June 2022 - Alsa-devel - mailman.alsa-project.org

Re: [syzbot] KASAN: use-after-free Read in snd_rawmidi_transmit
by syzbot 01 Jun '22

01 Jun '22

syzbot has found a reproducer for the following issue on: HEAD commit: 2a5699b0de4e Merge tag 'leds-5.19-rc1' of git://git.kernel.. git tree: upstream console+strace: https://syzkaller.appspot.com/x/log.txt?x=13df4d13f00000 kernel config: https://syzkaller.appspot.com/x/.config?x=f915857c44e13980 dashboard link: https://syzkaller.appspot.com/bug?extid=39e3268af9968f153591 compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=119d1fcbf00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17716bedf00000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+39e3268af9968f153591(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1286 [inline] BUG: KASAN: use-after-free in snd_rawmidi_transmit+0x3f3/0x420 sound/core/rawmidi.c:1411 Read of size 1 at addr ffff888074d3c07f by task kworker/1:1H/756 CPU: 1 PID: 756 Comm: kworker/1:1H Not tainted 5.18.0-syzkaller-11650-g2a5699b0de4e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_highpri snd_usbmidi_out_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 print_address_description+0x65/0x4b0 mm/kasan/report.c:313 print_report+0xf4/0x210 mm/kasan/report.c:429 kasan_report+0xfb/0x130 mm/kasan/report.c:491 __snd_rawmidi_transmit_peek sound/core/rawmidi.c:1286 [inline] snd_rawmidi_transmit+0x3f3/0x420 sound/core/rawmidi.c:1411 snd_usbmidi_standard_output+0x202/0xf30 sound/usb/midi.c:650 snd_usbmidi_do_output+0x20e/0x530 sound/usb/midi.c:311 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 3983: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:515 kasan_kmalloc include/linux/kasan.h:234 [inline] __kmalloc_node+0x262/0x400 mm/slub.c:4465 kmalloc_node include/linux/slab.h:623 [inline] kvmalloc_node+0x6e/0x160 mm/util.c:613 kvmalloc include/linux/slab.h:750 [inline] kvzalloc include/linux/slab.h:758 [inline] snd_rawmidi_runtime_create sound/core/rawmidi.c:162 [inline] open_substream+0x2a1/0x6d0 sound/core/rawmidi.c:306 rawmidi_open_priv+0xc2/0x6a0 sound/core/rawmidi.c:357 snd_rawmidi_kernel_open+0x1e3/0x280 sound/core/rawmidi.c:392 midisynth_use+0xf9/0x2b0 sound/core/seq/seq_midi.c:215 subscribe_port sound/core/seq/seq_ports.c:412 [inline] check_and_subscribe_port+0x633/0xac0 sound/core/seq/seq_ports.c:495 snd_seq_port_connect+0x27e/0x480 sound/core/seq/seq_ports.c:581 snd_seq_ioctl_subscribe_port+0x394/0x750 sound/core/seq/seq_clientmgr.c:1492 snd_seq_oss_midi_open+0x44b/0x9b0 sound/core/seq/oss/seq_oss_midi.c:359 snd_seq_oss_synth_setup_midi+0x126/0x530 sound/core/seq/oss/seq_oss_synth.c:269 snd_seq_oss_open+0x96d/0x1020 sound/core/seq/oss/seq_oss_init.c:260 odev_open+0x5e/0x90 sound/core/seq/oss/seq_oss.c:128 chrdev_open+0x5fb/0x680 fs/char_dev.c:414 do_dentry_open+0x789/0x1040 fs/open.c:848 do_open fs/namei.c:3527 [inline] path_openat+0x26c0/0x2ec0 fs/namei.c:3660 do_filp_open+0x277/0x4f0 fs/namei.c:3687 do_sys_openat2+0x13b/0x500 fs/open.c:1278 do_sys_open fs/open.c:1294 [inline] __do_sys_openat fs/open.c:1310 [inline] __se_sys_openat fs/open.c:1305 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1305 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 3983: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4c/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0xd8/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1727 [inline] slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1753 slab_free mm/slub.c:3507 [inline] kfree+0xc6/0x210 mm/slub.c:4555 snd_rawmidi_runtime_free sound/core/rawmidi.c:176 [inline] close_substream+0x38a/0x5f0 sound/core/rawmidi.c:528 rawmidi_release_priv+0xf1/0x180 sound/core/rawmidi.c:547 snd_rawmidi_kernel_release+0x42/0xa0 sound/core/rawmidi.c:564 unsubscribe_port sound/core/seq/seq_ports.c:437 [inline] __delete_and_unsubscribe_port+0x15c/0x330 sound/core/seq/seq_ports.c:537 snd_seq_port_disconnect+0x533/0x660 sound/core/seq/seq_ports.c:616 snd_seq_ioctl_unsubscribe_port+0x394/0x750 