- Alsa-devel - mailman.alsa-project.org

[PATCH v3] ASoC: tlv320adcx140: Fix accessing uninitialized adcx140->dev
by Camel Guo 01 Sep '20

01 Sep '20

From: Camel Guo <camelg(a)axis.com> In adcx140_i2c_probe, adcx140->dev is accessed before its initialization. This commit fixes this bug. Fixes: 689c7655b50c ("ASoC: tlv320adcx140: Add the tlv320adcx140 codec driver family") Signed-off-by: Camel Guo <camel.guo(a)axis.com> --- sound/soc/codecs/tlv320adcx140.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c index 5cd50d841177..7ae6ec374be3 100644 --- a/sound/soc/codecs/tlv320adcx140.c +++ b/sound/soc/codecs/tlv320adcx140.c @@ -980,6 +980,8 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, if (!adcx140) return -ENOMEM; + adcx140->dev = &i2c->dev; + adcx140->gpio_reset = devm_gpiod_get_optional(adcx140->dev, "reset", GPIOD_OUT_LOW); if (IS_ERR(adcx140->gpio_reset)) @@ -1007,7 +1009,7 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, ret); return ret; } - adcx140->dev = &i2c->dev; + i2c_set_clientdata(i2c, adcx140); return devm_snd_soc_register_component(&i2c->dev, -- 2.20.1

1 1

[PATCH v2] ASoC: tlv320adcx140: Fix accessing uninitialized adcx140->dev
by Camel Guo 01 Sep '20

01 Sep '20

From: Camel Guo <camelg(a)axis.com> In adcx140_i2c_probe, adcx140->dev is accessed before its initialization. This commit fixes this bug. Signed-off-by: Camel Guo <camel.guo(a)axis.com> --- sound/soc/codecs/tlv320adcx140.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c index 5cd50d841177..7ae6ec374be3 100644 --- a/sound/soc/codecs/tlv320adcx140.c +++ b/sound/soc/codecs/tlv320adcx140.c @@ -980,6 +980,8 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, if (!adcx140) return -ENOMEM; + adcx140->dev = &i2c->dev; + adcx140->gpio_reset = devm_gpiod_get_optional(adcx140->dev, "reset", GPIOD_OUT_LOW); if (IS_ERR(adcx140->gpio_reset)) @@ -1007,7 +1009,7 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, ret); return ret; } - adcx140->dev = &i2c->dev; + i2c_set_clientdata(i2c, adcx140); return devm_snd_soc_register_component(&i2c->dev, -- 2.20.1

