October 2017 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] ASoC: max98925: Return proper error if revision mismatch
by Axel Lin 13 Oct '17

13 Oct '17

Return proper error instead of 0 if the revision does not match. Signed-off-by: Axel Lin <axel.lin(a)ingics.com> --- sound/soc/codecs/max98925.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/sound/soc/codecs/max98925.c b/sound/soc/codecs/max98925.c index 327eaa25c9bd..921f95fc396d 100644 --- a/sound/soc/codecs/max98925.c +++ b/sound/soc/codecs/max98925.c @@ -579,7 +579,7 @@ static int max98925_i2c_probe(struct i2c_client *i2c, ret = PTR_ERR(max98925->regmap); dev_err(&i2c->dev, "Failed to allocate regmap: %d\n", ret); - goto err_out; + return ret; } if (!of_property_read_u32(i2c->dev.of_node, "vmon-slot-no", &value)) { @@ -596,16 +596,20 @@ static int max98925_i2c_probe(struct i2c_client *i2c, } max98925->i_slot = value; } - ret = regmap_read(max98925->regmap, - MAX98925_REV_VERSION, &reg); - if ((ret < 0) || - ((reg != MAX98925_VERSION) && - (reg != MAX98925_VERSION1))) { - dev_err(&i2c->dev, - "device initialization error (%d 0x%02X)\n", + + ret = regmap_read(max98925->regmap, MAX98925_REV_VERSION, &reg); + if (ret < 0) { + dev_err(&i2c->dev, "Read revision failed\n"); + return ret; + } + + if ((reg != MAX98925_VERSION) && (reg != MAX98925_VERSION1)) { + ret = -ENODEV; + dev_err(&i2c->dev, "Invalid revision (%d 0x%02X)\n", ret, reg); - goto err_out; + return ret; } + dev_info(&i2c->dev, "device version 0x%02X\n", reg); ret = snd_soc_register_codec(&i2c->dev, &soc_codec_dev_max98925, @@ -613,7 +617,6 @@ static int max98925_i2c_probe(struct i2c_client *i2c, if (ret < 0) dev_err(&i2c->dev, "Failed to register codec: %d\n", ret); -err_out: return ret; } -- 2.11.0

2 1

[alsa-devel] [PATCH] ASoC: cht_bsw_max98090_ti: Fix NULL pointer dereference while accessing jack
by Guenter Roeck 12 Oct '17

12 Oct '17

From: Guenter Roeck <groeck(a)chromium.org> Commit f2ed6b07645e ("ASoC: Make aux_dev more like a generic component") caused a regression on this driver, since now a kernel oops is seen when the driver is loaded, or more specifically when ts3a227e_enable_jack_detect() is called. That commit changed the probing of aux_devs before checking new DAI links, so cht_max98090_headset_init is now called before cht_codec_init. The kernel crashes due a NULL pointer dereference in cht_max98090_headset_init since there is a call that tries to access the jack pointer which has not been allocated yet. This patch moves the new jack object creation from cht_codec_init to cht_max98090_headset_init, making sure the jack is created before is accessed. Also see upstream commit 5f22449344d9 ("ASoC: rockchip-max98090: Fix NULL pointer dereference while accessing to jack.") for a similar fix in the rockchip-max98090 driver. Fixes: f2ed6b07645e ("ASoC: Make aux_dev more like a generic component") Cc: Mengdong Lin <mengdong.lin(a)linux.intel.com> Signed-off-by: Guenter Roeck <groeck(a)chromium.org> --- sound/soc/intel/boards/cht_bsw_max98090_ti.c | 55 ++++++++++++++-------------- 1 file changed, 27 insertions(+), 28 deletions(-) diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c index 20755ecc7f9e..c1518db7bb61 100644 --- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c +++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c @@ -111,37 +111,12 @@ static struct notifier_block cht_jack_nb = { static int cht_codec_init(struct snd_soc_pcm_runtime *runtime) { - int ret; - int jack_type; struct cht_mc_private *ctx = snd_soc_card_get_drvdata(runtime->card); - struct snd_soc_jack *jack = &ctx->jack; - - /** - * TI supports 4 butons headset detection - * KEY_MEDIA - * KEY_VOICECOMMAND - * KEY_VOLUMEUP - * KEY_VOLUMEDOWN - */ - if (ctx->ts3a227e_present) - jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE | - SND_JACK_BTN_0 | SND_JACK_BTN_1 | - SND_JACK_BTN_2 | SND_JACK_BTN_3; - else - jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE; - - ret = snd_soc_card_jack_new(runtime->card, "Headset Jack", - jack_type, jack, NULL, 0); - - if (ret) { - dev_err(runtime->dev, "Headset Jack creation failed %d\n", ret); - return ret; - } if (ctx->ts3a227e_present) - snd_soc_jack_notifier_register(jack, &cht_jack_nb); + snd_soc_jack_notifier_register(&ctx->jack, &cht_jack_nb); - return ret; + return 0; } static int cht_codec_fixup(struct snd_soc_pcm_runtime *rtd, @@ -188,8 +163,32 @@ static int cht_max98090_headset_init(struct snd_soc_component *component) { struct snd_soc_card *card = component->card; struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card); + struct snd_soc_jack *jack = &ctx->jack; + int jack_type; + int ret; + + /* + * TI supports 4 butons headset detection + * KEY_MEDIA + * KEY_VOICECOMMAND + * KEY_VOLUMEUP + * KEY_VOLUMEDOWN + */ + if (ctx->ts3a227e_present) + jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE | + SND_JACK_BTN_0 | SND_JACK_BTN_1 | + SND_JACK_BTN_2 | SND_JACK_BTN_3; + else + jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE; + + ret = snd_soc_card_jack_new(card, "Headset Jack", jack_type, jack, + NULL, 0); + if (ret) { + dev_err(card->dev, "Headset Jack creation failed %d\n", ret); + return ret; + } - return ts3a227e_enable_jack_detect(component, &ctx->jack); + return ts3a227e_enable_jack_detect(component, jack); } static const struct snd_soc_ops cht_aif1_ops = { -- 2.7.4

