockdep.c:4571 [inline] mark_usage kernel/locking/lockdep.c:4502 [inline] __lock_acquire+0x11e7/0x56c0 kernel/locking/lockdep.c:4983 lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170 snd_pcm_period_elapsed+0x1d/0x50 sound/core/pcm_lib.c:1848 dummy_hrtimer_callback+0x94/0x1b0 sound/drivers/dummy.c:377 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:645 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] acpi_safe_halt drivers/acpi/processor_idle.c:115 [inline] acpi_idle_do_entry+0x1c6/0x250 drivers/acpi/processor_idle.c:556 acpi_idle_enter+0x361/0x500 drivers/acpi/processor_idle.c:691 cpuidle_enter_state+0x1b1/0xc80 drivers/cpuidle/cpuidle.c:237 cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:351 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:236 [inline] do_idle+0x3e8/0x590 kernel/sched/idle.c:303 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400 start_kernel+0x47f/0x4a0 init/main.c:1140 secondary_startup_64_no_verify+0xc3/0xcb stack backtrace: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.18.0-rc3-syzkaller-00218-g13bc32bad705 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_irq_inversion_bug kernel/locking/lockdep.c:192 [inline] check_usage_forwards kernel/locking/lockdep.c:4045 [inline] mark_lock_irq kernel/locking/lockdep.c:4177 [inline] mark_lock.part.0.cold+0x86/0xd8 kernel/locking/lockdep.c:4607 mark_lock kernel/locking/lockdep.c:4571 [inline] mark_usage kernel/locking/lockdep.c:4502 [inline] __lock_acquire+0x11e7/0x56c0 kernel/locking/lockdep.c:4983 lock_acquire kernel/locking/lockdep.c:5641 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5606 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:162 _snd_pcm_stream_lock_irqsave+0x9f/0xd0 sound/core/pcm_native.c:170 snd_pcm_period_elapsed+0x1d/0x50 sound/core/pcm_lib.c:1848 dummy_hrtimer_callback+0x94/0x1b0 sound/drivers/dummy.c:377 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:645 RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline] RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline] RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:116 [inline] RIP: 0010:acpi_idle_do_entry+0x1c6/0x250 drivers/acpi/processor_idle.c:556 Code: 89 de e8 7d 6e 0c f8 84 db 75 ac e8 94 6a 0c f8 e8 ff b2 12 f8 eb 0c e8 88 6a 0c f8 0f 00 2d 51 07 c6 00 e8 7c 6a 0c f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 f7 6c 0c f8 48 85 db RSP: 0018:ffffffff8ba07d60 EFLAGS: 00000293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffffffff8babc700 RSI: ffffffff896cc614 RDI: 0000000000000000 RBP: ffff8880165b4864 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff817f7938 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880165b4800 R14: ffff8880165b4864 R15: ffff8881407ed004 acpi_idle_enter+0x361/0x500 drivers/acpi/processor_idle.c:691 cpuidle_enter_state+0x1b1/0xc80 drivers/cpuidle/cpuidle.c:237 cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:351 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:236 [inline] do_idle+0x3e8/0x590 kernel/sched/idle.c:303 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400 start_kernel+0x47f/0x4a0 init/main.c:1140 second ---------------- Code disassembly (best guess): 0: 89 de mov %ebx,%esi 2: e8 7d 6e 0c f8 callq 0xf80c6e84 7: 84 db test %bl,%bl 9: 75 ac jne 0xffffffb7 b: e8 94 6a 0c f8 callq 0xf80c6aa4 10: e8 ff b2 12 f8 callq 0xf812b314 15: eb 0c jmp 0x23 17: e8 88 6a 0c f8 callq 0xf80c6aa4 1c: 0f 00 2d 51 07 c6 00 verw 0xc60751(%rip) # 0xc60774 23: e8 7c 6a 0c f8 callq 0xf80c6aa4 28: fb sti 29: f4 hlt * 2a: 9c pushfq <-- trapping instruction 2b: 5b pop %rbx 2c: 81 e3 00 02 00 00 and $0x200,%ebx 32: fa cli 33: 31 ff xor %edi,%edi 35: 48 89 de mov %rbx,%rsi 38: e8 f7 6c 0c f8 callq 0xf80c6d34 3d: 48 85 db test %rbx,%rbx

