Date:   Mon, 06 Nov 2017 10:36:14 -0800
From:   syzbot 
        <bot+5e11c83d62924135b4d6f902434d4c243acef8a5@...kaller.appspotmail.com>
To:     alsa-devel@...a-project.org, danielmentz@...gle.com,
        linux-kernel@...r.kernel.org, perex@...ex.cz,
        syzkaller-bugs@...glegroups.com, tiwai@...e.com
Subject: BUG: looking up invalid subclass: 8

Hello,

syzkaller hit the following crash on  
5a3517e009e979f21977d362212b7729c5165d92
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


turning off the locking correctness validator.
CPU: 0 PID: 2988 Comm: syzkaller395259 Not tainted  
4.14.0-rc7-next-20171103+ #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x194/0x257 lib/dump_stack.c:53
  look_up_lock_class kernel/locking/lockdep.c:686 [inline]
  register_lock_class+0x5f2/0x2c70 kernel/locking/lockdep.c:769
  __lock_acquire+0x203/0x4770 kernel/locking/lockdep.c:3387
  lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:4004
  down_read_nested+0x9a/0x150 kernel/locking/rwsem.c:157
  deliver_to_subscribers sound/core/seq/seq_clientmgr.c:666 [inline]
  snd_seq_deliver_event+0x559/0x820 sound/core/seq/seq_clientmgr.c:811
  snd_seq_kernel_client_dispatch+0x11e/0x150  
sound/core/seq/seq_clientmgr.c:2317
  dummy_input+0x2c4/0x400 sound/core/seq/seq_dummy.c:104
  snd_seq_deliver_single_event.constprop.11+0x2fb/0x940  
sound/core/seq/seq_clientmgr.c:621
  deliver_to_subscribers sound/core/seq/seq_clientmgr.c:676 [inline]
  snd_seq_deliver_event+0x362/0x820 sound/core/seq/seq_clientmgr.c:811
  snd_seq_kernel_client_dispatch+0x11e/0x150  
sound/core/seq/seq_clientmgr.c:2317
  dummy_input+0x2c4/0x400 sound/core/seq/seq_dummy.c:104
  snd_seq_deliver_single_event.constprop.11+0x2fb/0x940  
sound/core/seq/seq_clientmgr.c:621
  deliver_to_subscribers sound/core/seq/seq_clientmgr.c:676 [inline]
  snd_seq_deliver_event+0x362/0x820 sound/core/seq/seq_clientmgr.c:811
  snd_seq_kernel_client_dispatch+0x11e/0x150  
sound/core/seq/seq_clientmgr.c:2317
  dummy_input+0x2c4/0x400 sound/core/seq/seq_dummy.c:104
  snd_seq_deliver_single_event.constprop.11+0x2fb/0x940  
sound/core/seq/seq_clientmgr.c:621
  deliver_to_subscribers sound/core/seq/seq_clientmgr.c:676 [inline]
  snd_seq_deliver_event+0x362/0x820 sound/core/seq/seq_clientmgr.c:811
  snd_seq_kernel_client_dispatch+0x11e/0x150  
sound/core/seq/seq_clientmgr.c:2317
  dummy_input+0x2c4/0x400 sound/core/seq/seq_dummy.c:104
  snd_seq_deliver_single_event.constprop.11+0x2fb/0x940  
sound/core/seq/seq_clientmgr.c:621
  deliver_to_subscribers sound/core/seq/seq_clientmgr.c:676 [inline]
  snd_seq_deliver_event+0x362/0x820 sound/core/seq/seq_clientmgr.c:811
  snd_seq_kernel_client_dispatch+0x11e/0x150  
sound/core/seq/seq_clientmgr.c:2317
  dummy_input+0x2c4/0x400 sound/core/seq/seq_dummy.c:104
  snd_seq_deliver_single_event.constprop.11+0x2fb/0x940  
sound/core/seq/seq_clientmgr.c:621
  deliver_to_subscribers sound/core/seq/seq_clientmgr.c:676 [inline]
  snd_seq_deliver_event+0x362/0x820 sound/core/seq/seq_clientmgr.c:811
  snd_seq_kernel_client_dispatch+0x11e/0x150  
sound/core/seq/seq_clientmgr.c:2317
  dummy_input+0x2c4/0x400 sound/core/seq/seq_dummy.c:104
  snd_seq_deliver_single_event.constprop.11+0x2fb/0x940  
sound/core/seq/seq_clientmgr.c:621
  deliver_to_subscribers sound/core/seq/seq_clientmgr.c:676 [inline]
  snd_seq_deliver_event+0x362/0x820 sound/core/seq/seq_clientmgr.c:811
  snd_seq_kernel_client_dispatch+0x11e/0x150  
sound/core/seq/seq_clientmgr.c:2317
  dummy_input+0x2c4/0x400 sound/core/seq/seq_dummy.c:104
  snd_seq_deliver_single_event.constprop.11+0x2fb/0x940  
sound/core/seq/seq_clientmgr.c:621
  snd_seq_deliver_event+0x176/0x820 sound/core/seq/seq_clientmgr.c:822
  snd_seq_kernel_client_dispatch+0x11e/0x150  
sound/core/seq/seq_clientmgr.c:2317
  snd_seq_oss_dispatch sound/core/seq/oss/seq_oss_device.h:150 [inline]
  snd_seq_oss_midi_reset+0x44b/0x700 sound/core/seq/oss/seq_oss_midi.c:481
  snd_seq_oss_synth_reset+0x398/0x980 sound/core/seq/oss/seq_oss_synth.c:416
  snd_seq_oss_reset+0x6c/0x260 sound/core/seq/oss/seq_oss_init.c:448
  snd_seq_oss_release+0x71/0x120 sound/core/seq/oss/seq_oss_init.c:425
  odev_release+0x52/0x70 sound/core/seq/oss/seq_oss.c:153
  __fput+0x333/0x7f0 fs/file_table.c:210
  ____fput+0x15/0x20 fs/file_table.c:244
  task_work_run+0x199/0x270 kernel/task_work.c:113
  exit_task_work include/linux/task_work.h:22 [inline]
  do_exit+0x9b5/0x1ad0 kernel/exit.c:869
  do_group_exit+0x149/0x400 kernel/exit.c:972
  SYSC_exit_group kernel/exit.c:983 [inline]
  SyS_exit_group+0x1d/0x20 kernel/exit.c:981
  entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x437dd9
RSP: 002b:00007ffe20d04a08 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000437dd9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000086 R08: 000000000000003c R09: 00000000000000e7
R10: ffffffffffffffc0 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000401e90 R14: 0000000000401f20 R15: 0000000000000000


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzkaller@...glegroups.com.
Please credit me with: Reported-by: syzbot <syzkaller@...glegroups.com>

syzbot will keep track of this bug report.
Once a fix for this bug is committed, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug  
report.
Note: all commands must start from beginning of the line.

View attachment "config.txt" of type "text/plain" (124357 bytes)

Download attachment "raw.log" of type "application/octet-stream" (11121 bytes)

View attachment "repro.txt" of type "text/plain" (918 bytes)

Download attachment "repro.c" of type "application/octet-stream" (4379 bytes)

Powered by blists - more mailing lists