January 2023 - Alsa-devel - mailman.alsa-project.org

[PATCH v2 0/5] ASoC: samsung: fsd: audio support for FSD SoC
by Padmanabhan Rajanbabu 13 Jan '23

13 Jan '23

The intention of this patch series is to enable audio support on FSD SoC. Changes in v2: 1. New compatible added in Exynos I2S driver for FSD platform. 2. Added Fixup support for Exynos I2S CPU DAI. 3. Migration of manual PSR, OPCLK configuration to Exynos CPU DAI driver as fixup. 4. Migrated from dedicated sound card to simple audio card. 5. Support added for tlv320aic3x-i2c codec on FSD platform. Changes in v1: 1. Add TDM support on samsung I2S interface. 2. Allow sound card to directly configure I2S prescaler divider instead of calculating it from frame clock. 3. The sound card support for FSD SoC which utilizes samsung I2S interface as CPU DAI. Padmanabhan Rajanbabu (5): ASoC: samsung-i2s: add FSD compatibile string ASoC: samsung: i2s: add support for FSD I2S arm64: dts: fsd: Add I2S DAI node for Tesla FSD arm64: dts: fsd: Add codec node for Tesla FSD arm64: dts: fsd: Add sound card node for Tesla FSD .../bindings/sound/samsung-i2s.yaml | 4 ++ arch/arm64/boot/dts/tesla/fsd-evb.dts | 59 +++++++++++++++++++ arch/arm64/boot/dts/tesla/fsd-pinctrl.dtsi | 14 +++++ arch/arm64/boot/dts/tesla/fsd.dtsi | 34 +++++++++++ sound/soc/samsung/i2s.c | 57 ++++++++++++++++++ 5 files changed, 168 insertions(+) -- 2.17.1

4 19

[PATCH 0/6] ALSA: fireface: support knob control event for Fireface 400
by Takashi Sakamoto 13 Jan '23

13 Jan '23

Hi, Fireface 400 uses asynchronous transaction mechanism to deliver event of hardware knob control as well as received MIDI messages. Current implementation doesn't distinguish them, thus all arrived messages are processed for MIDI message. This patchset adds the parser to distinguish them, and deliver knob control event to user space via ALSA hwdep character device. The implementation works well as long as I tested with the patches for libhitaki library: https://github.com/alsa-project/libhitaki/tree/topic/ff/400-msg I note that Fireface 400 transmits no asynchronous transaction when it is not configured by block write transaction to offset 0x000080100514, which turn off HOST led from red. Takashi Sakamoto (6): ALSA: fireface: rename callback functions ALSA: fireface: pick up time stamp for request subaction of asynchronous transaction ALSA: fireface: add helper function to parse MIDI messages transmitted by Fireface 400 ALSA: fireface: update UAPI for data of knob control ALSA: fireface: add local framework to message parser ALSA: fireface: implement message parser for Fireface 400 include/uapi/sound/firewire.h | 24 +++ sound/firewire/fireface/ff-hwdep.c | 41 ++-- sound/firewire/fireface/ff-protocol-former.c | 186 +++++++++++++++---- sound/firewire/fireface/ff-protocol-latter.c | 6 +- sound/firewire/fireface/ff-transaction.c | 17 +- sound/firewire/fireface/ff.c | 10 + sound/firewire/fireface/ff.h | 9 +- 7 files changed, 239 insertions(+), 54 deletions(-) -- 2.37.2

2 5

[PATCH] ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate()
by Jaroslav Kysela 13 Jan '23

13 Jan '23

The subs function argument may be NULL, so do not use it before the NULL check. Fixes: 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Reported-by: coverity-bot <keescook(a)chromium.org> Link: https://lore.kernel.org/alsa-devel/202301121424.4A79A485@keescook/ Signed-off-by: Jaroslav Kysela <perex(a)perex.cz> --- sound/usb/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 1f72960d0d53..d959da7a1afb 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -160,11 +160,12 @@ find_substream_format(struct snd_usb_substream *subs, bool snd_usb_pcm_has_fixed_rate(struct snd_usb_substream *subs) { const struct audioformat *fp; - struct snd_usb_audio *chip = subs->stream->chip; + struct snd_usb_audio *chip; int rate = -1; if (!subs) return false; + chip = subs->stream->chip; if (!(chip->quirk_flags & QUIRK_FLAG_FIXED_RATE)) return false; list_for_each_entry(fp, &subs->fmt_list, list) { -- 2.39.0

2 1

[PATCH] Support for MAX98090/91 codec in iMX8MM evk
by Hardevsinh Palaniya 13 Jan '23

13 Jan '23

From: Hardevsinh Palaniya <hardevsinh.palaniya(a)siliconsignals.io> Date: Sat, 7 Jan 2023 17:08:28 +0530 Subject: [PATCH] Support for MAX98090/91 codec in iMX8MM evk - Adding node for MAX98090/91 in dts imx8mm-evk.dtsi - Adding tristate option in <sound/soc/codecs/Kconfig> Signed-off-by: Hardevsinh Palaniya <hardevsinh.palaniya(a)siliconsignals.io> diff --git a/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi index e0b604ac0da4..58ff63cbc930 100644 --- a/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi @@ -132,6 +132,32 @@ simple-audio-card,codec { clocks = <&clk IMX8MM_CLK_SAI3_ROOT>; }; }; + + sound-max98090 { + compatible = "simple-audio-card"; + simple-audio-card,name = "max98090-audio"; + simple-audio-card,format = "i2s"; + simple-audio-card,frame-master = <&cpudai>; + simple-audio-card,bitclock-master = <&cpudai>; + simple-audio-card,widgets = "Speakers", "Speakers"; + simple-audio-card,routing = + "Speakers", "SPKR", + "Speakers", "SPKL", + "IN1", "MICBIAS", + "MIC1","IN1", + "MIC2","IN1"; + + cpudai: simple-audio-card,cpu { + sound-dai = <&sai5>; + dai-tdm-slot-num = <2>; + dai-tdm-slot-width = <32>; + }; + + simple-audio-card,codec { + sound-dai = <&max98090>; + clocks = <&clk IMX8MM_CLK_SAI5_ROOT>; + }; + }; }; &A53_0 { @@ -339,6 +365,14 @@ &i2c3 { pinctrl-0 = <&pinctrl_i2c3>; status = "okay"; + max98090: max98090@10 { + #sound-dai-cells = <0>; + compatible = "maxim,max98090"; + reg = <0x10>; + clocks = <&clk IMX8MM_CLK_SAI5_ROOT>; + clock-names = "mclk"; + }; + pca6416: gpio@20 { compatible = "ti,tca6416"; reg = <0x20>; @@ -391,6 +425,20 @@ &sai3 { status = "okay"; }; +&sai5 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai5>; + assigned-clocks = <&clk IMX8MM_CLK_SAI5>; + assigned-clock-parents = <&clk IMX8MM_AUDIO_PLL1_OUT>; + assigned-clock-rates = <24576000>; + clocks = <&clk IMX8MM_CLK_SAI5_IPG>, <&clk IMX8MM_CLK_DUMMY>, + <&clk IMX8MM_CLK_SAI5_ROOT>, <&clk IMX8MM_CLK_DUMMY>, + <&clk IMX8MM_CLK_DUMMY>, <&clk IMX8MM_AUDIO_PLL1_OUT>, + <&clk IMX8MM_AUDIO_PLL2_OUT>; + clock-names = "bus", "mclk0", "mclk1", "mclk2", "mclk3", "pll8k", "pll11k"; + status = "okay"; +}; + &snvs_pwrkey { status = "okay"; }; @@ -552,6 +600,16 @@ MX8MM_IOMUXC_SAI3_TXD_SAI3_TX_DATA0 0xd6 >; }; + pinctrl_sai5: sai5grp { + fsl,pins = < + MX8MM_IOMUXC_SAI5_MCLK_SAI5_MCLK 0xd6 + MX8MM_IOMUXC_SAI5_RXD2_SAI5_TX_BCLK 0xd6 + MX8MM_IOMUXC_SAI5_RXD1_SAI5_TX_SYNC 0xd6 + MX8MM_IOMUXC_SAI5_RXD0_SAI5_RX_DATA0 0xd6 + MX8MM_IOMUXC_SAI5_RXD3_SAI5_TX_DATA0 0xd6 + >; + } + pinctrl_typec1: typec1grp { fsl,pins = < MX8MM_IOMUXC_SD1_STROBE_GPIO2_IO11 0x159 diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig index 0f9d71490075..efef2df362a4 100644 --- a/sound/soc/codecs/Kconfig +++ b/sound/soc/codecs/Kconfig @@ -1009,7 +1009,7 @@ config SND_SOC_MAX98088 depends on I2C config SND_SOC_MAX98090 - tristate + tristate "Maxim MAX98090/1, Stereo Audio Codec" depends on I2C config SND_SOC_MAX98095 -- 2.25.1