1 0

Re: [syzbot] possible deadlock in snd_pcm_period_elapsed (3)
by syzbot 24 Apr '22

24 Apr '22

syzbot has found a reproducer for the following issue on: HEAD commit: 45ab9400e73f Merge tag 'perf-tools-fixes-for-v5.18-2022-04.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=17e13008f00000 kernel config: https://syzkaller.appspot.com/x/.config?x=d1843173f299d1e8 dashboard link: https://syzkaller.appspot.com/bug?extid=669c9abf11a6a011dd09 compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=154827d0f00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16e5002cf00000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+669c9abf11a6a011dd09(a)syzkaller.appspotmail.com ======================================================== WARNING: possible irq lock inversion dependency detected 5.18.0-rc3-syzkaller-00196-g45ab9400e73f #0 Not tainted -------------------------------------------------------- swapper/0/0 just changed the state of lock: ffff888023b16110 (&group->lock){..-.}-{2:2}, at: snd_pcm_period_elapsed+0x2c/0x210 sound/core/pcm_lib.c:1848 but this lock took another, SOFTIRQ-READ-unsafe lock in the past: (tasklist_lock){.+.+}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Chain exists of: &group->lock --> &timer->lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&group->lock); lock(&timer->lock); <Interrupt> lock(&group->lock); *** DEADLOCK *** no locks held by swapper/0/0. the shortest dependencies between 2nd lock and 1st lock: -> (tasklist_lock){.+.+}-{2:2} { HARDIRQ-ON-R at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x32/0x40 kernel/locking/spinlock.c:228 do_wait+0x224/0x9d0 kernel/exit.c:1508 kernel_wait+0xe4/0x230 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xb4/0x220 kernel/umh.c:166 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 SOFTIRQ-ON-R at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x32/0x40 kernel/locking/spinlock.c:228 do_wait+0x224/0x9d0 kernel/exit.c:1508 kernel_wait+0xe4/0x230 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xb4/0x220 kernel/umh.c:166 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 INITIAL USE at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0xcf/0x110 kernel/locking/spinlock.c:326 copy_process+0x234d/0x3f70 kernel/fork.c:2368 kernel_clone+0x22f/0x7a0 kernel/fork.c:2639 kernel_thread+0x167/0x1e0 kernel/fork.c:2691 rest_init+0x21/0x2e0 init/main.c:691 start_kernel+0x4bf/0x56e init/main.c:1140 secondary_startup_64_no_verify+0xc4/0xcb INITIAL READ USE at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x32/0x40 kernel/locking/spinlock.c:228 do_wait+0x224/0x9d0 kernel/exit.c:1508 kernel_wait+0xe4/0x230 kernel/exit.c:1698 call_usermodehelper_exec_sync kernel/umh.c:139 [inline] call_usermodehelper_exec_work+0xb4/0x220 kernel/umh.c:166 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 } ... key at: [<ffffffff8c80a058>] tasklist_lock+0x18/0x40 ... acquired at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_read_lock include/linux/rwlock_api_smp.h:150 [inline] _raw_read_lock+0x32/0x40 kernel/locking/spinlock.c:228 send_sigio+0xbe/0x300 fs/fcntl.c:792 dnotify_handle_event+0x136/0x450 fs/notify/dnotify/dnotify.c:115 fsnotify+0xc84/0x1270 fs/notify/fsnotify.c:564 fsnotify_name include/linux/fsnotify.h:36 [inline] fsnotify_dirent include/linux/fsnotify.h:42 [inline] fsnotify_create include/linux/fsnotify.h:207 [inline] open_last_lookups fs/namei.c:3402 [inline] path_openat+0x14b3/0x2ec0 fs/namei.c:3606 do_filp_open+0x277/0x4f0 fs/namei.c:3636 do_sys_openat2+0x13b/0x500 fs/open.c:1213 do_sys_open fs/open.c:1229 [inline] __do_sys_creat fs/open.c:1305 [inline] __se_sys_creat fs/open.c:1299 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1299 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae -> (&f->f_owner.lock){....}-{2:2} { INITIAL USE at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_write_lock_irq include/linux/rwlock_api_smp.h:195 [inline] _raw_write_lock_irq+0xcf/0x110 kernel/locking/spinlock.c:326 f_modown+0x38/0x340 fs/fcntl.c:91 __f_setown fs/fcntl.c:110 [inline] f_setown+0x113/0x1a0 fs/fcntl.c:138 do_fcntl+0x128/0x13b0 fs/fcntl.c:377 __do_sys_fcntl fs/fcntl.c:454 [inline] __se_sys_fcntl+0xd5/0x1b0 fs/fcntl.c:439 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae INITIAL READ USE at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xd9/0x120 kernel/locking/spinlock.c:236 send_sigio+0x2f/0x300 fs/fcntl.c:778 kill_fasync_rcu fs/fcntl.c:1003 [inline] kill_fasync+0x1e4/0x430 fs/fcntl.c:1017 snd_timer_user_ccallback+0x370/0x540 sound/core/timer.c:1386 snd_timer_notify1+0x1ad/0x350 sound/core/timer.c:516 snd_timer_start1+0x53d/0x640 sound/core/timer.c:578 snd_timer_start sound/core/timer.c:696 [inline] snd_timer_user_start sound/core/timer.c:1984 [inline] __snd_timer_user_ioctl+0xae7/0x54c0 sound/core/timer.c:2107 snd_timer_user_ioctl+0x5d/0x80 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae } ... key at: [<ffffffff90c42cc0>] __alloc_file.__key+0x0/0x10 ... acquired at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xd9/0x120 kernel/locking/spinlock.c:236 send_sigio+0x2f/0x300 fs/fcntl.c:778 kill_fasync_rcu fs/fcntl.c:1003 [inline] kill_fasync+0x1e4/0x430 fs/fcntl.c:1017 snd_timer_user_ccallback+0x370/0x540 sound/core/timer.c:1386 snd_timer_notify1+0x1ad/0x350 sound/core/timer.c:516 snd_timer_start1+0x53d/0x640 sound/core/timer.c:578 snd_timer_start sound/core/timer.c:696 [inline] snd_timer_user_start sound/core/timer.c:1984 [inline] __snd_timer_user_ioctl+0xae7/0x54c0 sound/core/timer.c:2107 snd_timer_user_ioctl+0x5d/0x80 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae -> (&new->fa_lock){....}-{2:2} { INITIAL READ USE at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xd9/0x120 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:996 [inline] kill_fasync+0x13b/0x430 fs/fcntl.c:1017 snd_timer_user_ccallback+0x370/0x540 sound/core/timer.c:1386 snd_timer_notify1+0x1ad/0x350 sound/core/timer.c:516 snd_timer_start1+0x53d/0x640 sound/core/timer.c:578 snd_timer_start sound/core/timer.c:696 [inline] snd_timer_user_start sound/core/timer.c:1984 [inline] __snd_timer_user_ioctl+0xae7/0x54c0 sound/core/timer.c:2107 snd_timer_user_ioctl+0x5d/0x80 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae } ... key at: [<ffffffff90c43940>] fasync_insert_entry.__key+0x0/0x20 ... acquired at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_read_lock_irqsave include/linux/rwlock_api_smp.h:160 [inline] _raw_read_lock_irqsave+0xd9/0x120 kernel/locking/spinlock.c:236 kill_fasync_rcu fs/fcntl.c:996 [inline] kill_fasync+0x13b/0x430 fs/fcntl.c:1017 snd_timer_user_ccallback+0x370/0x540 sound/core/timer.c:1386 snd_timer_notify1+0x1ad/0x350 sound/core/timer.c:516 snd_timer_start1+0x53d/0x640 sound/core/timer.c:578 snd_timer_start sound/core/timer.c:696 [inline] snd_timer_user_start sound/core/timer.c:1984 [inline] __snd_timer_user_ioctl+0xae7/0x54c0 sound/core/timer.c:2107 snd_timer_user_ioctl+0x5d/0x80 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae -> (&timer->lock){....