1 0

WARNING in snd_pcm_plugin_build_mulaw
by syzbot 01 Sep '20

01 Sep '20

Hello, syzbot found the following issue on: HEAD commit: 15bc20c6 Merge tag 'tty-5.9-rc3' of git://git.kernel.org/p.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1268efb1900000 kernel config: https://syzkaller.appspot.com/x/.config?x=891ca5711a9f1650 dashboard link: https://syzkaller.appspot.com/bug?extid=23b22dc2e0b81cbfcc95 compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11a95f41900000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11a452f2900000 The issue was bisected to: commit f3ca3f5b0966cfc2737178cca8a7a65b09991898 Author: Fabio Estevam <festevam(a)gmail.com> Date: Fri Mar 27 15:57:21 2020 +0000 dt-bindings: sound: cs42l51: Remove unneeded I2C unit name bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15395f41900000 final oops: https://syzkaller.appspot.com/x/report.txt?x=17395f41900000 console output: https://syzkaller.appspot.com/x/log.txt?x=13395f41900000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+23b22dc2e0b81cbfcc95(a)syzkaller.appspotmail.com Fixes: f3ca3f5b0966 ("dt-bindings: sound: cs42l51: Remove unneeded I2C unit name") ------------[ cut here ]------------ WARNING: CPU: 0 PID: 6835 at sound/core/oss/mulaw.c:332 snd_pcm_plugin_build_mulaw+0x4ef/0x6e0 sound/core/oss/mulaw.c:332 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 6835 Comm: syz-executor088 Not tainted 5.9.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1f0/0x31e lib/dump_stack.c:118 panic+0x264/0x7a0 kernel/panic.c:231 __warn+0x227/0x250 kernel/panic.c:600 report_bug+0x1b1/0x2e0 lib/bug.c:198 handle_bug+0x42/0x80 arch/x86/kernel/traps.c:234 exc_invalid_op+0x16/0x40 arch/x86/kernel/traps.c:254 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536 RIP: 0010:snd_pcm_plugin_build_mulaw+0x4ef/0x6e0 sound/core/oss/mulaw.c:332 Code: 0f 0b bb fa ff ff ff eb cd e8 fd e3 2d fb 0f 0b bb fa ff ff ff eb bf e8 ef e3 2d fb 0f 0b bb fa ff ff ff eb b1 e8 e1 e3 2d fb <0f> 0b bb fa ff ff ff eb a3 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 77 RSP: 0018:ffffc90001ed7950 EFLAGS: 00010293 RAX: ffffffff8647143f RBX: 0000000000000000 RCX: ffff88808dcbc540 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffff86471e70 R08: ffffffff864710ee R09: fffff520003daf47 R10: fffff520003daf47 R11: 0000000000000000 R12: 1ffff920003daf45 R13: ffffc90001ed7a18 R14: ffffc90001ed7a28 R15: ffffc90001ed7a28 snd_pcm_plug_format_plugins+0xbbd/0x1640 sound/core/oss/pcm_plugin.c:494 snd_pcm_oss_change_params_locked+0x2c29/0x4410 sound/core/oss/pcm_oss.c:952 snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1084 [inline] snd_pcm_oss_make_ready+0x115/0x2b0 sound/core/oss/pcm_oss.c:1143 snd_pcm_oss_sync+0x265/0x900 sound/core/oss/pcm_oss.c:1642 snd_pcm_oss_release+0x119/0x270 sound/core/oss/pcm_oss.c:2546 __fput+0x34f/0x7b0 fs/file_table.c:281 task_work_run+0x137/0x1c0 kernel/task_work.c:141 exit_task_work include/linux/task_work.h:25 [inline] do_exit+0x5f3/0x1f20 kernel/exit.c:806 do_group_exit+0x161/0x2d0 kernel/exit.c:903 __do_sys_exit_group+0x13/0x20 kernel/exit.c:914 __se_sys_exit_group+0x10/0x10 kernel/exit.c:912 __x64_sys_exit_group+0x37/0x40 kernel/exit.c:912 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x440038 Code: Bad RIP value. RSP: 002b:00007ffe721a2058 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440038 RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 RBP: 00000000004bf870 R08: 00000000000000e7 R09: ffffffffffffffd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000 Kernel Offset: disabled Rebooting in 86400 seconds.. --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

3 2

[PATCH] ASoC: tlv320adcx140: Fix accessing uninitialized abcx140->dev
by Camel Guo 01 Sep '20

01 Sep '20

From: Camel Guo <camelg(a)axis.com> in adcx140_i2c_probe, adcx140->dev is accessed before its initialization. This commit fixes this bug. Signed-off-by: Camel Guo <camel.guo(a)axis.com> --- sound/soc/codecs/tlv320adcx140.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c index 5cd50d841177..7ae6ec374be3 100644 --- a/sound/soc/codecs/tlv320adcx140.c +++ b/sound/soc/codecs/tlv320adcx140.c @@ -980,6 +980,8 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, if (!adcx140) return -ENOMEM; + adcx140->dev = &i2c->dev; + adcx140->gpio_reset = devm_gpiod_get_optional(adcx140->dev, "reset", GPIOD_OUT_LOW); if (IS_ERR(adcx140->gpio_reset)) @@ -1007,7 +1009,7 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, ret); return ret; } - adcx140->dev = &i2c->dev; + i2c_set_clientdata(i2c, adcx140); return devm_snd_soc_register_component(&i2c->dev, -- 2.20.1

