- Alsa-devel - mailman.alsa-project.org

[PATCH AUTOSEL 5.14 10/26] ALSA: hda: intel: Allow repeatedly probing on codec configuration errors
by Sasha Levin 21 Oct '21

21 Oct '21

From: Takashi Iwai <tiwai(a)suse.de> [ Upstream commit c0f1886de7e173865f1a0fa7680a1c07954a987f ] It seems that a few recent AMD systems show the codec configuration errors at the early boot, while loading the driver at a later stage works magically. Although the root cause of the error isn't clear, it's certainly not bad to allow retrying the codec probe in such a case if that helps. This patch adds the capability for retrying the probe upon codec probe errors on the certain AMD platforms. The probe_work is changed to a delayed work, and at the secondary call, it'll jump to the codec probing. Note that, not only adding the re-probing, this includes the behavior changes in the codec configuration function. Namely, snd_hda_codec_configure() won't unregister the codec at errors any longer. Instead, its caller, azx_codec_configure() unregisters the codecs with the probe failures *if* any codec has been successfully configured. If all codec probe failed, it doesn't unregister but let it re-probed -- which is the most case we're seeing and this patch tries to improve. Even if the driver doesn't re-probe or give up, it will go to the "free-all" error path, hence the leftover codecs shall be disabled / deleted in anyway. BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1190801 Link: https://lore.kernel.org/r/20211006141940.2897-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- include/sound/hda_codec.h | 1 + sound/pci/hda/hda_bind.c | 20 +++++++++++--------- sound/pci/hda/hda_codec.c | 1 + sound/pci/hda/hda_controller.c | 24 ++++++++++++++++-------- sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_intel.c | 29 +++++++++++++++++++++++------ sound/pci/hda/hda_intel.h | 4 +++- 7 files changed, 56 insertions(+), 25 deletions(-) diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h index 2e8d51937acd..47d2cad21b56 100644 --- a/include/sound/hda_codec.h +++ b/include/sound/hda_codec.h @@ -225,6 +225,7 @@ struct hda_codec { #endif /* misc flags */ + unsigned int configured:1; /* codec was configured */ unsigned int in_freeing:1; /* being released */ unsigned int registered:1; /* codec was registered */ unsigned int display_power_control:1; /* needs display power */ diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c index e8dee24c309d..50a58fb5ad9c 100644 --- a/sound/pci/hda/hda_bind.c +++ b/sound/pci/hda/hda_bind.c @@ -304,29 +304,31 @@ int snd_hda_codec_configure(struct hda_codec *codec) { int err; + if (codec->configured) + return 0; + if (is_generic_config(codec)) codec->probe_id = HDA_CODEC_ID_GENERIC; else codec->probe_id = 0; - err = snd_hdac_device_register(&codec->core); - if (err < 0) - return err; + if (!device_is_registered(&codec->core.dev)) { + err = snd_hdac_device_register(&codec->core); + if (err < 0) + return err; + } if (!codec->preset) codec_bind_module(codec); if (!codec->preset) { err = codec_bind_generic(codec); if (err < 0) { - codec_err(codec, "Unable to bind the codec\n"); - goto error; + codec_dbg(codec, "Unable to bind the codec\n"); + return err; } } + codec->configured = 1; return 0; - - error: - snd_hdac_device_unregister(&codec->core); - return err; } EXPORT_SYMBOL_GPL(snd_hda_codec_configure); diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 7a717e151156..8afcce6478cd 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -791,6 +791,7 @@ void snd_hda_codec_cleanup_for_unbind(struct hda_codec *codec) snd_array_free(&codec->nids); remove_conn_list(codec); snd_hdac_regmap_exit(&codec->core); + codec->configured = 0; } EXPORT_SYMBOL_GPL(snd_hda_codec_cleanup_for_unbind); diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c index ca2f2ecd1488..5a49ee4f6ce0 100644 --- a/sound/pci/hda/hda_controller.c +++ b/sound/pci/hda/hda_controller.c @@ -25,6 +25,7 @@ #include <sound/core.h> #include <sound/initval.h> #include "hda_controller.h" +#include "hda_local.h" #define CREATE_TRACE_POINTS #include "hda_controller_trace.h" @@ -1259,17 +1260,24 @@ EXPORT_SYMBOL_GPL(azx_probe_codecs); int azx_codec_configure(struct azx *chip) { struct hda_codec *codec, *next; + int success = 0; - /* use _safe version here since snd_hda_codec_configure() deregisters - * the device upon error and deletes itself from the bus list. - */ - list_for_each_codec_safe(codec, next, &chip->bus) { - snd_hda_codec_configure(codec); + list_for_each_codec(codec, &chip->bus) { + if (!snd_hda_codec_configure(codec)) + success++; } - if (!azx_bus(chip)->num_codecs) - return -ENODEV; - return 0; + if (success) { + /* unregister failed codecs if any codec has been probed */ + list_for_each_codec_safe(codec, next, &chip->bus) { + if (!codec->configured) { + codec_err(codec, "Unable to configure, disabling\n"); + snd_hdac_device_unregister(&codec->core); + } + } + } + + return success ? 