May 2022 - Alsa-devel - mailman.alsa-project.org

[PATCH] ASoC: lm49453: Drop no-op remove function
by Uwe Kleine-König 27 May '22

27 May '22

A remove callback that just returns 0 is equivalent to no callback at all as can be seen in i2c_device_remove(). So simplify accordingly. Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> --- sound/soc/codecs/lm49453.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/sound/soc/codecs/lm49453.c b/sound/soc/codecs/lm49453.c index 973d781b4b6a..86cead5022c0 100644 --- a/sound/soc/codecs/lm49453.c +++ b/sound/soc/codecs/lm49453.c @@ -1443,11 +1443,6 @@ static int lm49453_i2c_probe(struct i2c_client *i2c, return ret; } -static int lm49453_i2c_remove(struct i2c_client *client) -{ - return 0; -} - static const struct i2c_device_id lm49453_i2c_id[] = { { "lm49453", 0 }, { } @@ -1459,7 +1454,6 @@ static struct i2c_driver lm49453_i2c_driver = { .name = "lm49453", }, .probe = lm49453_i2c_probe, - .remove = lm49453_i2c_remove, .id_table = lm49453_i2c_id, }; base-commit: 4b0986a3613c92f4ec1bdc7f60ec66fea135991f -- 2.36.1

1 1

[PATCH] ASoC: Intel: common: fix typo for tplg naming
by David Lin 26 May '22

26 May '22

Correct typo form sof-adl-mx98360a-nau8825.tplg to sof-adl-max98360a-nau8825.tplg. The reason is tplg naming without naming limitaion of length. It will be consistency with sof topology generation. Signed-off-by: David Lin <CTLIN0(a)nuvoton.com> --- sound/soc/intel/common/soc-acpi-intel-adl-match.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/intel/common/soc-acpi-intel-adl-match.c b/sound/soc/intel/common/soc-acpi-intel-adl-match.c index e6e52c7b6803..c1385161cdc8 100644 --- a/sound/soc/intel/common/soc-acpi-intel-adl-match.c +++ b/sound/soc/intel/common/soc-acpi-intel-adl-match.c @@ -453,7 +453,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_machines[] = { .drv_name = "adl_mx98360a_nau8825", .machine_quirk = snd_soc_acpi_codec_list, .quirk_data = &adl_max98360a_amp, - .sof_tplg_filename = "sof-adl-mx98360a-nau8825.tplg", + .sof_tplg_filename = "sof-adl-max98360a-nau8825.tplg", }, { .id = "RTL5682", -- 2.25.1

3 2

[PATCH] ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform Clock" is not in the DAPM
by Oder Chiou 26 May '22

26 May '22

The pin "Platform Clock" was only used by the Intel Byt CR platform. In the others, the error log will be informed. The patch will set the flag to avoid the pin "Platform Clock" manipulated by the other platforms. Signed-off-by: Oder Chiou <oder_chiou(a)realtek.com> Reported-by: Sameer Pujar <spujar(a)nvidia.com> --- sound/soc/codecs/rt5640.c | 11 +++++++++-- sound/soc/codecs/rt5640.h | 2 ++ sound/soc/intel/boards/bytcr_rt5640.c | 2 ++ 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c index 12da2bea1a7b..69c80d80ed9d 100644 --- a/sound/soc/codecs/rt5640.c +++ b/sound/soc/codecs/rt5640.c @@ -2094,12 +2094,14 @@ EXPORT_SYMBOL_GPL(rt5640_sel_asrc_clk_src); void rt5640_enable_micbias1_for_ovcd(struct snd_soc_component *component) { struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component); + struct rt5640_priv *rt5640 = snd_soc_component_get_drvdata(component); snd_soc_dapm_mutex_lock(dapm); snd_soc_dapm_force_enable_pin_unlocked(dapm, "LDO2"); snd_soc_dapm_force_enable_pin_unlocked(dapm, "MICBIAS1"); /* OVCD is unreliable when used with RCCLK as sysclk-source */ - snd_soc_dapm_force_enable_pin_unlocked(dapm, "Platform Clock"); + if (rt5640->use_platform_clock) + snd_soc_dapm_force_enable_pin_unlocked(dapm, "Platform Clock"); snd_soc_dapm_sync_unlocked(dapm); snd_soc_dapm_mutex_unlock(dapm); } @@ -2108,9 +2110,11 @@ EXPORT_SYMBOL_GPL(rt5640_enable_micbias1_for_ovcd); void rt5640_disable_micbias1_for_ovcd(struct snd_soc_component *component) { struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component); + struct rt5640_priv *rt5640 = snd_soc_component_get_drvdata(component); snd_soc_dapm_mutex_lock(dapm); - snd_soc_dapm_disable_pin_unlocked(dapm, "Platform Clock"); + if (rt5640->use_platform_clock) + snd_soc_dapm_disable_pin_unlocked(dapm, "Platform Clock"); snd_soc_dapm_disable_pin_unlocked(dapm, "MICBIAS1"); snd_soc_dapm_disable_pin_unlocked(dapm, "LDO2"); snd_soc_dapm_sync_unlocked(dapm); @@ -2535,6 +2539,9 @@ static void rt5640_enable_jack_detect(struct snd_soc_component *component, rt5640->jd_gpio_irq_requested = true; } + if (jack_data && jack_data->use_platform_clock) + rt5640->use_platform_clock = jack_data->use_platform_clock; + ret = request_irq(rt5640->irq, rt5640_irq, IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_ONESHOT, "rt5640", rt5640); diff --git a/sound/soc/codecs/rt5640.h b/sound/soc/codecs/rt5640.h index 9e49b9a0ccaa..505c93514051 100644 --- a/sound/soc/codecs/rt5640.h +++ b/sound/soc/codecs/rt5640.h @@ -2155,11 +2155,13 @@ struct rt5640_priv { bool jd_inverted; unsigned int ovcd_th; unsigned int ovcd_sf; + bool use_platform_clock; }; struct rt5640_set_jack_data { int codec_irq_override; struct gpio_desc *jd_gpio; + bool use_platform_clock; }; int rt5640_dmic_enable(struct snd_soc_component *component, diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c index 7b948a219177..ed9fa1728722 100644 --- a/sound/soc/intel/boards/bytcr_rt5640.c +++ b/sound/soc/intel/boards/bytcr_rt5640.c @@ -1191,12 +1191,14 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime) { struct snd_soc_card *card = runtime->card; struct byt_rt5640_private *priv = snd_soc_card_get_drvdata(card); + struct rt5640_set_jack_data *jack_data = &priv->jack_data; struct snd_soc_component *component = asoc_rtd_to_codec(runtime, 0)->component; const struct snd_soc_dapm_route *custom_map = NULL; int num_routes = 0; int ret; card->dapm.idle_bias_off = true; + jack_data->use_platform_clock = true; /* Start with RC clk for jack-detect (we disable MCLK below) */ if (byt_rt5640_quirk & BYT_RT5640_MCLK_EN) -- 2.35.3

3 2

Update mapping for the new Gigabyte Aorus Pro WiFi rev 1.2
by GitHub pull_request - edited 26 May '22

26 May '22

alsa-project/alsa-ucm-conf pull request #156 was edited from 13r0ck: Requires kernel patch from: https://bugzilla.kernel.org/attachment.cgi?id=301036&action=diff This doesn't fix the front mic for some reason (any ideas please?)~~, as well I am not sure if this will cause a regression for the 1.1 board~~ Request URL : https://github.com/alsa-project/alsa-ucm-conf/pull/156 Patch URL : https://github.com/alsa-project/alsa-ucm-conf/pull/156.patch Repository URL: https://github.com/alsa-project/alsa-ucm-conf