}-{2:2} { INITIAL USE at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162 snd_timer_resolution sound/core/timer.c:489 [inline] snd_timer_user_params sound/core/timer.c:1851 [inline] __snd_timer_user_ioctl+0x1a3f/0x54c0 sound/core/timer.c:2100 snd_timer_user_ioctl+0x5d/0x80 sound/core/timer.c:2128 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae } ... key at: [<ffffffff90f96160>] snd_timer_new.__key+0x0/0x20 ... acquired at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162 snd_timer_notify+0x105/0x3e0 sound/core/timer.c:1086 snd_pcm_action sound/core/pcm_native.c:1364 [inline] snd_pcm_start+0x383/0x400 sound/core/pcm_native.c:1470 __snd_pcm_lib_xfer+0x13e0/0x18a0 sound/core/pcm_lib.c:2308 snd_pcm_oss_write3+0x202/0x390 sound/core/oss/pcm_oss.c:1253 snd_pcm_oss_write2 sound/core/oss/pcm_oss.c:1393 [inline] snd_pcm_oss_sync1+0x3a6/0x7f0 sound/core/oss/pcm_oss.c:1627 snd_pcm_oss_sync+0x9cf/0xf00 sound/core/oss/pcm_oss.c:1693 snd_pcm_oss_release+0x119/0x270 sound/core/oss/pcm_oss.c:2590 __fput+0x3b9/0x820 fs/file_table.c:317 task_work_run+0x146/0x1c0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:37 [inline] do_exit+0x547/0x1eb0 kernel/exit.c:795 do_group_exit+0x23b/0x2f0 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:934 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae -> (&group->lock){..-.}-{2:2} { IN-SOFTIRQ-W at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162 snd_pcm_period_elapsed+0x2c/0x210 sound/core/pcm_lib.c:1848 dummy_hrtimer_callback+0x87/0x190 sound/drivers/dummy.c:377 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x50b/0xa60 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x1a1/0x580 kernel/time/hrtimer.c:1766 __do_softirq+0x382/0x793 kernel/softirq.c:558 __irq_exit_rcu+0xec/0x170 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] acpi_safe_halt drivers/acpi/processor_idle.c:115 [inline] acpi_idle_do_entry drivers/acpi/processor_idle.c:556 [inline] acpi_idle_enter+0x42d/0x790 drivers/acpi/processor_idle.c:691 cpuidle_enter_state+0x517/0xed0 drivers/cpuidle/cpuidle.c:237 cpuidle_enter+0x59/0x90 drivers/cpuidle/cpuidle.c:351 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:236 [inline] do_idle+0x3d2/0x640 kernel/sched/idle.c:303 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:400 start_kernel+0x4bf/0x56e init/main.c:1140 secondary_startup_64_no_verify+0xc4/0xcb INITIAL USE at: lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0xcf/0x110 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:374 [inline] snd_pcm_group_lock_irq sound/core/pcm_native.c:97 [inline] snd_pcm_stream_lock_irq sound/core/pcm_native.c:136 [inline] snd_pcm_hw_params+0x164/0x1860 sound/core/pcm_native.c:726 snd_pcm_oss_change_params_locked+0x1f21/0x3c80 sound/core/oss/pcm_oss.c:976 snd_pcm_oss_make_ready_locked sound/core/oss/pcm_oss.c:1198 [inline] snd_pcm_oss_write1+0x249/0x1130 sound/core/oss/pcm_oss.c:1416 vfs_write+0x303/0xd40 fs/read_write.c:589 ksys_write+0x19b/0x2c0 fs/read_write.c:644 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae } ... key at: [<ffffffff90f96980>] snd_pcm_group_init.