- Alsa-devel - mailman.alsa-project.org

Missunderstanding or a BUG in reported frequencies for audio cards present in system.
by GitHub issues - edited 02 Jan '25

02 Jan '25

alsa-project/alsa-lib issue #432 was edited from CapSel: I use ArchLinux with kernel 6.12.7 with "Zen" patches. HW is ASUS Vivobook 14X pro. So the problem I'm having is that I can't set pipewire to 96000 sampling rate. I tried all options in pipewire. Nothing helped. But a long time ago it worked fine - I can't remember when. What I see in system: when I do `cat /proc/asound/card0/pcm3p/info` (no other pcm* files) I can see `name: HDMI 0` - it's important. with `cat /proc/asound/card0/codec#0` on top there is: ``` Codec: ATI R6xx HDMI Address: 0 AFG Function Id: 0x1 (unsol 0) Vendor Id: 0x1002aa01 Subsystem Id: 0x00aa0100 Revision Id: 0x100700 No Modem Function Group found Default PCM: rates [0x70]: 32000 44100 48000 bits [0x2]: 16 formats [0x1]: PCM ``` for the other (default) audio card: `cat /proc/asound/card1/pcm0p/info` (there is pcm0c file too but I did not check it) gives: `name: ALC294 Analog` `cat /proc/asound/card1/codec#0` on top: ``` Codec: Realtek ALC294 Address: 0 AFG Function Id: 0x1 (unsol 1) Vendor Id: 0x10ec0294 Subsystem Id: 0x10431ab2 Revision Id: 0x100004 No Modem Function Group found Default PCM: rates [0x560]: 44100 48000 96000 192000 bits [0xe]: 16 20 24 formats [0x1]: PCM ``` so as you can see: - hdmi supports up to 48000 - analog supports up to 192000 I first noticed there is something wrong with alsacap program that reports: ``` *** Scanning for playback devices *** Card 0, ID `Generic', name `HD-Audio Generic' Device 3, ID `HDMI 0', name `HDMI 0', 1 subdevices (1 available) 2..8 channels, sampling rate 32000..192000 Hz Sample formats: S16_LE, S32_LE Subdevice 0, name `subdevice #0' Card 1, ID `Generic_1', name `HD-Audio Generic' Device 0, ID `ALC294 Analog', name `ALC294 Analog', 1 subdevices (1 available) 2 channels, sampling rate 44100..48000 Hz Sample formats: S16_LE, S32_LE Subdevice 0, name `subdevice #0' ``` As you can see: - hdmi supports up to 192000 - analog supports up to 48000 so it's... flipped? here is a output from `cat /proc/asound/pcm`: ``` 00-03: HDMI 0 : HDMI 0 : playback 1 01-00: ALC294 Analog : ALC294 Analog : playback 1 : capture 1 ``` To confirm this I downloaded flac file with 96000 sample rate and tried to play it with ffmpeg after pipewire,pipewire-pulse,wireplumber services are stopped. I confirmed that these programs are disabled by checking if `ps ax | grep wire` before and after, also I monitored logs from these services. It reported error for device "hw:1,0" because it could not set sampling rate to 96000. It did not fail on "hw:0,3" but of course I did not hear anything since external monitor is disconnected. Replay command: `ffmpeg -i yuri_korzunov-through-moon_ring-96kHz-24bit.flac -f alsa hw:1,0` the file is some random file found in internet that tested with `ffprobe` shows that it has sample rate of 96000. I don't want to attach it since I forgot where I found it ;) I don't have `asound.conf` files in `/etc/` or `~/.config`. After connecting external monitor alsacap reports max 48000 for both cards. FFmpeg reports sampling rate problem with both audio cards: ``` [alsa @ 0x586316542b00] sample rate 96000 not available, nearest is 48000 ``` What else can I do to discover the problem? Issue URL : https://github.com/alsa-project/alsa-lib/issues/432 Repository URL: https://github.com/alsa-project/alsa-lib

1 0

Missunderstanding or a BUG in reported frequencies for audio cards present in system.
by GitHub issues - opened 02 Jan '25