2 1

[alsa-devel] regression introduced by commit 70d435ba1cd6 ("ASoC: imx-pcm-dma: simplify pcm_config")
by Lothar Waßmann 12 Oct '17

12 Oct '17

Hi, the commit 70d435ba1cd6 ("ASoC: imx-pcm-dma: simplify pcm_config") introduced a regression on the Ka-Ro TX series modules (and possibly other hardware as well). The problem is, that this commit restricts the supported sound formats to S24_LE only rather than S16_LE, S24_LE, S20_3LE without the patch. Therefore aplay fails with the following error messages, when trying to play a sound file with S16_LE format: |ALSA lib alsa-lib-1.1.2/src/pcm/pcm_params.c:2162:(snd1_pcm_hw_refine_slave) Slave PCM not usable |aplay: set_params:1204: Broken configuration for this PCM: no configurations available This is with the simple-sound-card driver as well as the imx-sgtl5000 driver. Can someone tell me on what hardware and with what software has this patch been tested? Lothar Waßmann

3 3

[alsa-devel] [PATCH] ASoC: rsnd: add rsnd_kctrl_xxx() macro
by Kuninori Morimoto 12 Oct '17

12 Oct '17

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Current CTU/MIX/DVC are directly using rsnd_kctrl_cfg_m/s to control val etc, but it is difficult to read/understand. And there was no uniformity in access method. This patch adds new rsnd_kctrl_xxx() and implements uniformed access method. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> --- sound/soc/sh/rcar/ctu.c | 80 ++++++++++++++++++++++++------------------------ sound/soc/sh/rcar/dvc.c | 19 ++++++------ sound/soc/sh/rcar/mix.c | 10 +++--- sound/soc/sh/rcar/rsnd.h | 4 +++ 4 files changed, 59 insertions(+), 54 deletions(-) diff --git a/sound/soc/sh/rcar/ctu.c b/sound/soc/sh/rcar/ctu.c index ad07ba8..d201d55 100644 --- a/sound/soc/sh/rcar/ctu.c +++ b/sound/soc/sh/rcar/ctu.c @@ -133,7 +133,7 @@ static void rsnd_ctu_value_init(struct rsnd_dai_stream *io, int i; for (i = 0; i < RSND_MAX_CHANNELS; i++) { - u32 val = ctu->pass.val[i]; + u32 val = rsnd_kctrl_valm(ctu->pass, i); cpmdr |= val << (28 - (i * 4)); @@ -150,44 +150,44 @@ static void rsnd_ctu_value_init(struct rsnd_dai_stream *io, rsnd_mod_write(mod, CTU_SCMDR, scmdr); if (scmdr > 0) { - rsnd_mod_write(mod, CTU_SV00R, ctu->sv0.val[0]); - rsnd_mod_write(mod, CTU_SV01R, ctu->sv0.val[1]); - rsnd_mod_write(mod, CTU_SV02R, ctu->sv0.val[2]); - rsnd_mod_write(mod, CTU_SV03R, ctu->sv0.val[3]); - rsnd_mod_write(mod, CTU_SV04R, ctu->sv0.val[4]); - rsnd_mod_write(mod, CTU_SV05R, ctu->sv0.val[5]); - rsnd_mod_write(mod, CTU_SV06R, ctu->sv0.val[6]); - rsnd_mod_write(mod, CTU_SV07R, ctu->sv0.val[7]); + rsnd_mod_write(mod, CTU_SV00R, rsnd_kctrl_valm(ctu->sv0, 0)); + rsnd_mod_write(mod, CTU_SV01R, rsnd_kctrl_valm(ctu->sv0, 1)); + rsnd_mod_write(mod, CTU_SV02R, rsnd_kctrl_valm(ctu->sv0, 2)); + rsnd_mod_write(mod, CTU_SV03R, rsnd_kctrl_valm(ctu->sv0, 3)); + rsnd_mod_write(mod, CTU_SV04R, rsnd_kctrl_valm(ctu->sv0, 4)); + rsnd_mod_write(mod, CTU_SV05R, rsnd_kctrl_valm(ctu->sv0, 5)); + rsnd_mod_write(mod, CTU_SV06R, rsnd_kctrl_valm(ctu->sv0, 6)); + rsnd_mod_write(mod, CTU_SV07R, rsnd_kctrl_valm(ctu->sv0, 7)); } if (scmdr > 1) { - rsnd_mod_write(mod, CTU_SV10R, ctu->sv1.val[0]); - rsnd_mod_write(mod, CTU_SV11R, ctu->sv1.val[1]); - rsnd_mod_write(mod, CTU_SV12R, ctu->sv1.val[2]); - rsnd_mod_write(mod, CTU_SV13R, ctu->sv1.val[3]); - rsnd_mod_write(mod, CTU_SV14R, ctu->sv1.val[4]); - rsnd_mod_write(mod, CTU_SV15R, ctu->sv1.val[5]); - rsnd_mod_write(mod, CTU_SV16R, ctu->sv1.val[6]); - rsnd_mod_write(mod, CTU_SV17R, ctu->sv1.val[7]); + rsnd_mod_write(mod, CTU_SV10R, rsnd_kctrl_valm(ctu->sv1, 