WARNING in __snd_rawmidi_transmit_ack (2)

WARNING in __snd_rawmidi_transmit_ack (2)

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit:    4e8b38549b50 Add linux-next specific files for 20180814
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=11f5e78c400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=18edf0289d1b5ab
dashboard link: https://syzkaller.appspot.com/bug?extid=ec5f605c91812d200367
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=12f8c6d2400000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16976b72400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ec5f605c91812d200367@syzkaller.appspotmail.com

WARNING: CPU: 1 PID: 1691 at sound/core/rawmidi.c:1170  
__snd_rawmidi_transmit_ack+0x263/0x2f0 sound/core/rawmidi.c:1170
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 1691 Comm: kworker/1:1H Not tainted 4.18.0-next-20180814+ #38
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Workqueue: events_highpri snd_vmidi_output_work
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
  panic+0x238/0x4e7 kernel/panic.c:184
  __warn.cold.8+0x163/0x1ba kernel/panic.c:536
  report_bug+0x252/0x2d0 lib/bug.c:186
  fixup_bug arch/x86/kernel/traps.c:178 [inline]
  do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
  do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
  invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:996
RIP: 0010:__snd_rawmidi_transmit_ack+0x263/0x2f0 sound/core/rawmidi.c:1170
Code: ba 01 00 00 00 be 03 00 00 00 e8 18 3a 66 fc e8 e3 44 86 fc 89 d8 48  
83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 cd 44 86 fc <0f> 0b e9 72 fe  
ff ff e8 21 5a c5 fc e9 1b ff ff ff bb ea ff ff ff
RSP: 0018:ffff8801d2a6f5a8 EFLAGS: 00010093
RAX: ffff8801d2a52300 RBX: 0000000000000001 RCX: ffffffff84f64792
RDX: 0000000000000000 RSI: ffffffff84f64923 RDI: 0000000000000006
RBP: ffff8801d2a6f5e8 R08: ffff8801d2a52300 R09: ffffed003607acc1
R10: ffffed003607acc1 R11: ffff8801b03d660b R12: ffff8801ce2479c0
R13: 0000000000001001 R14: 0000000000000001 R15: ffff8801b03d65c0
  snd_rawmidi_transmit_ack+0x51/0x80 sound/core/rawmidi.c:1201
  snd_vmidi_output_work+0x3f4/0x4e0 sound/core/seq/seq_virmidi.c:153
  process_one_work+0xc73/0x1aa0 kernel/workqueue.c:2153
  worker_thread+0x189/0x13c0 kernel/workqueue.c:2296
  kthread+0x35a/0x420 kernel/kthread.c:246
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415
Shutting down cpus with NMI
Dumping ftrace buffer:
    (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with  
syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

Re: WARNING in __snd_rawmidi_transmit_ack (2)

[Takashi Iwai]

On Tue, 14 Aug 2018 16:20:02 +0200,
syzbot wrote:
> 
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    4e8b38549b50 Add linux-next specific files for 20180814
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=11f5e78c400000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=18edf0289d1b5ab
> dashboard link: https://syzkaller.appspot.com/bug?extid=ec5f605c91812d200367
> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
> syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=12f8c6d2400000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16976b72400000
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+ec5f605c91812d200367@syzkaller.appspotmail.com
> 
> WARNING: CPU: 1 PID: 1691 at sound/core/rawmidi.c:1170
> __snd_rawmidi_transmit_ack+0x263/0x2f0 sound/core/rawmidi.c:1170

This seems to be a bad side-effect by the code change along with the
offloading the virmidi work.

I'm going to queue the fix below.


thanks,

Takashi

-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] ALSA: seq: virmidi: Fix discarding the unsubscribed output

The recent change to move the virmidi output processing to a work
slightly modified the code to discard the unsubscribed outputs so that
it works without a temporary buffer.  However, this is actually buggy,
and may spew a kernel warning due to the unexpected call of
snd_rawmidi_transmit_ack(), as triggered by syzbot.

This patch takes back to the original code in that part, use a
temporary buffer and simply repeat snd_rawmidi_transmit(), in order to
address the regression.

Fixes: f7debfe54090 ("ALSA: seq: virmidi: Offload the output event processing")
Reported-by: syzbot+ec5f605c91812d200367@syzkaller.appspotmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/core/seq/seq_virmidi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
index a2f1c6b58693..cb988efd1ed0 100644
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -149,8 +149,9 @@ static void snd_vmidi_output_work(struct work_struct *work)
 	/* discard the outputs in dispatch mode unless subscribed */
 	if (vmidi->seq_mode == SNDRV_VIRMIDI_SEQ_DISPATCH &&
 	    !(vmidi->rdev->flags & SNDRV_VIRMIDI_SUBSCRIBE)) {
-		while (!snd_rawmidi_transmit_empty(substream))
-			snd_rawmidi_transmit_ack(substream, 1);
+		char buf[32];
+		while (snd_rawmidi_transmit(substream, buf, sizeof(buf)) > 0)
+			; /* ignored */
 		return;
 	}
 
-- 
2.18.0