sound/core/seq/seq_clientmgr.c:1537 snd_seq_oss_midi_close+0x33f/0x740 sound/core/seq/oss/seq_oss_midi.c:404 snd_seq_oss_synth_reset+0x3b6/0x9d0 sound/core/seq/oss/seq_oss_synth.c:406 snd_seq_oss_reset+0x5b/0x240 sound/core/seq/oss/seq_oss_init.c:435 snd_seq_oss_release+0xe9/0x300 sound/core/seq/oss/seq_oss_init.c:412 odev_release+0x52/0x70 sound/core/seq/oss/seq_oss.c:144 __fput+0x3b9/0x820 fs/file_table.c:317 task_work_run+0x146/0x1c0 kernel/task_work.c:177 ptrace_notify+0x29f/0x350 kernel/signal.c:2372 ptrace_report_syscall include/linux/ptrace.h:427 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:489 [inline] syscall_exit_work+0x8c/0xe0 kernel/entry/common.c:249 syscall_exit_to_user_mode_prepare+0x62/0x80 kernel/entry/common.c:276 __syscall_exit_to_user_mode_work kernel/entry/common.c:281 [inline] syscall_exit_to_user_mode+0xa/0x60 kernel/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff888074d3c000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 127 bytes inside of 4096-byte region [ffff888074d3c000, ffff888074d3d000) The buggy address belongs to the physical page: page:ffffea0001d34e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x74d38 head:ffffea0001d34e00 order:3 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011442140 raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3983, tgid 3982 (syz-executor242), ts 217737880306, free_ts 217582307012 prep_new_page mm/page_alloc.c:2456 [inline] get_page_from_freelist+0x72b/0x7a0 mm/page_alloc.c:4198 __alloc_pages+0x259/0x560 mm/page_alloc.c:5426 alloc_slab_page+0x70/0xf0 mm/slub.c:1797 allocate_slab+0x5e/0x520 mm/slub.c:1942 new_slab mm/slub.c:2002 [inline] ___slab_alloc+0x41e/0xcd0 mm/slub.c:3002 __slab_alloc mm/slub.c:3089 [inline] slab_alloc_node mm/slub.c:3180 [inline] slab_alloc mm/slub.c:3222 [inline] __kmalloc+0x2ba/0x370 mm/slub.c:4413 kmalloc include/linux/slab.h:605 [inline] tomoyo_realpath_from_path+0xd8/0x5f0 security/tomoyo/realpath.c:254 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x22f/0x490 security/tomoyo/file.c:771 security_file_open+0x50/0x560 security/security.c:1645 do_dentry_open+0x34a/0x1040 fs/open.c:835 do_open fs/namei.c:3527 [inline] path_openat+0x26c0/0x2ec0 fs/namei.c:3660 do_filp_open+0x277/0x4f0 fs/namei.c:3687 do_sys_openat2+0x13b/0x500 fs/open.c:1278 do_sys_open fs/open.c:1294 [inline] __do_sys_openat fs/open.c:1310 [inline] __se_sys_openat fs/open.c:1305 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1305 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1371 [inline] free_pcp_prepare+0x812/0x900 mm/page_alloc.c:1421 free_unref_page_prepare mm/page_alloc.c:3343 [inline] free_unref_page+0x7d/0x390 mm/page_alloc.c:3438 free_slab mm/slub.c:2041 [inline] discard_slab mm/slub.c:2047 [inline] __unfreeze_partials+0x1ab/0x200 mm/slub.c:2521 put_cpu_partial+0x116/0x180 mm/slub.c:2597 do_slab_free mm/slub.c:3495 [inline] ___cache_free+0x118/0x1a0 mm/slub.c:3514 qlist_free_all+0x2b/0x70 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x169/0x180 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:446 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:750 [inline] slab_alloc_node mm/slub.c:3214 [inline] __kmalloc_node+0x1f3/0x400 mm/slub.c:4461 kmalloc_node include/linux/slab.h:623 [inline] kvmalloc_node+0x6e/0x160 mm/util.c:613 kvmalloc include/linux/slab.h:750 [inline] seq_buf_alloc fs/seq_file.c:38 [inline] seq_read_iter+0x1f6/0xd30 fs/seq_file.c:210 call_read_iter include/linux/fs.h:2054 [inline] new_sync_read fs/read_write.c:401 [inline] vfs_read+0xa01/0xd10 fs/read_write.c:482 ksys_read+0x19b/0x2c0 fs/read_write.c:620 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Memory state around the buggy address: ffff888074d3bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888074d3bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888074d3c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888074d3c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888074d3c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

