<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/sound, branch v4.8.5</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>ALSA: hda - Fix a failure of micmute led when having multi adcs</title>
<updated>2016-10-28T07:45:24+00:00</updated>
<author>
<name>Hui Wang</name>
<email>hui.wang@canonical.com</email>
</author>
<published>2016-10-11T02:48:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=7e98c29e0bb25fe1df584099fe2ac7b5db91968c'/>
<id>7e98c29e0bb25fe1df584099fe2ac7b5db91968c</id>
<content type='text'>
commit 4875a5f7218068cdeea5f998330dfa3d118b2fea upstream.

On a Dell laptop, there is no global adcs for all input devices, so
the input devices use the different adc, as a result, dyn_adc_switch
is set to true.

In this situation, it is safe to control the micmute led according to
user's choice of muting/unmuting the current input device, since only
current input device path is active, while other input device paths
are inactive and powered down.

Fixes: 00ef99408b6c ('ALSA: hda - add mic mute led hook for dell machines')
Signed-off-by: Hui Wang &lt;hui.wang@canonical.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4875a5f7218068cdeea5f998330dfa3d118b2fea upstream.

On a Dell laptop, there is no global adcs for all input devices, so
the input devices use the different adc, as a result, dyn_adc_switch
is set to true.

In this situation, it is safe to control the micmute led according to
user's choice of muting/unmuting the current input device, since only
current input device path is active, while other input device paths
are inactive and powered down.

Fixes: 00ef99408b6c ('ALSA: hda - add mic mute led hook for dell machines')
Signed-off-by: Hui Wang &lt;hui.wang@canonical.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ASoC: Intel: Atom: add a missing star in a memcpy call</title>
<updated>2016-10-22T10:40:24+00:00</updated>
<author>
<name>Nicolas Iooss</name>
<email>nicolas.iooss_linux@m4x.org</email>
</author>
<published>2016-08-28T19:10:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=dad1754151e17126c2b27a1b776980544e25ba9c'/>
<id>dad1754151e17126c2b27a1b776980544e25ba9c</id>
<content type='text'>
commit 61ab0d403bbd9d5f6e000e3b5734049141b91f6f upstream.

In sst_prepare_and_post_msg(), when a response is received in "block",
the following code gets executed:

    *data = kzalloc(block-&gt;size, GFP_KERNEL);
    memcpy(data, (void *) block-&gt;data, block-&gt;size);

The memcpy() call overwrites the content of the *data pointer instead of
filling the newly-allocated memory (which pointer is hold by *data).
Fix this by merging kzalloc+memcpy into a single kmemdup() call.

Thanks Joe Perches for suggesting using kmemdup()

Fixes: 60dc8dbacb00 ("ASoC: Intel: sst: Add some helper functions")
Signed-off-by: Nicolas Iooss &lt;nicolas.iooss_linux@m4x.org&gt;
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 61ab0d403bbd9d5f6e000e3b5734049141b91f6f upstream.

In sst_prepare_and_post_msg(), when a response is received in "block",
the following code gets executed:

    *data = kzalloc(block-&gt;size, GFP_KERNEL);
    memcpy(data, (void *) block-&gt;data, block-&gt;size);

The memcpy() call overwrites the content of the *data pointer instead of
filling the newly-allocated memory (which pointer is hold by *data).
Fix this by merging kzalloc+memcpy into a single kmemdup() call.

Thanks Joe Perches for suggesting using kmemdup()

Fixes: 60dc8dbacb00 ("ASoC: Intel: sst: Add some helper functions")
Signed-off-by: Nicolas Iooss &lt;nicolas.iooss_linux@m4x.org&gt;
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ASoC: nau8825: fix bug in FLL parameter</title>
<updated>2016-10-22T10:40:24+00:00</updated>
<author>
<name>John Hsu</name>
<email>KCHSU0@nuvoton.com</email>
</author>
<published>2016-09-13T03:56:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=9b3aaaa8d6a0a61f84b394d29c7c8653641a5924'/>
<id>9b3aaaa8d6a0a61f84b394d29c7c8653641a5924</id>
<content type='text'>
commit a8961cae29c38e225120c40c3340dbde2f552e60 upstream.

In the FLL parameter calculation, the FVCO should choose the maximum one.
The patch is to fix the bug about the wrong FVCO chosen.

Signed-off-by: John Hsu &lt;KCHSU0@nuvoton.com&gt;
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit a8961cae29c38e225120c40c3340dbde2f552e60 upstream.

In the FLL parameter calculation, the FVCO should choose the maximum one.
The patch is to fix the bug about the wrong FVCO chosen.

Signed-off-by: John Hsu &lt;KCHSU0@nuvoton.com&gt;
Signed-off-by: Mark Brown &lt;broonie@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ALSA: usb-line6: use the same declaration as definition in header for MIDI manufacturer ID</title>
<updated>2016-10-16T16:03:38+00:00</updated>
<author>
<name>Takashi Sakamoto</name>
<email>o-takashi@sakamocchi.jp</email>
</author>
<published>2016-09-25T13:00:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=14ca6ce4528d834c9c2abe4b3423e58df2390c0f'/>
<id>14ca6ce4528d834c9c2abe4b3423e58df2390c0f</id>
<content type='text'>
commit 8da08ca03b73593d5299893bf29fc08569c3fb5f upstream.

Currently, usb-line6 module exports an array of MIDI manufacturer ID and
usb-pod module uses it. However, the declaration is not the definition in
common header. The difference is explicit length of array. Although
compiler calculates it and everything goes well, it's better to use the
same representation between definition and declaration.

This commit fills the length of array for usb-line6 module. As a small
good sub-effect, this commit suppress below warnings from static analysis
by sparse v0.5.0.

sound/usb/line6/driver.c:274:43: error: cannot size expression
sound/usb/line6/driver.c:275:16: error: cannot size expression
sound/usb/line6/driver.c:276:16: error: cannot size expression
sound/usb/line6/driver.c:277:16: error: cannot size expression

Fixes: 705ececd1c60 ("Staging: add line6 usb driver")
Signed-off-by: Takashi Sakamoto &lt;o-takashi@sakamocchi.jp&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 8da08ca03b73593d5299893bf29fc08569c3fb5f upstream.

Currently, usb-line6 module exports an array of MIDI manufacturer ID and
usb-pod module uses it. However, the declaration is not the definition in
common header. The difference is explicit length of array. Although
compiler calculates it and everything goes well, it's better to use the
same representation between definition and declaration.

This commit fills the length of array for usb-line6 module. As a small
good sub-effect, this commit suppress below warnings from static analysis
by sparse v0.5.0.

sound/usb/line6/driver.c:274:43: error: cannot size expression
sound/usb/line6/driver.c:275:16: error: cannot size expression
sound/usb/line6/driver.c:276:16: error: cannot size expression
sound/usb/line6/driver.c:277:16: error: cannot size expression

Fixes: 705ececd1c60 ("Staging: add line6 usb driver")
Signed-off-by: Takashi Sakamoto &lt;o-takashi@sakamocchi.jp&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants</title>
<updated>2016-10-16T16:03:38+00:00</updated>
<author>
<name>Anssi Hannula</name>
<email>anssi.hannula@iki.fi</email>
</author>
<published>2016-09-23T03:43:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=e09db64b3e100e7c021b8d34ef2f92c888eec95b'/>
<id>e09db64b3e100e7c021b8d34ef2f92c888eec95b</id>
<content type='text'>
commit eb1a74b7bea17eea31915c4f76385cefe69d9795 upstream.

The DragonFly quirk added in 42e3121d90f4 ("ALSA: usb-audio: Add a more
accurate volume quirk for AudioQuest DragonFly") applies a custom dB map
on the volume control when its range is reported as 0..50 (0 .. 0.2dB).

However, there exists at least one other variant (hw v1.0c, as opposed
to the tested v1.2) which reports a different non-sensical volume range
(0..53) and the custom map is therefore not applied for that device.

This results in all of the volume change appearing close to 100% on
mixer UIs that utilize the dB TLV information.

