* Re: [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction
[not found] <20260821114238.11840-1-kartikey406@gmail.com>
@ 2026-08-21 11:42 ` syzbot
0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2026-08-21 11:42 UTC (permalink / raw)
To: kartikey406; +Cc: kartikey406, linux-kernel, syzkaller-bugs
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
This crash does not have a reproducer. I cannot test it.
>
>
> u_audio_get_playback_srate() unconditionally locks and reads
> uac->p_prm.lock/srate, but g_audio_setup() only initializes
> p_prm.lock when p_chmask is set. On a UAC2 instance configured
> without a playback direction, this results in acquiring a
> never spin_lock_init()'d lock when a GET_CUR sample rate
> request targets playback, triggering a lockdep "trying to
> register non-static key" warning.
>
> Reject the request with -EOPNOTSUPP when p_chmask is not set,
> before touching prm->lock.
>
> Reported-by: syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com
> Closes: http://syzkaller.appspot.com/bug?extid=e1d0e66badecc32d45eb
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
> drivers/usb/gadget/function/u_audio.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
> index e53f2927b539..ff811ea1e25a 100644
> --- a/drivers/usb/gadget/function/u_audio.c
> +++ b/drivers/usb/gadget/function/u_audio.c
> @@ -575,6 +575,9 @@ int u_audio_get_playback_srate(struct g_audio *audio_dev, u32 *val)
> struct uac_rtd_params *prm;
> unsigned long flags;
>
> + if (!audio_dev->params.p_chmask)
> + return -EOPNOTSUPP;
> +
> prm = &uac->p_prm;
> spin_lock_irqsave(&prm->lock, flags);
> *val = prm->srate;
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction
[not found] <20260821114427.11896-1-kartikey406@gmail.com>
@ 2026-08-21 11:44 ` syzbot
0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2026-08-21 11:44 UTC (permalink / raw)
To: kartikey406; +Cc: kartikey406, linux-kernel, syzkaller-bugs
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
This crash does not have a reproducer. I cannot test it.
>
> u_audio_get_playback_srate() unconditionally locks and reads
> uac->p_prm.lock/srate, but g_audio_setup() only initializes
> p_prm.lock when p_chmask is set. On a UAC2 instance configured
> without a playback direction, this results in acquiring a
> never spin_lock_init()'d lock when a GET_CUR sample rate
> request targets playback, triggering a lockdep "trying to
> register non-static key" warning.
>
> Reject the request with -EOPNOTSUPP when p_chmask is not set,
> before touching prm->lock.
>
> Reported-by: syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com
> Closes: http://syzkaller.appspot.com/bug?extid=e1d0e66badecc32d45eb
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
> drivers/usb/gadget/function/u_audio.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
> index e53f2927b539..ff811ea1e25a 100644
> --- a/drivers/usb/gadget/function/u_audio.c
> +++ b/drivers/usb/gadget/function/u_audio.c
> @@ -575,6 +575,9 @@ int u_audio_get_playback_srate(struct g_audio *audio_dev, u32 *val)
> struct uac_rtd_params *prm;
> unsigned long flags;
>
> + if (!audio_dev->params.p_chmask)
> + return -EOPNOTSUPP;
> +
> prm = &uac->p_prm;
> spin_lock_irqsave(&prm->lock, flags);
> *val = prm->srate;
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction
@ 2026-08-21 11:48 Deepanshu Kartikey
0 siblings, 0 replies; 3+ messages in thread
From: Deepanshu Kartikey @ 2026-08-21 11:48 UTC (permalink / raw)
To: gregkh
Cc: kees, pavel.hofman, linux-usb, linux-kernel, Deepanshu Kartikey,
syzbot+e1d0e66badecc32d45eb
u_audio_get_playback_srate() unconditionally locks and reads
uac->p_prm.lock/srate, but g_audio_setup() only initializes
p_prm.lock when p_chmask is set. On a UAC2 instance configured
without a playback direction, this results in acquiring a
never spin_lock_init()'d lock when a GET_CUR sample rate
request targets playback, triggering a lockdep "trying to
register non-static key" warning.
Reject the request with -EOPNOTSUPP when p_chmask is not set,
before touching prm->lock.
Fixes: eb3a1ce6f5ed ("usb: gadget: u_audio: Add capture/playback srate getter")
Reported-by: syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com
Closes: http://syzkaller.appspot.com/bug?extid=e1d0e66badecc32d45eb
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/usb/gadget/function/u_audio.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index e53f2927b539..ff811ea1e25a 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -575,6 +575,9 @@ int u_audio_get_playback_srate(struct g_audio *audio_dev, u32 *val)
struct uac_rtd_params *prm;
unsigned long flags;
+ if (!audio_dev->params.p_chmask)
+ return -EOPNOTSUPP;
+
prm = &uac->p_prm;
spin_lock_irqsave(&prm->lock, flags);
*val = prm->srate;
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-21 11:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260821114427.11896-1-kartikey406@gmail.com>
2026-08-21 11:44 ` [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction syzbot
2026-08-21 11:48 Deepanshu Kartikey
[not found] <20260821114238.11840-1-kartikey406@gmail.com>
2026-08-21 11:42 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox