Skip to content

ASoC: qcom: add Surface Pro 11 TX DMIC capture - #88

Closed
ooaklee wants to merge 728 commits into
jglathe:jg/ubuntu-qcom-x1e-7.2.yfrom
ooaklee:x/sp11-tx-dmic-audio
Closed

ooaklee wants to merge 728 commits into
jglathe:jg/ubuntu-qcom-x1e-7.2.yfrom
ooaklee:x/sp11-tx-dmic-audio

Conversation

@ooaklee

@ooaklee ooaklee commented Aug 31, 2026

Copy link
Copy Markdown

Summary

  • select the validated DIV4 direct-DMIC clocking on Surface Pro 11
  • let the Denali TX macro request the two direct-DMIC pad clocks owned by the VA macro
  • add the regular two-channel TX_CODEC_DMA_TX_3 capture route while retaining the existing low-power VA path

Dependency and status

This PR targets jg/ubuntu-qcom-x1e-7.2.y directly. It follows the Denali baseline in #82, the QSPI/touch core in #83, the pen ABI topic, and the split camera topics:

The branch itself is based directly on the release branch, so it does not merge those prerequisite heads or the broad -sp11 staging branch. It also does not replay the correction merged through #81.

This PR is a draft until the exact branch has passed the SP11 capture and non-SP11 audio checks below. Protected speaker playback remains a separate audio topic and is not required by this microphone-capture path.

Containment

  • the alternate 4.8 MHz validation and DIV4 selection are gated by the microsoft,denali root compatible
  • the VA-to-TX clock broker is used only by the exact Denali two-channel DMIC0/DMIC1 route
  • existing VA capture remains present for low-power use and comparison
  • other LPASS machines retain the existing VA divider, TX event handling, and direct-DMIC ownership
  • the board change is limited to the common Denali description and does not add the route to unrelated X1E devices
  • no speaker-protection runtime, PA profile, diagnostic ABI, global readiness state, or module parameter is included

Provenance

The divider and shared-clock commits preserve Co-authored-by: geoca <272055834+geocausa@users.noreply.github.com> from @geocausa's focused source patches, link to their immutable revisions, and append Signed-off-by: Leon Silcott <leon@boasi.io>. The Denali route commit is authored and signed by Leon Silcott.

All three commits also link back to the relevant integration commits, including 58e36b1acb04, so the contributor history remains discoverable without carrying the original broad commits wholesale.

Validation

  • git diff --check 032e174490d2..HEAD
  • strict checkpatch for all three commits
  • ARM64 ubuntu_x1e_defconfig W=1 builds of the affected LPASS common, VA-macro, and TX-macro objects
  • successful builds of both Surface Pro 11 Denali device trees
  • source audit confirms that the changed divider and cross-macro clock requests are Denali-gated
  • source audit confirms no protected-playback runtime, userspace ABI, diagnostic control, or module parameter is present

Hardware checks still required

  • boot this exact branch on an X1E Surface Pro 11
  • record from the regular two-channel TX path at 48 kHz and verify both microphone channels
  • compare the existing VA capture path and confirm it remains usable
  • repeat open/close, capture, suspend/resume, and capture-after-resume cycles
  • check kernel logs for LPASS clock, DAI, AudioReach, or underrun errors
  • run playback and capture smoke tests on at least one non-SP11 X1E device to confirm the shared LPASS paths retain their existing behavior

harrisonvanderbyl and others added 30 commits August 30, 2026 10:33
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
This is required to distinguish these models easier on the boot loader level
for dtb selection.

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
remove the delete-node statement, no longer needed

refers-to: d68d93c

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
fix typo

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Follow the example of other DP controllers and also eDP controller on
SC7280 and move mdss_dp3_out endpoint declaration to the SoC
DTSI. This slightly reduces the boilerplate in the platform DT files and
also reduces the difference between DP and eDP controllers.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
… lanes on type-c

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
At the moment, we indirectly rely on the boot firmware to set up the
pinctrl for the eDP HPD line coming from the internal display. If the boot
firmware does not configure the display (e.g. because a different display
is selected for output in the UEFI settings), then the display fails to
come up and there are several errors in the kernel log:

 [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041
 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110
 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout
 ...

Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and
bias-disable according to the ACPI DSDT), which is defined as
&edp0_hpd_default template in x1e80100.dtsi.