2 1

[PATCH 00/10] sound: convert tasklets to use new tasklet_setup()
by Allen Pais 01 Sep '20

01 Sep '20

From: Allen Pais <allen.lkml(a)gmail.com> Commit 12cc923f1ccc ("tasklet: Introduce new initialization API")' introduced a new tasklet initialization API. This series converts all the sound drivers to use the new tasklet_setup() API Allen Pais (10): sound: core: convert tasklets to use new tasklet_setup() API sound: firewire: convert tasklets to use new tasklet_setup() API sound: asihpi: convert tasklets to use new tasklet_setup() API sound: riptide: convert tasklets to use new tasklet_setup() API sound: rm9652: convert tasklets to use new tasklet_setup() API sound/soc: fsl_esai: convert tasklets to use new tasklet_setup() API sound/soc: sh: convert tasklets to use new tasklet_setup() API sound/soc: txx9: convert tasklets to use new tasklet_setup() API sound: midi: convert tasklets to use new tasklet_setup() API sound: ua101: convert tasklets to use new tasklet_setup() API sound/core/timer.c | 7 +++---- sound/firewire/amdtp-stream.c | 8 ++++---- sound/pci/asihpi/asihpi.c | 9 ++++----- sound/pci/riptide/riptide.c | 6 +++--- sound/pci/rme9652/hdsp.c | 6 +++--- sound/pci/rme9652/hdspm.c | 7 +++---- sound/soc/fsl/fsl_esai.c | 7 +++---- sound/soc/sh/siu_pcm.c | 10 ++++------ sound/soc/txx9/txx9aclc.c | 7 +++---- sound/usb/midi.c | 7 +++---- sound/usb/misc/ua101.c | 7 +++---- 11 files changed, 36 insertions(+), 45 deletions(-) -- 2.17.1

4 22

[PATCH v3 0/3] ASoC: soundwire: fix port_ready[] dynamic allocation
by Bard Liao 01 Sep '20

01 Sep '20

The existing code allocates memory for the total number of ports. This only works if the ports are contiguous, but will break if e.g. a Devices uses port0, 1, and 14. The port_ready[] array would contain 3 elements, which would lead to an out-of-bounds access. Conversely in other cases, the wrong port index would be used leading to timeouts on prepare. This can be fixed by allocating for the worst-case of 15 ports (DP0..DP14). In addition since the number is now fixed, we can use an array instead of a dynamic allocation. Changes in v3: - Add ASoC tag in the cover letter title. - Edit the title and commit message of the third patch for better understanding. Changes in v2: - Split patches into sdw and asoc patches. Please note that "soundwire: fix port_ready[] dynamic allocation in mipi_disco" and "ASoC: codecs: fix port_ready[] dynamic allocation in ASoC codecs" should be merged at the same time. Pierre-Louis Bossart (3): soundwire: add definition for maximum number of ports soundwire: fix port_ready[] dynamic allocation in mipi_disco ASoC: codecs: soundwire: remove port_ready[] usage from codecs. drivers/soundwire/mipi_disco.c | 18 +----------------- drivers/soundwire/slave.c | 4 ++++ include/linux/soundwire/sdw.h | 5 +++-- sound/soc/codecs/max98373-sdw.c | 15 +-------------- sound/soc/codecs/rt1308-sdw.c | 14 +------------- sound/soc/codecs/rt5682-sdw.c | 15 +-------------- sound/soc/codecs/rt700-sdw.c | 15 +-------------- sound/soc/codecs/rt711-sdw.c | 15 +-------------- sound/soc/codecs/rt715-sdw.c | 33 +-------------------------------- 9 files changed, 14 insertions(+), 120 deletions(-) -- 2.17.1

2 5

[PATCH 0/9] soundwire: use FIELD_{GET|PREP} in subsystem
by Vinod Koul 31 Aug '20