3 6

[syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
by syzbot 13 Jan '23

13 Jan '23

Hello, syzbot found the following issue on: HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112 git tree: linux-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=123b545e480000 kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5 dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17530902480000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1206692c480000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.… kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e29d28728f38190cecfc(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650 kernel/sched/wait.c:100 Read of size 8 at addr ffff88801eb938f0 by task syz-executor234/5078 CPU: 0 PID: 5078 Comm: syz-executor234 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report+0xc0/0xf0 mm/kasan/report.c:517 __wake_up_common+0x637/0x650 kernel/sched/wait.c:100 __wake_up_common_lock+0xd4/0x140 kernel/sched/wait.c:138 snd_pcm_post_stop+0x91/0x1f0 sound/core/pcm_native.c:1522 snd_pcm_action_single+0xf4/0x130 sound/core/pcm_native.c:1283 snd_pcm_action+0x6e/0x90 sound/core/pcm_native.c:1364 snd_pcm_stop sound/core/pcm_native.c:1543 [inline] snd_pcm_drop+0x165/0x2b0 sound/core/pcm_native.c:2227 snd_pcm_kernel_ioctl+0x243/0x2e0 sound/core/pcm_native.c:3456 snd_pcm_oss_sync+0x230/0x810 sound/core/oss/pcm_oss.c:1746 snd_pcm_oss_release+0x27a/0x300 sound/core/oss/pcm_oss.c:2590 __fput+0x27c/0xa90 fs/file_table.c:321 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xb17/0x2a90 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x225f/0x24f0 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f864105c209 Code: Unable to access opcode bytes at 0x7f864105c1df. RSP: 002b:00007fff6e56b898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 0000000000000004 RCX: 00007f864105c209 RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006 RBP: 0000000000000000 R08: 00007fff6e56ba38 R09: 00007fff6e56ba38 R10: 000000000000000d R11: 0000000000000246 R12: 00007f864101f800 R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 5078: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook mm/slab.h:769 [inline] kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033 __io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062 io_alloc_req_refill io_uring/io_uring.h:348 [inline] io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407 __do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 1002: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] kmem_cache_free+0xec/0x4e0 mm/slub.c:3809 io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2737 io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2967 process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293 worker_thread+0x669/0x1090 kernel/workqueue.c:2440 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 The buggy address belongs to the object at ffff88801eb938c0 which belongs to the cache io_kiocb of size 216 The buggy address is located 48 bytes inside of 216-byte region [ffff88801eb938c0, ffff88801eb93998) The buggy address belongs to the physical page: page:ffffea00007ae4c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eb93 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffff88801bc32dc0 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5078, tgid 5078 (syz-executor234), ts 58909389529, free_ts 58908987546 prep_new_page mm/page_alloc.c:2549 [inline] get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324 __alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590 alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281 alloc_slab_page mm/slub.c:1851 [inline] allocate_slab+0x25f/0x350 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __kmem_cache_alloc_bulk mm/slub.c:3951 [inline] kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026 __io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062 io_alloc_req_refill io_uring/io_uring.h:348 [inline] io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407 __do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1451 [inline] free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501 free_unref_page_prepare mm/page_alloc.c:3387 [inline] free_unref_page+0x1d/0x490 mm/page_alloc.c:3482 skb_free_frag include/linux/skbuff.h:3193 [inline] skb_free_head+0x96/0x110 net/core/skbuff.c:818 skb_release_data+0x5f4/0x870 net/core/skbuff.c:849 skb_release_all net/core/skbuff.c:914 [inline] __kfree_skb+0x4f/0x70 net/core/skbuff.c:928 tcp_rcv_established+0x15fd/0x2270 net/ipv4/tcp_input.c:5927 tcp_v4_do_rcv+0x663/0x9d0 net/ipv4/tcp_ipv4.c:1721 tcp_v4_rcv+0x2eab/0x3280 net/ipv4/tcp_ipv4.c:2142 ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2ec/0x4f0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:302 [inline] NF_HOOK include/linux/netfilter.h:296 [inline] ip_local_deliver+0x1ae/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:454 [inline] ip_sublist_rcv_finish+0x9a/0x2c0 net/ipv4/ip_input.c:580 ip_list_rcv_finish.constprop.0+0x4f9/0x6c0 net/ipv4/ip_input.c:630 ip_sublist_rcv net/ipv4/ip_input.c:638 [inline] ip_list_rcv+0x347/0x4a0 net/ipv4/ip_input.c:673 __netif_receive_skb_list_ptype net/core/dev.c:5525 [inline] __netif_receive_skb_list_core+0x548/0x8f0 net/core/dev.c:5573 __netif_receive_skb_list net/core/dev.c:5625 [inline] netif_receive_skb_list_internal+0x75f/0xdc0 net/core/dev.c:5716 Memory state around the buggy address: ffff88801eb93780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801eb93800: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc >ffff88801eb93880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ^ ffff88801eb93900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801eb93980: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