0 : -ENODEV; } EXPORT_SYMBOL_GPL(azx_codec_configure); diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h index 68f9668788ea..324cba13c7ba 100644 --- a/sound/pci/hda/hda_controller.h +++ b/sound/pci/hda/hda_controller.h @@ -41,7 +41,7 @@ /* 24 unused */ #define AZX_DCAPS_COUNT_LPIB_DELAY (1 << 25) /* Take LPIB as delay */ #define AZX_DCAPS_PM_RUNTIME (1 << 26) /* runtime PM support */ -/* 27 unused */ +#define AZX_DCAPS_RETRY_PROBE (1 << 27) /* retry probe if no codec is configured */ #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28) /* CORBRP clears itself after reset */ #define AZX_DCAPS_NO_MSI64 (1 << 29) /* Stick to 32-bit MSIs */ #define AZX_DCAPS_SEPARATE_STREAM_TAG (1 << 30) /* capture and playback use separate stream tag */ diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 0062c18b646a..89f135a6a1f6 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -307,7 +307,8 @@ enum { /* quirks for AMD SB */ #define AZX_DCAPS_PRESET_AMD_SB \ (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_AMD_WORKAROUND |\ - AZX_DCAPS_SNOOP_TYPE(ATI) | AZX_DCAPS_PM_RUNTIME) + AZX_DCAPS_SNOOP_TYPE(ATI) | AZX_DCAPS_PM_RUNTIME |\ + AZX_DCAPS_RETRY_PROBE) /* quirks for Nvidia */ #define AZX_DCAPS_PRESET_NVIDIA \ @@ -1730,7 +1731,7 @@ static void azx_check_snoop_available(struct azx *chip) static void azx_probe_work(struct work_struct *work) { - struct hda_intel *hda = container_of(work, struct hda_intel, probe_work); + struct hda_intel *hda = container_of(work, struct hda_intel, probe_work.work); azx_probe_continue(&hda->chip); } @@ -1839,7 +1840,7 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci, } /* continue probing in work context as may trigger request module */ - INIT_WORK(&hda->probe_work, azx_probe_work); + INIT_DELAYED_WORK(&hda->probe_work, azx_probe_work); *rchip = chip; @@ -2170,7 +2171,7 @@ static int azx_probe(struct pci_dev *pci, #endif if (schedule_probe) - schedule_work(&hda->probe_work); + schedule_delayed_work(&hda->probe_work, 0); dev++; if (chip->disabled) @@ -2256,6 +2257,11 @@ static int azx_probe_continue(struct azx *chip) int dev = chip->dev_index; int err; + if (chip->disabled || hda->init_failed) + return -EIO; + if (hda->probe_retry) + goto probe_retry; + to_hda_bus(bus)->bus_probing = 1; hda->probe_continued = 1; @@ -2317,10 +2323,20 @@ static int azx_probe_continue(struct azx *chip) #endif } #endif + + probe_retry: if (bus->codec_mask && !(probe_only[dev] & 1)) { err = azx_codec_configure(chip); - if (err < 0) + if (err) { + if ((chip->driver_caps & AZX_DCAPS_RETRY_PROBE) && + ++hda->probe_retry < 60) { + schedule_delayed_work(&hda->probe_work, + msecs_to_jiffies(1000)); + return 0; /* keep things up */ + } + dev_err(chip->card->dev, "Cannot probe codecs, giving up\n"); goto out_free; + } } err = snd_card_register(chip->card); @@ -2350,6 +2366,7 @@ static int azx_probe_continue(struct azx *chip) display_power(chip, false); complete_all(&hda->probe_wait); to_hda_bus(bus)->bus_probing = 0; + hda->probe_retry = 0; return 0; } @@ -2375,7 +2392,7 @@ static void azx_remove(struct pci_dev *pci) * device during cancel_work_sync() call. */ device_unlock(&pci->dev); - cancel_work_sync(&hda->probe_work); + cancel_delayed_work_sync(&hda->probe_work); device_lock(&pci->dev); snd_card_free(card); diff --git a/sound/pci/hda/hda_intel.h b/sound/pci/hda/hda_intel.h index 3fb119f09040..0f39418f9328 100644 --- a/sound/pci/hda/hda_intel.h +++ b/sound/pci/hda/hda_intel.h @@ -14,7 +14,7 @@ struct hda_intel { /* sync probing */ struct completion probe_wait; - struct work_struct probe_work; + struct delayed_work probe_work; /* card list (for power_save trigger) */ struct list_head list; @@ -30,6 +30,8 @@ struct hda_intel { unsigned int freed:1; /* resources already released */ bool need_i915_power:1; /* the hda controller needs i915 power */ + + int probe_retry; /* being probe-retry */ }; #endif -- 2.33.0

1 0

Re: linux-next: Tree for Oct 20 [sound/soc/codecs/snd-soc-cs35l41-spi.ko]
by Randy Dunlap 20 Oct '21

20 Oct '21

On 10/20/21 12:39 AM, Stephen Rothwell wrote: > Hi all, > > Changes since 20211019: > on i386: WARNING: unmet direct dependencies detected for SND_SOC_CS35L41_SPI Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SPI_MASTER [=n] Selected by [m]: - SND_SOC_AMD_VANGOGH_MACH [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_SOC_AMD_ACP5x [=m] && I2C [=y] KCONFIG_SEED=0x4F150562 and then ERROR: modpost: "__devm_regmap_init_spi" [sound/soc/codecs/snd-soc-cs35l41-spi.ko] undefined! ERROR: modpost: "__spi_register_driver" [sound/soc/codecs/snd-soc-cs35l41-spi.ko] undefined! ERROR: modpost: "spi_setup" [sound/soc/codecs/snd-soc-cs35l41-spi.ko] undefined! Full randconfig file is attached. -- ~Randy

1 0

[PATCH] ALSA: mixer: oss: Fix racy access to slots
by Takashi Iwai 20 Oct '21

20 Oct '21

The OSS mixer can reassign the mapping slots dynamically via proc file. Although the addition and deletion of those slots are protected by mixer->reg_mutex, the access to slots aren't, hence this may cause UAF when the slots in use are deleted concurrently. This patch applies the mixer->reg_mutex in all appropriate code paths (i.e. the ioctl functions) that may access slots. Reported-by: syzbot+9988f17cf72a1045a189(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/00000000000036adc005ceca9175@google.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/oss/mixer_oss.c | 44 ++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 11 deletions(-) diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c index 6a5abdd4271b..d5ddc154a735 100644 --- a/sound/core/oss/mixer_oss.c +++ b/sound/core/oss/mixer_oss.c @@ -130,11 +130,13 @@ static int snd_mixer_oss_devmask(struct snd_mixer_oss_file *fmixer) if (mixer == NULL) return -EIO; + mutex_lock(&mixer->reg_mutex); for (chn = 0; chn < 31; chn++) { pslot = &mixer->slots[chn]; if (pslot->put_volume || pslot->put_recsrc) result |= 1 << chn; } + mutex_unlock(&mixer->reg_mutex); return result; } @@ -146,11 +148,13 @@ static int snd_mixer_oss_stereodevs(struct snd_mixer_oss_file *fmixer) if (mixer == NULL) return -EIO; + mutex_lock(&mixer->reg_mutex); for (chn = 0; chn < 31; chn++) { pslot = &mixer->slots[chn]; if (pslot->put_volume && pslot->stereo) result |= 1 << chn; } + mutex_unlock(&mixer->reg_mutex); return result; } @@ -161,6 +165,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer) if (mixer == NULL) return -EIO; + mutex_lock(&mixer->reg_mutex); if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */ result = mixer->mask_recsrc; } else { @@ -172,6 +177,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer) result |= 1 << chn; } } + mutex_unlock(&mixer->reg_mutex); return result; } @@ -182,12 +188,12 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer) if (mixer == NULL) return -EIO; + mutex_lock(&mixer->reg_mutex); if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */ - int err; unsigned int index; - err = mixer->get_recsrc(fmixer, &index); - if (err < 0) - return err; + result = mixer->get_recsrc(fmixer, &index); + if (result < 0) + goto unlock; result = 1 << index; } else { struct snd_mixer_oss_slot *pslot; @@ -202,7 +208,10 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer) } } } - return mixer->oss_recsrc = result; + mixer->oss_recsrc = result; + unlock: + mutex_unlock(&mixer->reg_mutex); + return result; } static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsrc) @@ -215,6 +224,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr if (mixer == NULL) return -EIO; + mutex_lock(&mixer->reg_mutex); if (mixer->get_recsrc && mixer->put_recsrc) { /* exclusive input */ if (recsrc & ~mixer->oss_recsrc) recsrc &= ~mixer->oss_recsrc; @@ -240,6 +250,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr } } } + mutex_unlock(&mixer->reg_mutex); return result; } @@ -251,6 +262,7 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot) if (mixer == NULL || slot > 30) return -EIO; + mutex_lock(&mixer->reg_mutex); pslot = &mixer->slots[slot]; left = pslot->volume[0]; right = pslot->volume[1]; @@ -258,15 +270,21 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot) result = pslot->get_volume(fmixer, pslot, &left, &right); if (!pslot->stereo) right = left; - if (snd_BUG_ON(left < 0 || left > 100)) - return -EIO; - if (snd_BUG_ON(right < 0 || right > 100)) - return -EIO; + if (snd_BUG_ON(left < 0 || left > 100)) { + result = -EIO; + goto unlock; + } + if (snd_BUG_ON(right < 0 || right > 100)) { + result = -EIO; + goto unlock; + } if (result >= 0) { pslot->volume[0] = left; pslot->volume[1] = right; result = (left & 0xff) | ((right & 0xff) << 8); } + unlock: + mutex_unlock(&mixer->reg_mutex); return result; } @@ -279,6 +297,7 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer, if (mixer == NULL || slot > 30) return -EIO; + mutex_lock(&mixer->reg_mutex); pslot = &mixer->slots[slot]; if (left > 100) left = 100; @@ -289,10 +308,13 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer, if (pslot->put_volume) result = pslot->put_volume(fmixer, pslot, left, right); if (result < 0) - return result; + goto unlock; pslot->volume[0] = left; pslot->volume[1] = right; - return (left & 0xff) | ((right & 0xff) << 8); + result = (left & 0xff) | ((right & 0xff) << 8); + unlock: + mutex_lock(&mixer->reg_mutex); + return result; } static int snd_mixer_oss_ioctl1(struct snd_mixer_oss_file *fmixer, unsigned int cmd, unsigned long arg) -- 2.26.2

2 1

WC vs UC mappings in snd_dma_sg_alloc()
by sanekf＠nxt.ru 20 Oct '21

20 Oct '21

Hi I've stumbled across this code in sound/core/sgbuf.c: 66 static void *snd_dma_sg_alloc(struct snd_dma_buffer *dmab, size_t size) 67 { < ... > 80 if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG) { 81 type = SNDRV_DMA_TYPE_DEV_WC; 82 #ifdef pgprot_noncached 83 prot = pgprot_noncached(PAGE_KERNEL); 84 #endif 85 } < ... > 131 area = vmap(sgbuf->page_table, sgbuf->pages, VM_MAP, prot); Does not this violate x86 rules about using the same memory mapping type for all mappings? It seems that the following patch should fix it (only compile tested - my x86 PCs are either without Linux or without sound, and probably in practice this might not trigger any problems since both WC and UC-minus are incoherent types): ----------------------------- ALSA: memalloc: duly use pgprot_writecombine() for WC mapping x86 has strict rules about not having memory type aliasing (Documentation/x86/pat.rst). snd_dma_sg_alloc() violates them by mapping first as WC (with set_memory_wc()) and then as UC- (with pgprot_noncached() + vmap()). Switching to pgprot_writecombine() should fix this. Signed-off-by: Aleksandr Fedorov <halcien(a)gmail.com> diff --git a/sound/core/sgbuf.c b/sound/core/sgbuf.c index 8352a5cdb19f..670b30c3b6e5 100644 --- a/sound/core/sgbuf.c +++ b/sound/core/sgbuf.c @@ -79,9 +79,7 @@ static void *snd_dma_sg_alloc(struct snd_dma_buffer *dmab, size_t size) return NULL; if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG) { type = SNDRV_DMA_TYPE_DEV_WC; -#ifdef pgprot_noncached - prot = pgprot_noncached(PAGE_KERNEL); -#endif + prot = pgprot_writecombine(PAGE_KERNEL); } sgbuf->dev = dmab->dev.dev; pages = snd_sgbuf_aligned_pages(size);

2 1

[PATCH v3 0/2] arm: ep93xx: CCF conversion
by Alexander Sverdlin 20 Oct '21

20 Oct '21

This series series of patches converts ep93xx to Common Clock Framework. It consists of preparation patches to use clk_prepare_enable where it is needed, instead of clk_enable used in ep93xx drivers prior to CCF and a patch converting mach-ep93xx/clock.c to CCF. Link: https://lore.kernel.org/patchwork/cover/1445563/ Link: https://lore.kernel.org/patchwork/patch/1435884/ v2->v3: Rebased the series onto v5.15-rc5 v1->v2: - added SoB Alexander Sverdlin (1): ASoC: cirrus: i2s: Prepare clock before using it Nikita Shubin (1): ep93xx: clock: convert in-place to COMMON_CLK arch/arm/Kconfig | 2 +- arch/arm/mach-ep93xx/clock.c | 975 +++++++++++++++++++--------------- arch/arm/mach-ep93xx/core.c | 2 +- arch/arm/mach-ep93xx/soc.h | 42 +- sound/soc/cirrus/ep93xx-i2s.c | 12 +- 5 files changed, 587 insertions(+), 446 deletions(-) -- 2.33.0

2 2

[PATCH v3 0/6] Multiple headphone codec driver support
by Brent Lu 20 Oct '21

20 Oct '21

Support multiple headphone drivers in same machine driver. In this case, both rt5682 and rt5682s are supported and enumerated by different ACPI HID "10EC5682" and "RTL5682". V2 Changes: - remove useless 'NULL', 'false' in if-condition - can use 'comp_ids' field alone to enumerate driver - add comma to the end of entry in structure initialization - keep the table of byt/cht/cml/icl untouched V3 Changes: - upstreamd from SOF github, PR#3200 - use new compatiable IDs to shrink the enumerate table of BYT and CHT - add 'const' to snd_soc_acpi_codecs structures Brent Lu (3): ASoC: soc-acpi: add comp_ids field for machine driver matching ASoC: Intel: sof_rt5682: detect codec variant in probe function ASoC: Intel: sof_rt5682: use comp_ids to enumerate rt5682s Pierre-Louis Bossart (3): ASoC: Intel: soc-acpi-byt: shrink tables using compatible IDs ASoC: Intel: soc-acpi-cht: shrink tables using compatible IDs ASoC: Intel: soc-acpi: use const for all uses of snd_soc_acpi_codecs include/sound/soc-acpi.h | 3 + sound/soc/intel/boards/sof_rt5682.c | 34 ++------- .../intel/common/soc-acpi-intel-adl-match.c | 11 ++- .../intel/common/soc-acpi-intel-bxt-match.c | 2 +- .../intel/common/soc-acpi-intel-byt-match.c | 68 +++++++----------- .../intel/common/soc-acpi-intel-cht-match.c | 69 +++++++------------ .../intel/common/soc-acpi-intel-cml-match.c | 8 +-- .../intel/common/soc-acpi-intel-glk-match.c | 2 +- .../intel/common/soc-acpi-intel-jsl-match.c | 43 ++++-------- .../intel/common/soc-acpi-intel-kbl-match.c | 12 ++-- .../intel/common/soc-acpi-intel-skl-match.c | 2 +- .../intel/common/soc-acpi-intel-tgl-match.c | 11 ++- sound/soc/soc-acpi.c | 24 ++++++- 13 files changed, 119 insertions(+), 170 deletions(-) -- 2.25.1

3 8

[syzbot] KASAN: use-after-free Read in snd_mixer_oss_get_volume1
by syzbot 20 Oct '21

