- Alsa-devel - mailman.alsa-project.org

Re: Bug: slab-out-of-bounds in snd_seq_oss_synth_sysex
by Kun Hu 26 Dec '24

26 Dec '24

>> BUG: KASAN: slab-out-of-bounds in snd_seq_oss_synth_sysex+0x5d1/0x6c0 sound/core/seq/oss/seq_oss_synth.c:516 > > We further analyzed the issue at line 516 in ./sound/core/seq/oss/seq_oss_synth.c. > The slab-out-of-bounds crash occurs in line 509, when sysex->len = 128. Specifically, the write operation to dest[0] accesses memory beyond the bounds of sysex->buf (128 byte). > To resolve this issue, we suggest adding 6 lines of code to validate the legality of the address write to sysex->buf before entering the loop: > > if (sysex->len >= MAX_SYSEX_BUFLEN) { > sysex->len = 0; > sysex->skip = 1; > return -EINVAL; /* Exit early if sysex->len is out of bounds */ > } If you need any more information, please don't hesitate to let me know. ————— Best regards, Kun Hu > 2024年12月25日 13:37，Kun Hu <huk23(a)m.fudan.edu.cn> 写道： > > Hello, > >> BUG: KASAN: slab-out-of-bounds in snd_seq_oss_synth_sysex+0x5d1/0x6c0 sound/core/seq/oss/seq_oss_synth.c:516 > > We further analyzed the issue at line 516 in ./sound/core/seq/oss/seq_oss_synth.c. > The slab-out-of-bounds crash occurs in line 509, when sysex->len = 128. Specifically, the write operation to dest[0] accesses memory beyond the bounds of sysex->buf (128 byte). > To resolve this issue, we suggest adding 6 lines of code to validate the legality of the address write to sysex->buf before entering the loop: > > if (sysex->len >= MAX_SYSEX_BUFLEN) { > sysex->len = 0; > sysex->skip = 1; > return -EINVAL; /* Exit early if sysex->len is out of bounds */ > } > > If you fix this issue, please add the following tag to the commit: > Reported-by: Kun Hu <huk23(a)m.fudan.edu.cn> > > ————— > Thanks, > Kun Hu > >> 2024年12月24日 19:16，Kun Hu <huk23(a)m.fudan.edu.cn> 写道： >> >> Hello, >> >> When using fuzzer tool to fuzz the latest Linux kernel, the following crash >> was triggered. >> >> HEAD commit: 78d4f34e2115b517bcbfe7ec0d018bbbb6f9b0b8 >> git tree: upstream >> Console output:https://drive.google.com/file/d/17oCyKDW_kNhSW5Bbvm23vnpD1eo0MHFi/vi… >> Kernel config: https://drive.google.com/file/d/1RhT5dFTs6Vx1U71PbpenN7TPtnPoa3NI/view?usp=… >> C reproducer: https://drive.google.com/file/d/177HJht6a7-6F3YLudKb_d4kiPGd1VA_i/view?usp=… >> Syzlang reproducer: https://drive.google.com/file/d/1AuP5UGGc47rEXXPuvjmCKgJ3d0U1P84j/view?usp=… >> >> >> If you fix this issue, please add the following tag to the commit: >> Reported-by: Kun Hu <huk23(a)m.fudan.edu.cn> >> >> ================================================================== >> BUG: KASAN: slab-out-of-bounds in snd_seq_oss_synth_sysex+0x5d1/0x6c0 sound/core/seq/oss/seq_oss_synth.c:516 >> Write of size 1 at addr ff1100000588e288 by task syz-executor411/824 >> >> CPU: 2 UID: 0 PID: 824 Comm: syz-executor411 Not tainted 6.13.0-rc3 #5 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 >> Call Trace: >> <TASK> >> __dump_stack lib/dump_stack.c:94 [inline] >> dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 >> print_address_description mm/kasan/report.c:378 [inline] >> print_report+0xcf/0x5f0 mm/kasan/report.c:489 >> kasan_report+0x93/0xc0 mm/kasan/report.c:602 >> snd_seq_oss_synth_sysex+0x5d1/0x6c0 