0)); + rsnd_mod_write(mod, CTU_SV11R, rsnd_kctrl_valm(ctu->sv1, 1)); + rsnd_mod_write(mod, CTU_SV12R, rsnd_kctrl_valm(ctu->sv1, 2)); + rsnd_mod_write(mod, CTU_SV13R, rsnd_kctrl_valm(ctu->sv1, 3)); + rsnd_mod_write(mod, CTU_SV14R, rsnd_kctrl_valm(ctu->sv1, 4)); + rsnd_mod_write(mod, CTU_SV15R, rsnd_kctrl_valm(ctu->sv1, 5)); + rsnd_mod_write(mod, CTU_SV16R, rsnd_kctrl_valm(ctu->sv1, 6)); + rsnd_mod_write(mod, CTU_SV17R, rsnd_kctrl_valm(ctu->sv1, 7)); } if (scmdr > 2) { - rsnd_mod_write(mod, CTU_SV20R, ctu->sv2.val[0]); - rsnd_mod_write(mod, CTU_SV21R, ctu->sv2.val[1]); - rsnd_mod_write(mod, CTU_SV22R, ctu->sv2.val[2]); - rsnd_mod_write(mod, CTU_SV23R, ctu->sv2.val[3]); - rsnd_mod_write(mod, CTU_SV24R, ctu->sv2.val[4]); - rsnd_mod_write(mod, CTU_SV25R, ctu->sv2.val[5]); - rsnd_mod_write(mod, CTU_SV26R, ctu->sv2.val[6]); - rsnd_mod_write(mod, CTU_SV27R, ctu->sv2.val[7]); + rsnd_mod_write(mod, CTU_SV20R, rsnd_kctrl_valm(ctu->sv2, 0)); + rsnd_mod_write(mod, CTU_SV21R, rsnd_kctrl_valm(ctu->sv2, 1)); + rsnd_mod_write(mod, CTU_SV22R, rsnd_kctrl_valm(ctu->sv2, 2)); + rsnd_mod_write(mod, CTU_SV23R, rsnd_kctrl_valm(ctu->sv2, 3)); + rsnd_mod_write(mod, CTU_SV24R, rsnd_kctrl_valm(ctu->sv2, 4)); + rsnd_mod_write(mod, CTU_SV25R, rsnd_kctrl_valm(ctu->sv2, 5)); + rsnd_mod_write(mod, CTU_SV26R, rsnd_kctrl_valm(ctu->sv2, 6)); + rsnd_mod_write(mod, CTU_SV27R, rsnd_kctrl_valm(ctu->sv2, 7)); } if (scmdr > 3) { - rsnd_mod_write(mod, CTU_SV30R, ctu->sv3.val[0]); - rsnd_mod_write(mod, CTU_SV31R, ctu->sv3.val[1]); - rsnd_mod_write(mod, CTU_SV32R, ctu->sv3.val[2]); - rsnd_mod_write(mod, CTU_SV33R, ctu->sv3.val[3]); - rsnd_mod_write(mod, CTU_SV34R, ctu->sv3.val[4]); - rsnd_mod_write(mod, CTU_SV35R, ctu->sv3.val[5]); - rsnd_mod_write(mod, CTU_SV36R, ctu->sv3.val[6]); - rsnd_mod_write(mod, CTU_SV37R, ctu->sv3.val[7]); + rsnd_mod_write(mod, CTU_SV30R, rsnd_kctrl_valm(ctu->sv3, 0)); + rsnd_mod_write(mod, CTU_SV31R, rsnd_kctrl_valm(ctu->sv3, 1)); + rsnd_mod_write(mod, CTU_SV32R, rsnd_kctrl_valm(ctu->sv3, 2)); + rsnd_mod_write(mod, CTU_SV33R, rsnd_kctrl_valm(ctu->sv3, 3)); + rsnd_mod_write(mod, CTU_SV34R, rsnd_kctrl_valm(ctu->sv3, 4)); + rsnd_mod_write(mod, CTU_SV35R, rsnd_kctrl_valm(ctu->sv3, 5)); + rsnd_mod_write(mod, CTU_SV36R, rsnd_kctrl_valm(ctu->sv3, 6)); + rsnd_mod_write(mod, CTU_SV37R, rsnd_kctrl_valm(ctu->sv3, 7)); } rsnd_mod_write(mod, CTU_CTUIR, 0); @@ -199,17 +199,17 @@ static void rsnd_ctu_value_reset(struct rsnd_dai_stream *io, struct rsnd_ctu *ctu = rsnd_mod_to_ctu(mod); int i; - if (!ctu->reset.val) + if (!rsnd_kctrl_vals(ctu->reset)) return; for (i = 0; i < RSND_MAX_CHANNELS; i++) { - ctu->pass.val[i] = 0; - ctu->sv0.val[i] = 0; - ctu->sv1.val[i] = 0; - ctu->sv2.val[i] = 0; - ctu->sv3.val[i] = 0; + rsnd_kctrl_valm(ctu->pass, i) = 0; + rsnd_kctrl_valm(ctu->sv0, i) = 0; + rsnd_kctrl_valm(ctu->sv1, i) = 0; + rsnd_kctrl_valm(ctu->sv2, i) = 0; + rsnd_kctrl_valm(ctu->sv3, i) = 0; } - ctu->reset.val = 0; + rsnd_kctrl_vals(ctu->reset) = 0; } static int rsnd_ctu_init(struct rsnd_mod *mod, diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c index 4ef318a..dbe54f0 100644 --- a/sound/soc/sh/rcar/dvc.c +++ b/sound/soc/sh/rcar/dvc.c @@ -73,8 +73,9 @@ static void