31 Aug '20

Use the FIELD_{GET|PREP} in soundwire subsytem and remove the local SDW_REG_SHIFT(). This makes code IMO look much neater Tested this on db845c board Bard, can you please verify this on intel boards. Vinod Koul (9): soundwire: define and use addr bit masks soundwire: bus: use FIELD_GET() soundwire: slave: use SDW_DISCO_LINK_ID() soundwire: stream: use FIELD_{GET|PREP} soundwire: qcom : use FIELD_{GET|PREP} soundwire: cadence: use FIELD_{GET|PREP} soundwire: intel: use FIELD_{GET|PREP} soundwire: intel_init: use FIELD_{GET|PREP} soundwire: remove SDW_REG_SHIFT() drivers/soundwire/bus.c | 6 +-- drivers/soundwire/cadence_master.c | 53 ++++++++++--------------- drivers/soundwire/intel.c | 40 +++++++------------ drivers/soundwire/intel_init.c | 2 +- drivers/soundwire/qcom.c | 22 ++++------ drivers/soundwire/slave.c | 2 +- drivers/soundwire/stream.c | 13 +++--- include/linux/soundwire/sdw.h | 21 ++++++---- include/linux/soundwire/sdw_registers.h | 7 ---- 9 files changed, 67 insertions(+), 99 deletions(-) -- 2.26.2

3 15

general protection fault in line6_midibuf_write
by syzbot 31 Aug '20

31 Aug '20

Hello, syzbot found the following issue on: HEAD commit: 3ed8e1c2 usb: typec: tcpm: Migrate workqueue to RT priorit.. git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing console output: https://syzkaller.appspot.com/x/log.txt?x=137be056900000 kernel config: https://syzkaller.appspot.com/x/.config?x=ccafc70ac3d5f49c dashboard link: https://syzkaller.appspot.com/bug?extid=b333bd4e812c1d42827a compiler: gcc (GCC) 10.1.0-syz 20200507 Unfortunately, I don't have any reproducer for this issue yet. IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+b333bd4e812c1d42827a(a)syzkaller.appspotmail.com general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] CPU: 1 PID: 21 Comm: kworker/1:1 Not tainted 5.9.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event RIP: 0010:midibuf_is_full sound/usb/line6/midibuf.c:44 [inline] RIP: 0010:line6_midibuf_write+0x30/0x3f0 sound/usb/line6/midibuf.c:91 Code: 49 89 f5 41 54 55 89 d5 53 48 89 fb 4c 8d 7b 18 48 83 ec 28 e8 11 68 5f fc 4c 89 fa 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 0a 03 00 00 44 8b 63 18 31 ff RSP: 0018:ffff8881db3099d8 EFLAGS: 00010002 RAX: dffffc0000000000 RBX: 00000000000000b0 RCX: ffffc900006a8000 RDX: 0000000000000019 RSI: ffffffff84e098af RDI: 00000000000000b0 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8734d643 R10: 0000000000000000 R11: 000000000004e017 R12: 00000000000000b0 R13: ffff8881d40aec80 R14: ffff8881d4464984 R15: 00000000000000c8 FS: 0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005629deed5130 CR3: 00000001d2254000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> line6_data_received+0x281/0x520 sound/usb/line6/driver.c:296 __usb_hcd_giveback_urb+0x32d/0x560 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1716 