sound/core/seq/oss/seq_oss_synth.c:516 >> snd_seq_oss_process_event+0x46a/0x2620 sound/core/seq/oss/seq_oss_event.c:61 >> insert_queue sound/core/seq/oss/seq_oss_rw.c:167 [inline] >> snd_seq_oss_write+0x261/0x7f0 sound/core/seq/oss/seq_oss_rw.c:135 >> odev_write+0x53/0xa0 sound/core/seq/oss/seq_oss.c:168 >> vfs_write fs/read_write.c:677 [inline] >> vfs_write+0x2e3/0x10f0 fs/read_write.c:659 >> ksys_write+0x122/0x240 fs/read_write.c:731 >> do_syscall_x64 arch/x86/entry/common.c:52 [inline] >> do_syscall_64+0xc3/0x1d0 arch/x86/entry/common.c:83 >> entry_SYSCALL_64_after_hwframe+0x77/0x7f >> RIP: 0033:0x7f69b379994d >> Code: c3 e8 97 2a 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 >> RSP: 002b:00007f69b3718d78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 >> RAX: ffffffffffffffda RBX: 00007f69b382d2d0 RCX: 00007f69b379994d >> RDX: 0000000000000008 RSI: 0000000020000140 RDI: 0000000000000003 >> RBP: 00007f69b382d2d8 R08: 0000000000000000 R09: 0000000000000000 >> R10: 0000000000000000 R11: 0000000000000246 R12: 00007f69b382d2dc >> R13: 0000000020000140 R14: 00007f69b37fa008 R15: 000000000000000d >> </TASK> >> >> Allocated by task 823: >> kasan_save_stack+0x24/0x50 mm/kasan/common.c:47 >> kasan_save_track+0x14/0x30 mm/kasan/common.c:68 >> poison_kmalloc_redzone mm/kasan/common.c:377 [inline] >> __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 >> kmalloc_noprof include/linux/slab.h:901 [inline] >> kzalloc_noprof include/linux/slab.h:1037 [inline] >> snd_seq_oss_synth_sysex+0x1d9/0x6c0 sound/core/seq/oss/seq_oss_synth.c:502 >> snd_seq_oss_process_event+0x46a/0x2620 sound/core/seq/oss/seq_oss_event.c:61 >> insert_queue sound/core/seq/oss/seq_oss_rw.c:167 [inline] >> snd_seq_oss_write+0x261/0x7f0 sound/core/seq/oss/seq_oss_rw.c:135 >> odev_write+0x53/0xa0 sound/core/seq/oss/seq_oss.c:168 >> vfs_write fs/read_write.c:677 [inline] >> vfs_write+0x2e3/0x10f0 fs/read_write.c:659 >> ksys_write+0x122/0x240 fs/read_write.c:731 >> do_syscall_x64 arch/x86/entry/common.c:52 [inline] >> do_syscall_64+0xc3/0x1d0 arch/x86/entry/common.c:83 >> entry_SYSCALL_64_after_hwframe+0x77/0x7f >> >> The buggy address belongs to the object at ff1100000588e200 >> which belongs to the cache kmalloc-192 of size 192 >> The buggy address is located 0 bytes to the right of >> allocated 136-byte region [ff1100000588e200, ff1100000588e288) >> >> The buggy address belongs to the physical page: >> page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x588e >> anon flags: 0x100000000000000(node=0|zone=1) >> page_type: f5(slab) >> raw: 0100000000000000 ff1100000103c3c0 ffd4000000162340 dead000000000003 >> raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 >> page dumped because: kasan: bad access detected >> >> Memory state around the buggy address: >> ff1100000588e180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >> ff1100000588e200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>> ff1100000588e280: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >> ^ >> ff1100000588e300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >> ff1100000588e380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >> ================================================================== >> >> --------------- >> thanks, >> Kun Hu > >

