[alsa-devel] WARNING in __snd_rawmidi_transmit_ack (2)
Hello,
syzbot found the following crash on:
HEAD commit: 4e8b38549b50 Add linux-next specific files for 20180814 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=11f5e78c400000 kernel config: https://syzkaller.appspot.com/x/.config?x=18edf0289d1b5ab dashboard link: https://syzkaller.appspot.com/bug?extid=ec5f605c91812d200367 compiler: gcc (GCC) 8.0.1 20180413 (experimental) syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=12f8c6d2400000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16976b72400000
IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+ec5f605c91812d200367@syzkaller.appspotmail.com
WARNING: CPU: 1 PID: 1691 at sound/core/rawmidi.c:1170 __snd_rawmidi_transmit_ack+0x263/0x2f0 sound/core/rawmidi.c:1170 Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 1691 Comm: kworker/1:1H Not tainted 4.18.0-next-20180814+ #38 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_highpri snd_vmidi_output_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 panic+0x238/0x4e7 kernel/panic.c:184 __warn.cold.8+0x163/0x1ba kernel/panic.c:536 report_bug+0x252/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:996 RIP: 0010:__snd_rawmidi_transmit_ack+0x263/0x2f0 sound/core/rawmidi.c:1170 Code: ba 01 00 00 00 be 03 00 00 00 e8 18 3a 66 fc e8 e3 44 86 fc 89 d8 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 cd 44 86 fc <0f> 0b e9 72 fe ff ff e8 21 5a c5 fc e9 1b ff ff ff bb ea ff ff ff RSP: 0018:ffff8801d2a6f5a8 EFLAGS: 00010093 RAX: ffff8801d2a52300 RBX: 0000000000000001 RCX: ffffffff84f64792 RDX: 0000000000000000 RSI: ffffffff84f64923 RDI: 0000000000000006 RBP: ffff8801d2a6f5e8 R08: ffff8801d2a52300 R09: ffffed003607acc1 R10: ffffed003607acc1 R11: ffff8801b03d660b R12: ffff8801ce2479c0 R13: 0000000000001001 R14: 0000000000000001 R15: ffff8801b03d65c0 snd_rawmidi_transmit_ack+0x51/0x80 sound/core/rawmidi.c:1201 snd_vmidi_output_work+0x3f4/0x4e0 sound/core/seq/seq_virmidi.c:153 process_one_work+0xc73/0x1aa0 kernel/workqueue.c:2153 worker_thread+0x189/0x13c0 kernel/workqueue.c:2296 kthread+0x35a/0x420 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 Shutting down cpus with NMI Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Rebooting in 86400 seconds..
--- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches
On Tue, 14 Aug 2018 16:20:02 +0200, syzbot wrote:
Hello,
syzbot found the following crash on:
HEAD commit: 4e8b38549b50 Add linux-next specific files for 20180814 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=11f5e78c400000 kernel config: https://syzkaller.appspot.com/x/.config?x=18edf0289d1b5ab dashboard link: https://syzkaller.appspot.com/bug?extid=ec5f605c91812d200367 compiler: gcc (GCC) 8.0.1 20180413 (experimental) syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=12f8c6d2400000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16976b72400000
IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+ec5f605c91812d200367@syzkaller.appspotmail.com
WARNING: CPU: 1 PID: 1691 at sound/core/rawmidi.c:1170 __snd_rawmidi_transmit_ack+0x263/0x2f0 sound/core/rawmidi.c:1170
This seems to be a bad side-effect by the code change along with the offloading the virmidi work.
I'm going to queue the fix below.
thanks,
Takashi
-- 8< -- From: Takashi Iwai tiwai@suse.de Subject: [PATCH] ALSA: seq: virmidi: Fix discarding the unsubscribed output
The recent change to move the virmidi output processing to a work slightly modified the code to discard the unsubscribed outputs so that it works without a temporary buffer. However, this is actually buggy, and may spew a kernel warning due to the unexpected call of snd_rawmidi_transmit_ack(), as triggered by syzbot.
This patch takes back to the original code in that part, use a temporary buffer and simply repeat snd_rawmidi_transmit(), in order to address the regression.
Fixes: f7debfe54090 ("ALSA: seq: virmidi: Offload the output event processing") Reported-by: syzbot+ec5f605c91812d200367@syzkaller.appspotmail.com Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/core/seq/seq_virmidi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c index a2f1c6b58693..cb988efd1ed0 100644 --- a/sound/core/seq/seq_virmidi.c +++ b/sound/core/seq/seq_virmidi.c @@ -149,8 +149,9 @@ static void snd_vmidi_output_work(struct work_struct *work) /* discard the outputs in dispatch mode unless subscribed */ if (vmidi->seq_mode == SNDRV_VIRMIDI_SEQ_DISPATCH && !(vmidi->rdev->flags & SNDRV_VIRMIDI_SUBSCRIBE)) { - while (!snd_rawmidi_transmit_empty(substream)) - snd_rawmidi_transmit_ack(substream, 1); + char buf[32]; + while (snd_rawmidi_transmit(substream, buf, sizeof(buf)) > 0) + ; /* ignored */ return; }
participants (2)
-
syzbot -
Takashi Iwai