From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AIpwx49POc7dDv2zkUN1rNuHjCZVVVnvMtd2TRWqcDZGoz78PCKlSsrhRoiZYb/VFUOzjnuIBysY ARC-Seal: i=1; a=rsa-sha256; t=1523095007; cv=none; d=google.com; s=arc-20160816; b=FYazlJ5oNCC96JlygkoS5dNKb7k2LZOrS+UejbpY8gQvB9LUlT0RtKrFIfmnrL0y2z jkF5CKXUOXnRtikWCa1DeouiHiSsMba3MQSgaBmOlI6FCNo5dL3GhDFDtH6jtSiBZqeX 9OZ7dnC2gid4PR0ooiscn1hCHND4f6FMoUxac0OjuHu10nm4q2ZHJC0Nm/t4llQEZDC+ iMycs1UZpHj9S7d3KZ5ESIzdvNt4qgf/cYayFYSYL7LVSxjyNnbmi9u9fwWbPxCn70Ew nnS8FnIWPSZZ30RqIAOFnjMsqKuQeG1cnZy3oruIZWHHo1O2JxHuBGOOdS0dL4NQv49T iSvQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:subject:cc:to:from :message-id:date:arc-authentication-results; bh=GbeXTQgm9qVH1iM6DAbIiRupOAMxBZQjD6hPviuxpLY=; b=LFwAB+0YVSGWs4+3JZFKCTJ5tXA/3bw8HKC9Djgh6XMvOZbbd4jSzPT29ifl1G2Z00 JTustVKwXHVKT49NRsLzwMSWRa0OTSYPHxgU7QHI4ekBA3zUXB5gdcQLkczSBk/CUBH9 gcsQeXPLGHeZHZCEn4Cqi76vMss9LoqJZjE/bVW1scSkUktJ0b8MJ2sWUD70/LeE2PR6 cuNotgmTpAexqBj0l2yQ+e2rfpOhgS40+Y2Z4OiOYcu83g9Jneny3yQIWQdHen4EOGtf gb1Ju+G66vc5T/+vsZO25fVBexZ7yOk3SWUCisxvtbsoEflnS4NHlrCJeqyHIoPxI3q+ h4mg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of tiwai@suse.de designates 195.135.220.15 as permitted sender) smtp.mailfrom=tiwai@suse.de Authentication-Results: mx.google.com; spf=pass (google.com: domain of tiwai@suse.de designates 195.135.220.15 as permitted sender) smtp.mailfrom=tiwai@suse.de Date: Sat, 07 Apr 2018 11:56:43 +0200 Message-ID: From: Takashi Iwai To: syzbot Cc: , , , , , , , , , , Subject: Re: INFO: rcu detected stall in snd_pcm_oss_write3 (2) In-Reply-To: <00000000000004c1de05693489a8@google.com> References: <000000000000118a9a056928bbd9@google.com> <00000000000004c1de05693489a8@google.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1596979719194785856?= X-GMAIL-MSGID: =?utf-8?q?1597080870396582753?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Fri, 06 Apr 2018 23:14:01 +0200, syzbot wrote: > > syzbot has found reproducer for the following crash on upstream commit > 38c23685b273cfb4ccf31a199feccce3bdcb5d83 (Fri Apr 6 04:29:35 2018 +0000) > Merge tag 'armsoc-drivers' of > git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc > syzbot dashboard link: > https://syzkaller.appspot.com/bug?extid=150189c103427d31a053 > > So far this crash happened 15 times on upstream. > C reproducer: https://syzkaller.appspot.com/x/repro.c?id=5405588854931456 > syzkaller reproducer: > https://syzkaller.appspot.com/x/repro.syz?id=5561439796330496 > Raw console output: > https://syzkaller.appspot.com/x/log.txt?id=5697900571000832 > Kernel config: > https://syzkaller.appspot.com/x/.config?id=-5813481738265533882 > compiler: gcc (GCC) 8.0.1 20180301 (experimental) Thanks to the reproducer, I could spot out now. Below is the patch (which was submitted as well). thanks, Takashi -- 8< -- From: Takashi Iwai Subject: [PATCH] ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation The commit 02a5d6925cd3 ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write") split the PCM preparation code to a locked version, and it added a sanity check of runtime->oss.prepare flag along with the change. This leaded to an endless loop when the stream gets XRUN: namely, snd_pcm_oss_write3() and co call snd_pcm_oss_prepare() without setting runtime->oss.prepare flag and the loop continues until the PCM state reaches to another one. As the function is supposed to execute the preparation unconditionally, drop the invalid state check there. The bug was triggered by syzkaller. Fixes: 02a5d6925cd3 ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write") Reported-by: syzbot+7e3f31a52646f939c052@syzkaller.appspotmail.com Reported-by: syzbot+4f2016cf5185da7759dc@syzkaller.appspotmail.com Cc: Signed-off-by: Takashi Iwai --- sound/core/oss/pcm_oss.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 481ab0e94ffa..727647755aab 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1128,13 +1128,12 @@ static int snd_pcm_oss_get_active_substream(struct snd_pcm_oss_file *pcm_oss_fil } /* call with params_lock held */ +/* NOTE: this doesn't care whether runtime->oss.prepare is set or not */ static int snd_pcm_oss_prepare(struct snd_pcm_substream *substream) { int err; struct snd_pcm_runtime *runtime = substream->runtime; - if (!runtime->oss.prepare) - return 0; err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_PREPARE, NULL); if (err < 0) { pcm_dbg(substream->pcm, -- 2.16.3