1 0

[PATCH V9 0/5] ASoC: codecs: Add Awinic AW883XX audio amplifier driver
by wangweidong.a＠awinic.com 13 Jan '23

13 Jan '23

From: Weidong Wang <wangweidong.a(a)awinic.com> The Awinic AW883XX is an I2S/TDM input, high efficiency digital Smart K audio amplifier with an integrated 10.25V smart boost convert Add a DT schema for describing Awinic AW883xx audio amplifiers. They are controlled using I2C v8 -> v9: Delete extra empty lines Use devm_kzalloc instead of kzalloc Structure members applied with devm_kzalloc are not initialized to NULL DAMP is used for power management In Kcontrol, out-of-range values return -EINVAL Delete switch Kcontrol Use devm_snd_soc_unregister_component instead of snd_soc_unregister_component Use aw88395 instead of aw883xx in awinic,aw88395.yaml file Add the sound-dai-cells in awinic,aw88395.yaml file Use unevaluatedProperties: false in awinic,aw88395.yaml file Weidong Wang (5): ASoC: codecs: Add i2c and codec registration for aw883xx and their associated operation functions ASoC: codecs: Aw883xx function for ACF file parse and check ASoC: codecs: Aw883xx common function for ALSA Audio Driver ASoC: codecs: Aw883xx chip register file, data type file and Kconfig Makefile ASoC: dt-bindings: Add schema for "awinic,aw883xx" .../bindings/sound/awinic,aw883xx.yaml | 53 + sound/soc/codecs/Kconfig | 10 + sound/soc/codecs/Makefile | 6 + sound/soc/codecs/aw883xx/aw883xx.c | 579 ++++++ sound/soc/codecs/aw883xx/aw883xx.h | 58 + sound/soc/codecs/aw883xx/aw883xx_bin_parse.c | 1067 ++++++++++ sound/soc/codecs/aw883xx/aw883xx_bin_parse.h | 92 + sound/soc/codecs/aw883xx/aw883xx_data_type.h | 142 ++ sound/soc/codecs/aw883xx/aw883xx_device.c | 1756 +++++++++++++++++ sound/soc/codecs/aw883xx/aw883xx_device.h | 196 ++ .../soc/codecs/aw883xx/aw883xx_pid_2049_reg.h | 383 ++++ 11 files changed, 4342 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/awinic,aw883xx.yaml create mode 100644 sound/soc/codecs/aw883xx/aw883xx.c create mode 100644 sound/soc/codecs/aw883xx/aw883xx.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_bin_parse.c create mode 100644 sound/soc/codecs/aw883xx/aw883xx_bin_parse.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_data_type.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_device.c create mode 100644 sound/soc/codecs/aw883xx/aw883xx_device.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_pid_2049_reg.h base-commit: 1f5abbd77e2c1787e74b7c2caffac97def78ba52 -- 2.39.0

4 11

[RFC PATCH 00/14] Introduce QC USB SND audio offloading support
by Wesley Cheng 13 Jan '23