rsnd_dvc_halt(struct rsnd_mod *mod) rsnd_mod_write(mod, DVC_SWRSR, 0); } -#define rsnd_dvc_get_vrpdr(dvc) (dvc->rup.val << 8 | dvc->rdown.val) -#define rsnd_dvc_get_vrdbr(dvc) (0x3ff - (dvc->volume.val[0] >> 13)) +#define rsnd_dvc_get_vrpdr(dvc) (rsnd_kctrl_vals(dvc->rup) << 8 | \ + rsnd_kctrl_vals(dvc->rdown)) +#define rsnd_dvc_get_vrdbr(dvc) (0x3ff - (rsnd_kctrl_valm(dvc->volume, 0) >> 13)) static void rsnd_dvc_volume_parameter(struct rsnd_dai_stream *io, struct rsnd_mod *mod) @@ -84,12 +85,12 @@ static void rsnd_dvc_volume_parameter(struct rsnd_dai_stream *io, int i; /* Enable Ramp */ - if (dvc->ren.val) + if (rsnd_kctrl_vals(dvc->ren)) for (i = 0; i < RSND_MAX_CHANNELS; i++) - val[i] = dvc->volume.cfg.max; + val[i] = rsnd_kctrl_max(dvc->volume); else for (i = 0; i < RSND_MAX_CHANNELS; i++) - val[i] = dvc->volume.val[i]; + val[i] = rsnd_kctrl_valm(dvc->volume, i); /* Enable Digital Volume */ rsnd_mod_write(mod, DVC_VOL0R, val[0]); @@ -119,7 +120,7 @@ static void rsnd_dvc_volume_init(struct rsnd_dai_stream *io, dvucr |= 0x101; /* Enable Ramp */ - if (dvc->ren.val) { + if (rsnd_kctrl_vals(dvc->ren)) { dvucr |= 0x10; /* @@ -161,10 +162,10 @@ static void rsnd_dvc_volume_update(struct rsnd_dai_stream *io, u32 vrdbr = 0; int i; - for (i = 0; i < dvc->mute.cfg.size; i++) - zcmcr |= (!!dvc->mute.cfg.val[i]) << i; + for (i = 0; i < rsnd_kctrl_size(dvc->mute); i++) + zcmcr |= (!!rsnd_kctrl_valm(dvc->mute, i)) << i; - if (dvc->ren.val) { + if (rsnd_kctrl_vals(dvc->ren)) { vrpdr = rsnd_dvc_get_vrpdr(dvc); vrdbr = rsnd_dvc_get_vrdbr(dvc); } diff --git a/sound/soc/sh/rcar/mix.c b/sound/soc/sh/rcar/mix.c index 912cfec..7998380 100644 --- a/sound/soc/sh/rcar/mix.c +++ b/sound/soc/sh/rcar/mix.c @@ -84,7 +84,7 @@ static void rsnd_mix_halt(struct rsnd_mod *mod) #define rsnd_mix_get_vol(mix, X) \ rsnd_flags_has(mix, HAS_VOL##X) ? \ - (VOL_MAX - mix->volume##X.cfg.val[0]) : 0 + (VOL_MAX - rsnd_kctrl_vals(mix->volume##X)) : 0 static void rsnd_mix_volume_parameter(struct rsnd_dai_stream *io, struct rsnd_mod *mod) { @@ -116,9 +116,9 @@ static void rsnd_mix_volume_init(struct rsnd_dai_stream *io, rsnd_mod_write(mod, MIX_ADINR, rsnd_runtime_channel_after_ctu(io)); /* volume step */ - rsnd_mod_write(mod, MIX_MIXMR, mix->ren.cfg.val[0]); - rsnd_mod_write(mod, MIX_MVPDR, mix->rup.cfg.val[0] << 8 | - mix->rdw.cfg.val[0]); + rsnd_mod_write(mod, MIX_MIXMR, rsnd_kctrl_vals(mix->ren)); + rsnd_mod_write(mod, MIX_MVPDR, rsnd_kctrl_vals(mix->rup) << 8 | + rsnd_kctrl_vals(mix->rdw)); /* common volume parameter */ rsnd_mix_volume_parameter(io, mod); @@ -217,7 +217,7 @@ static int rsnd_mix_pcm_new(struct rsnd_mod *mod, volume, VOL_MAX); if (ret < 0) return ret; - volume->cfg.val[0] = VOL_MAX; + rsnd_kctrl_vals(*volume) = VOL_MAX; if (rsnd_flags_has(mix, ONCE_KCTRL_INITIALIZED)) return ret; diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h index 0d9f9c3..2a224fa 100644 --- a/sound/soc/sh/rcar/rsnd.h +++ b/sound/soc/sh/rcar/rsnd.h @@ -631,6 +631,10 @@ struct rsnd_kctrl_cfg_s { struct rsnd_kctrl_cfg cfg; u32 val; }; +#define rsnd_kctrl_size(x) ((x).cfg.size) +#define rsnd_kctrl_max(x) ((x).cfg.max) +#define rsnd_kctrl_valm(x, i) ((x).val[i]) /* = (x).cfg.val[i] */ +#define rsnd_kctrl_vals(x) ((x).val) /* = (x).cfg.val[0] */ int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io); int rsnd_kctrl_accept_runtime(struct rsnd_dai_stream *io); -- 1.9.1

2 1

[alsa-devel] Pulseaudio say me to report a issue.
by Diniz Bortolotto 12 Oct '17

12 Oct '17

Hi buddies! My name is Diniz and I'm new here in alsa-devel list. I just entered in the list because pulseaudio reported a error in my syslog. I'm running a Slackware 64bits current machine and receive the messages below: pulseaudio[1938]: [alsa-sink-ALC887-VD Analog] alsa-sink.c: ALSA woke us up to write new data to the device, but there was actually nothing to write. pulseaudio[1938]: [alsa-sink-ALC887-VD Analog] alsa-sink.c: Most likely this is a bug in the ALSA driver "snd_hda_intel". Please report this issue to the ALSA developers. pulseaudio[1938]: [alsa-sink-ALC887-VD Analog] alsa-sink.c: We were woken up with POLLOUT set -- however a subsequent snd_pcm_avail() returned 0 or another value < min_avail. I don't know if that is a big deal. Sorry if it is not. I only wanna help. Sorry my poor english. :-) Best Regards, Diniz Bortolotto

1 0

[alsa-devel] Click sound when playing "silence" buffer
by Владимир Мартьянов 11 Oct '17

11 Oct '17

Hello! I'm completely new to ALSA and I tried to do a simply buzzer using it. During the debug I noticed a strange behaviour: I used SND_PCM_FORMAT_S8 format, tried to play the buffer filled with zero bytes and I heard click sound when my program starts and end playing the buffer. When I filled the buffer with 0x80 bytes I didn't hear any clicks. The closer the bytes value to 0x80, the quieter the click is. I tried snd_pcm_format_set_silence() instead of memset() and got clicks too. Why I got them? Does it mean what when I use some formats, the values in buffer for zero output voltage are not 0x00? My source code is in attachment, my sound card is Intel HDA.

1 0

[alsa-devel] [PATCH] ALSA: seq: Fix use-after-free at creating a port
by Takashi Iwai 11 Oct '17

11 Oct '17

There is a potential race window opened at creating and deleting a port via ioctl, as spotted by fuzzing. snd_seq_create_port() creates a port object and returns its pointer, but it doesn't take the refcount, thus it can be deleted immediately by another thread. Meanwhile, snd_seq_ioctl_create_port() still calls the function snd_seq_system_client_ev_port_start() with the created port object that is being deleted, and this triggers use-after-free like: BUG: KASAN: use-after-free in snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] at addr ffff8801f2241cb1 ============================================================================= BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in snd_seq_create_port+0x94/0x9b0 [snd_seq] age=1 cpu=3 pid=4511 ___slab_alloc+0x425/0x460 __slab_alloc+0x20/0x40 kmem_cache_alloc_trace+0x150/0x190 snd_seq_create_port+0x94/0x9b0 [snd_seq] snd_seq_ioctl_create_port+0xd1/0x630 [snd_seq] snd_seq_do_ioctl+0x11c/0x190 [snd_seq] snd_seq_ioctl+0x40/0x80 [snd_seq] do_vfs_ioctl+0x54b/0xda0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x16/0x75 INFO: Freed in port_delete+0x136/0x1a0 [snd_seq] age=1 cpu=2 pid=4717 __slab_free+0x204/0x310 kfree+0x15f/0x180 port_delete+0x136/0x1a0 [snd_seq] snd_seq_delete_port+0x235/0x350 [snd_seq] snd_seq_ioctl_delete_port+0xc8/0x180 [snd_seq] snd_seq_do_ioctl+0x11c/0x190 [snd_seq] snd_seq_ioctl+0x40/0x80 [snd_seq] do_vfs_ioctl+0x54b/0xda0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x16/0x75 Call Trace: [<ffffffff81b03781>] dump_stack+0x63/0x82 [<ffffffff81531b3b>] print_trailer+0xfb/0x160 [<ffffffff81536db4>] object_err+0x34/0x40 [<ffffffff815392d3>] kasan_report.part.2+0x223/0x520 [<ffffffffa07aadf4>] ? snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] [<ffffffff815395fe>] __asan_report_load1_noabort+0x2e/0x30 [<ffffffffa07aadf4>] snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] [<ffffffffa07aa8f0>] ? snd_seq_ioctl_delete_port+0x180/0x180 [snd_seq] [<ffffffff8136be50>] ? taskstats_exit+0xbc0/0xbc0 [<ffffffffa07abc5c>] snd_seq_do_ioctl+0x11c/0x190 [snd_seq] [<ffffffffa07abd10>] snd_seq_ioctl+0x40/0x80 [snd_seq] [<ffffffff8136d433>] ? acct_account_cputime+0x63/0x80 [<ffffffff815b515b>] do_vfs_ioctl+0x54b/0xda0 ..... We may fix this in a few different ways, and in this patch, it's fixed simply by taking the refcount properly at snd_seq_create_port() and letting the caller unref the object after use. Also, there is another potential use-after-free by sprintf() call in snd_seq_create_port(), and this is moved inside the lock. This fix covers CVE-2017-15265. Reported-and-tested-by: Michael23 Yu <ycqzsy(a)gmail.com> Suggested-by: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/seq/seq_clientmgr.c | 6 +++++- sound/core/seq/seq_ports.c | 7 +++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index ea2d0ae85bd3..6c9cba2166d9 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -1259,6 +1259,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg) struct snd_seq_port_info *info = arg; struct snd_seq_client_port *port; struct snd_seq_port_callback *callback; + int port_idx; /* it is not allowed to create the port for an another client */ if (info->addr.client != client->number) @@ -1269,7 +1270,9 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg) return -ENOMEM; if (client->type == USER_CLIENT && info->kernel) { - snd_seq_delete_port(client, port->addr.port); + port_idx = port->addr.port; + snd_seq_port_unlock(port); + snd_seq_delete_port(client, port_idx); return -EINVAL; } if (client->type == KERNEL_CLIENT) { @@ -1290,6 +1293,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg) snd_seq_set_port_info(port, info); snd_seq_system_client_ev_port_start(port->addr.client, port->addr.port); + snd_seq_port_unlock(port); return 0; } diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c index 0a7020c82bfc..d21ece9f8d73 100644 --- a/sound/core/seq/seq_ports.c +++ b/sound/core/seq/seq_ports.c @@ -122,7 +122,9 @@ static void port_subs_info_init(struct snd_seq_port_subs_info *grp) } -/* create a port, port number is returned (-1 on failure) */ +/* create a port, port number is returned (-1 on failure); + * the caller needs to unref the port via snd_seq_port_unlock() appropriately + */ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client, int port) { @@ -151,6 +153,7 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client, snd_use_lock_init(&new_port->use_lock); port_subs_info_init(&new_port->c_src); port_subs_info_init(&new_port->c_dest); + snd_use_lock_use(&new_port->use_lock); num = port >= 0 ? port : 0; mutex_lock(&client->ports_mutex); @@ -165,9 +168,9 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client, list_add_tail(&new_port->list, &p->list); client->num_ports++; new_port->addr.port = num; /* store the port number in the port */ + sprintf(new_port->name, "port-%d", num); write_unlock_irqrestore(&client->ports_lock, flags); mutex_unlock(&client->ports_mutex); - sprintf(new_port->name, "port-%d", num); return new_port; } -- 2.14.2

2 2

[alsa-devel] PCM2902: click/pop sound when it should be silent.
by Theodor van Nahl 11 Oct '17

11 Oct '17

Hello, I do have a Behringer U-PHORIA UMC22 USB soundcard which uses the PCM2902 soundchip. I am using that device with pulseaudio on top and the trouble occurs when I do not use the device. Problem ======= In various intervals, but only when I don't play audio, I do hear a pop or click sound comparable to the sound a power amp does when connecting or disconnecting the power. My Analysis =========== I did watch the usb port using wireshark and the following frame has been the last frame before that sound: Frame 3470: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0 USB URB [Source: host] [Destination: 2.4.0] URB id: 0xffff9522ee93f9c0 URB type: URB_SUBMIT ('S') URB transfer type: URB_CONTROL (0x02) Endpoint: 0x00, Direction: OUT Device: 4 URB bus id: 2 Device setup request: relevant (0) Data: present (0) URB sec: 1507602131 URB usec: 34054 URB status: Operation now in progress (-EINPROGRESS) (-115) URB length [bytes]: 0 Data length [bytes]: 0 [Response in: 3471] Interval: 0 Start frame: 0 Copy of Transfer Flags: 0x00000000 Number of ISO descriptors: 0 URB setup bmRequestType: 0x01 0... .... = Direction: Host-to-device .00. .... = Type: Standard (0x0) ...0 0001 = Recipient: Interface (0x01) bRequest: SET INTERFACE (11) bAlternateSetting: 0 wInterface: 1 wLength: 0 From what I understand from the PCM2902 Manual [0] on page 22 is that the streaming interface gets deactivated (zero bandwith setting) by this frame. If I read the documentation of the PCM2902 correctly that step is not nesessary, the chip suspends itself when no data comes in (p. 26). Reading *linux/sound/usb/endpoint.c* I am convinced that the frame above and its counter part are send by this code and send everytime a first endpoint (pulseaudio, aplay, …) connects and the last endpoint disconnected. Due to that I do believe that this is a bug in the driver used for the pcm2902 chip. References ========== That bug is not unheard of as you can see in [1] and [2] but the workarounds provided in those links I cannot confirm to work. I hope that my analysis is as conclusive for you as they sound to me. From this point I am unsure where to head next and was hoping for help here. So my followup questions are: * What do you believe where and "why there" this should be fixed? * Why is the frame above beeing send to the device? The soundcard does seem to have power after that frame. * Isn't it possible to never set the pcm2902 into "zero bandwith mode"? Greetings, Theodor [0]: http://www.ti.com/product/pcm2902 [1]: https://ubuntuforums.org/showthread.php?t=2292143&p=13345100#post13345100 [2]: https://www.reddit.com/r/linux/comments/3idb1h/clicky_noise_before_and_afte…