20 Oct '21

Hello, syzbot found the following issue on: HEAD commit: 8fe31e0995f0 Merge tag 'gpio-fixes-for-v5.15-rc6' of git:/.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16a58d94b00000 kernel config: https://syzkaller.appspot.com/x/.config?x=bab9d35f204746a7 dashboard link: https://syzkaller.appspot.com/bug?extid=9988f17cf72a1045a189 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 userspace arch: i386 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10251d58b00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17039278b00000 Bisection is inconclusive: the issue happens on the oldest tested release. bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=167855f4b00000 final oops: https://syzkaller.appspot.com/x/report.txt?x=157855f4b00000 console output: https://syzkaller.appspot.com/x/log.txt?x=117855f4b00000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+9988f17cf72a1045a189(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in snd_mixer_oss_get_volume1+0x574/0x610 sound/core/oss/mixer_oss.c:600 Read of size 4 at addr ffff888070afc984 by task syz-executor166/6533 CPU: 0 PID: 6533 Comm: syz-executor166 Not tainted 5.15.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x6c/0x309 mm/kasan/report.c:256 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 snd_mixer_oss_get_volume1+0x574/0x610 sound/core/oss/mixer_oss.c:600 snd_mixer_oss_get_volume sound/core/oss/mixer_oss.c:258 [inline] snd_mixer_oss_ioctl1+0x249/0x1880 sound/core/oss/mixer_oss.c:358 snd_mixer_oss_ioctl_compat+0x45/0x60 sound/core/oss/mixer_oss.c:391 __do_compat_sys_ioctl+0x1c7/0x290 fs/ioctl.c:972 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f42549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000ffa708bc EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080254d18 RDX: 0000000000000000 RSI: 0000000003700000 RDI: 0000000001000000 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 6526: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] ____kasan_kmalloc mm/kasan/common.c:472 [inline] __kasan_kmalloc+0xa4/0xd0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:591 [inline] snd_mixer_oss_build_input+0x656/0xe30 sound/core/oss/mixer_oss.c:1093 snd_mixer_oss_proc_write+0x384/0x5c0 sound/core/oss/mixer_oss.c:1233 snd_info_text_entry_release+0xfa/0x260 sound/core/info.c:408 close_pdeo.part.0+0xdc/0x2e0 fs/proc/inode.c:244 close_pdeo fs/proc/inode.c:563 [inline] proc_reg_release+0x2e9/0x360 fs/proc/inode.c:562 __fput+0x288/0x9f0 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xbae/0x2a30 kernel/exit.c:825 do_group_exit+0x125/0x310 kernel/exit.c:922 __do_sys_exit_group kernel/exit.c:933 [inline] __se_sys_exit_group kernel/exit.c:931 [inline] __ia32_sys_exit_group+0x3a/0x50 kernel/exit.c:931 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Freed by task 6531: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:360 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free mm/kasan/common.c:328 [inline] __kasan_slab_free+0xff/0x130 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1700 [inline] slab_free_freelist_hook+0x81/0x190 mm/slub.c:1725 slab_free mm/slub.c:3483 [inline] kfree+0xe4/0x530 mm/slub.c:4543 snd_mixer_oss_slot_free+0xf3/0x130 sound/core/oss/mixer_oss.c:951 mixer_slot_clear+0x5a/0xb0 sound/core/oss/mixer_oss.c:959 snd_mixer_oss_build_input+0x7f0/0xe30 sound/core/oss/mixer_oss.c:1101 snd_mixer_oss_proc_write+0x384/0x5c0 sound/core/oss/mixer_oss.c:1233 snd_info_text_entry_release+0xfa/0x260 sound/core/info.c:408 close_pdeo.part.0+0xdc/0x2e0 fs/proc/inode.c:244 close_pdeo fs/proc/inode.c:563 [inline] proc_reg_release+0x2e9/0x360 fs/proc/inode.c:562 __fput+0x288/0x9f0 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xbae/0x2a30 kernel/exit.c:825 do_group_exit+0x125/0x310 kernel/exit.c:922 __do_sys_exit_group kernel/exit.c:933 [inline] __se_sys_exit_group kernel/exit.c:931 [inline] __ia32_sys_exit_group+0x3a/0x50 kernel/exit.c:931 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c The buggy address belongs to the object at ffff888070afc980 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 4 bytes inside of 96-byte region [ffff888070afc980, ffff888070afc9e0) The buggy address belongs to the page: page:ffffea0001c2bf00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x70afc flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea0000725740 0000000700000007 ffff888010c41780 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 4486, ts 39889903663, free_ts 39887746705 prep_new_page mm/page_alloc.c:2424 [inline] get_page_from_freelist+0xa72/0x2f80 mm/page_alloc.c:4153 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5375 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2197 alloc_slab_page mm/slub.c:1763 [inline] allocate_slab mm/slub.c:1900 [inline] new_slab+0x319/0x490 mm/slub.c:1963 ___slab_alloc+0x921/0xfe0 mm/slub.c:2994 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3081 slab_alloc_node mm/slub.c:3172 [inline] slab_alloc mm/slub.c:3214 [inline] __kmalloc+0x305/0x320 mm/slub.c:4387 kmalloc include/linux/slab.h:596 [inline] kzalloc include/linux/slab.h:721 [inline] tomoyo_encode2.part.0+0xe9/0x3a0 security/tomoyo/realpath.c:45 tomoyo_encode2 security/tomoyo/realpath.c:31 [inline] tomoyo_encode+0x28/0x50 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x186/0x620 security/tomoyo/realpath.c:288 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x272/0x380 security/tomoyo/file.c:771 tomoyo_file_open security/tomoyo/tomoyo.c:311 [inline] tomoyo_file_open+0xa3/0xd0 security/tomoyo/tomoyo.c:306 security_file_open+0x45/0xb0 security/security.c:1634 do_dentry_open+0x353/0x11d0 fs/open.c:809 do_open fs/namei.c:3428 [inline] path_openat+0x1c9a/0x2740 fs/namei.c:3561 do_filp_open+0x1aa/0x400 fs/namei.c:3588 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1338 [inline] free_pcp_prepare+0x2c5/0x780 mm/page_alloc.c:1389 free_unref_page_prepare mm/page_alloc.c:3315 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3394 __vunmap+0x783/0xb70 mm/vmalloc.c:2621 free_work+0x58/0x70 mm/vmalloc.c:95 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Memory state around the buggy address: ffff888070afc880: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc ffff888070afc900: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff888070afc980: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888070afca00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888070afca80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ================================================================== ---------------- Code disassembly (best guess): 0: 03 74 c0 01 add 0x1(%rax,%rax,8),%esi 4: 10 05 03 74 b8 01 adc %al,0x1b87403(%rip) # 0x1b8740d a: 10 06 adc %al,(%rsi) c: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi 10: 10 07 adc %al,(%rdi) 12: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi 16: 10 08 adc %cl,(%rax) 18: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi 1c: 00 00 add %al,(%rax) 1e: 00 00 add %al,(%rax) 20: 00 51 52 add %dl,0x52(%rcx) 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 * 2a: 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 retq 2e: 90 nop 2f: 90 nop 30: 90 nop 31: 90 nop 32: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi 39: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