13 Jan '23

Several Qualcomm based chipsets can support USB audio offloading to a dedicated audio DSP, which can take over issuing transfers to the USB host controller. The intention is to reduce the load on the main processors in the SoC, and allow them to be placed into lower power modes. There are several parts to this design: 1. Adding ASoC binding layer 2. Create a USB backend for Q6DSP 3. Introduce XHCI interrupter support 4. Create vendor ops for the USB SND driver Adding ASoC binding layer: soc-usb: Intention is to treat a USB port similar to a headphone jack. The port is always present on the device, but cable/pin status can be enabled/disabled. Expose mechanisms for USB backend ASoC drivers to communicate with USB SND. Create a USB backend for Q6DSP: q6usb: Basic backend driver that will be responsible for maintaining the resources needed to initiate a playback stream using the Q6DSP. Will be the entity that checks to make sure the connected USB audio device supports the requested PCM format. If it does not, the PCM open call will fail, and userpsace ALSA can take action accordingly. Introduce XHCI interrupter support: XHCI HCD supports multiple interrupters, which allows for events to be routed to different event rings. This is determined by "Interrupter Target" field specified in Section "6.4.1.1 Normal TRB" of the XHCI specification. Events in the offloading case will be routed to an event ring that is assigned to the audio DSP. Create vendor ops for the USB SND driver: qc_audio_offload: This particular driver has several components associated with it: - QMI stream request handler - XHCI interrupter and resource management - audio DSP memory management When the audio DSP wants to enable a playback stream, the request is first received by the ASoC platform sound card. Depending on the selected route, ASoC will bring up the individual DAIs in the path. The Q6USB backend DAI will send an AFE port start command (with enabling the USB playback path), and the audio DSP will handle the request accordingly. Part of the AFE USB port start handling will have an exchange of control messages using the QMI protocol. The qc_audio_offload driver will populate the buffer information: - Event ring base address - EP transfer ring base address and pass it along to the audio DSP. All endpoint management will now be handed over to the DSP, and the main processor is not involved in transfers. Overall, implementing this feature will still expose separate sound card and PCM devices for both the platorm card and USB audio device: 0 [SM8250MTPWCD938]: sm8250 - SM8250-MTP-WCD9380-WSA8810-VA-D SM8250-MTP-WCD9380-WSA8810-VA-DMIC 1 [Audio ]: USB-Audio - USB Audio Generic USB Audio at usb-xhci-hcd.1.auto-1.4, high speed This is to ensure that userspace ALSA entities can decide which route to take when executing the audio playback. In the above, if card#1 is selected, then USB audio data will take the legacy path over the USB PCM drivers, etc... This feature was validated using: - tinymix: set/enable the multimedia path to route to USB backend - tinyplay: issue playback on platform card Wesley Cheng (14): ASoC: Add SOC USB APIs for adding an USB backend ASoC: qcom: qdsp6: Introduce USB AFE port to q6dsp ASoC: qcom: Add USB backend ASoC driver for Q6 sound: usb: card: Introduce USB SND vendor op callbacks sound: usb: Export USB SND APIs for modules usb: core: hcd: Introduce USB HCD APIs for interrupter management usb: host: xhci: Add XHCI secondary interrupter support usb: dwc3: Add DT parameter to specify maximum number of interrupters sound: usb: Introduce QC USB SND offloading support sound: usb: card: Check for support for requested audio format sound: soc: soc-usb: Add PCM format check API for USB backend sound: soc: qcom: qusb6: Ensure PCM format is supported by USB audio device ASoC: dt-bindings: Add Q6USB backend bindings ASoC: dt-bindings: Update example for enabling USB offload on SM8250 .../bindings/sound/qcom,q6usb-dais.yaml | 55 + .../bindings/sound/qcom,sm8250.yaml | 13 + drivers/usb/core/hcd.c | 86 + drivers/usb/dwc3/core.c | 12 + drivers/usb/dwc3/core.h | 2 + drivers/usb/dwc3/host.c | 5 +- drivers/usb/host/xhci-mem.c | 219 ++- drivers/usb/host/xhci-plat.c | 2 + drivers/usb/host/xhci.c | 169 +- drivers/usb/host/xhci.h | 15 + .../sound/qcom,q6dsp-lpass-ports.h | 1 + include/linux/usb.h | 7 + include/linux/usb/hcd.h | 16 +- include/sound/q6usboffload.h | 20 + include/sound/soc-usb.h | 34 + sound/soc/Makefile | 2 +- sound/soc/qcom/Kconfig | 4 + sound/soc/qcom/qdsp6/Makefile | 1 + sound/soc/qcom/qdsp6/q6afe-dai.c | 47 + sound/soc/qcom/qdsp6/q6afe.c | 183 ++ sound/soc/qcom/qdsp6/q6afe.h | 46 +- sound/soc/qcom/qdsp6/q6dsp-lpass-ports.c | 23 + sound/soc/qcom/qdsp6/q6dsp-lpass-ports.h | 1 + sound/soc/qcom/qdsp6/q6routing.c | 8 + sound/soc/qcom/qdsp6/q6usb.c | 239 +++ sound/soc/soc-usb.c | 79 + sound/usb/Kconfig | 14 + sound/usb/Makefile | 2 +- sound/usb/card.c | 43 + sound/usb/card.h | 10 + sound/usb/endpoint.c | 2 + sound/usb/helper.c | 1 + sound/usb/pcm.c | 9 +- sound/usb/pcm.h | 12 + sound/usb/qcom/Makefile | 2 + sound/usb/qcom/qc_audio_offload.c | 1610 +++++++++++++++++ sound/usb/qcom/usb_audio_qmi_v01.c | 892 +++++++++ sound/usb/qcom/usb_audio_qmi_v01.h | 162 ++ 38 files changed, 3998 insertions(+), 50 deletions(-) create mode 100644 Documentation/devicetree/bindings/sound/qcom,q6usb-dais.yaml create mode 100644 include/sound/q6usboffload.h create mode 100644 include/sound/soc-usb.h create mode 100644 sound/soc/qcom/qdsp6/q6usb.c create mode 100644 sound/soc/soc-usb.c create mode 100644 sound/usb/qcom/Makefile create mode 100644 sound/usb/qcom/qc_audio_offload.c create mode 100644 sound/usb/qcom/usb_audio_qmi_v01.c create mode 100644 sound/usb/qcom/usb_audio_qmi_v01.h