1 0

[PATCH 00/21] ASoC: amd: acp70: add soundwire and acp pdm support
by Vijendar Mukunda 25 Dec '24

25 Dec '24

This patch series includes below changes - Add Audio IO support for ACP7.0 and ACP7.1 platforms for SoundWire IO and ACP PDM controller combination. - Add common driver modules for ACP7.0 and ACP7.1 platforms (acp pci driver, Soundwire dma driver, pdm platform driver). - Add SoundWire generic machine driver changes for legacy stack (No DSP enabled) for ACP7.0 & ACP7.1 platforms. - Add SoundWire machines for ACP7.0 & ACP7.1 platforms. Vijendar Mukunda (21): ASoC: amd: add register header file for ACP7.0 platform ASoC: amd: acp70: add acp pci driver for ACP7.0 and ACP7.1 platforms ASoC: amd: acp70: add acp init and de-init functions ASoC: amd: acp70: add logic for scanning acp child devices ASoC: amd: acp70: create platform devices for acp child nodes ASoC: amd: acp70: enable driver build for ACP7.0 platform ASoC: amd: acp70: add acp pdm platform driver ASoC: amd: acp70: add acp pdm driver dma ops and dai ops ASoC: amd: acp70: add acp soundwire dma driver ASoC: amd: update ACP7.0 KConfig option description ASoC: amd: acp70: add soundwire dma driver dma ops ASoC: amd: acp70: add acp ip interrupt handler ASoC: amd: acp70: add acp pdm driver pm ops ASoC: amd: acp70: add pm ops support for soundwire dma driver ASoC: amd: acp70: add acp driver pm ops support ASoC: amd: acp70: enable wake capability for acp pci driver ASoC: amd: acp70: add soundwire host wake interrupt handling ASoC: amd: acp70: create a device node for soundwire machine driver ASoC: amd: acp: add machine driver changes for ACP7.0 and ACP7.1 platforms ASoC: amd: acp: add RT711, RT714 & RT1316 support for ACP7.0 platform ASoC: amd: acp: amd-acp70-acpi-match: Add rt722 support include/sound/acp70_chip_offset_byte.h | 484 ++++++++++++++ sound/soc/amd/Kconfig | 12 + sound/soc/amd/Makefile | 1 + sound/soc/amd/acp/Makefile | 2 +- sound/soc/amd/acp/acp-sdw-legacy-mach.c | 16 + sound/soc/amd/acp/acp-sdw-mach-common.c | 34 + sound/soc/amd/acp/amd-acp70-acpi-match.c | 132 ++++ sound/soc/amd/acp/soc_amd_sdw_common.h | 11 + sound/soc/amd/acp70/Makefile | 9 + sound/soc/amd/acp70/acp70-pdm-dma.c | 463 +++++++++++++ sound/soc/amd/acp70/acp70-sdw-dma.c | 586 ++++++++++++++++ sound/soc/amd/acp70/acp70.h | 283 ++++++++ sound/soc/amd/acp70/pci-acp70.c | 807 +++++++++++++++++++++++ sound/soc/amd/mach-config.h | 1 + 14 files changed, 2840 insertions(+), 1 deletion(-) create mode 100644 include/sound/acp70_chip_offset_byte.h create mode 100644 sound/soc/amd/acp/amd-acp70-acpi-match.c create mode 100644 sound/soc/amd/acp70/Makefile create mode 100644 sound/soc/amd/acp70/acp70-pdm-dma.c create mode 100644 sound/soc/amd/acp70/acp70-sdw-dma.c create mode 100644 sound/soc/amd/acp70/acp70.h create mode 100644 sound/soc/amd/acp70/pci-acp70.c -- 2.34.1

3 23

Acer 315-24P Microphone indicator is not working
by GitHub issues - edited 23 Dec '24

23 Dec '24

alsa-project/alsa-utils issue #284 was edited from River000000: ![изображение](https://github.com/user-attachments/assets/dc8b0b9a-f877-4edc-a9eb-d1c4d1d2fcb7) ![изображение](https://github.com/user-attachments/assets/5f8f1c69-294b-4833-8bdf-9c2f8033c379) alsa-info: [alsa.txt](https://github.com/user-attachments/files/18227950/alsa.txt) Issue URL : https://github.com/alsa-project/alsa-utils/issues/284 Repository URL: https://github.com/alsa-project/alsa-utils

1 0

Acer 315-24P Microphone indicator is not working
by GitHub issues - edited 23 Dec '24

23 Dec '24

alsa-project/alsa-utils issue #284 was edited from River000000: ![изображение](https://github.com/user-attachments/assets/dc8b0b9a-f877-4edc-a9eb-d1c4d1d2fcb7) ![изображение](https://github.com/user-attachments/assets/5f8f1c69-294b-4833-8bdf-9c2f8033c379) [alsa.txt](https://github.com/user-attachments/files/18227950/alsa.txt) Issue URL : https://github.com/alsa-project/alsa-utils/issues/284 Repository URL: https://github.com/alsa-project/alsa-utils

1 0

Acer 315-24P Microphone indicator is not working
by GitHub issues - opened 23 Dec '24

23 Dec '24

alsa-project/alsa-utils issue #284 was opened from River000000: [alsa.txt](https://github.com/user-attachments/files/18227950/alsa.txt) ![изображение](https://github.com/user-attachments/assets/dc8b0b9a-f877-4edc-a9eb-d1c4d1d2fcb7) ![изображение](https://github.com/user-attachments/assets/5f8f1c69-294b-4833-8bdf-9c2f8033c379) Issue URL : https://github.com/alsa-project/alsa-utils/issues/284 Repository URL: https://github.com/alsa-project/alsa-utils