__key+0x0/0x20 ... acquired at: mark_lock+0x21c/0x350 kernel/locking/lockdep.c:4607 __lock_acquire+0xb81/0x1f80 kernel/locking/lockdep.c:4983 lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162 snd_pcm_period_elapsed+0x2c/0x210 sound/core/pcm_lib.c:1848 dummy_hrtimer_callback+0x87/0x190 sound/drivers/dummy.c:377 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x50b/0xa60 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x1a1/0x580 kernel/time/hrtimer.c:1766 __do_softirq+0x382/0x793 kernel/softirq.c:558 __irq_exit_rcu+0xec/0x170 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] acpi_safe_halt drivers/acpi/processor_idle.c:115 [inline] acpi_idle_do_entry drivers/acpi/processor_idle.c:556 [inline] acpi_idle_enter+0x42d/0x790 drivers/acpi/processor_idle.c:691 cpuidle_enter_state+0x517/0xed0 drivers/cpuidle/cpuidle.c:237 cpuidle_enter+0x59/0x90 drivers/cpuidle/cpuidle.c:351 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:236 [inline] do_idle+0x3d2/0x640 kernel/sched/idle.c:303 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:400 start_kernel+0x4bf/0x56e init/main.c:1140 secondary_startup_64_no_verify+0xc4/0xcb stack backtrace: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.18.0-rc3-syzkaller-00196-g45ab9400e73f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 print_irq_inversion_bug+0x58c/0x6f0 kernel/locking/lockdep.c:4014 mark_lock_irq+0x9d2/0xf00 kernel/locking/lockdep.c:4177 mark_lock+0x21c/0x350 kernel/locking/lockdep.c:4607 __lock_acquire+0xb81/0x1f80 kernel/locking/lockdep.c:4983 lock_acquire+0x1a7/0x400 kernel/locking/lockdep.c:5641 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162 snd_pcm_period_elapsed+0x2c/0x210 sound/core/pcm_lib.c:1848 dummy_hrtimer_callback+0x87/0x190 sound/drivers/dummy.c:377 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x50b/0xa60 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x1a1/0x580 kernel/time/hrtimer.c:1766 __do_softirq+0x382/0x793 kernel/softirq.c:558 __irq_exit_rcu+0xec/0x170 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1097 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x12/0x20 RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:22 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline] RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline] RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:116 [inline] RIP: 0010:acpi_idle_do_entry drivers/acpi/processor_idle.c:556 [inline] RIP: 0010:acpi_idle_enter+0x42d/0x790 drivers/acpi/processor_idle.c:691 Code: fc 48 83 e3 08 44 8b 7c 24 04 0f 85 22 01 00 00 4c 8d 74 24 40 e8 93 fd 00 fd eb 0c e8 ac 59 fa fc 0f 00 2d f5 a1 68 06 fb f4 <4c> 89 f3 48 c1 eb 03 42 80 3c 23 00 74 08 4c 89 f7 e8 5d 3f 4b fd RSP: 0018:ffffffff8c807bc0 EFLAGS: 00000282 RAX: ea48baa34ad6ff00 RBX: 0000000000000000 RCX: ffffffff90b7a603 RDX: dffffc0000000000 RSI: ffffffff8a8d0480 RDI: ffffffff8ae88c20 RBP: ffffffff8c807c70 R08: ffffffff818ca320 R09: fffffbfff19176c9 R10: fffffbfff19176c9 R11: 1ffffffff19176c8 R12: dffffc0000000000 R13: ffff888016bdf064 R14: ffffffff8c807c00 R15: 0000000000000001 cpuidle_enter_state+0x517/0xed0 drivers/cpuidle/cpuidle.c:237 ---------------- Code disassembly (best guess): 0: fc cld 1: 48 83 e3 08 and $0x8,%rbx 5: 44 8b 7c 24 04 mov 0x4(%rsp),%r15d a: 0f 85 22 01 00 00 jne 0x132 10: 4c 8d 74 24 40 lea 0x40(%rsp),%r14 15: e8 93 fd 00 fd callq 0xfd00fdad 1a: eb 0c jmp 0x28 1c: e8 ac 59 fa fc callq 0xfcfa59cd 21: 0f 00 2d f5 a1 68 06 verw 0x668a1f5(%rip) # 0x668a21d 28: fb sti 29: f4 hlt * 2a: 4c 89 f3 mov %r14,%rbx <-- trapping instruction 2d: 48 c1 eb 03 shr $0x3,%rbx 31: 42 80 3c 23 00 cmpb $0x0,(%rbx,%r12,1) 36: 74 08 je 0x40 38: 4c 89 f7 mov %r14,%rdi 3b: e8 5d 3f 4b fd callq 0xfd4b3f9d

1 0