1 0

[PATCH alsa-utils 1/2] alsamixer: Check the availability of mouse
by Takashi Iwai 20 Oct '21

20 Oct '21

Let's check the availiabiy via has_mouse(). Otherwise the program aborts unexpectedly just focusing on my rxvt terminal :-( Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- alsamixer/mainloop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/alsamixer/mainloop.c b/alsamixer/mainloop.c index e67c0f821e8a..cdbe28e390fd 100644 --- a/alsamixer/mainloop.c +++ b/alsamixer/mainloop.c @@ -50,7 +50,7 @@ void initialize_curses(bool use_color, bool use_mouse) #endif window_size_changed(); /* update screen_lines/cols */ init_colors(use_color); - if (use_mouse) + if (use_mouse && has_mouse()) mousemask(ALL_MOUSE_EVENTS, NULL); snd_lib_error_set_handler(black_hole_error_handler); } -- 2.26.2

1 1

[PATCH] soundwire: qcom: add debugfs entry for soundwire register dump
by Srinivas Kandagatla 20 Oct '21

20 Oct '21

For debug purposes add an entry in debugfs to dump Qualcomm SoundWire Controller registers. Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> --- drivers/soundwire/qcom.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c index 0ef79d60e88e..a317bea2d42d 100644 --- a/drivers/soundwire/qcom.c +++ b/drivers/soundwire/qcom.c @@ -7,6 +7,7 @@ #include <linux/io.h> #include <linux/kernel.h> #include <linux/module.h> +#include <linux/debugfs.h> #include <linux/of.h> #include <linux/of_irq.h> #include <linux/of_device.h> @@ -83,6 +84,7 @@ #define SWRM_DP_PORT_HCTRL_BANK(n, m) (0x1134 + 0x100 * (n - 1) + 0x40 * m) #define SWRM_DP_BLOCK_CTRL3_BANK(n, m) (0x1138 + 0x100 * (n - 1) + 0x40 * m) #define SWRM_DIN_DPn_PCM_PORT_CTRL(n) (0x1054 + 0x100 * (n - 1)) +#define SWR_MSTR_MAX_REG_ADDR (0x1740) #define SWRM_DP_PORT_CTRL_EN_CHAN_SHFT 0x18 #define SWRM_DP_PORT_CTRL_OFFSET2_SHFT 0x10 @@ -127,6 +129,9 @@ struct qcom_swrm_ctrl { struct device *dev; struct regmap *regmap; void __iomem *mmio; +#ifdef CONFIG_DEBUG_FS + struct dentry *debugfs; +#endif struct completion broadcast; struct completion enumeration; struct work_struct slave_work; @@ -1192,6 +1197,22 @@ static int qcom_swrm_get_port_config(struct qcom_swrm_ctrl *ctrl) return 0; } +#ifdef CONFIG_DEBUG_FS +static int swrm_reg_show(struct seq_file *s_file, void *data) +{ + struct qcom_swrm_ctrl *swrm = s_file->private; + int reg, reg_val; + + for (reg = 0; reg <= SWR_MSTR_MAX_REG_ADDR; reg += 4) { + swrm->reg_read(swrm, reg, &reg_val); + seq_printf(s_file, "0x%.3x: 0x%.2x\n", reg, reg_val); + } + + return 0; +} +DEFINE_SHOW_ATTRIBUTE(swrm_reg); +#endif + static int qcom_swrm_probe(struct platform_device *pdev) { struct device *dev = &pdev->dev; @@ -1302,6 +1323,12 @@ static int qcom_swrm_probe(struct platform_device *pdev) (ctrl->version >> 24) & 0xff, (ctrl->version >> 16) & 0xff, ctrl->version & 0xffff); +#ifdef CONFIG_DEBUG_FS + ctrl->debugfs = debugfs_create_dir("qualcomm-sdw", ctrl->bus.debugfs); + debugfs_create_file("qualcomm-registers", 0400, ctrl->debugfs, ctrl, + &swrm_reg_fops); +#endif + return 0; err_master_add: -- 2.21.0

3 4

[PATCH] soundwire: bus: stop dereferencing invalid slave pointer
by Srinivas Kandagatla 20 Oct '21

20 Oct '21

Slave pointer is invalid after end of list iteration, using this would result in below Memory abort. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 ... Call trace: __dev_printk+0x34/0x7c _dev_warn+0x6c/0x90 sdw_bus_exit_clk_stop+0x194/0x1d0 swrm_runtime_resume+0x13c/0x238 pm_generic_runtime_resume+0x2c/0x48 __rpm_callback+0x44/0x150 rpm_callback+0x6c/0x78 rpm_resume+0x314/0x558 rpm_resume+0x378/0x558 rpm_resume+0x378/0x558 __pm_runtime_resume+0x3c/0x88 Use bus->dev instead to print this error message. Fixes: b50bb8ba369cd ("soundwire: bus: handle -ENODATA errors in clock stop/start sequences") Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> --- drivers/soundwire/bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c index 1b115734a8f6..67369e941d0d 100644 --- a/drivers/soundwire/bus.c +++ b/drivers/soundwire/bus.c @@ -1110,7 +1110,7 @@ int sdw_bus_exit_clk_stop(struct sdw_bus *bus) if (!simple_clk_stop) { ret = sdw_bus_wait_for_clk_prep_deprep(bus, SDW_BROADCAST_DEV_NUM); if (ret < 0) - dev_warn(&slave->dev, "clock stop deprepare wait failed:%d\n", ret); + dev_warn(bus->dev, "clock stop deprepare wait failed:%d\n", ret); } list_for_each_entry(slave, &bus->slaves, node) { -- 2.21.0

3 2