1 0

[alsa-devel] [PATCH v2 0/9] sound: Add sanity checks for invalid EPs
by Takashi Iwai 11 Oct '17

11 Oct '17

Hi, this is a revised patch set to cover the codes that may submit URBs containing invalid EPs without validation, which result in the kernel warning from the USB core. The first patch adds a new helper for simplifying the EP check, and the rest applies it at needed places. The original issues were spotted by syzkaller, and I put a few others for covering more similar cases. The only updated code in v2 is about the first patch to add usb_urb_ep_type_check() helper (in addition to tested-by tag from Andrey). Typos were fixed and it's called also from usb_submit_urb() as Greg suggested, too. USB devs: does this look OK now? If yes, and if I get acks, I can take the patches to sound tree. Or I don't mind if you take all to usb tree, too. Or maybe better, I'll prepare an immutable branch based on 4.4.14-rc (rc4 for now) in case you want to pull into both trees. Let me know your wish. thanks, Takashi === Takashi Iwai (9): usb: core: Add a helper function to check the validity of EP type in URB ALSA: bcd2000: Add a sanity check for invalid EPs ALSA: caiaq: Add a sanity check for invalid EPs ALSA: line6: Add a sanity check for invalid EPs ALSA: usb-audio: Add sanity checks for invalid EPs ALSA: usx2y: Add sanity checks for invalid EPs ALSA: hiface: Add sanity checks for invalid EPs ALSA: caiaq: Add yet more sanity checks for invalid EPs ALSA: line6: Add yet more sanity checks for invalid EPs drivers/usb/core/urb.c | 30 ++++++++++++++++++++++++++---- include/linux/usb.h | 2 ++ sound/usb/bcd2000/bcd2000.c | 7 +++++++ sound/usb/caiaq/device.c | 7 +++++++ sound/usb/caiaq/input.c | 9 +++++++++ sound/usb/hiface/pcm.c | 9 +++++++-- sound/usb/line6/driver.c | 30 ++++++++++++++++++++++-------- sound/usb/line6/midi.c | 17 +++++++++++------ sound/usb/midi.c | 38 ++++++++++++++++++++++++++++++-------- sound/usb/usx2y/usbusx2y.c | 8 ++++++++ sound/usb/usx2y/usbusx2yaudio.c | 3 +++ 11 files changed, 132 insertions(+), 28 deletions(-) -- 2.14.2

3 26

[alsa-devel] [PATCH 0/3] ALSA: add snd_card_disconnect_sync()
by Kuninori Morimoto 11 Oct '17

11 Oct '17

Hi Takashi-san, Mark Current ALSA (SoC) might be kernel panic if user unbinds sound driver during playback. > aplay xxx.wav & > echo xxxx > /sys/bus/platform/drivers/xxxx/unbind Main issue is we *can't* skip unbind with return -Exxx, because unbind operation doesn't checks return value from each driver. Thus, we *must* stop driver immediately when unbind. 1) is for ALSA 2) is for ALSA SoC 3) is for Renesas sound driver. I think almost all driver want to have 3) type patch on .remove but this patch-set doesn't care at this point. Please let me know if they should have it. Takashi Iwai (1): 1) ALSA: add snd_card_disconnect_sync() Kuninori Morimoto (2): 2) ASoC: add snd_soc_card_disconnect_sync() 3) ASoC: rsnd: call snd_soc_card_disconnect_sync() when remove include/sound/core.h | 2 ++ include/sound/soc.h | 2 ++ sound/core/init.c | 18 ++++++++++++++++++ sound/core/pcm.c | 4 ++++ sound/soc/sh/rcar/core.c | 2 ++ sound/soc/soc-core.c | 10 ++++++++++ 6 files changed, 38 insertions(+) -- 1.9.1 Best regards --- Kuninori Morimoto

3 8