1 0

[PATCH] ALSA: usb-audio: Cancel pending work at closing a MIDI substream
by Takashi Iwai 25 May '22

25 May '22

At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing. Reported-by: syzbot+6912c9592caca7ca0e7d(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/000000000000e7e75005dfd07cf6@google.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/usb/midi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index 7c6ca2b433a5..344fbeadf161 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1145,6 +1145,9 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream) static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream) { + struct usbmidi_out_port *port = substream->runtime->private_data; + + cancel_work_sync(&port->ep->work); return substream_open(substream, 0, 0); } -- 2.35.3

1 0

[PATCH] ASoC: stm32: sai: Use of_device_get_match_data() to simplify code
by Tang Bin 25 May '22

25 May '22

Retrieve of match data, it's better and cleaner to use 'of_device_get_match_data' over 'of_match_device'. Signed-off-by: Tang Bin <tangbin(a)cmss.chinamobile.com> --- sound/soc/stm/stm32_sai_sub.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c index dd636af81..d300605a2 100644 --- a/sound/soc/stm/stm32_sai_sub.c +++ b/sound/soc/stm/stm32_sai_sub.c @@ -1500,7 +1500,6 @@ static int stm32_sai_sub_parse_of(struct platform_device *pdev, static int stm32_sai_sub_probe(struct platform_device *pdev) { struct stm32_sai_sub_data *sai; - const struct of_device_id *of_id; const struct snd_dmaengine_pcm_config *conf = &stm32_sai_pcm_config; int ret; @@ -1508,10 +1507,9 @@ static int stm32_sai_sub_probe(struct platform_device *pdev) if (!sai) return -ENOMEM; - of_id = of_match_device(stm32_sai_sub_ids, &pdev->dev); - if (!of_id) + sai->id = (uintptr_t)of_device_get_match_data(&pdev->dev); + if (!sai->id) return -EINVAL; - sai->id = (uintptr_t)of_id->data; sai->pdev = pdev; mutex_init(&sai->ctrl_lock); -- 2.20.1.windows.1

4 6

[PATCH] ALSA: usb-audio: Add mixer mapping for Gigabyte B450/550 Mobos
by Takashi Iwai 25 May '22

25 May '22

This patch implements a static mapping for Gigabyte B450/550 Mobos so that the mixer elements appear reasonably and jack detections work properly. Reported-and-tested-by: Brock Szuszczewicz <brock(a)system76.com> BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215988 Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/usb/mixer_maps.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c index 7ef7a8abcc2b..3c795675f048 100644 --- a/sound/usb/mixer_maps.c +++ b/sound/usb/mixer_maps.c @@ -439,6 +439,31 @@ static const struct usbmix_name_map msi_mpg_x570s_carbon_max_wifi_alc4080_map[] {} }; +/* Gigabyte B450/550 Mobo */ +static const struct usbmix_name_map gigabyte_b450_map[] = { + { 24, NULL }, /* OT, IEC958?, disabled */ + { 21, "Speaker" }, /* OT */ + { 29, "Speaker Playback" }, /* FU */ + { 22, "Headphone" }, /* OT */ + { 30, "Headphone Playback" }, /* FU */ + { 11, "Line" }, /* IT */ + { 27, "Line Capture" }, /* FU */ + { 12, "Mic" }, /* IT */ + { 28, "Mic Capture" }, /* FU */ + { 9, "Front Mic" }, /* IT */ + { 25, "Front Mic Capture" }, /* FU */ + {} +}; + +static const struct usbmix_connector_map gigabyte_b450_connector_map[] = { + { 13, 21 }, /* Speaker */ + { 14, 22 }, /* Headphone */ + { 19, 11 }, /* Line */ + { 20, 12 }, /* Mic */ + { 17, 9 }, /* Front Mic */ + {} +}; + /* * Control map entries */ @@ -581,6 +606,11 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = { .map = trx40_mobo_map, .connector_map = trx40_mobo_connector_map, }, + { /* Gigabyte B450/550 Mobo */ + .id = USB_ID(0x0414, 0xa00d), + .map = gigabyte_b450_map, + .connector_map = gigabyte_b450_connector_map, + }, { /* ASUS ROG Zenith II */ .id = USB_ID(0x0b05, 0x1916), .map = asus_rog_map, -- 2.35.3

1 0

conf: Use ino64_t to save and compare inode numbers
by GitHub pull_request - opened 25 May '22

25 May '22

alsa-project/alsa-lib pull request #231 was opened from smcv: On 32-bit platforms when not using the large-file-support ABI, struct stat64 contains ino64_t which is 64-bit, while ino_t is only 32-bit. snd_config_update_r() checks whether a file has been replaced by saving the ino member of a struct stat64 and comparing it with a previously-saved inode number. On 32-bit platforms, assigning the 64-bit member of struct stat64 to a 32-bit member of struct finfo will truncate it modulo 1<<32, which could conceivably result in libasound not reloading configuration when it should (although the inode number space is large enough to make this failure mode highly unlikely). --- This is from source code inspection while looking at #223, I haven't seen a genuine user-observable bug result from this. cc @dos1, @perexg, @bertogg Request URL : https://github.com/alsa-project/alsa-lib/pull/231 Patch URL : https://github.com/alsa-project/alsa-lib/pull/231.patch Repository URL: https://github.com/alsa-project/alsa-lib

1 0

[PATCH v7 0/1] firmware: mtk: add adsp ipc protocol for SOF
by Allen-KH Cheng 25 May '22

25 May '22

This patch provides mediatek adsp ipc support for SOF. ADSP IPC protocol offers (send/recv) interfaces using mediatek-mailbox APIs. This patch was tested and confirmed to with SOF fw on MT8195 cherry board. Based on matthias.bgg/linux.git, v5.18-next/soc changes since v6: - rebase to matthias.bgg/linux.git, v5.18-next/soc - Prefer "GPL" over "GPL v2" for MODULE_LICENSE changes since v5: - fix WARNING: modpost: missing MODULE_LICENSE() in drivers/mailbox /mtk-adsp-mailbox.o. Add MODULE_LICENSE in the last line. - Due to WARNING: Missing or malformed SPDX-License-Identifier tag in line 1 in checkpatch, we don't remove SPDX-License in line 1. changes since v4: - add error message for wrong mbox chan changes since v3: - rebase on v5.16-rc8 - update reviewers changes since v2: - add out tag for two memory free phases changes since v1: - add comments for mtk_adsp_ipc_send and mtk_adsp_ipc_recv - remove useless MODULE_LICENSE - change label name to out_free Allen-KH Cheng (1): firmware: mediatek: add adsp ipc protocol interface drivers/firmware/Kconfig | 1 + drivers/firmware/Makefile | 1 + drivers/firmware/mediatek/Kconfig | 9 + drivers/firmware/mediatek/Makefile | 2 + drivers/firmware/mediatek/mtk-adsp-ipc.c | 161 ++++++++++++++++++ .../linux/firmware/mediatek/mtk-adsp-ipc.h | 65 +++++++ 6 files changed, 239 insertions(+) create mode 100644 drivers/firmware/mediatek/Kconfig create mode 100644 drivers/firmware/mediatek/Makefile create mode 100644 drivers/firmware/mediatek/mtk-adsp-ipc.c create mode 100644 include/linux/firmware/mediatek/mtk-adsp-ipc.h -- 2.18.0

4 6

[syzbot] KASAN: use-after-free Read in __snd_rawmidi_transmit_ack
by syzbot 25 May '22

25 May '22

Hello, syzbot found the following issue on: HEAD commit: 3b5e1590a267 Merge tag 'gpio-fixes-for-v5.18' of git://git.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1195135ef00000 kernel config: https://syzkaller.appspot.com/x/.config?x=902c5209311d387c dashboard link: https://syzkaller.appspot.com/bug?extid=6912c9592caca7ca0e7d compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 Unfortunately, I don't have any reproducer for this issue yet. IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+6912c9592caca7ca0e7d(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in __snd_rawmidi_transmit_ack+0x2cd/0x2f0 sound/core/rawmidi.c:1348 Read of size 8 at addr ffff888078b36410 by task kworker/1:1H/754 CPU: 1 PID: 754 Comm: kworker/1:1H Not tainted 5.18.0-rc7-syzkaller-00136-g3b5e1590a267 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_highpri snd_usbmidi_out_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 __snd_rawmidi_transmit_ack+0x2cd/0x2f0 sound/core/rawmidi.c:1348 snd_rawmidi_transmit+0xae/0xf0 sound/core/rawmidi.c:1415 snd_usbmidi_standard_output+0x264/0xc10 sound/usb/midi.c:650 snd_usbmidi_do_output+0x200/0x510 sound/usb/midi.c:311 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 </TASK> Allocated by task 9345: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524 kmalloc include/linux/slab.h:581 [inline] kzalloc include/linux/slab.h:714 [inline] snd_rawmidi_runtime_create sound/core/rawmidi.c:148 [inline] open_substream+0xe9/0x8b0 sound/core/rawmidi.c:306 rawmidi_open_priv+0x591/0x6f0 sound/core/rawmidi.c:357 snd_rawmidi_kernel_open+0x1b5/0x270 sound/core/rawmidi.c:392 midisynth_use+0xee/0x270 sound/core/seq/seq_midi.c:215 subscribe_port sound/core/seq/seq_ports.c:412 [inline] check_and_subscribe_port+0x89a/0xb80 sound/core/seq/seq_ports.c:495 snd_seq_port_connect+0x382/0x540 sound/core/seq/seq_ports.c:581 snd_seq_ioctl_subscribe_port+0x1fc/0x400 sound/core/seq/seq_clientmgr.c:1492 snd_seq_kernel_client_ctl+0x102/0x1e0 sound/core/seq/seq_clientmgr.c:2369 snd_seq_oss_midi_open+0x582/0x6e0 sound/core/seq/oss/seq_oss_midi.c:359 snd_seq_oss_synth_setup_midi+0x12d/0x530 sound/core/seq/oss/seq_oss_synth.c:269 snd_seq_oss_open+0x8c3/0xa80 sound/core/seq/oss/seq_oss_init.c:260 odev_open+0x6c/0x90 sound/core/seq/oss/seq_oss.c:128 soundcore_open+0x44e/0x620 sound/sound_core.c:593 chrdev_open+0x266/0x770 fs/char_dev.c:414 do_dentry_open+0x4a1/0x11e0 fs/open.c:824 do_open fs/namei.c:3476 [inline] path_openat+0x1c71/0x2910 fs/namei.c:3609 do_filp_open+0x1aa/0x400 fs/namei.c:3636 do_sys_openat2+0x16d/0x4c0 fs/open.c:1213 do_sys_open fs/open.c:1229 [inline] __do_sys_openat fs/open.c:1245 [inline] __se_sys_openat fs/open.c:1240 [inline] __x64_sys_openat+0x13f/0x1f0 fs/open.c:1240 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 9345: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x166/0x1a0 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1754 slab_free mm/slub.c:3510 [inline] kfree+0xd6/0x4d0 mm/slub.c:4552 snd_rawmidi_runtime_free sound/core/rawmidi.c:177 [inline] close_substream.part.0+0x18d/0x720 sound/core/rawmidi.c:528 close_substream sound/core/rawmidi.c:507 [inline] rawmidi_release_priv+0x192/0x270 sound/core/rawmidi.c:547 snd_rawmidi_kernel_release+0x39/0xd0 sound/core/rawmidi.c:564 midisynth_unuse+0x45/0x80 sound/core/seq/seq_midi.c:244 unsubscribe_port sound/core/seq/seq_ports.c:437 [inline] __delete_and_unsubscribe_port+0x270/0x4c0 sound/core/seq/seq_ports.c:537 