dummy_timer+0x11f2/0x3240 drivers/usb/gadget/udc/dummy_hcd.c:1967 call_timer_fn+0x1ac/0x6e0 kernel/time/timer.c:1413 expire_timers kernel/time/timer.c:1458 [inline] __run_timers.part.0+0x67c/0xa60 kernel/time/timer.c:1755 __run_timers kernel/time/timer.c:1736 [inline] run_timer_softirq+0x80/0x120 kernel/time/timer.c:1768 __do_softirq+0x1af/0x91c kernel/softirq.c:298 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline] do_softirq_own_stack+0x73/0x90 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x107/0x1a0 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x43/0x90 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline] RIP: 0010:console_unlock+0xa99/0xcd0 kernel/printk/printk.c:2509 Code: 00 89 ee 48 c7 c7 a0 0a 35 87 e8 12 b9 03 00 65 ff 0d 3b 48 d8 7e e9 87 f9 ff ff e8 f1 59 16 00 e8 dc f2 1b 00 ff 74 24 30 9d <e9> 20 fe ff ff e8 dd 59 16 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 42 RSP: 0018:ffff8881da34f5e0 EFLAGS: 00000212 RAX: 00000000000d56ed RBX: 0000000000000200 RCX: 0000000000000006 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8129a6d4 RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffff895c65e7 R10: fffffbfff12b8cbc R11: 0000000000003254 R12: ffffffff82b3d6f0 R13: ffffffff876fa450 R14: 0000000000000054 R15: dffffc0000000000 vprintk_emit+0x1b2/0x460 kernel/printk/printk.c:2029 dev_vprintk_emit+0x3eb/0x436 drivers/base/core.c:4133 dev_printk_emit+0xba/0xf1 drivers/base/core.c:4144 __dev_printk+0xcf/0xf5 drivers/base/core.c:4156 _dev_info+0xd7/0x109 drivers/base/core.c:4202 hub_port_init.cold+0x264/0x32f drivers/usb/core/hub.c:4628 hub_port_connect drivers/usb/core/hub.c:5140 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x2191/0x4390 drivers/usb/core/hub.c:5576 process_one_work+0x94c/0x15f0 kernel/workqueue.c:2269 process_scheduled_works kernel/workqueue.c:2331 [inline] worker_thread+0x82b/0x1120 kernel/workqueue.c:2417 kthread+0x392/0x470 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Modules linked in: ---[ end trace 3dff073ad8b565c9 ]--- RIP: 0010:midibuf_is_full sound/usb/line6/midibuf.c:44 [inline] RIP: 0010:line6_midibuf_write+0x30/0x3f0 sound/usb/line6/midibuf.c:91 Code: 49 89 f5 41 54 55 89 d5 53 48 89 fb 4c 8d 7b 18 48 83 ec 28 e8 11 68 5f fc 4c 89 fa 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 0a 03 00 00 44 8b 63 18 31 ff RSP: 0018:ffff8881db3099d8 EFLAGS: 00010002 RAX: dffffc0000000000 RBX: 00000000000000b0 RCX: ffffc900006a8000 RDX: 0000000000000019 RSI: ffffffff84e098af RDI: 00000000000000b0 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8734d643 R10: 0000000000000000 R11: 000000000004e017 R12: 00000000000000b0 R13: ffff8881d40aec80 R14: ffff8881d4464984 R15: 00000000000000c8 FS: 0000000000000000(0000) GS:ffff8881db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005629deed5130 CR3: 00000001d2254000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0