Fixes: 6516961 ("arm64: dts: qcom: Add support for X1-based Asus Zenbook A14")
Tested-by: Aleksandrs Vinarskis <alex.vinarskis@gmail.com>    # FHD OLED
Reviewed-by: Aleksandrs Vinarskis <alex.vinarskis@gmail.com>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
…for eDP HPD

At the moment, we indirectly rely on the boot firmware to set up the
pinctrl for the eDP HPD line coming from the internal display. If the boot
firmware does not configure the display (e.g. because a different display
is selected for output in the UEFI settings), then the display fails to
come up and there are several errors in the kernel log:

 [drm:dpu_encoder_phys_vid_wait_for_commit_done:544] [dpu error]vblank timeout: 80020041
 [drm:dpu_kms_wait_for_commit_done:524] [dpu error]wait for commit done returned -110
 [drm:dpu_encoder_frame_done_timeout:2715] [dpu error]enc40 frame done timeout
 ...

Fix this by adding the missing pinctrl for gpio119 (func1/edp0_hot and
bias-disable according to the ACPI DSDT), which is defined as
&edp0_hpd_default template in x1e80100.dtsi.

Fixes: 7d1cbe2 ("arm64: dts: qcom: Add X1E78100 ThinkPad T14s Gen 6")
Tested-by: Christopher Obbard <christopher.obbard@linaro.org>
Reviewed-by: Christopher Obbard <christopher.obbard@linaro.org>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on Lenovo Thinkpad T14s OLED
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
amend the following files for the new mdss_dp3_out definition:

arch/arm64/boot/dts/qcom/x1-acer-swift-14.dtsi
arch/arm64/boot/dts/qcom/x1-asus-vivobook-s15.dtsi
arch/arm64/boot/dts/qcom/x1-hp-omnibook-x14.dtsi
arch/arm64/boot/dts/qcom/x1p42100-lenovo-ideapad-5-2in1.dts
arch/arm64/boot/dts/qcom/x1p42100-lenovo-ideapad-slim5x.dts

refers-to: 24f44be

also add the edp0_hpd_default pinctrl on dp3.

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
slim5x: i2c0: correct pinctrl-0
5-2in1: add commented- out dedicated driver atna40ct01

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
… 3 15Q8X10

add x126100 chip designation and compatible
add initial device tree

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
…ncept ISO

needs to boot and have efivars - use Thinkpad T14s as compatible
also added Vivobook 15 x1p42100
also added HP Omnibook X 14-fe1
also added Thinkbook 16
also added Acer Swift Go 14
also added Surface Pro 12"

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
fix typos in tlmm definition

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
since calculating tlmmgpio was unsuccessfful, use the common known one: tlmm 3

remove all possible touchpads except for the actual detected one, @38
disable all sophisticated pinctrl, only on the i2c devices

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
shared with keyboard, f yeah

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
since its apparently shared with the keyboard, disable it for now
there needs to be a mux driver which does the handling for it

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
required for 6.17

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
add dependency for python3-libfdt
add stubble-script hwids/finddtbs.py as debian/scripts/misc/find-dtbs.py

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
… T14s

T14s is powerful, but the fan doesn't cool it enough for full load.
Tone it down to the experimentally determined limits
QMP Combo PHYs default to USB3DP lane routing, which can break static setups like
DP-to-HDMI bridges by misallocating lanes to USB3.
Revive the optional "qcom,combo-initial-mode" DT property [1] to explicitly
set the initial mode ("usb3dp", "dp", "usb3"). In static configs (no mode-switch
or orientation-switch props), honor it and skip lane inference to avoid overrides.
This simplifies HDMI enablement on undocumented Snapdragon X laptops while
preserving dynamic Type-C behavior.

[1]: https://lore.kernel.org/r/20250821-topic-x1e80100-hdmi-v1-2-f14ad9430e88@linaro.org

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
jglathe and others added 19 commits August 30, 2026 10:33
including lcd backlight, but Hamoa model (x1p64100)

Inspired from [1]

[1]: 3thanRam/DELL-Latitude-5455-Ubuntu@7a27530

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
- new pcie node structure
- add gpi dma nodes
- add iris node, remove venus
- add mode-switch to qmpphy nodes (should be in sc8280xp.dtsi, but it is what it is)
- correct camera gpio definition

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
- new pcie node structure
- add gpi dma nodes
- add iris node, remove venus
- add mode-switch to qmpphy nodes (should be in sc8280xp.dtsi, but it is what it is)
- bluetooth: correct vddrfa1p7-supply description

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
- specifically iris vs. venus
- keep the arm-smmu-v3 improvements we have

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Commit a53b4f9 ("usb: typec: mux: avoid duplicated orientation
switches") started using the orientation switch result array as state for
duplicate detection, but left the array uninitialized.

The first match therefore scans indeterminate stack contents before any
result has been stored. A valid orientation switch may be incorrectly
discarded as a duplicate, causing fwnode_typec_switch_get() to return no
switch.

Zero-initialize the array before collecting matches.

Fixes: a53b4f9 ("usb: typec: mux: avoid duplicated orientation switches")
Signed-off-by: Haobo Cheng <i@4t.pw>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
…es, enable DisplayPort audio

The Windows Dev Kit 2023 has no built-in speakers, microphones or
headphone jack. Likewise the device with the same mainboard, Surface
Pro 9 5G [1]. The previous WCD938x / WSA / VA sound card definition
was therefore non-functional.

Replace the unused codec nodes, SoundWire controllers, LPASS macros
and related pinctrl with DisplayPort DAI links (DP0/DP1/DP2) so that
audio is available over the DP connectors. Add the required
sound-name-prefix properties and update the card model name to the
conventional SC8280XP-MICROSOFT-BLACKROCK form.

[1]: https://support.microsoft.com/en-us/surface/models/surface-pro-9-features-and-specs

Fixes: 16a7fed ("arm64: dts: qcom: sc8280xp-blackrock: dt definition for WDK2023")
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Allow up to 4 lanes for the DisplayPort links on the USB-C ports and
the mini-DP connector. Add the standard link-frequencies and move
data-lanes to the out endpoints where required by the current bindings.

Also enable mode-switch on the QMP combo PHYs so that altmode events
can reach them.

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Add the dp0/dp1 DAI links for sound via displayport.

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Some devices use combo PHYs (i.e. USB3 + DisplayPort), which also
handle the lane muxing. These PHYs are referenced twice from
the USB-C connector (USB super-speed lines and SBU/AUX lines)
resulting in the mux being configured twice. Avoid this by
dropping duplicates.

This is a re-application of b145c3f ("usb: typec: mux: avoid
duplicated mux switches"), with fix derived from usb: typec: mux:
Fix typec_switch_match() .

Fixes: f576c75 ("Revert "usb: typec: mux: avoid duplicated mux switches"")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Co-developed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
The fwnode_typec_switch_get() sporadically returns NULL instead of an
-EPROBE_DEFER for orientation-switch described in DT. This makes it
impossible to discern whether the DT does describe an orientation-switch
which did not probe yet, or whether the DT does not describe the switch.
This happens with gpio-sbu-mux connected to an I2C GPIO expander.

The class_find_device() on typec_switch_match() may return NULL in case
the mux did not probe just yet early on boot. The sw_devs[] array can be
empty on boot as well. If these two conditions occur, then the conditional
if (to_typec_switch_dev(dev) == sw_devs[i]) evaluates to true and the match
function returns NULL, which propagates to fwnode_typec_switch_get() which
makes it look as if the orientation-switch was not described in DT.

This is incorrect, because the mux driver will probe a bit later on, but
at that point, the caller of fwnode_typec_switch_get() already got the
NULL return value. The NULL return value also does not trigger IS_ERR(),
therefore the caller driver interprets this as if the orientation-switch
is not described in DT, and does not return -EPROBE_DEFER to try again,
even if it should.

Fix this by checking the class_find_device() return value, and return
-EPROBE_DEFER if it is NULL right away. If the return value is not NULL,
perform the deduplication test, and if that test passes, consider the
return value to be already non-NULL.

Fixes: a53b4f9 ("usb: typec: mux: avoid duplicated orientation switches")
Cc: stable@vger.kernel.org
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Tested-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
base purwa and hamoa variants on a common dtsi

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
…patible strings

required to boot via stubble to identify the dtb

Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Signed-off-by: Jens Glathe <jens.glathe@oldschoolsolutions.biz>
Rewrite of the OmniBook 5 devicetree that is independent of the X14
dtsi.

Additional changes:
- Corrected the display-adjacent type-c port configuration by replacing
  the PS8830 redriver with a TB16-derived usb_1_ss0 setup
- Adjusted eUSB2 repeaters following the TB16 configuration
Denali uses a 4.8 MHz direct-DMIC rate with the VA path clocked at
19.2 MHz. Validate the sample rate against that clock so the driver
selects DIV4, matching the native Windows programming, instead of DIV2.

Keep the existing calculation on every other machine.

This is based on geoca's Windows-parity analysis in patch 0072.

Link: https://github.com/geocausa/SP11X1e-audio/blob/a1d51ecc7416a905acdad50d31600fff7f28ac1c/patches/0072-ASoC-lpass-va-macro-SP11-match-Windows-DMIC-divider.patch
Link: 58e36b1
Co-authored-by: geoca <272055834+geocausa@users.noreply.github.com>
Signed-off-by: Leon Silcott <leon@boasi.io>
The Surface Pro 11 microphone array feeds the TX macro while the VA
macro owns its direct-DMIC pad clocks. Without a cross-macro clock
request, the TX capture path cannot reproduce the working firmware
sequence.

Add an LPASS-internal DMIC clock broker, register the Denali VA macro as
its provider, and request DMIC1 then DMIC0 from the TX DEC event group.
Validate the exact two-channel Denali route before changing the clocks.

Both the provider and consumer paths are gated by the microsoft,denali
root compatible. Other machines retain the existing VA and TX behavior;
the common broker remains unused on those systems.

This implementation follows geoca's Windows-parity work in patch 0078.

Link: https://github.com/geocausa/SP11X1e-audio/blob/a1d51ecc7416a905acdad50d31600fff7f28ac1c/patches/0078-ASoC-lpass-SP11-share-VA-DMIC-clock-with-TX-capture.patch
Link: 58e36b1
Co-authored-by: geoca <272055834+geocausa@users.noreply.github.com>
Signed-off-by: Leon Silcott <leon@boasi.io>
The Surface Pro 11 exposes its microphone array as two 48 kHz PCM
channels. The existing VA backend covers the voice path but does not
provide the regular TX-macro host capture path.

Add a TX macro link through AudioReach TX_CODEC_DMA_TX_3 and route DMIC0
and DMIC1 through the microphone regulator. Keep the existing VA capture
link available for low-power use and hardware comparison.

Link: ab34e94
Link: 58e36b1
Signed-off-by: Leon Silcott <leon@boasi.io>
ooaklee added a commit to ooaklee/linux_ms_dev_kit-sp11 that referenced this pull request Sep 1, 2026
Integrate jglathe#88 for combined SP11 testing.
@jglathe
jglathe force-pushed the jg/ubuntu-qcom-x1e-7.2.y branch 2 times, most recently from 4943ee7 to 6407d62 Compare September 9, 2026 20:39
@jglathe
jglathe force-pushed the jg/ubuntu-qcom-x1e-7.2.y branch 3 times, most recently from 68e1550 to e57ec29 Compare September 18, 2026 05:08
@ooaklee

ooaklee commented Oct 4, 2026

Copy link
Copy Markdown
Author

Withdrawing this older 7.2.2-era submission version without merging while we continue qualification of the repaired 7.2.5 source on the fork. Current source/dependency review is tracked in ooaklee/linux_ms_dev_kit-sp11#57 and the combined candidate ooaklee/linux_ms_dev_kit-sp11#68. These are review vehicles, not an upstream-ready replacement or proof of equivalence to this old PR head.

The current combined source is 8ba2b75713feb5c72bbc11dd8cce4048e23cdeea, ABI 7.2.5-jg-0sp11v8-qcom-x1e; see the experimental v8 release. Ordinary-use results on one X1E/OLED unit are recorded, but the release remains experimental and the detailed hardware, lifecycle, deviation, CI and provenance gates in ooaklee/linux_ms_dev_kit-sp11#68 remain open.

This PR's branch and exact head fcc9dc637570, authored history, discussion and test evidence are retained unchanged. Closing is administrative supersession, not a merge, an acceptance decision, or a claim that the old and current trees are identical. Beta and the repository default are unchanged.