1 0

[PATCH RESEND] soundwire: amd: clear wake enable register for power off mode
by Vijendar Mukunda 23 Dec '24

23 Dec '24

As per design for power off mode, clear the wake enable register during resume sequence. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> --- drivers/soundwire/amd_manager.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c index 5a4bfaef65fb..96a3aa6da711 100644 --- a/drivers/soundwire/amd_manager.c +++ b/drivers/soundwire/amd_manager.c @@ -1190,6 +1190,7 @@ static int __maybe_unused amd_resume_runtime(struct device *dev) if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) { return amd_sdw_clock_stop_exit(amd_manager); } else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) { + writel(0x00, amd_manager->acp_mmio + ACP_SW_WAKE_EN(amd_manager->instance)); val = readl(amd_manager->mmio + ACP_SW_CLK_RESUME_CTRL); if (val) { val |= AMD_SDW_CLK_RESUME_REQ; -- 2.34.1

3 3

[PATCH] soundwire: amd: clear wake enable register for power off mode
by Vijendar Mukunda 23 Dec '24

23 Dec '24

As per design for power off mode, clear the wake enable register during resume sequence. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> --- drivers/soundwire/amd_manager.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c index 5a4bfaef65fb..96a3aa6da711 100644 --- a/drivers/soundwire/amd_manager.c +++ b/drivers/soundwire/amd_manager.c @@ -1190,6 +1190,7 @@ static int __maybe_unused amd_resume_runtime(struct device *dev) if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) { return amd_sdw_clock_stop_exit(amd_manager); } else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) { + writel(0x00, amd_manager->acp_mmio + ACP_SW_WAKE_EN(amd_manager->instance)); val = readl(amd_manager->mmio + ACP_SW_CLK_RESUME_CTRL); if (val) { val |= AMD_SDW_CLK_RESUME_REQ; -- 2.34.1

3 2

[PATCH V2] soundwire: amd: clear wake enable register for power off mode
by Vijendar Mukunda 23 Dec '24

23 Dec '24

As per design for AMD SoundWire manager power off mode, clear the wake enable register during resume sequence. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> --- Changes Since v1: - Replaced 0x00 with 0 in register write - Updte Commit message drivers/soundwire/amd_manager.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c index 5a4bfaef65fb..ca271a728a65 100644 --- a/drivers/soundwire/amd_manager.c +++ b/drivers/soundwire/amd_manager.c @@ -1190,6 +1190,7 @@ static int __maybe_unused amd_resume_runtime(struct device *dev) if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) { return amd_sdw_clock_stop_exit(amd_manager); } else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) { + writel(0, amd_manager->acp_mmio + ACP_SW_WAKE_EN(amd_manager->instance)); val = readl(amd_manager->mmio + ACP_SW_CLK_RESUME_CTRL); if (val) { val |= AMD_SDW_CLK_RESUME_REQ; -- 2.34.1

1 0

[PATCH RESEND] soundwire: amd: clear wake enable register for
by Vijendar Mukunda 23 Dec '24

23 Dec '24

As per design for power off mode, clear the wake enable register during resume sequence. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> --- drivers/soundwire/amd_manager.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c index 5a4bfaef65fb..96a3aa6da711 100644 --- a/drivers/soundwire/amd_manager.c +++ b/drivers/soundwire/amd_manager.c @@ -1190,6 +1190,7 @@ static int __maybe_unused amd_resume_runtime(struct device *dev) if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) { return amd_sdw_clock_stop_exit(amd_manager); } else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) { + writel(0x00, amd_manager->acp_mmio + ACP_SW_WAKE_EN(amd_manager->instance)); val = readl(amd_manager->mmio + ACP_SW_CLK_RESUME_CTRL); if (val) { val |= AMD_SDW_CLK_RESUME_REQ; -- 2.34.1

3 3

make check fails to compile playmidi1.c: "error: expected identifier or '(' before numeric constant"
by GitHub issues - opened 22 Dec '24