[PATCH] ALSA: opti9xx: Fix memleak in snd_opti9xx_read_check
by Dinghao Liu 31 Aug '20

31 Aug '20

When request_region() on chip->res_mc_indir fails, chip->res_mc_base should be freed to prevent memleak. Signed-off-by: Dinghao Liu <dinghao.liu(a)zju.edu.cn> --- sound/isa/opti9xx/opti92x-ad1848.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c index 881d3b5711d2..06ba18d1737c 100644 --- a/sound/isa/opti9xx/opti92x-ad1848.c +++ b/sound/isa/opti9xx/opti92x-ad1848.c @@ -679,8 +679,11 @@ static int snd_opti9xx_read_check(struct snd_opti9xx *chip) #else /* OPTi93X */ chip->res_mc_indir = request_region(chip->mc_indir_index, 2, "OPTi93x MC"); - if (chip->res_mc_indir == NULL) + if (chip->res_mc_indir == NULL) { + release_and_free_resource(chip->res_mc_base); + chip->res_mc_base = NULL; return -EBUSY; + } spin_lock_irqsave(&chip->lock, flags); outb(chip->password, chip->mc_base + chip->pwd_reg); -- 2.17.1

2 1

KASAN: use-after-free Read in snd_pcm_oss_release
by syzbot 31 Aug '20

31 Aug '20

Hello, syzbot found the following issue on: HEAD commit: f37be724 Add linux-next specific files for 20200826 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=137c7cb9900000 kernel config: https://syzkaller.appspot.com/x/.config?x=1e5a1cf036089d95 dashboard link: https://syzkaller.appspot.com/bug?extid=12a3fcd1493ec6585007 compiler: gcc (GCC) 10.1.0-syz 20200507 Unfortunately, I don't have any reproducer for this issue yet. IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+12a3fcd1493ec6585007(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2367 [inline] BUG: KASAN: use-after-free in snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2361 [inline] BUG: KASAN: use-after-free in snd_pcm_oss_release+0x28d/0x300 sound/core/oss/pcm_oss.c:2548 Read of size 8 at addr ffff888026b66480 by task syz-executor.1/27751 CPU: 1 PID: 27751 Comm: syz-executor.1 Not tainted 5.9.0-rc2-next-20200826-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2367 [inline] snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2361 [inline] snd_pcm_oss_release+0x28d/0x300 sound/core/oss/pcm_oss.c:2548 __fput+0x285/0x920 fs/file_table.c:281 task_work_run+0xdd/0x190 kernel/task_work.c:141 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:140 [inline] exit_to_user_mode_prepare+0x195/0x1c0 kernel/entry/common.c:167 syscall_exit_to_user_mode+0x59/0x2b0 kernel/entry/common.c:242 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x416f01 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffdd39a5e70 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000416f01 RDX: 0000000000000001 RSI: 0000000001190428 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ffdd39a5f60 R11: 0000000000000293 R12: 0000000001190428 R13: 0000000000268c54 R14: ffffffffffffffff R15: 000000000118cfec Allocated by task 27754: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461 kmem_cache_alloc_trace+0x16e/0x2c0 mm/slab.c:3550 kmalloc include/linux/slab.h:554 [inline] kzalloc include/linux/slab.h:666 [inline] snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2389 [inline] snd_pcm_oss_open.part.0+0x55e/0x1290 sound/core/oss/pcm_oss.c:2491 snd_pcm_oss_open+0x3c/0x50 sound/core/oss/pcm_oss.c:2455 soundcore_open+0x445/0x600 sound/sound_core.c:593 chrdev_open+0x266/0x770 fs/char_dev.c:414 do_dentry_open+0x4b9/0x11b0 fs/open.c:817 do_open fs/namei.c:3251 [inline] path_openat+0x1b9a/0x2730 fs/namei.c:3368 do_filp_open+0x17e/0x3c0 fs/namei.c:3395 do_sys_openat2+0x16d/0x420 fs/open.c:1168 do_sys_open fs/open.c:1184 [inline] __do_sys_openat fs/open.c:1200 [inline] __se_sys_openat fs/open.c:1195 [inline] __x64_sys_openat+0x13f/0x1f0 fs/open.c:1195 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 27754: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422 __cache_free mm/slab.c:3418 [inline] kfree+0x103/0x2c0 mm/slab.c:3756 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2371 [inline] snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2361 [inline] snd_pcm_oss_release+0x17e/0x300 sound/core/oss/pcm_oss.c:2548 __fput+0x285/0x920 fs/file_table.c:281 task_work_run+0xdd/0x190 kernel/task_work.c:141 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:140 [inline] exit_to_user_mode_prepare+0x195/0x1c0 kernel/entry/common.c:167 syscall_exit_to_user_mode+0x59/0x2b0 kernel/entry/common.c:242 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff888026b66480 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes inside of 32-byte region [ffff888026b66480, ffff888026b664a0) The buggy address belongs to the page: page:0000000076bbbb49 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888026b66fc1 pfn:0x26b66 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0002385208 ffffea0000782448 ffff8880aa040100 raw: ffff888026b66fc1 ffff888026b66000 000000010000002e 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888026b66380: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff888026b66400: 00 fc fc fc fc fc fc fc 00 00 00 00 fc fc fc fc >ffff888026b66480: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ^ ffff888026b66500: 00 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc ffff888026b66580: fa fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

3 2