snd_seq_port_disconnect+0x41c/0x5d0 sound/core/seq/seq_ports.c:616 snd_seq_ioctl_unsubscribe_port+0x1fc/0x400 sound/core/seq/seq_clientmgr.c:1537 snd_seq_kernel_client_ctl+0x102/0x1e0 sound/core/seq/seq_clientmgr.c:2369 snd_seq_oss_midi_close+0x44f/0x4d0 sound/core/seq/oss/seq_oss_midi.c:404 snd_seq_oss_synth_reset+0x422/0x880 sound/core/seq/oss/seq_oss_synth.c:406 snd_seq_oss_reset+0x6f/0x290 sound/core/seq/oss/seq_oss_init.c:435 snd_seq_oss_release+0x78/0x1a0 sound/core/seq/oss/seq_oss_init.c:412 odev_release+0x4f/0x70 sound/core/seq/oss/seq_oss.c:144 __fput+0x277/0x9d0 fs/file_table.c:317 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 get_signal+0x1c5/0x24c0 kernel/signal.c:2641 arch_do_signal_or_restart+0x82/0x20f0 arch/x86/kernel/signal.c:867 exit_to_user_mode_loop kernel/entry/common.c:166 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:294 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff888078b36400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 16 bytes inside of 512-byte region [ffff888078b36400, ffff888078b36600) The buggy address belongs to the physical page: page:ffffea0001e2cd00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78b34 head:ffffea0001e2cd00 order:2 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888010c41c80 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2967, tgid 2967 (udevadm), ts 15461279103, free_ts 12532036824 prep_new_page mm/page_alloc.c:2441 [inline] get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1799 [inline] allocate_slab+0x26c/0x3c0 mm/slub.c:1944 new_slab mm/slub.c:2004 [inline] ___slab_alloc+0x8df/0xf20 mm/slub.c:3005 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3092 slab_alloc_node mm/slub.c:3183 [inline] __kmalloc_node_track_caller+0x2cb/0x360 mm/slub.c:4947 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0xde/0x340 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1300 [inline] alloc_uevent_skb+0x7b/0x210 lib/kobject_uevent.c:290 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:409 [inline] kobject_uevent_env+0xc42/0x1660 lib/kobject_uevent.c:593 kobject_synth_uevent+0x701/0x850 lib/kobject_uevent.c:208 store_uevent+0x12/0x20 kernel/module.c:1166 module_attr_store+0x50/0x80 kernel/params.c:919 sysfs_kf_write+0x110/0x160 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x3f8/0x610 fs/kernfs/file.c:291 call_write_iter include/linux/fs.h:2050 [inline] new_sync_write+0x38a/0x560 fs/read_write.c:504 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1356 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406 free_unref_page_prepare mm/page_alloc.c:3328 [inline] free_unref_page+0x19/0x6a0 mm/page_alloc.c:3423 free_contig_range+0xb1/0x180 mm/page_alloc.c:9418 destroy_args+0xa8/0x646 mm/debug_vm_pgtable.c:1018 debug_vm_pgtable+0x2a51/0x2ae3 mm/debug_vm_pgtable.c:1332 do_one_initcall+0x103/0x650 init/main.c:1298 do_initcall_level init/main.c:1371 [inline] do_initcalls init/main.c:1387 [inline] do_basic_setup init/main.c:1406 [inline] kernel_init_freeable+0x6b1/0x73a init/main.c:1613 kernel_init+0x1a/0x1d0 init/main.c:1502 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Memory state around the buggy address: ffff888078b36300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888078b36380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888078b36400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888078b36480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888078b36500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0