Add a fallback case where no dB TLV is reported at all if the control
range is not 0..50 but still 0..N where N &lt;= 1000 (3.9 dB). Also
restrict the quirk to only apply to the volume control as there is also
a mute control which would match the check otherwise.

Fixes: 42e3121d90f4 ("ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly")
Signed-off-by: Anssi Hannula &lt;anssi.hannula@iki.fi&gt;
Reported-by: David W &lt;regulars@d-dub.org.uk&gt;
Tested-by: David W &lt;regulars@d-dub.org.uk&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit eb1a74b7bea17eea31915c4f76385cefe69d9795 upstream.

The DragonFly quirk added in 42e3121d90f4 ("ALSA: usb-audio: Add a more
accurate volume quirk for AudioQuest DragonFly") applies a custom dB map
on the volume control when its range is reported as 0..50 (0 .. 0.2dB).

However, there exists at least one other variant (hw v1.0c, as opposed
to the tested v1.2) which reports a different non-sensical volume range
(0..53) and the custom map is therefore not applied for that device.

This results in all of the volume change appearing close to 100% on
mixer UIs that utilize the dB TLV information.

Add a fallback case where no dB TLV is reported at all if the control
range is not 0..50 but still 0..N where N &lt;= 1000 (3.9 dB). Also
restrict the quirk to only apply to the volume control as there is also
a mute control which would match the check otherwise.

Fixes: 42e3121d90f4 ("ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly")
Signed-off-by: Anssi Hannula &lt;anssi.hannula@iki.fi&gt;
Reported-by: David W &lt;regulars@d-dub.org.uk&gt;
Tested-by: David W &lt;regulars@d-dub.org.uk&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ALSA: ali5451: Fix out-of-bound position reporting</title>
<updated>2016-10-16T16:03:38+00:00</updated>
<author>
<name>Takashi Iwai</name>
<email>tiwai@suse.de</email>
</author>
<published>2016-09-21T12:38:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=80e84e00f9c9acbea67bf8badd284ab033da2fbe'/>
<id>80e84e00f9c9acbea67bf8badd284ab033da2fbe</id>
<content type='text'>
commit db68577966abc1aeae4ec597b3dcfa0d56e92041 upstream.

The pointer callbacks of ali5451 driver may return the value at the
boundary occasionally, and it results in the kernel warning like
  snd_ali5451 0000:00:06.0: BUG: , pos = 16384, buffer size = 16384, period size = 1024

It seems that folding the position offset is enough for fixing the
warning and no ill-effect has been seen by that.

Reported-by: Enrico Mioso &lt;mrkiko.rs@gmail.com&gt;
Tested-by: Enrico Mioso &lt;mrkiko.rs@gmail.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit db68577966abc1aeae4ec597b3dcfa0d56e92041 upstream.

The pointer callbacks of ali5451 driver may return the value at the
boundary occasionally, and it results in the kernel warning like
  snd_ali5451 0000:00:06.0: BUG: , pos = 16384, buffer size = 16384, period size = 1024

It seems that folding the position offset is enough for fixing the
warning and no ill-effect has been seen by that.

Reported-by: Enrico Mioso &lt;mrkiko.rs@gmail.com&gt;
Tested-by: Enrico Mioso &lt;mrkiko.rs@gmail.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ALSA: hda - Add the top speaker pin config for HP Spectre x360</title>
<updated>2016-10-07T13:03:20+00:00</updated>
<author>
<name>Takashi Iwai</name>
<email>tiwai@suse.de</email>
</author>
<published>2016-09-27T14:44:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=8cf61e57d856a29d227700ab212bb5d6e706003e'/>
<id>8cf61e57d856a29d227700ab212bb5d6e706003e</id>
<content type='text'>
commit 0eec880966e77bdbee0112989a2be67d92e39929 upstream.

HP Spectre x360 with CX20724 codec has two speaker outputs while the
BIOS sets up only the bottom one (NID 0x17) and disables the top one
(NID 0x1d).