8 45

Re: [PATCH 0/8] arm64: dts: renesas: Simple-Card / Audio-Graph-Card/Card2 dts for ULCB/KF
by Geert Uytterhoeven 13 Jan '23

13 Jan '23

Hi Morimoto-san, CC DT/ASoC On Wed, Dec 14, 2022 at 2:47 AM Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> wrote: > ALSA SoC is now supporting generic Sound Card driver such as > Simple-Card / Audio-Graph-Card/Card2, and it supports > "normal connection" and "special connections". > I'm its maintainer, thus I need/want to test these. > > I have been tested these by using my local patches to switching card, > but maintenance it locally is not useful for me, and users who want to > know the sample DT settings. > > And I have noticed that some local patch had bug, but no one noticed > about it (of course :) > > ULCB/KF is very good board to test these. > So, I want to upstream these. > > One note here is that this patch *should not* have effect to > existing normal users, but useful for test user. > So, this patch-set adds "3 card" x "2 use case" dtsi file, > and ulcb/ulcb-kf "include" one of them which doesn't change anything. > test user can switch to other card or other use case by changing > "include" dtsi. > > [1/8][2/8] are small tidyup patches for all SoC sound. Thanks for your series! I really wanted to review this earlier, but I am held back by my lack of understanding of the audio subsystem and the audio bindings. It is also not clear to me what really is hardware description (i.e. to be described in DT), and what is software policy (i.e. not to be described in DT)... Hence I have lots of questions ("A fool can ask more questions in a minute than a wise man can answer in an hour." ;-) What is the difference between "Simple Audio Card", "Audio Graph Card", and "Audio Graph Card2"? Why do we need to support all three of them? How come we can have no #sound-dai-cells, #sound-dai-cells = <0>, and #sound-dai-cells = <1>, for the same hardware? What is the real difference between Single DAI and Multi DAI? Why do we need to support both? > Kuninori Morimoto (8): > ARM: dts: renesas: #sound-dai-cells is used when simple-card > arm64: dts: renesas: #sound-dai-cells is used when simple-card > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card dtsi > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card2 dtsi > arm64: dts: renesas: add ulcb{-kf} Simple Audio Card dtsi The above three all describe the same hardware configuration? > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card2 dtsi MIX + TDM Split dtsi > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card dtsi MIX + TDM Split dtsi > arm64: dts: renesas: add ulcb{-kf} Simple Audio Card MIX + TDM Split dtsi Is MIX and TDM Split a different hardware configuration, or software policy? Thanks! > arch/arm/boot/dts/r8a7742.dtsi | 2 +- > arch/arm/boot/dts/r8a7743.dtsi | 2 +- > arch/arm/boot/dts/r8a7744.dtsi | 2 +- > arch/arm/boot/dts/r8a7745.dtsi | 2 +- > arch/arm/boot/dts/r8a7778.dtsi | 2 +- > arch/arm/boot/dts/r8a7790.dtsi | 2 +- > arch/arm/boot/dts/r8a7791.dtsi | 2 +- > arch/arm/boot/dts/r8a7793.dtsi | 2 +- > arch/arm/boot/dts/r8a7794.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77951.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77960.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77961.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77965.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77990.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77995.dtsi | 2 +- > .../boot/dts/renesas/salvator-common.dtsi | 3 - > .../ulcb-audio-graph-card-mix+split.dtsi | 89 +++++++++ > .../dts/renesas/ulcb-audio-graph-card.dtsi | 85 +++++++++ > .../ulcb-audio-graph-card2-mix+split.dtsi | 111 +++++++++++ > .../dts/renesas/ulcb-audio-graph-card2.dtsi | 26 +++ > .../ulcb-kf-audio-graph-card-mix+split.dtsi | 162 ++++++++++++++++ > .../dts/renesas/ulcb-kf-audio-graph-card.dtsi | 88 +++++++++ > .../ulcb-kf-audio-graph-card2-mix+split.dtsi | 177 ++++++++++++++++++ > .../renesas/ulcb-kf-audio-graph-card2.dtsi | 30 +++ > .../ulcb-kf-simple-audio-card-mix+split.dtsi | 137 ++++++++++++++ > .../renesas/ulcb-kf-simple-audio-card.dtsi | 85 +++++++++ > arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 66 ++----- > .../ulcb-simple-audio-card-mix+split.dtsi | 86 +++++++++ > .../dts/renesas/ulcb-simple-audio-card.dtsi | 89 +++++++++ > arch/arm64/boot/dts/renesas/ulcb.dtsi | 60 ++---- > 34 files changed, 1212 insertions(+), 120 deletions(-) > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card2-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card2.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card2-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card2.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-simple-audio-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-simple-audio-card.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-simple-audio-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-simple-audio-card.dtsi Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert(a)linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds

2 3

Coverity: snd_usb_pcm_has_fixed_rate(): Null pointer dereferences
by coverity-bot 12 Jan '23

12 Jan '23

Hello! This is an experimental semi-automated report about issues detected by Coverity from a scan of next-20230111 as part of the linux-next scan project: https://scan.coverity.com/projects/linux-next-weekly-scan You're getting this email because you were associated with the identified lines of code (noted below) that were touched by commits: Mon Jan 9 16:05:21 2023 +0100 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Coverity reported the following: *** CID 1530547: Null pointer dereferences (REVERSE_INULL) sound/usb/pcm.c:166 in snd_usb_pcm_has_fixed_rate() 160 bool snd_usb_pcm_has_fixed_rate(struct snd_usb_substream *subs) 161 { 162 const struct audioformat *fp; 163 struct snd_usb_audio *chip = subs->stream->chip; 164 int rate = -1; 165 vvv CID 1530547: Null pointer dereferences (REVERSE_INULL) vvv Null-checking "subs" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 166 if (!subs) 167 return false; 168 if (!(chip->quirk_flags & QUIRK_FLAG_FIXED_RATE)) 169 return false; 170 list_for_each_entry(fp, &subs->fmt_list, list) { 171 if (fp->rates & SNDRV_PCM_RATE_CONTINUOUS) If this is a false positive, please let us know so we can mark it as such, or teach the Coverity rules to be smarter. If not, please make sure fixes get into linux-next. :) For patches fixing this, please include these lines (but double-check the "Fixes" first): Reported-by: coverity-bot <keescook+coverity-bot(a)chromium.org> Addresses-Coverity-ID: 1530547 ("Null pointer dereferences") Fixes: 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Thanks for your attention! -- Coverity-bot