TX ooaklee/linux_ms_dev_kit-sp11#57 precedes protected playback ooaklee/linux_ms_dev_kit-sp11#58. The maintainer's non-SP11 X1E boot requirement remains necessary before shared audio reaches the release line; an ordinary SP11 test or a representative DTB build does not satisfy it.

Fresh focused upstream submissions will preserve the contributing authors, source links and dependencies after exact combined acceptance and the appropriate shared-driver checks. Fork-only integration scripts/workflows and repository policy will be excluded. PR #79 remains open as the maintainer's coordination/provenance thread.

@ooaklee ooaklee closed this Oct 4, 2026
jglathe pushed a commit that referenced this pull request Oct 9, 2026
[ Upstream commit 383a948 ]

On the rdma_accept_failed error path of
smbdirect_accept_connect_request(), the receive io posted just above is
owned by the QP (recv_io is set to NULL after a successful post).  The
error path fell through to smbdirect_connection_destroy_mem_pools()
before smbdirect_connection_destroy_qp(), so the mem pools and the
recv_io slab cache were destroyed while that recv_io was still
outstanding on the QP.

The drain in smbdirect_connection_destroy_qp() (ib_drain_qp()) is what
runs the recv completion that returns the recv_io to the free list, so
destroying the pools first leaves the object outstanding at
kmem_cache_destroy() time ("Slab cache still has objects") and later
frees it into an already-destroyed mempool (mempool_free_bulk
NULL-pointer dereference).

Give rdma_accept_failed its own teardown that drains the QP first, then
destroys the mem pools, and returns.  The remaining labels
(post_recv_io_failed onward) run before the recv_io was ever posted, so
they keep the mem-pools-then-qp order.

The outstanding recv_io at kmem_cache_destroy() time:

[ 3487.344647] =============================================================================
[ 3487.349942] BUG smbdirect_recv_io_cache_ffff88811ba99000 (Not tainted): Objects remaining on __kmem_cache_shutdown()
[ 3487.356078] -----------------------------------------------------------------------------
[ 3487.356078]
[ 3487.356738] Object 0xffff8881511c3440 @offset=13376
[ 3487.358464] Allocated in mempool_alloc_noprof+0x18c/0x290 age=1194 cpu=6 pid=22254
[ 3487.361197]  mempool_alloc_noprof+0x18c/0x290
[ 3487.361542]  smbdirect_connection_create_mem_pools+0x405/0x780
[ 3487.361972]  smbdirect_accept_connect_request+0x5a8/0x1b80
[ 3487.362359]  smbdirect_listen_rdma_event_handler+0x1579/0x1b90
[ 3487.362779]  cma_cm_event_handler+0x9c/0x230
[ 3487.363096]  cma_ib_req_handler+0x2682/0x45d0
[ 3487.363414]  cm_process_work+0x56/0x3d0
[ 3487.363676]  cm_work_handler+0x8a0e/0xd000
[ 3487.367496]  process_scheduled_works+0xa07/0x13a0
[ 3487.367859]  worker_thread+0x7c9/0xc80
[ 3487.368148]  kthread+0x341/0x430
[ 3487.368407]  ret_from_fork+0x3a8/0x7a0
[ 3487.368704]  ret_from_fork_asm+0x1a/0x30
[ 3487.370307] Slab 0xffffea0005447000 objects=19 used=1 fp=0xffff8881511c0040 flags=0x100000000000240(workingset|head|node=0|zone=2)
[ 3487.372840] ------------[ cut here ]------------
[ 3487.373195] WARNING: mm/slub.c:1244 at __slab_err+0x1a/0x30, CPU#6: kworker/6:84/22254
[ 3487.373759] Modules linked in:
[ 3487.373993] CPU: 6 UID: 0 PID: 22254 Comm: kworker/6:84 Tainted: G    B               7.1.0-next-20260623+ #88 PREEMPT(lazy)
[ 3487.374778] Tainted: [B]=BAD_PAGE
[ 3487.377830] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 3487.378515] Workqueue: ib_cm cm_work_handler
[ 3487.378820] RIP: 0010:__slab_err+0x1a/0x30
[ 3487.379129] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 e8 36 00 00 00 bf 05 00 00 00 be 01 00 00 00 e8 f7 75 45 00 90 <0f> 0b 90 c3 cc cc cc cc cc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00
[ 3487.383255] RSP: 0018:ffff888220fc7050 EFLAGS: 00010093
[ 3487.383643] RAX: ffffffff8168e60a RBX: ffff88810955e640 RCX: ffff88821c381d80
[ 3487.384158] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff870fa080
[ 3487.384662] RBP: ffff888220fc7068 R08: ffffffff870fa087 R09: 1ffffffff0e1f410
[ 3487.385192] R10: dffffc0000000000 R11: fffffbfff0e1f411 R12: ffffea0005447210
[ 3487.385674] R13: ffffea0005447000 R14: ffff888220fc7068 R15: ffff88812a8ab300
[ 3487.388932] FS:  0000000000000000(0000) GS:ffff888427e76000(0000) knlGS:0000000000000000
[ 3487.389529] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3487.389934] CR2: 00007ffcf2d84fd8 CR3: 0000000111d64006 CR4: 0000000000f72ef0
[ 3487.390440] PKRU: 55555554
[ 3487.390641] Call Trace:
[ 3487.390826]  <TASK>
[ 3487.391209]  __kmem_cache_shutdown+0x1aa/0x2b0
[ 3487.392062]  ? smbdirect_connection_destroy_mem_pools+0x239/0x300
[ 3487.393565]  kmem_cache_destroy+0x9d/0x180
[ 3487.398663]  smbdirect_connection_destroy_mem_pools+0x239/0x300
[ 3487.403534]  ? __pfx_smb_direct_logging_needed+0x10/0x10
[ 3487.407562]  smbdirect_accept_connect_request+0x95c/0x1b80
[ 3487.412391]  ? __pfx_smbdirect_accept_connect_request+0x10/0x10
[ 3487.416753]  ? do_raw_spin_lock+0x130/0x300
[ 3487.420623]  ? smbdirect_socket_set_initial_parameters+0x28b/0x6a0
[ 3487.424322]  ? lock_acquire+0x4c/0x270
[ 3487.424409] ksmbd: can't change a file to a directory
[ 3487.426321]  ? trace_irq_enable+0x36/0x120
[ 3487.429144]  smbdirect_listen_rdma_event_handler+0x1579/0x1b90
[ 3487.432606]  ? __pfx_smbdirect_listen_rdma_event_handler+0x10/0x10
[ 3487.433595]  ? trace_cm_event_handler+0x51/0x170
[ 3487.435183]  ? __pfx_smbdirect_listen_rdma_event_handler+0x10/0x10
[ 3487.435646]  ? cma_listen_handler+0xf6/0x150
[ 3487.435975]  cma_cm_event_handler+0x9c/0x230
[ 3487.436288]  cma_ib_req_handler+0x2682/0x45d0
[ 3487.439039]  ? __pfx_cma_ib_req_handler+0x10/0x10
[ 3487.439540]  ? __pfx_roce_resolve_route_from_path+0x10/0x10
[ 3487.439972]  ? stack_depot_save_flags+0x34/0x840
[ 3487.440374]  ? __xas_nomem+0xa9/0x410
[ 3487.443356]  ? xas_clear_mark+0x26c/0x4a0
[ 3487.443673]  cm_process_work+0x56/0x3d0
[ 3487.443969]  ? _raw_spin_unlock_irq+0x28/0x50
[ 3487.444317]  cm_work_handler+0x8a0e/0xd000
[ 3487.444624]  ? __pfx_cm_work_handler+0x10/0x10
[ 3487.444971]  ? pwq_dec_nr_in_flight+0xa73/0xdf0
[ 3487.445344]  ? __pfx_pwq_dec_nr_in_flight+0x10/0x10
[ 3487.445737]  ? lock_acquire+0x4c/0x270
[ 3487.448833]  ? process_scheduled_works+0x995/0x13a0
[ 3487.449230]  ? process_scheduled_works+0x995/0x13a0
[ 3487.449588]  process_scheduled_works+0xa07/0x13a0
[ 3487.449938]  ? __pfx_process_scheduled_works+0x10/0x10
[ 3487.450334]  ? do_raw_spin_lock+0x130/0x300
[ 3487.450639]  ? assign_work+0x3bb/0x5c0
[ 3487.450916]  worker_thread+0x7c9/0xc80
[ 3487.451211]  kthread+0x341/0x430
[ 3487.451453]  ? __pfx_worker_thread+0x10/0x10
[ 3487.451756]  ? __pfx_kthread+0x10/0x10
[ 3487.454814]  ret_from_fork+0x3a8/0x7a0
[ 3487.455114]  ? __pfx_ret_from_fork+0x10/0x10
[ 3487.455450]  ? __switch_to+0xb76/0x1110
[ 3487.455772]  ? __pfx_kthread+0x10/0x10
[ 3487.456081]  ret_from_fork_asm+0x1a/0x30
[ 3487.456384]  </TASK>
[ 3487.456549] irq event stamp: 0
[ 3487.456767] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[ 3487.460124] hardirqs last disabled at (0): [<ffffffff81684648>] copy_process+0xa08/0x3a10
[ 3487.460726] softirqs last  enabled at (0): [<ffffffff81684648>] copy_process+0xa08/0x3a10
[ 3487.461328] softirqs last disabled at (0): [<0000000000000000>] 0x0
[ 3487.461778] ---[ end trace 0000000000000000 ]---
[ 3487.543875] ksmbd: can't change a file to a directory
[ 3487.599675] ksmbd: can't change a file to a directory
[ 3487.626694] ksmbd: can't change a file to a directory
[ 3487.824687] ksmbd: can't change a file to a directory
[ 3487.871840] ksmbd: can't change a file to a directory
[ 3487.986207] ------------[ cut here ]------------
[ 3487.987157] kmem_cache_destroy smbdirect_recv_io_cache_ffff88811ba99000: Slab cache still has objects when called from smbdirect_connection_destroy_mem_pools+0x239/0x300
[ 3487.987183] WARNING: mm/slab_common.c:572 at kmem_cache_destroy+0x15c/0x180, CPU#6: kworker/6:84/22254
[ 3487.999821] Modules linked in:
[ 3488.001902] CPU: 6 UID: 0 PID: 22254 Comm: kworker/6:84 Tainted: G    B   W           7.1.0-next-20260623+ #88 PREEMPT(lazy)
[ 3488.008289] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 3488.010459] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 3488.014502] Workqueue: ib_cm cm_work_handler
[ 3488.017790] RIP: 0010:kmem_cache_destroy+0x16a/0x180
[ 3488.020662] Code: fd ff 48 8b 3d 2f c0 9c 06 48 89 de 5b 41 5e 5d e9 5b a3 0e 00 48 8d 3d a4 07 12 04 48 8b 53 58 48 c7 c6 91 9d 3e 85 4c 89 f1 <67> 48 0f b9 3a e9 33 ff ff ff 66 66 66 2e 0f 1f 84 00 00 00 00 00
[ 3488.028077] RSP: 0018:ffff888220fc70b8 EFLAGS: 00010202
[ 3488.032038] RAX: 0000000000000001 RBX: ffff88810955e640 RCX: ffffffff822bc079
[ 3488.035742] RDX: ffff88812404ec40 RSI: ffffffff853e9d91 RDI: ffffffff85f7ac50
[ 3488.037830] RBP: 0000000000000001 R08: ffff8883aef3e843 R09: 1ffff11075de7d08
[ 3488.041076] R10: dffffc0000000000 R11: ffffed1075de7d09 R12: 1ffff11024fa6c3c
[ 3488.045376] R13: ffff888127d361e8 R14: ffffffff822bc079 R15: ffff88811ba99538