This patch adds a fixup simply defining the proper pincfg for NID 0x1d
so that the top speaker works as is.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=169071
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 0eec880966e77bdbee0112989a2be67d92e39929 upstream.

HP Spectre x360 with CX20724 codec has two speaker outputs while the
BIOS sets up only the bottom one (NID 0x17) and disables the top one
(NID 0x1d).

This patch adds a fixup simply defining the proper pincfg for NID 0x1d
so that the top speaker works as is.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=169071
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ALSA: hda - Fix headset mic detection problem for several Dell laptops</title>
<updated>2016-10-07T13:03:20+00:00</updated>
<author>
<name>Hui Wang</name>
<email>hui.wang@canonical.com</email>
</author>
<published>2016-09-11T03:26:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=35e0251bfab3d9cf6874153e7ffb6f6619f8b900'/>
<id>35e0251bfab3d9cf6874153e7ffb6f6619f8b900</id>
<content type='text'>
commit 3f640970a41429f0a076c01270bbd014c9eae61c upstream.

One of the laptops has the codec ALC256 on it, applying the
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE can fix the problem, the rest
of laptops have the codec ALC295 on them, they are similar to machines
with ALC225, applying the ALC269_FIXUP_DELL1_MIC_NO_PRESENCE can fix
the problem.

Signed-off-by: Hui Wang &lt;hui.wang@canonical.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 3f640970a41429f0a076c01270bbd014c9eae61c upstream.

One of the laptops has the codec ALC256 on it, applying the
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE can fix the problem, the rest
of laptops have the codec ALC295 on them, they are similar to machines
with ALC225, applying the ALC269_FIXUP_DELL1_MIC_NO_PRESENCE can fix
the problem.

Signed-off-by: Hui Wang &lt;hui.wang@canonical.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ALSA: hda - Adding one more ALC255 pin definition for headset problem</title>
<updated>2016-10-07T13:03:20+00:00</updated>
<author>
<name>Hui Wang</name>
<email>hui.wang@canonical.com</email>
</author>
<published>2016-09-26T02:59:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=f090888f591096fafe2c89054dc6fd79b60e8c08'/>
<id>f090888f591096fafe2c89054dc6fd79b60e8c08</id>
<content type='text'>
commit 392c9da24a994f238c5d7ea611c6245be4617014 upstream.

We have two new Dell laptop models, they have the same ALC255 pin
definition, but not in the pin quirk table yet, as a result, the
headset microphone can't work. After adding the definition in the
table, the headset microphone works well.

Signed-off-by: Hui Wang &lt;hui.wang@canonical.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 392c9da24a994f238c5d7ea611c6245be4617014 upstream.

We have two new Dell laptop models, they have the same ALC255 pin
definition, but not in the pin quirk table yet, as a result, the
headset microphone can't work. After adding the definition in the
table, the headset microphone works well.

Signed-off-by: Hui Wang &lt;hui.wang@canonical.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ALSA: rawmidi: Fix possible deadlock with virmidi registration</title>
<updated>2016-09-08T08:45:20+00:00</updated>
<author>
<name>Takashi Iwai</name>
<email>tiwai@suse.de</email>
</author>
<published>2016-08-30T12:45:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=816f318b2364262a51024096da7ca3b84e78e3b5'/>
<id>816f318b2364262a51024096da7ca3b84e78e3b5</id>
<content type='text'>
When a seq-virmidi driver is initialized, it registers a rawmidi
instance with its callback to create an associated seq kernel client.
Currently it's done throughly in rawmidi's register_mutex context.
Recently it was found that this may lead to a deadlock another rawmidi
device that is being attached with the sequencer is accessed, as both
open with the same register_mutex.  This was actually triggered by
syzkaller, as Dmitry Vyukov reported:

======================================================
 [ INFO: possible circular locking dependency detected ]
 4.8.0-rc1+ #11 Not tainted
 -------------------------------------------------------
 syz-executor/7154 is trying to acquire lock:
  (register_mutex#5){+.+.+.}, at: [&lt;ffffffff84fd6d4b&gt;] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341

 but task is already holding lock:
  (&amp;grp-&gt;list_mutex){++++.+}, at: [&lt;ffffffff850138bb&gt;] check_and_subscribe_port+0x5b/0x5c0 sound/core/seq/seq_ports.c:495