22 Dec '24

alsa-project/alsa-lib issue #430 was opened from 746B61: Getting the latest version from branch master (352cbc5e) and running `./gitcompile` followed by `make check` fails with: ``` Making check in test make[1]: Entering directory '/tmp/alsa-lib-master/test' Making check in . make[2]: Entering directory '/tmp/alsa-lib-master/test' make control pcm pcm_min latency seq seq-ump-example playmidi1 timer rawmidi midiloop umpinfo oldapi queue_timer namehint client_event_filter chmap audio_time user-ctl-element-set pcm-multi-thread make[3]: Entering directory '/tmp/alsa-lib-master/test' CC control.o CCLD control CC pcm.o CCLD pcm CC pcm_min.o CCLD pcm_min CC latency.o CCLD latency CC seq.o In file included from seq.c:12: seq-sender.c: In function 'event_sender': seq-sender.c:150:62: warning: variable 'pcm_flag' set but not used [-Wunused-but-set-variable] 150 | int client, port, queue, max, err, v1, v2, time = 0, pcm_flag = 0; | ^~~~~~~~ CCLD seq CC seq-ump-example.o CCLD seq-ump-example CC playmidi1.o In file included from playmidi1.c:48: midifile.h:55:33: error: expected identifier or '(' before numeric constant 55 | #define note_on 0x90 | ^~~~ ../include/alsa/ump_msg.h:170:41: note: in expansion of macro 'note_on' 170 | snd_ump_msg_midi1_note_t note_on; /**< MIDI1 note-on message */ | ^~~~~~~ midifile.h:54:33: error: expected identifier or '(' before numeric constant 54 | #define note_off 0x80 | ^~~~ ../include/alsa/ump_msg.h:171:41: note: in expansion of macro 'note_off' 171 | snd_ump_msg_midi1_note_t note_off; /**< MIDI1 note-off message */ | ^~~~~~~~ midifile.h:57:33: error: expected identifier or '(' before numeric constant 57 | #define control_change 0xb0 | ^~~~ ../include/alsa/ump_msg.h:173:41: note: in expansion of macro 'control_change' 173 | snd_ump_msg_midi1_cc_t control_change; /**< MIDI1 control-change message */ | ^~~~~~~~~~~~~~ midifile.h:55:33: error: expected identifier or '(' before numeric constant 55 | #define note_on 0x90 | ^~~~ ../include/alsa/ump_msg.h:432:41: note: in expansion of macro 'note_on' 432 | snd_ump_msg_midi2_note_t note_on; /**< MIDI2 note-on message */ | ^~~~~~~ midifile.h:54:33: error: expected identifier or '(' before numeric constant 54 | #define note_off 0x80 | ^~~~ ../include/alsa/ump_msg.h:433:41: note: in expansion of macro 'note_off' 433 | snd_ump_msg_midi2_note_t note_off; /**< MIDI2 note-off message */ | ^~~~~~~~ midifile.h:57:33: error: expected identifier or '(' before numeric constant 57 | #define control_change 0xb0 | ^~~~ ../include/alsa/ump_msg.h:438:41: note: in expansion of macro 'control_change' 438 | snd_ump_msg_midi2_cc_t control_change; /**< MIDI2 control-change message */ | ^~~~~~~~~~~~~~ In file included from playmidi1.c:49: midifile.c:57:33: error: expected identifier or '(' before numeric constant 57 | #define set_tempo 0x51 | ^~~~ ../include/alsa/ump_msg.h:711:41: note: in expansion of macro 'set_tempo' 711 | snd_ump_msg_set_tempo_t set_tempo; /**< Set Tempo */ | ^~~~~~~~~ make[3]: *** [Makefile:622: playmidi1.o] Error 1 make[3]: Leaving directory '/tmp/alsa-lib-master/test' make[2]: *** [Makefile:819: check-am] Error 2 make[2]: Leaving directory '/tmp/alsa-lib-master/test' make[1]: *** [Makefile:669: check-recursive] Error 1 make[1]: Leaving directory '/tmp/alsa-lib-master/test' make: *** [Makefile:414: check-recursive] Error 1 ``` The issue was introduced with commit 07cee0ba. playmidi1.c first [includes](https://github.com/alsa-project/alsa-lib/blob/352cbc5eb94a271a9c3… midifile.h from the test directory, which [has](https://github.com/alsa-project/alsa-lib/blob/352cbc5eb94a271a9c3c0ff5… `#define note_on 0x90`. After commit 07cee0ba, ump_msg.h gets included later, which [has](https://github.com/alsa-project/alsa-lib/blob/352cbc5eb94a271a9c3c0ff5… ` snd_ump_msg_midi1_note_t note_on; /**< MIDI1 note-on message */`. The preprocessor replaces `note_on` with `0x90` and the compilation fails with the error above. Issue URL : https://github.com/alsa-project/alsa-lib/issues/430 Repository URL: https://github.com/alsa-project/alsa-lib

1 0