From nobody Mon Sep 28 13:17:45 2026 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3C24471436 for ; Fri, 21 Aug 2026 11:49:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787312953; cv=none; b=dPMkdzd5QThQiF/k6sWcskDHgeBO5JwN8PCDy3O0IQVgsikmCO81Oiva4++dyBSM9Wl2YoqS6y6uDHKT47+ZLBSH64vaighELDIudZTt/MzMya5XpMubMSeaSV+54rS3J2XrftpO7jm0hCa3QQ5rUJvEL81OK02CxDKuFui9kYs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787312953; c=relaxed/simple; bh=GGQqnXopS3w0hGDXFED3WEdOuTRvC90+jNVd4y1nDHE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cvGz98DiIBtGf94tQ/nJ1bAJj5qaSzl+5H0fzFiisE1uLHBNJZM1VP1AXx8MtSqrOJbvM2G2lo3eFluVN9Sf6AScvMTxWPaNri70ljK5AYIHvSO12SMRsO8UpEJQchl759X8mZ1xY6Ir1djx7+l38peE7lHL9e3YfUk3iWRAJY4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=s0t2YOnv; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="s0t2YOnv" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2ceaf8a1265so10356825ad.2 for ; Fri, 21 Aug 2026 04:49:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787312945; x=1787917745; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=DhOyIfgwq3ymDsnKi6KRa4VEpe76UoUoo41OCGygdSE=; b=s0t2YOnvYCDG/6hRZgI3WU+ErOVuGgZF/Jsyq+B0ufWdeI9tWvVPM3jbQjRrakWuTl Et8QOKY/xq3udSVp1y/4y7UvHN/X9AAoI0Za4hi12el1SO1p1ZNgPmXDAFM5jFj2/6/N jeY2XPnO2fMU7EgOmiw2yeoA+T1oA74vzJeVCekqN+IJwsbIoM5HtqaghpJTy3Ok8GXw FT0EUexZ1S6l68ptd5L49HcN+o2QcvF1jSHM95eaxMcemsoNNGaJKPAu72xnHFV5Q9gR i3gea595QBvPZG+TvvzmXcBV/3pmQJnmT2akRApfx+JwClr/4KbJpkAcogLhnmiwrIPf ospA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787312945; x=1787917745; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DhOyIfgwq3ymDsnKi6KRa4VEpe76UoUoo41OCGygdSE=; b=nx/DdftDneTk2xdsDIotyZzaEwNku7TPz6Fft+Ljpg3FMqC243dLAjOrhtK0JZ0UnR 2PTKelc+rMS8Mj7/JAFjxGkKkaDoelR3XK7SQQv9yI3/eK0IlCWZKwNGuFtlIu2VBNxa Xe68YWYJs7vpmtv8R/NZzjLN/kJZwgtvfR4ksvO4f5j03zq4l8omXcnpkgw2PuzHV3cm 8Cf88D84fEcJS6jsmbwGqrpB0GTMLizNxI0XtQM0NGQHS0416rrwVezXJ9IByfK5PYCk otTueUjuoHxfrjpeJKQ08Uq+rcd0BiMKHRL934rXcoGZ3WJr3R9NN0bLKwlO6pFrEpXr qcQA== X-Forwarded-Encrypted: i=1; AHgh+Ro2v/UiAscGDAdw/VlmQE8SNRXr65c3ra9bTqcEavU4Zm7TrsvgFzjgudKTTfPqzqpb1kwECHXoTjPfLzg=@vger.kernel.org X-Gm-Message-State: AFuF++m9ZNxFQVgEkKL0ynE9fexfGd/Yz5hkEMQJYTZ5CI7mNDRL5oEk HgkCXiBpP4XyYVCKCJsGkvt3Msu11/Las92zpHKuKwFtJz4SDweWnSup X-Gm-Gg: AR+sD12V1nnAQxPxKkxedzG/JFifsDArIEzIG1BNmLoBP5p3Y4CxSjsyR1LWJypxXyY NkxWFda9mcCFlAxWNo5mPxeHf5g0zlr2LbVoupJTh92greUdQSIepmuqJ4Bmo9mRu43TnuZAsns JUehfXtBmWVUoMMCMugKECAAFhcPEFZ1IKSSXrkXiYP1IZJN1JPFKSB1yidZ1og6Gm2O9kzcOEf KzzP1JIAU5eQhgoGAuINyjifYEwnO44Fh1egycH8kM4so81eUU5k2cNS+3NuYACioBzWQJOIaBy 9Wjk0I0wqQVCgIDT5Kju6p7L464lEMLO4ey53ETM0q2AoooQXWlw9g4CnkdWWZtJ5wchPytEuQj UB2W0BreEqgJYZP2Vb6AK9uMfqgyny22hHXFFf6j9olW8cohr7afhmivKycWuVyPvRMNEcVoC0F guVmpSha1On5HStxNtjZwtUGDHkEKfPY0Wk6sY39nPmWD7DvPmY4wun5fkSMLQEAHZ3sQmnmgFH kDnlsy/AbHVY7i4f3ht3+/OH//A/p9UDYHaF66O976ojqW9sVodAw== X-Received: by 2002:a17:902:f68b:b0:2cf:c543:2c7e with SMTP id d9443c01a7336-2d64b0ce441mr120097945ad.10.1787312944722; Fri, 21 Aug 2026 04:49:04 -0700 (PDT) Received: from deepanshu-Legion-Pro-5-16AFR10.. ([2405:201:682f:383f:569e:7ed4:3735:ea2a]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327bf175399sm45738270eec.26.2026.08.21.04.49.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Aug 2026 04:49:03 -0700 (PDT) From: Deepanshu Kartikey To: gregkh@linuxfoundation.org Cc: kees@kernel.org, pavel.hofman@ivitera.com, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com Subject: [PATCH] usb: gadget: u_audio: reject srate request for unconfigured direction Date: Fri, 21 Aug 2026 17:18:54 +0530 Message-ID: <20260821114854.12218-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" u_audio_get_playback_srate() unconditionally locks and reads uac->p_prm.lock/srate, but g_audio_setup() only initializes p_prm.lock when p_chmask is set. On a UAC2 instance configured without a playback direction, this results in acquiring a never spin_lock_init()'d lock when a GET_CUR sample rate request targets playback, triggering a lockdep "trying to register non-static key" warning. Reject the request with -EOPNOTSUPP when p_chmask is not set, before touching prm->lock. Fixes: eb3a1ce6f5ed ("usb: gadget: u_audio: Add capture/playback srate gett= er") Reported-by: syzbot+e1d0e66badecc32d45eb@syzkaller.appspotmail.com Closes: http://syzkaller.appspot.com/bug?extid=3De1d0e66badecc32d45eb Signed-off-by: Deepanshu Kartikey --- drivers/usb/gadget/function/u_audio.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/fun= ction/u_audio.c index e53f2927b539..ff811ea1e25a 100644 --- a/drivers/usb/gadget/function/u_audio.c +++ b/drivers/usb/gadget/function/u_audio.c @@ -575,6 +575,9 @@ int u_audio_get_playback_srate(struct g_audio *audio_de= v, u32 *val) struct uac_rtd_params *prm; unsigned long flags; =20 + if (!audio_dev->params.p_chmask) + return -EOPNOTSUPP; + prm =3D &uac->p_prm; spin_lock_irqsave(&prm->lock, flags); *val =3D prm->srate; --=20 2.43.0