From: Greg KH <gregkh@linuxfoundation.org>
To: Deepanshu Kartikey <kartikey406@gmail.com>
Cc: kees@kernel.org, pavel.hofman@ivitera.com,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com
Subject: Re: [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction
Date: Sun, 18 Oct 2026 13:54:07 +0200 [thread overview]
Message-ID: <2026101828-oxidation-squishy-51e3@gregkh> (raw)
In-Reply-To: <CADhLXY55XwzujRCg+xgm4v4UJmfdgUQ0oihS39f3iMwFDzXTRw@mail.gmail.com>
On Sun, Oct 18, 2026 at 04:28:49PM +0530, Deepanshu Kartikey wrote:
> On Wed, Sep 30, 2026 at 1:48 PM Deepanshu Kartikey
> <kartikey406@gmail.com> wrote:
> >
> > On Tue, Sep 29, 2026 at 6:53 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Fri, Aug 21, 2026 at 05:18:54PM +0530, Deepanshu Kartikey wrote:
> > > > u_audio_get_playback_srate() unconditionally locks and reads
> > > > uac->p_prm.lock/srate, but g_audio_setup() only initializes
> > > > p_prm.lock when p_chmask is set. On a UAC2 instance configured
> > > > without a playback direction, this results in acquiring a
> > > > never spin_lock_init()'d lock when a GET_CUR sample rate
> > > > request targets playback, triggering a lockdep "trying to
> > > > register non-static key" warning.
> > > >
> > > > Reject the request with -EOPNOTSUPP when p_chmask is not set,
> > > > before touching prm->lock.
> > > >
> > > > Fixes: eb3a1ce6f5ed ("usb: gadget: u_audio: Add capture/playback srate getter")
> > > > Reported-by: syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com
> > > > Closes: http://syzkaller.appspot.com/bug?extid=e1d0e66badecc32d45eb
> > > > Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> > > > ---
> > >
> > > How was this tested?
> >
> > I have not been able to test this since there is no
> > repro present in syzbot.
> >
> > I verified the fix by static analysis of the call path in the report
> > (afunc_setup -> in_rq_cur -> u_audio_get_playback_srate) and confirmed
> > in g_audio_setup() that uac->p_prm.lock is only passed through
> > spin_lock_init() inside the "if (p_chmask)" block, so it is left
> > uninitialized whenever p_chmask is 0. Leading to lock splat issue.
> >
> > This patch is compile test only
> >
> > > Did you forget a Assisted-by: tag?
> >
> > Sure I will add assisted by tag
> >
> > thanks
> >
> > Deepanshu
>
> Hi Greg,
>
> Please let me know the status of this patch.
Burried with 2000+ other pending USB patches, please be patient, there
is no rush here as this is not affecting any real device you have,
right?
thanks,
greg k-h
prev parent reply other threads:[~2026-10-18 11:54 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-21 11:48 [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction Deepanshu Kartikey
2026-09-12 1:11 ` Deepanshu Kartikey
2026-09-23 3:31 ` Deepanshu Kartikey
2026-09-29 13:23 ` Greg KH
2026-09-29 13:23 ` Greg KH
2026-09-30 8:18 ` Deepanshu Kartikey
2026-10-18 10:58 ` Deepanshu Kartikey
2026-10-18 11:54 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026101828-oxidation-squishy-51e3@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=kartikey406@gmail.com \
--cc=kees@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=pavel.hofman@ivitera.com \
--cc=syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox