Re: [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

>
> u_audio_get_playback_srate() unconditionally locks and reads
> uac->p_prm.lock/srate, but g_audio_setup() only initializes
> p_prm.lock when p_chmask is set. On a UAC2 instance configured
> without a playback direction, this results in acquiring a
> never spin_lock_init()'d lock when a GET_CUR sample rate
> request targets playback, triggering a lockdep "trying to
> register non-static key" warning.
>
> Reject the request with -EOPNOTSUPP when p_chmask is not set,
> before touching prm->lock.
>
> Reported-by: syzbot+e1d0e66badecc32d45eb@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: http://syzkaller.appspot.com/bug?extid=e1d0e66badecc32d45eb
> Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
> ---
>  drivers/usb/gadget/function/u_audio.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
> index e53f2927b539..ff811ea1e25a 100644
> --- a/drivers/usb/gadget/function/u_audio.c
> +++ b/drivers/usb/gadget/function/u_audio.c
> @@ -575,6 +575,9 @@ int u_audio_get_playback_srate(struct g_audio *audio_dev, u32 *val)
>  	struct uac_rtd_params *prm;
>  	unsigned long flags;
>  
> +	if (!audio_dev->params.p_chmask)
> +		return -EOPNOTSUPP;
> +
>  	prm = &uac->p_prm;
>  	spin_lock_irqsave(&prm->lock, flags);
>  	*val = prm->srate;
> -- 
> 2.43.0
>