[ 3488.049073] FS:  0000000000000000(0000) GS:ffff888427e76000(0000) knlGS:0000000000000000
[ 3488.052515] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3488.054934] CR2: 00007ffcf2d84fd8 CR3: 0000000111d64006 CR4: 0000000000f72ef0
[ 3488.058529] PKRU: 55555554
[ 3488.060542] Call Trace:
[ 3488.061595]  <TASK>
[ 3488.062006]  smbdirect_connection_destroy_mem_pools+0x239/0x300
[ 3488.066041]  ? __pfx_smb_direct_logging_needed+0x10/0x10
[ 3488.068620]  smbdirect_accept_connect_request+0x95c/0x1b80
[ 3488.071594]  ? __pfx_smbdirect_accept_connect_request+0x10/0x10
[ 3488.073218] ksmbd: not allow base filename in rename
[ 3488.074751]  ? do_raw_spin_lock+0x130/0x300
[ 3488.076792] ksmbd: can't change a file to a directory
[ 3488.077942]  ? smbdirect_socket_set_initial_parameters+0x28b/0x6a0
[ 3488.080143]  ? lock_acquire+0x4c/0x270
[ 3488.080747]  ? trace_irq_enable+0x36/0x120
[ 3488.081400]  smbdirect_listen_rdma_event_handler+0x1579/0x1b90
[ 3488.085089]  ? __pfx_smbdirect_listen_rdma_event_handler+0x10/0x10
[ 3488.089333]  ? trace_cm_event_handler+0x51/0x170
[ 3488.092637]  ? __pfx_smbdirect_listen_rdma_event_handler+0x10/0x10
[ 3488.095741]  ? cma_listen_handler+0xf6/0x150
[ 3488.099638]  cma_cm_event_handler+0x9c/0x230
[ 3488.101552]  cma_ib_req_handler+0x2682/0x45d0
[ 3488.104571]  ? __pfx_cma_ib_req_handler+0x10/0x10
[ 3488.106790]  ? __pfx_roce_resolve_route_from_path+0x10/0x10
[ 3488.109799]  ? stack_depot_save_flags+0x34/0x840
[ 3488.112174]  ? __xas_nomem+0xa9/0x410
[ 3488.114217]  ? xas_clear_mark+0x26c/0x4a0
[ 3488.116854]  cm_process_work+0x56/0x3d0
[ 3488.118179]  ? _raw_spin_unlock_irq+0x28/0x50
[ 3488.120034]  cm_work_handler+0x8a0e/0xd000
[ 3488.121677]  ? __pfx_cm_work_handler+0x10/0x10
[ 3488.123682]  ? pwq_dec_nr_in_flight+0xa73/0xdf0
[ 3488.126928]  ? __pfx_pwq_dec_nr_in_flight+0x10/0x10
[ 3488.129390]  ? lock_acquire+0x4c/0x270
[ 3488.131432]  ? process_scheduled_works+0x995/0x13a0
[ 3488.132694] ksmbd: can't change a file to a directory
[ 3488.136702]  ? process_scheduled_works+0x995/0x13a0
[ 3488.140060]  process_scheduled_works+0xa07/0x13a0
[ 3488.143379]  ? __pfx_process_scheduled_works+0x10/0x10
[ 3488.147221]  ? do_raw_spin_lock+0x130/0x300
[ 3488.150790]  ? assign_work+0x3bb/0x5c0
[ 3488.154259]  worker_thread+0x7c9/0xc80
[ 3488.155730]  kthread+0x341/0x430
[ 3488.158309]  ? __pfx_worker_thread+0x10/0x10
[ 3488.160865]  ? __pfx_kthread+0x10/0x10
[ 3488.164384]  ret_from_fork+0x3a8/0x7a0
[ 3488.167020]  ? __pfx_ret_from_fork+0x10/0x10
[ 3488.170050]  ? __switch_to+0xb76/0x1110
[ 3488.171809]  ? __pfx_kthread+0x10/0x10
[ 3488.174955]  ret_from_fork_asm+0x1a/0x30
[ 3488.175605]  </TASK>
[ 3488.176206] irq event stamp: 0
[ 3488.179360] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[ 3488.186521] hardirqs last disabled at (0): [<ffffffff81684648>] copy_process+0xa08/0x3a10
[ 3488.191889] softirqs last  enabled at (0): [<ffffffff81684648>] copy_process+0xa08/0x3a10
[ 3488.196853] softirqs last disabled at (0): [<0000000000000000>] 0x0
[ 3488.200870] ---[ end trace 0000000000000000 ]---

Found with ksmbdzzer [2], a KSMBD fuzzer that drives libFuzzer with a
kcov-dataflow [1] coverage vector: it folds each instrumented
comparison/argument's runtime operand value together with its PC (the
default arm mixes them as pc⊕val) so that a new operand value at a known
site counts as new coverage.

[1] https://lwn.net/Articles/1077606/
[2] https://github.com/yskzalloc/kcov-dataflow

Fixes: eb3ed1e ("smb: smbdirect: introduce smbdirect_accept_connect_request()")
Signed-off-by: Yunseong Kim <yunseong.kim@est.tech>
Acked-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.