Repository navigation
[BUG][CML][RT1011_RT5682] KASAN bug found to play with speaker #2176
Description
New KASAN bug found while working on #2168.
- Platform : CML Helios
- Topology: sof-cml-rt1011-rt5682.tplg
- linux build hash: 16d98cd
- KConfig: default + memory-debug-defconfig-
- cmd:
aplay -Dhw:0,5 -r 48000 -c 2 -f S16_LE -d 3 /dev/zero -v
[ 170.777592] ==================================================================
[ 170.777603] BUG: KASAN: stack-out-of-bounds in _find_next_bit.constprop.0+0x3e/0xf0
[ 170.777608] Read of size 8 at addr ffff888202d6f530 by task aplay/1757
[ 170.777615] CPU: 0 PID: 1757 Comm: aplay Not tainted 5.7.0-rc7-test+ #3
[ 170.777617] Hardware name: Google Helios/Helios, BIOS 01/21/2020
[ 170.777618] Call Trace:
[ 170.777624] dump_stack+0x76/0xa0
[ 170.777629] print_address_description.constprop.0.cold+0xd3/0x43e
[ 170.777634] ? _raw_spin_lock_irqsave+0x7b/0xd0
[ 170.777637] ? _raw_spin_trylock_bh+0xf0/0xf0
[ 170.777640] ? _find_next_bit.constprop.0+0x3e/0xf0
[ 170.777643] __kasan_report.cold+0x37/0x86
[ 170.777647] ? regmap_readable+0xb0/0xc0
[ 170.777650] ? _find_next_bit.constprop.0+0x3e/0xf0
[ 170.777652] kasan_report+0x38/0x50
[ 170.777656] _find_next_bit.constprop.0+0x3e/0xf0
[ 170.777663] rt1011_set_tdm_slot+0x125/0x5d0 [snd_soc_rt1011]
[ 170.777669] ? rt1011_hw_params+0x2f0/0x2f0 [snd_soc_rt1011]
[ 170.777672] ? mutex_unlock+0x18/0x40
[ 170.777691] snd_soc_dai_set_tdm_slot+0x152/0x210 [snd_soc_core]
[ 170.777710] ? snd_soc_dai_set_fmt+0x80/0x80 [snd_soc_core]
[ 170.777717] cml_rt1011_hw_params+0x20c/0x320 [snd_soc_cml_rt1011_rt5682]
[ 170.777735] snd_soc_link_hw_params+0x59/0x90 [snd_soc_core]
[ 170.777752] soc_pcm_hw_params+0x42c/0xb10 [snd_soc_core]
[ 170.777771] ? soc_pcm_open+0xbd0/0xbd0 [snd_soc_core]
Metadata
Metadata
Assignees
Labels
No labels
Activity
plbossart commentedon Jun 8, 2020
Probably this sort of code in sound/soc/codecs/rt1011.c
rx_max is declared as unsigned int, this cast is probably just wrong.