02 Jan '25

alsa-project/alsa-lib issue #432 was opened from CapSel: I use ArchLinux with kernel 6.12.7 with "Zen" patches. HW is ASUS Vivobook 14X pro. So the problem I'm having is that I can't set pipewire to 96000 sampling rate. I tried all options in pipewire. Nothing helped. But a long time ago it worked fine - I can't remember when. What I see in system: when I do `cat /proc/asound/card0/pcm3p/info` (no other pcm* files) I can see `name: HDMI 0` - it's important. with `cat /proc/asound/card0/codec#0` on top there is: ``` Codec: ATI R6xx HDMI Address: 0 AFG Function Id: 0x1 (unsol 0) Vendor Id: 0x1002aa01 Subsystem Id: 0x00aa0100 Revision Id: 0x100700 No Modem Function Group found Default PCM: rates [0x70]: 32000 44100 48000 bits [0x2]: 16 formats [0x1]: PCM ``` for the other (default) audio card: `cat /proc/asound/card1/pcm0p/info` (there is pcm0c file too but I did not check it) gives: `name: ALC294 Analog` `cat /proc/asound/card1/codec#0` on top: ``` Codec: Realtek ALC294 Address: 0 AFG Function Id: 0x1 (unsol 1) Vendor Id: 0x10ec0294 Subsystem Id: 0x10431ab2 Revision Id: 0x100004 No Modem Function Group found Default PCM: rates [0x560]: 44100 48000 96000 192000 bits [0xe]: 16 20 24 formats [0x1]: PCM ``` so as you can see: - hdmi supports up to 48000 - analog supports up to 192000 I first noticed there is something wrong with alsacap program that reports: ``` *** Scanning for playback devices *** Card 0, ID `Generic', name `HD-Audio Generic' Device 3, ID `HDMI 0', name `HDMI 0', 1 subdevices (1 available) 2..8 channels, sampling rate 32000..192000 Hz Sample formats: S16_LE, S32_LE Subdevice 0, name `subdevice #0' Card 1, ID `Generic_1', name `HD-Audio Generic' Device 0, ID `ALC294 Analog', name `ALC294 Analog', 1 subdevices (1 available) 2 channels, sampling rate 44100..48000 Hz Sample formats: S16_LE, S32_LE Subdevice 0, name `subdevice #0' ``` As you can see: - hdmi supports up to 192000 - analog supports up to 48000 so it's... flipped? here is a output from `cat /proc/asound/pcm`: ``` 00-03: HDMI 0 : HDMI 0 : playback 1 01-00: ALC294 Analog : ALC294 Analog : playback 1 : capture 1 ``` To confirm this I downloaded flac file with 96000 sample rate and tried to play it with ffmpeg after pipewire,pipewire-pulse,wireplumber services are stopped. I confirmed that these programs are disabled by checking if `ps ax | grep wire` before and after, also I monitored logs from these services. It reported error for device "hw:1,0" because it could not set sampling rate to 96000. It did not fail on "hw:0,3" but of course I did not hear anything since external monitor is disconnected. Replay command: `ffmpeg -i yuri_korzunov-through-moon_ring-96kHz-24bit.flac -f alsa hw:1,0` the file is some random file found in internet that tested with `ffprobe` shows that it has sample rate of 96000. I don't want to attach it since I forgot where I found it ;) I don't have `asound.conf` files in `/etc/` or `~/.config`. What else can I do to discover the problem? Issue URL : https://github.com/alsa-project/alsa-lib/issues/432 Repository URL: https://github.com/alsa-project/alsa-lib

1 0

Add Roland QUAD-CAPTURE USB 2.0 support
by GitHub pull_request - opened 31 Dec '24

31 Dec '24

alsa-project/alsa-ucm-conf pull request #494 was opened from bjornmp: Add Roland QUAD-CAPTURE USB 2.0 support Request URL : https://github.com/alsa-project/alsa-ucm-conf/pull/494 Patch URL : https://github.com/alsa-project/alsa-ucm-conf/pull/494.patch Repository URL: https://github.com/alsa-project/alsa-ucm-conf

1 0

alsa-lib-1.2.13 is breaking dssi-1.1.1 because of missing header
by GitHub issues - opened 30 Dec '24

30 Dec '24

alsa-project/alsa-lib issue #431 was opened from kobboi: What was working with 1.2.12 no longer isn't: ``` /usr/include/alsa/ump_msg.h:1119:65: error: unknown type name ‘size_t’ 1119 | int snd_ump_msg_sysex_expand(const uint32_t *ump, uint8_t *buf, size_t maxlen, | ^~~~~~ /usr/include/alsa/ump_msg.h:13:1: note: ‘size_t’ is defined in header ‘<stddef.h>’; did you forget to ‘#include <stddef.h>’? 12 | #include <stdint.h> +++ |+#include <stddef.h> 13 | /usr/include/alsa/ump_msg.h:1120:30: error: unknown type name ‘size_t’ 1120 | size_t *filled); | ^~~~~~ /usr/include/alsa/ump_msg.h:1120:30: note: ‘size_t’ is defined in header ‘<stddef.h>’; did you forget to ‘#include <stddef.h>’? ``` Can this be addressed? Happy holidays! Issue URL : https://github.com/alsa-project/alsa-lib/issues/431 Repository URL: https://github.com/alsa-project/alsa-lib

1 0

[PATCH v1] MAINTAINERS: update entries in TEXAS INSTRUMENTS LOW/MIDDLE-POWER AUDIO AMPLIFIER (ASoC/HDA) DRIVERS and add entries for haptic driver
by Shenghao Ding 30 Dec '24

30 Dec '24

Due to internal re-org, Kevin has no longer maintained audio driver. With the job responsibility change, drop entries for the audio converter and add entries for both haptics drivers and middle-power audio amplifier drivers. Add audio converter, set the Status as Supported. Signed-off-by: Shenghao Ding <shenghao-ding(a)ti.com> --- MAINTAINERS | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index 910305c11e8a..db50e677c9ca 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -23170,25 +23170,42 @@ S: Maintained F: Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml F: sound/soc/ti/ -TEXAS INSTRUMENTS AUDIO (ASoC/HDA) DRIVERS +TEXAS INSTRUMENTS LOW/MIDDLE-POWER AUDIO AMPLIFIER (ASoC/HDA) & HAPTICS DRIVERS M: Shenghao Ding <shenghao-ding(a)ti.com> -M: Kevin Lu <kevin-lu(a)ti.com> M: Baojun Xu <baojun.xu(a)ti.com> L: linux-sound(a)vger.kernel.org -S: Maintained +S: Supported +F: Documentation/devicetree/bindings/input/ti,drv260x.yaml +F: Documentation/devicetree/bindings/input/ti,drv266x.yaml F: Documentation/devicetree/bindings/sound/tas2552.txt +F: Documentation/devicetree/bindings/sound/tas5720.txt F: Documentation/devicetree/bindings/sound/ti,tas2562.yaml F: Documentation/devicetree/bindings/sound/ti,tas2770.yaml +F: Documentation/devicetree/bindings/sound/ti,tas2781.yaml F: Documentation/devicetree/bindings/sound/ti,tas27xx.yaml +F: Documentation/devicetree/bindings/sound/ti,tas5086.txt +F: Documentation/devicetree/bindings/sound/ti,tas57xx.yaml +F: Documentation/devicetree/bindings/sound/ti,tas5805m.yaml F: Documentation/devicetree/bindings/sound/ti,tpa6130a2.yaml +F: drivers/input/misc/drv2*.c +F: include/sound/tas2*.h +F: include/sound/tas5086.h +F: include/sound/tpa6130a2-plat.h +F: sound/pci/hda/tas2781_hda_i2c.c +F: sound/soc/codecs/tas2*.* +F: sound/soc/codecs/tas5*.* +F: sound/soc/codecs/tpa6130a2.* + +TEXAS INSTRUMENTS AUDIO Converter (ASoC) and Touch Screen DRIVERS +L: linux-sound(a)vger.kernel.org +S: Maintained F: Documentation/devicetree/bindings/sound/ti,pcm1681.yaml F: Documentation/devicetree/bindings/sound/ti,pcm3168a.yaml +F: Documentation/devicetree/bindings/sound/ti,pcm6240.yaml F: Documentation/devicetree/bindings/sound/ti,tlv320*.yaml F: Documentation/devicetree/bindings/sound/ti,tlv320adcx140.yaml -F: include/sound/tas2*.h +F: drivers/input/touchscreen/tsc2*.* F: include/sound/tlv320*.h -F: include/sound/tpa6130a2-plat.h -F: sound/pci/hda/tas2781_hda_i2c.c F: sound/soc/codecs/pcm1681.c F: sound/soc/codecs/pcm1789*.* F: sound/soc/codecs/pcm179x*.* @@ -23198,9 +23215,8 @@ F: sound/soc/codecs/pcm3060*.* F: sound/soc/codecs/pcm3168a*.* F: sound/soc/codecs/pcm5102a.c F: sound/soc/codecs/pcm512x*.* -F: sound/soc/codecs/tas2*.* +F: sound/soc/codecs/pcm6240.* F: sound/soc/codecs/tlv320*.* -F: sound/soc/codecs/tpa6130a2.* TEXAS INSTRUMENTS DMA DRIVERS M: Peter Ujfalusi <peter.ujfalusi(a)gmail.com> -- 2.34.1