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -&gt; #1 (&amp;grp-&gt;list_mutex){++++.+}:
    [&lt;ffffffff8147a3a8&gt;] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746
    [&lt;ffffffff863f6199&gt;] down_read+0x49/0xc0 kernel/locking/rwsem.c:22
    [&lt;     inline     &gt;] deliver_to_subscribers sound/core/seq/seq_clientmgr.c:681
    [&lt;ffffffff85005c5e&gt;] snd_seq_deliver_event+0x35e/0x890 sound/core/seq/seq_clientmgr.c:822
    [&lt;ffffffff85006e96&gt;] &gt; snd_seq_kernel_client_dispatch+0x126/0x170 sound/core/seq/seq_clientmgr.c:2418
    [&lt;ffffffff85012c52&gt;] snd_seq_system_broadcast+0xb2/0xf0 sound/core/seq/seq_system.c:101
    [&lt;ffffffff84fff70a&gt;] snd_seq_create_kernel_client+0x24a/0x330 sound/core/seq/seq_clientmgr.c:2297
    [&lt;     inline     &gt;] snd_virmidi_dev_attach_seq sound/core/seq/seq_virmidi.c:383
    [&lt;ffffffff8502d29f&gt;] snd_virmidi_dev_register+0x29f/0x750 sound/core/seq/seq_virmidi.c:450
    [&lt;ffffffff84fd208c&gt;] snd_rawmidi_dev_register+0x30c/0xd40 sound/core/rawmidi.c:1645
    [&lt;ffffffff84f816d3&gt;] __snd_device_register.part.0+0x63/0xc0 sound/core/device.c:164
    [&lt;     inline     &gt;] __snd_device_register sound/core/device.c:162
    [&lt;ffffffff84f8235d&gt;] snd_device_register_all+0xad/0x110 sound/core/device.c:212
    [&lt;ffffffff84f7546f&gt;] snd_card_register+0xef/0x6c0 sound/core/init.c:749
    [&lt;ffffffff85040b7f&gt;] snd_virmidi_probe+0x3ef/0x590 sound/drivers/virmidi.c:123
    [&lt;ffffffff833ebf7b&gt;] platform_drv_probe+0x8b/0x170 drivers/base/platform.c:564
    ......

 -&gt; #0 (register_mutex#5){+.+.+.}:
    [&lt;     inline     &gt;] check_prev_add kernel/locking/lockdep.c:1829
    [&lt;     inline     &gt;] check_prevs_add kernel/locking/lockdep.c:1939
    [&lt;     inline     &gt;] validate_chain kernel/locking/lockdep.c:2266
    [&lt;ffffffff814791f4&gt;] __lock_acquire+0x4d44/0x4d80 kernel/locking/lockdep.c:3335
    [&lt;ffffffff8147a3a8&gt;] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746
    [&lt;     inline     &gt;] __mutex_lock_common kernel/locking/mutex.c:521
    [&lt;ffffffff863f0ef1&gt;] mutex_lock_nested+0xb1/0xa20 kernel/locking/mutex.c:621
    [&lt;ffffffff84fd6d4b&gt;] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341
    [&lt;ffffffff8502e7c7&gt;] midisynth_subscribe+0xf7/0x350 sound/core/seq/seq_midi.c:188
    [&lt;     inline     &gt;] subscribe_port sound/core/seq/seq_ports.c:427
    [&lt;ffffffff85013cc7&gt;] check_and_subscribe_port+0x467/0x5c0 sound/core/seq/seq_ports.c:510
    [&lt;ffffffff85015da9&gt;] snd_seq_port_connect+0x2c9/0x500 sound/core/seq/seq_ports.c:579
    [&lt;ffffffff850079b8&gt;] snd_seq_ioctl_subscribe_port+0x1d8/0x2b0 sound/core/seq/seq_clientmgr.c:1480
    [&lt;ffffffff84ffe9e4&gt;] snd_seq_do_ioctl+0x184/0x1e0 sound/core/seq/seq_clientmgr.c:2225
    [&lt;ffffffff84ffeae8&gt;] snd_seq_kernel_client_ctl+0xa8/0x110 sound/core/seq/seq_clientmgr.c:2440
    [&lt;ffffffff85027664&gt;] snd_seq_oss_midi_open+0x3b4/0x610 sound/core/seq/oss/seq_oss_midi.c:375
    [&lt;ffffffff85023d67&gt;] snd_seq_oss_synth_setup_midi+0x107/0x4c0 sound/core/seq/oss/seq_oss_synth.c:281
    [&lt;ffffffff8501b0a8&gt;] snd_seq_oss_open+0x748/0x8d0 sound/core/seq/oss/seq_oss_init.c:274
    [&lt;ffffffff85019d8a&gt;] odev_open+0x6a/0x90 sound/core/seq/oss/seq_oss.c:138
    [&lt;ffffffff84f7040f&gt;] soundcore_open+0x30f/0x640 sound/sound_core.c:639
    ......

 other info that might help us debug this:

 Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(&amp;grp-&gt;list_mutex);
                                lock(register_mutex#5);
                                lock(&amp;grp-&gt;list_mutex);
   lock(register_mutex#5);

 *** DEADLOCK ***
======================================================

The fix is to simply move the registration parts in
snd_rawmidi_dev_register() to the outside of the register_mutex lock.
The lock is needed only to manage the linked list, and it's not
necessarily to cover the whole initialization process.

Reported-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When a seq-virmidi driver is initialized, it registers a rawmidi
instance with its callback to create an associated seq kernel client.
Currently it's done throughly in rawmidi's register_mutex context.
Recently it was found that this may lead to a deadlock another rawmidi
device that is being attached with the sequencer is accessed, as both
open with the same register_mutex.  This was actually triggered by
syzkaller, as Dmitry Vyukov reported:

======================================================
 [ INFO: possible circular locking dependency detected ]
 4.8.0-rc1+ #11 Not tainted
 -------------------------------------------------------
 syz-executor/7154 is trying to acquire lock:
  (register_mutex#5){+.+.+.}, at: [&lt;ffffffff84fd6d4b&gt;] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341

 but task is already holding lock:
  (&amp;grp-&gt;list_mutex){++++.+}, at: [&lt;ffffffff850138bb&gt;] check_and_subscribe_port+0x5b/0x5c0 sound/core/seq/seq_ports.c:495

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -&gt; #1 (&amp;grp-&gt;list_mutex){++++.+}:
    [&lt;ffffffff8147a3a8&gt;] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746
    [&lt;ffffffff863f6199&gt;] down_read+0x49/0xc0 kernel/locking/rwsem.c:22
    [&lt;     inline     &gt;] deliver_to_subscribers sound/core/seq/seq_clientmgr.c:681
    [&lt;ffffffff85005c5e&gt;] snd_seq_deliver_event+0x35e/0x890 sound/core/seq/seq_clientmgr.c:822
    [&lt;ffffffff85006e96&gt;] &gt; snd_seq_kernel_client_dispatch+0x126/0x170 sound/core/seq/seq_clientmgr.c:2418
    [&lt;ffffffff85012c52&gt;] snd_seq_system_broadcast+0xb2/0xf0 sound/core/seq/seq_system.c:101
    [&lt;ffffffff84fff70a&gt;] snd_seq_create_kernel_client+0x24a/0x330 sound/core/seq/seq_clientmgr.c:2297
    [&lt;     inline     &gt;] snd_virmidi_dev_attach_seq sound/core/seq/seq_virmidi.c:383
    [&lt;ffffffff8502d29f&gt;] snd_virmidi_dev_register+0x29f/0x750 sound/core/seq/seq_virmidi.c:450
    [&lt;ffffffff84fd208c&gt;] snd_rawmidi_dev_register+0x30c/0xd40 sound/core/rawmidi.c:1645
    [&lt;ffffffff84f816d3&gt;] __snd_device_register.part.0+0x63/0xc0 sound/core/device.c:164
    [&lt;     inline     &gt;] __snd_device_register sound/core/device.c:162
    [&lt;ffffffff84f8235d&gt;] snd_device_register_all+0xad/0x110 sound/core/device.c:212
    [&lt;ffffffff84f7546f&gt;] snd_card_register+0xef/0x6c0 sound/core/init.c:749
    [&lt;ffffffff85040b7f&gt;] snd_virmidi_probe+0x3ef/0x590 sound/drivers/virmidi.c:123
    [&lt;ffffffff833ebf7b&gt;] platform_drv_probe+0x8b/0x170 drivers/base/platform.c:564
    ......

 -&gt; #0 (register_mutex#5){+.+.+.}:
    [&lt;     inline     &gt;] check_prev_add kernel/locking/lockdep.c:1829
    [&lt;     inline     &gt;] check_prevs_add kernel/locking/lockdep.c:1939
    [&lt;     inline     &gt;] validate_chain kernel/locking/lockdep.c:2266
    [&lt;ffffffff814791f4&gt;] __lock_acquire+0x4d44/0x4d80 kernel/locking/lockdep.c:3335
    [&lt;ffffffff8147a3a8&gt;] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746
    [&lt;     inline     &gt;] __mutex_lock_common kernel/locking/mutex.c:521
    [&lt;ffffffff863f0ef1&gt;] mutex_lock_nested+0xb1/0xa20 kernel/locking/mutex.c:621
    [&lt;ffffffff84fd6d4b&gt;] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341
    [&lt;ffffffff8502e7c7&gt;] midisynth_subscribe+0xf7/0x350 sound/core/seq/seq_midi.c:188
    [&lt;     inline     &gt;] subscribe_port sound/core/seq/seq_ports.c:427
    [&lt;ffffffff85013cc7&gt;] check_and_subscribe_port+0x467/0x5c0 sound/core/seq/seq_ports.c:510
    [&lt;ffffffff85015da9&gt;] snd_seq_port_connect+0x2c9/0x500 sound/core/seq/seq_ports.c:579
    [&lt;ffffffff850079b8&gt;] snd_seq_ioctl_subscribe_port+0x1d8/0x2b0 sound/core/seq/seq_clientmgr.c:1480
    [&lt;ffffffff84ffe9e4&gt;] snd_seq_do_ioctl+0x184/0x1e0 sound/core/seq/seq_clientmgr.c:2225
    [&lt;ffffffff84ffeae8&gt;] snd_seq_kernel_client_ctl+0xa8/0x110 sound/core/seq/seq_clientmgr.c:2440
    [&lt;ffffffff85027664&gt;] snd_seq_oss_midi_open+0x3b4/0x610 sound/core/seq/oss/seq_oss_midi.c:375
    [&lt;ffffffff85023d67&gt;] snd_seq_oss_synth_setup_midi+0x107/0x4c0 sound/core/seq/oss/seq_oss_synth.c:281
    [&lt;ffffffff8501b0a8&gt;] snd_seq_oss_open+0x748/0x8d0 sound/core/seq/oss/seq_oss_init.c:274
    [&lt;ffffffff85019d8a&gt;] odev_open+0x6a/0x90 sound/core/seq/oss/seq_oss.c:138
    [&lt;ffffffff84f7040f&gt;] soundcore_open+0x30f/0x640 sound/sound_core.c:639
    ......

 other info that might help us debug this:

 Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(&amp;grp-&gt;list_mutex);
                                lock(register_mutex#5);
                                lock(&amp;grp-&gt;list_mutex);
   lock(register_mutex#5);

 *** DEADLOCK ***
======================================================

The fix is to simply move the registration parts in
snd_rawmidi_dev_register() to the outside of the register_mutex lock.
The lock is needed only to manage the linked list, and it's not
necessarily to cover the whole initialization process.

Reported-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Cc: &lt;stable@vger.kernel.org&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</pre>
</div>
</content>
</entry>
</feed>