1 0

[GIT PULL] ASoC fixes for v5.19-rc0
by Mark Brown 01 Jun '22

01 Jun '22

The following changes since commit e5cd20e0d6713138444cc3f3f982712cf9a36143: ASoC: SOF: Introduce generic (in)firmware tracing infrastructure (2022-05-20 14:56:35 +0100) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git tags/asoc-fix-v5.19-rc0 for you to fetch changes up to ab0925ab728163b854ea17da09e299254a86076e: ASoC: da7219: Small fixes for jack detection and removal (2022-05-31 10:16:59 +0200) ---------------------------------------------------------------- ASoC: Fixes for v5.19 A few more fixes that came in during the merge window - nothing huge here, there is one core fix for DPCM from Pierre but mostly driver changes. ---------------------------------------------------------------- Adam Thomson (2): ASoC: da7219: Fix pole orientation detection on certain headsets ASoC: da7219: cancel AAD related work earlier for jack removal David Lin (1): ASoC: Intel: common: fix typo for tplg naming Mark Brown (1): ASoC: da7219: Small fixes for jack detection and removal Oder Chiou (1): ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform Clock" is not in the DAPM Pierre-Louis Bossart (1): ASoC: soc-pcm: fix BE transition for TRIGGER_START Shengjiu Wang (1): ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition Syed Saba kareem (1): ASoC: SOF: amd: Fixed Build error Uwe Kleine-König (1): ASoC: Intel: avs: Fix build error on arc, m68k and sparc sound/soc/amd/acp/acp-pci.c | 1 + sound/soc/codecs/da7219-aad.c | 18 +++++++++++++++--- sound/soc/codecs/rt5640.c | 11 +++++++++-- sound/soc/codecs/rt5640.h | 2 ++ sound/soc/fsl/fsl_sai.h | 4 ++-- sound/soc/intel/avs/board_selection.c | 3 ++- sound/soc/intel/boards/bytcr_rt5640.c | 2 ++ sound/soc/intel/common/soc-acpi-intel-adl-match.c | 2 +- sound/soc/soc-pcm.c | 2 -- 9 files changed, 34 insertions(+), 11 deletions(-)

2 1

[PATCH 0/5] seq: add interface for queue timer
by GitHub pull_request - opened 01 Jun '22

01 Jun '22

alsa-project/alsa-gobject pull request #72 was opened from takaswie: Current implementation uses function of QueueTimer to retrieve data for variants of queue timer, however it's not enough convenient in the case of language bindings. The usage of GObject.Value in object property is expected to be supported widely instead. This patchset uses object classes derived from GObject to express the variants. The common properties are expressed by QueueTimerCommon interface. The ALSATimer variant is currently supported to implement the interface. ``` Takashi Sakamoto (5): doc: seq: fix URL to document for ALSATimer seq: queue-timer-common: add common interface for queue timer seq: queue-timer-alsa: add class for queue timer specialized to ALSA Timer seq: user-client: use QueueTimerCommon interface instead of QueueTimer seq: queue-timer/queue-timer-data-alsa: remove unused gobject classes doc/seq/alsaseq.toml.in | 2 +- doc/seq/urlmap.js | 2 +- src/seq/alsaseq.h | 5 +- src/seq/alsaseq.map | 16 +- src/seq/meson.build | 8 +- src/seq/privates.h | 21 ++- src/seq/queue-timer-alsa.c | 134 +++++++++++++++++ src/seq/queue-timer-alsa.h | 22 +++ src/seq/queue-timer-common.c | 87 +++++++++++ src/seq/queue-timer-common.h | 20 +++ src/seq/queue-timer-data-alsa.c | 76 ---------- src/seq/queue-timer-data-alsa.h | 32 ---- src/seq/queue-timer.c | 138 ------------------ src/seq/queue-timer.h | 26 ---- src/seq/user-client.c | 42 +++--- src/seq/user-client.h | 4 +- ...q-queue-timer => alsaseq-queue-timer-alsa} | 8 +- tests/meson.build | 2 +- 18 files changed, 325 insertions(+), 320 deletions(-) create mode 100644 src/seq/queue-timer-alsa.c create mode 100644 src/seq/queue-timer-alsa.h create mode 100644 src/seq/queue-timer-common.c create mode 100644 src/seq/queue-timer-common.h delete mode 100644 src/seq/queue-timer-data-alsa.c delete mode 100644 src/seq/queue-timer-data-alsa.h delete mode 100644 src/seq/queue-timer.c delete mode 100644 src/seq/queue-timer.h rename tests/{alsaseq-queue-timer => alsaseq-queue-timer-alsa} (76%) ``` Request URL : https://github.com/alsa-project/alsa-gobject/pull/72 Patch URL : https://github.com/alsa-project/alsa-gobject/pull/72.patch Repository URL: https://github.com/alsa-project/alsa-gobject

1 0

[PATCH 00/13] ctl: add interfaces for element information
by GitHub pull_request - opened 01 Jun '22

01 Jun '22

alsa-project/alsa-gobject pull request #71 was opened from takaswie: Current implementation uses function of ElemInfo to express variants of element information, however it's not enough convenient in the case of language bindings. The usage of GObject.Value in object property is expected to be supported widely instead. This patchset uses object classes derived from GObject to express the variants. The common properties are expressed by two interfaces; ElemInfoCommon and ElemInfoSingleArray. All of classes implement the former, and the latter is implemented except for IEC60958 element information. ``` Takashi Sakamoto (13): ctl: card: fix indentation fix missing usage of declaration macro ctl: card: add error path when generating name list at element addition ctl: elem-info-common: add common interface for element information ctl: elem-info-iec60958: add class for element information of IEC60958 type ctl: elem-info-single-array: add interface for single array element information ctl: elem-info-boolean: add class for element information of boolean type ctl: elem-info-bytes: add class for element information of bytes type ctl: elem-info-integer: add class for element information of integer type ctl: elem-info-integer64: add class for element information of integer64 type ctl: elem-info-enumerated: add class for element information of enumerated type ctl: card: use ALSACtl.ElemInfoCommon instead of ElemInfo ctl: elem-info: remove unused classes samples/ctl | 56 +-- src/ctl/alsactl-enum-types.h | 4 + src/ctl/alsactl.h | 10 +- src/ctl/alsactl.map | 30 +- src/ctl/card.c | 156 ++++--- src/ctl/card.h | 6 +- src/ctl/elem-info-boolean.c | 90 +++++ src/ctl/elem-info-boolean.h | 22 + src/ctl/elem-info-bytes.c | 89 ++++ src/ctl/elem-info-bytes.h | 21 + src/ctl/elem-info-common.c | 135 +++++++ src/ctl/elem-info-common.h | 20 + src/ctl/elem-info-enumerated.c | 137 +++++++ src/ctl/elem-info-enumerated.h | 22 + src/ctl/elem-info-iec60958.c | 80 ++++ src/ctl/elem-info-iec60958.h | 22 + src/ctl/elem-info-integer.c | 162 ++++++++ src/ctl/elem-info-integer.h | 22 + src/ctl/elem-info-integer64.c | 162 ++++++++ src/ctl/elem-info-integer64.h | 22 + src/ctl/elem-info-single-array.c | 68 ++++ src/ctl/elem-info-single-array.h | 20 + src/ctl/elem-info.c | 379 ------------------ src/ctl/elem-info.h | 30 -- src/ctl/meson.build | 18 +- src/ctl/privates.h | 54 ++- src/hwdep/alsahwdep-enum-types.h | 4 + src/rawmidi/alsarawmidi-enum-types.h | 4 + src/seq/alsaseq-enum-types.h | 4 + src/timer/alsatimer-enum-types.h | 4 + ...tl-elem-info => alsactl-elem-info-boolean} | 10 +- tests/alsactl-elem-info-bytes | 26 ++ tests/alsactl-elem-info-enumerated | 27 ++ tests/alsactl-elem-info-iec60958 | 25 ++ tests/alsactl-elem-info-integer | 29 ++ tests/alsactl-elem-info-integer64 | 29 ++ tests/meson.build | 7 +- 37 files changed, 1492 insertions(+), 514 deletions(-) create mode 100644 src/ctl/elem-info-boolean.c create mode 100644 src/ctl/elem-info-boolean.h create mode 100644 src/ctl/elem-info-bytes.c create mode 100644 src/ctl/elem-info-bytes.h create mode 100644 src/ctl/elem-info-common.c create mode 100644 src/ctl/elem-info-common.h create mode 100644 src/ctl/elem-info-enumerated.c create mode 100644 src/ctl/elem-info-enumerated.h create mode 100644 src/ctl/elem-info-iec60958.c create mode 100644 src/ctl/elem-info-iec60958.h create mode 100644 src/ctl/elem-info-integer.c create mode 100644 src/ctl/elem-info-integer.h create mode 100644 src/ctl/elem-info-integer64.c create mode 100644 src/ctl/elem-info-integer64.h create mode 100644 src/ctl/elem-info-single-array.c create mode 100644 src/ctl/elem-info-single-array.h delete mode 100644 src/ctl/elem-info.c delete mode 100644 src/ctl/elem-info.h rename tests/{alsactl-elem-info => alsactl-elem-info-boolean} (68%) create mode 100644 tests/alsactl-elem-info-bytes create mode 100644 tests/alsactl-elem-info-enumerated create mode 100644 tests/alsactl-elem-info-iec60958 create mode 100644 tests/alsactl-elem-info-integer create mode 100644 tests/alsactl-elem-info-integer64 ``` Request URL : https://github.com/alsa-project/alsa-gobject/pull/71 Patch URL : https://github.com/alsa-project/alsa-gobject/pull/71.patch Repository URL: https://github.com/alsa-project/alsa-gobject

1 0