1 0

UCM2 macro breaks on updates for Motu 828
by GitHub issues - opened 30 Dec '24

30 Dec '24

alsa-project/alsa-ucm-conf issue #493 was opened from beatboxa: It appears that every time there is an update, my UCM profile breaks. So that when I boot my machine, I have no sound (unless I manually map things in a pro audio application). This appears to be due to an issue in the SplitPCM macro--specifically, some parsing. Here is the thread describing the creation of the UCM profile I am using, including a patch that I had to apply in order to get things working: #416 And specifically, here is the patch I apply in order to fix it: https://github.com/alsa-project/alsa-ucm-conf/commit/b68aa52acdd2763fedad5e… It involves adding a single hyphen character to the file: ucm2/common/pcm/split.conf Because it is a single character, I have been manually changing the file. It's hard for me to follow that thread--but is this fixed and I am on older versions, or is this still an open item? Or is there a way to automate this so that my audio doesn't break on every update? Issue URL : https://github.com/alsa-project/alsa-ucm-conf/issues/493 Repository URL: https://github.com/alsa-project/alsa-ucm-conf

1 0

[RESEND PATCH v2] drm/bridge: dw-hdmi-i2s: set insert_pcuv bit if hardware supports it
by Geraldo Nascimento 30 Dec '24

30 Dec '24

Hi Mark, resending this as it failed to apply in my last submission. Added Neil Armstrong to Cc: as hopefully he will be able to better review this. Thanks, Geraldo Nascimento --- Starting with version 2.10a of Synopsys DesignWare HDMI controller the insert_pcuv bit was introduced. On RK3399pro SoM (Radxa Rock Pi N10), for example, if we neglect to set this bit and proceed to enable hdmi_sound and i2s2 on the device tree there will be extreme clipping of sound output, to the point that music sounds like white noise. Problem could also manifest as just mild cracking depending of HDMI audio implementation of sink. Setting insert_pcuv bit (bit 2 of aud_conf2 Audio Sample register) fixes this. Signed-off-by: Geraldo Nascimento <geraldogabriel(a)gmail.com> --- v1->v2: SoC->SoM on description, better commenting, minor style changes, conditional application of fix for L-PCM only --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio-20221017.c +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio-20221017.c @@ -42,6 +42,7 @@ static int dw_hdmi_i2s_hw_params(struct device *dev, void *data, struct dw_hdmi *hdmi = audio->hdmi; u8 conf0 = 0; u8 conf1 = 0; + u8 conf2 = 0; u8 inputclkfs = 0; /* it cares I2S only */ @@ -101,6 +102,28 @@ static int dw_hdmi_i2s_hw_params(struct device *dev, void *data, return -EINVAL; } + /* + * dw-hdmi introduced insert_pcuv bit in + * version 2.10a. + * + * This single bit (bit 2 of HDMI_AUD_CONF2) + * when set to 1 will enable the insertion of the PCUV + * (Parity, Channel Status, User bit and Validity) + * bits on the incoming audio stream. + * + * Support is limited to Linear PCM audio. If + * neglected, the lack of valid PCUV bits + * on L-PCM streams will cause anything from + * mild cracking to full blown extreme + * clipping depending on the HDMI audio + * implementation of the sink. + * + */ + + if (hdmi_read(audio, HDMI_DESIGN_ID) >= 0x21 && + !(hparms->iec.status[0] & IEC958_AES0_NONAUDIO)) + conf2 = HDMI_AUD_CONF2_INSERT_PCUV; + dw_hdmi_set_sample_rate(hdmi, hparms->sample_rate); dw_hdmi_set_channel_status(hdmi, hparms->iec.status); dw_hdmi_set_channel_count(hdmi, hparms->channels); @@ -109,6 +120,7 @@ static int dw_hdmi_i2s_hw_params(struct device *dev, void *data, hdmi_write(audio, inputclkfs, HDMI_AUD_INPUTCLKFS); hdmi_write(audio, conf0, HDMI_AUD_CONF0); hdmi_write(audio, conf1, HDMI_AUD_CONF1); + hdmi_write(audio, conf2, HDMI_AUD_CONF2); return 0; } --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-20221017.h +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-20221017.h @@ -931,6 +931,11 @@ enum { HDMI_AUD_CONF1_WIDTH_16 = 0x10, HDMI_AUD_CONF1_WIDTH_24 = 0x18, +/* AUD_CONF2 field values */ + HDMI_AUD_CONF2_HBR = 0x01, + HDMI_AUD_CONF2_NLPCM = 0x02, + HDMI_AUD_CONF2_INSERT_PCUV = 0x04, + /* AUD_CTS3 field values */ HDMI_AUD_CTS3_N_SHIFT_OFFSET = 5, HDMI_AUD_CTS3_N_SHIFT_MASK = 0xe0,

3 6

[PATCH v4 0/9] ASoC: samsung: midas-audio: Add GPIO-based headset jack detection
by Artur Weber 29 Dec '24

29 Dec '24

Many of Samsung's Exynos 4 devices share the same midas-audio driver to handle the codec setup. While most of these devices, including the Midas itself, use the jack detection provided by the WM8994 driver, other devices such as the Samsung Galaxy Tab 3 8.0 (lt01) use two GPIOs and an ADC channel to determine jack insertion, the jack's type, and button presses (for headsets with volume up/down/play buttons). In the downstream kernel, this behavior is implemented in the sec-jack driver[1], and the per-device settings are configured in *-jack.c files in the mach folder (see e.g. the Tab 3's implementation[2]). This patchset implements this mechanism in the midas_wm1811.c driver, and adds new DTS options to allow for its configuration. It also enables jack detection for the Samsung Galaxy Tab 3 8.0. A very similar mechanism was already present in the aries_wm8994.c driver[3]; this implementation heavily borrows from it, though there are a few extra cleanups as well. Signed-off-by: Artur Weber <aweber.kernel(a)gmail.com> [1] https://github.com/gr8nole/android_kernel_samsung_smdk4x12/blob/lineage-14.… [2] https://github.com/gr8nole/android_kernel_samsung_smdk4x12/blob/lineage-14.… [3] https://github.com/torvalds/linux/blob/master/sound/soc/samsung/aries_wm899… --- Changes in v4: - Replaced manual regulator toggles with SND_SOC_DAPM_REGULATOR_SUPPLY, both for existing mic bias regulators and for the new headset mic bias regulator - Link to v3: https://lore.kernel.org/r/20240519-midas-wm1811-gpio-jack-v3-0-0c1736144c0e… Changes in v3: - Re-added pipe (|) character to samsung,headset-button-threshold-microvolt description to prevent it from being parsed as a mapping (fixes syntax error) - Split out "ASoC: dt-bindings: samsung,midas-audio: Add GPIO-based headset jack detection" into two patches - Link to v2: https://lore.kernel.org/r/20240508-midas-wm1811-gpio-jack-v2-0-b4d36cd02c6e… Changes in v2: - Added vendor prefix to threshold properties - Added separate headset mic bias regulator - Changed some cases of dev_err + return with return dev_err_probe - Added an extra patch to replace some previous dev_err + return cases with dev_err_probe - Moved tab3 DTS wm1811 codec config changes to separate commit --- Artur Weber (9): ASoC: dt-bindings: samsung,midas-audio: Add headset mic bias supply ASoC: dt-bindings: samsung,midas-audio: Add GPIO-based headset jack detection ASoC: samsung: midas_wm1811: Use SND_SOC_DAPM_REGULATOR_SUPPLY for bias regulators ASoC: samsung: midas_wm1811: Add headset mic bias supply support ASoC: samsung: midas_wm1811: Add GPIO-based headset jack detection ASoC: samsung: midas_wm1811: Use dev_err_probe where appropriate ARM: dts: samsung: exynos4212-tab3: Fix headset mic, add jack detection ARM: dts: samsung: exynos4212-tab3: Add MCLK2 clock to WM1811 codec config ARM: dts: samsung: exynos4212-tab3: Drop interrupt from WM1811 codec .../bindings/sound/samsung,midas-audio.yaml | 33 ++ arch/arm/boot/dts/samsung/exynos4212-tab3.dtsi | 31 +- sound/soc/samsung/Kconfig | 2 +- sound/soc/samsung/midas_wm1811.c | 348 +++++++++++++++++---- 4 files changed, 343 insertions(+), 71 deletions(-) --- base-commit: a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 change-id: 20240502-midas-wm1811-gpio-jack-b10226b17ecc Best regards, -- Artur Weber <aweber.kernel(a)gmail.com>