1 0

[syzbot] KASAN: use-after-free Read in snd_pcm_oss_poll
by syzbot 12 Jan '23

12 Jan '23

Hello, syzbot found the following issue on: HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=16d906ea480000 kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5 dashboard link: https://syzkaller.appspot.com/bug?extid=ee73befabe68e7907adf compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.… kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+ee73befabe68e7907adf(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849 Read of size 8 at addr ffff8880222ed980 by task syz-executor.0/13421 CPU: 0 PID: 13421 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report+0xc0/0xf0 mm/kasan/report.c:517 snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849 vfs_poll include/linux/poll.h:88 [inline] io_poll_check_events io_uring/poll.c:279 [inline] io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327 handle_tw_list+0xa8/0x460 io_uring/io_uring.c:1169 tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1224 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fbb08c8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fbb099a6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007fbb08dabf88 RCX: 00007fbb08c8c0c9 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbb08dabf8c RBP: 00007fbb08dabf80 R08: 00007ffdf79a3080 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 00007fbb08dabf8c R13: 00007ffdf794d43f R14: 00007fbb099a6300 R15: 0000000000022000 </TASK> Allocated by task 13421: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:580 [inline] kzalloc include/linux/slab.h:720 [inline] snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2433 [inline] snd_pcm_oss_open.part.0+0x558/0x1330 sound/core/oss/pcm_oss.c:2535 snd_pcm_oss_open+0x44/0x60 sound/core/oss/pcm_oss.c:2499 soundcore_open+0x452/0x620 sound/sound_core.c:593 chrdev_open+0x26a/0x770 fs/char_dev.c:414 do_dentry_open+0x6cc/0x13f0 fs/open.c:883 do_open fs/namei.c:3558 [inline] path_openat+0x1bc1/0x2b40 fs/namei.c:3715 do_filp_open+0x1ba/0x410 fs/namei.c:3742 do_sys_openat2+0x16d/0x4c0 fs/open.c:1311 do_sys_open fs/open.c:1327 [inline] __do_sys_openat fs/open.c:1343 [inline] __se_sys_openat fs/open.c:1338 [inline] __x64_sys_openat+0x143/0x1f0 fs/open.c:1338 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 13421: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2415 [inline] snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2405 [inline] snd_pcm_oss_release+0x182/0x300 sound/core/oss/pcm_oss.c:2592 __fput+0x27c/0xa90 fs/file_table.c:321 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff8880222ed980 which belongs to the cache kmalloc-16 of size 16 The buggy address is located 0 bytes inside of 16-byte region [ffff8880222ed980, ffff8880222ed990) The buggy address belongs to the physical page: page:ffffea000088bb40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x222ed anon flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffff8880124413c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000800080 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5107, tgid 5107 (syz-executor.1), ts 750843463810, free_ts 748166918947 prep_new_page mm/page_alloc.c:2549 [inline] get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324 __alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590 __alloc_pages_node include/linux/gfp.h:237 [inline] alloc_slab_page mm/slub.c:1853 [inline] allocate_slab+0xa7/0x350 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292 __slab_alloc_node mm/slub.c:3345 [inline] slab_alloc_node mm/slub.c:3442 [inline] __kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc_node+0x4d/0xd0 mm/slab_common.c:974 kmalloc_node include/linux/slab.h:610 [inline] kvmalloc_node+0xa2/0x1a0 mm/util.c:603 xt_jumpstack_alloc net/netfilter/x_tables.c:1354 [inline] xt_replace_table+0x1a7/0x8c0 net/netfilter/x_tables.c:1393 __do_replace+0x1d7/0x8e0 net/ipv4/netfilter/ip_tables.c:1067 do_replace net/ipv4/netfilter/ip_tables.c:1140 [inline] do_ipt_set_ctl+0x89d/0xb10 net/ipv4/netfilter/ip_tables.c:1630 nf_setsockopt+0x87/0xe0 net/netfilter/nf_sockopt.c:101 ip_setsockopt+0xf2/0x110 net/ipv4/ip_sockglue.c:1445 tcp_setsockopt+0x9f/0x100 net/ipv4/tcp.c:3802 __sys_setsockopt+0x2c6/0x5b0 net/socket.c:2246 __do_sys_setsockopt net/socket.c:2257 [inline] __se_sys_setsockopt net/socket.c:2254 [inline] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2254 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1451 [inline] free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501 free_unref_page_prepare mm/page_alloc.c:3387 [inline] free_unref_page+0x1d/0x490 mm/page_alloc.c:3482 __unfreeze_partials+0x17c/0x1a0 mm/slub.c:2637 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook mm/slab.h:769 [inline] slab_alloc_node mm/slub.c:3452 [inline] slab_alloc mm/slub.c:3460 [inline] __kmem_cache_alloc_lru mm/slub.c:3467 [inline] kmem_cache_alloc+0x175/0x320 mm/slub.c:3476 kmem_cache_zalloc include/linux/slab.h:710 [inline] alloc_buffer_head+0x24/0x150 fs/buffer.c:2946 alloc_page_buffers+0x284/0x790 fs/buffer.c:871 create_empty_buffers+0x30/0xf30 fs/buffer.c:1585 ext4_block_write_begin+0x10a7/0x15f0 fs/ext4/inode.c:1080 ext4_da_write_begin+0x450/0xb70 fs/ext4/inode.c:3082 generic_perform_write+0x256/0x570 mm/filemap.c:3772 ext4_buffered_write_iter+0x15b/0x460 fs/ext4/file.c:285 ext4_file_write_iter+0x8bf/0x1710 fs/ext4/file.c:700 __kernel_write_iter+0x262/0x730 fs/read_write.c:517 Memory state around the buggy address: ffff8880222ed880: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc ffff8880222ed900: fa fb fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc >ffff8880222ed980: fa fb fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc ^ ffff8880222eda00: 00 00 fc fc 00 00 fc fc fa fb fc fc 00 00 fc fc ffff8880222eda80: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 1