3 12

USB-Audio: ALC4080 - add ASUS ROG Crosshair X870E Hero (USB 0b05:1b7c)
by GitHub pull_request - opened 26 Dec '24

26 Dec '24

alsa-project/alsa-ucm-conf pull request #492 was opened from jetm: https://rog.asus.com/motherboards/rog-crosshair/rog-crosshair-x870e-hero/ Request URL : https://github.com/alsa-project/alsa-ucm-conf/pull/492 Patch URL : https://github.com/alsa-project/alsa-ucm-conf/pull/492.patch Repository URL: https://github.com/alsa-project/alsa-ucm-conf

1 0

Re: Bug: slab-out-of-bounds in snd_seq_oss_synth_sysex
by Kun Hu 26 Dec '24

26 Dec '24

>> BUG: KASAN: slab-out-of-bounds in snd_seq_oss_synth_sysex+0x5d1/0x6c0 sound/core/seq/oss/seq_oss_synth.c:516 > > We further analyzed the issue at line 516 in ./sound/core/seq/oss/seq_oss_synth.c. > The slab-out-of-bounds crash occurs in line 509, when sysex->len = 128. Specifically, the write operation to dest[0] accesses memory beyond the bounds of sysex->buf (128 byte). > To resolve this issue, we suggest adding 6 lines of code to validate the legality of the address write to sysex->buf before entering the loop: > > if (sysex->len >= MAX_SYSEX_BUFLEN) { > sysex->len = 0; > sysex->skip = 1; > return -EINVAL; /* Exit early if sysex->len is out of bounds */ > } If you need any more information, please don't hesitate to let me know. ————— Best regards, Kun Hu > 2024年12月25日 13:37，Kun Hu <huk23(a)m.fudan.edu.cn> 写道： > > Hello, > >> BUG: KASAN: slab-out-of-bounds in snd_seq_oss_synth_sysex+0x5d1/0x6c0 sound/core/seq/oss/seq_oss_synth.c:516 > > We further analyzed the issue at line 516 in ./sound/core/seq/oss/seq_oss_synth.c. > The slab-out-of-bounds crash occurs in line 509, when sysex->len = 128. Specifically, the write operation to dest[0] accesses memory beyond the bounds of sysex->buf (128 byte). > To resolve this issue, we suggest adding 6 lines of code to validate the legality of the address write to sysex->buf before entering the loop: > > if (sysex->len >= MAX_SYSEX_BUFLEN) { > sysex->len = 0; > sysex->skip = 1; > return -EINVAL; /* Exit early if sysex->len is out of bounds */ > } > > If you fix this issue, please add the following tag to the commit: > Reported-by: Kun Hu <huk23(a)m.fudan.edu.cn> > > ————— > Thanks, > Kun Hu > >> 2024年12月24日 19:16，Kun Hu <huk23(a)m.fudan.edu.cn> 写道： >> >> Hello, >> >> When using fuzzer tool to fuzz the latest Linux kernel, the following crash >> was triggered. >> >> HEAD commit: 78d4f34e2115b517bcbfe7ec0d018bbbb6f9b0b8 >> git tree: upstream >> Console output:https://drive.google.com/file/d/17oCyKDW_kNhSW5Bbvm23vnpD1eo0MHFi/vi… >> Kernel config: https://drive.google.com/file/d/1RhT5dFTs6Vx1U71PbpenN7TPtnPoa3NI/view?usp=… >> C reproducer: https://drive.google.com/file/d/177HJht6a7-6F3YLudKb_d4kiPGd1VA_i/view?usp=… >> Syzlang reproducer: https://drive.google.com/file/d/1AuP5UGGc47rEXXPuvjmCKgJ3d0U1P84j/view?usp=… >> >> >> If you fix this issue, please add the following tag to the commit: >> Reported-by: Kun Hu <huk23(a)m.fudan.edu.cn> >> >> ================================================================== >> BUG: KASAN: slab-out-of-bounds in snd_seq_oss_synth_sysex+0x5d1/0x6c0 sound/core/seq/oss/seq_oss_synth.c:516 >> Write of size 1 at addr ff1100000588e288 by task syz-executor411/824 >> >> CPU: 2 UID: 0 PID: 824 Comm: syz-executor411 Not tainted 6.13.0-rc3 #5 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 >> Call Trace: >> <TASK> >> __dump_stack lib/dump_stack.c:94 [inline] >> dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 >> print_address_description mm/kasan/report.c:378 [inline] >> print_report+0xcf/0x5f0 mm/kasan/report.c:489 >> kasan_report+0x93/0xc0 mm/kasan/report.c:602 >> snd_seq_oss_synth_sysex+0x5d1/0x6c0 sound/core/seq/oss/seq_oss_synth.c:516 >> snd_seq_oss_process_event+0x46a/0x2620 sound/core/seq/oss/seq_oss_event.c:61 >> insert_queue sound/core/seq/oss/seq_oss_rw.c:167 [inline] >> snd_seq_oss_write+0x261/0x7f0 sound/core/seq/oss/seq_oss_rw.c:135 >> odev_write+0x53/0xa0 sound/core/seq/oss/seq_oss.c:168 >> vfs_write fs/read_write.c:677 [inline] >> vfs_write+0x2e3/0x10f0 fs/read_write.c:659 >> ksys_write+0x122/0x240 fs/read_write.c:731 >> do_syscall_x64 arch/x86/entry/common.c:52 [inline] >> do_syscall_64+0xc3/0x1d0 arch/x86/entry/common.c:83 >> entry_SYSCALL_64_after_hwframe+0x77/0x7f >> RIP: 0033:0x7f69b379994d >> Code: c3 e8 97 2a 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 >> RSP: 002b:00007f69b3718d78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 >> RAX: ffffffffffffffda RBX: 00007f69b382d2d0 RCX: 00007f69b379994d >> RDX: 0000000000000008 RSI: 0000000020000140 RDI: 0000000000000003 >> RBP: 00007f69b382d2d8 R08: 0000000000000000 R09: 0000000000000000 >> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f69b382d2dc >> R13: 0000000020000140 R14: 00007f69b37fa008 R15: 000000000000000d >> </TASK> >> >> Allocated by task 823: >> kasan_save_stack+0x24/0x50 mm/kasan/common.c:47 >> kasan_save_track+0x14/0x30 mm/kasan/common.c:68 >> poison_kmalloc_redzone mm/kasan/common.c:377 [inline] >> __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 >> kmalloc_noprof include/linux/slab.h:901 [inline] >> kzalloc_noprof include/linux/slab.h:1037 [inline] >> snd_seq_oss_synth_sysex+0x1d9/0x6c0 sound/core/seq/oss/seq_oss_synth.c:502 >> snd_seq_oss_process_event+0x46a/0x2620 sound/core/seq/oss/seq_oss_event.c:61 >> insert_queue sound/core/seq/oss/seq_oss_rw.c:167 [inline] >> snd_seq_oss_write+0x261/0x7f0 sound/core/seq/oss/seq_oss_rw.c:135 >> odev_write+0x53/0xa0 sound/core/seq/oss/seq_oss.c:168 >> vfs_write fs/read_write.c:677 [inline] >> vfs_write+0x2e3/0x10f0 fs/read_write.c:659 >> ksys_write+0x122/0x240 fs/read_write.c:731 >> do_syscall_x64 arch/x86/entry/common.c:52 [inline] >> do_syscall_64+0xc3/0x1d0 arch/x86/entry/common.c:83 >> entry_SYSCALL_64_after_hwframe+0x77/0x7f >> >> The buggy address belongs to the object at ff1100000588e200 >> which belongs to the cache kmalloc-192 of size 192 >> The buggy address is located 0 bytes to the right of >> allocated 136-byte region [ff1100000588e200, ff1100000588e288) >> >> The buggy address belongs to the physical page: >> page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x588e >> anon flags: 0x100000000000000(node=0|zone=1) >> page_type: f5(slab) >> raw: 0100000000000000 ff1100000103c3c0 ffd4000000162340 dead000000000003 >> raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 >> page dumped because: kasan: bad access detected >> >> Memory state around the buggy address: >> ff1100000588e180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >> ff1100000588e200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>> ff1100000588e280: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >> ^ >> ff1100000588e300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >> ff1100000588e380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >> ================================================================== >> >> --------------- >> thanks, >> Kun Hu > >

1 0