October 2017 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] ASoC: rsnd: stop all working stream when .remove
by Kuninori Morimoto 11 Oct '17

11 Oct '17

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Driver should stop all working stream when .remove timing. Current Renesas sound driver is assuming that all stream was stopped when .remove but it was wrong. This patch stops all working stream when .remove, otherwise kernel will get damage for example in below case. Special thanks to Truong, Hiep > cd /sys/bus/platform/drivers/rcar_sound > aplay xxx.wav & > echo ec500000.sound > unbind Reported-by: Hiep Cao Minh <cm-hiep(a)jinso.co.jp> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> --- sound/soc/sh/rcar/core.c | 68 ++++++++++++++++++++++++++++++++++-------------- 1 file changed, 48 insertions(+), 20 deletions(-) diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c index 1071332..1bf472f 100644 --- a/sound/soc/sh/rcar/core.c +++ b/sound/soc/sh/rcar/core.c @@ -197,12 +197,6 @@ void rsnd_mod_interrupt(struct rsnd_mod *mod, } } -int rsnd_io_is_working(struct rsnd_dai_stream *io) -{ - /* see rsnd_dai_stream_init/quit() */ - return !!io->substream; -} - int rsnd_runtime_channel_original(struct rsnd_dai_stream *io) { struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); @@ -610,20 +604,24 @@ struct rsnd_dai_stream *rsnd_rdai_to_io(struct rsnd_dai *rdai, return &rdai->capture; } -static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, - struct snd_soc_dai *dai) +int rsnd_io_is_working(struct rsnd_dai_stream *io) +{ + /* see rsnd_dai_stream_init/quit() */ + return !!io->substream; +} + +#define rsnd_io_start(priv, io, sub) rsnd_io_operation(priv, io, sub) +#define rsnd_io_stop(priv, io) rsnd_io_operation(priv, io, NULL) +static int rsnd_io_operation(struct rsnd_priv *priv, + struct rsnd_dai_stream *io, + struct snd_pcm_substream *substream) { - struct rsnd_priv *priv = rsnd_dai_to_priv(dai); - struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); - struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream); int ret; unsigned long flags; spin_lock_irqsave(&priv->lock, flags); - switch (cmd) { - case SNDRV_PCM_TRIGGER_START: - case SNDRV_PCM_TRIGGER_RESUME: + if (substream) { rsnd_dai_stream_init(io, substream); ret = rsnd_dai_call(init, io, priv); @@ -638,9 +636,7 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, if (ret < 0) goto dai_trigger_end; - break; - case SNDRV_PCM_TRIGGER_STOP: - case SNDRV_PCM_TRIGGER_SUSPEND: + } else { ret = rsnd_dai_call(irq, io, priv, 0); ret |= rsnd_dai_call(stop, io, priv); @@ -648,9 +644,6 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, ret |= rsnd_dai_call(quit, io, priv); rsnd_dai_stream_quit(io); - break; - default: - ret = -EINVAL; } dai_trigger_end: @@ -659,6 +652,30 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, return ret; } +static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, + struct snd_soc_dai *dai) +{ + struct rsnd_priv *priv = rsnd_dai_to_priv(dai); + struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); + struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream); + int ret; + + switch (cmd) { + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + ret = rsnd_io_start(priv, io, substream); + break; + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + ret = rsnd_io_stop(priv, io); + break; + default: + ret = -EINVAL; + } + + return ret; +} + static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) { struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); @@ -1477,6 +1494,17 @@ static int rsnd_remove(struct platform_device *pdev) }; int ret = 0, i; + /* + * Stop all working io + */ + for_each_rsnd_dai(rdai, priv, i) { + if (rsnd_io_is_working(&rdai->playback)) + rsnd_io_stop(priv, &rdai->playback); + + if (rsnd_io_is_working(&rdai->capture)) + rsnd_io_stop(priv, &rdai->capture); + } + pm_runtime_disable(&pdev->dev); for_each_rsnd_dai(rdai, priv, i) { -- 1.9.1

3 21

[alsa-devel] [PATCH 0/3] ALSA: add snd_card_disconnect_sync()
by Kuninori Morimoto 11 Oct '17

11 Oct '17

Hi Takashi-san, Mark Current ALSA (SoC) might be kernel panic if user unbinds sound driver during playback. > aplay xxx.wav & > echo xxxx > /sys/bus/platform/drivers/xxxx/unbind Main issue is we *can't* skip unbind with return -Exxx, because unbind operation doesn't checks return value from each driver. Thus, we *must* stop driver immediately when unbind. 1) is for ALSA 2) is for ALSA SoC 3) is for Renesas sound driver. I think almost all driver want to have 3) type patch on .remove but this patch-set doesn't care at this point. Please let me know if they should have it. Takashi Iwai (1): 1) ALSA: add snd_card_disconnect_sync() Kuninori Morimoto (2): 2) ASoC: add snd_soc_card_disconnect_sync() 3) ASoC: rsnd: call snd_soc_card_disconnect_sync() when remove include/sound/core.h | 2 ++ include/sound/soc.h | 2 ++ sound/core/init.c | 18 ++++++++++++++++++ sound/core/pcm.c | 4 ++++ sound/soc/sh/rcar/core.c | 2 ++ sound/soc/soc-core.c | 10 ++++++++++ 6 files changed, 38 insertions(+) -- 1.9.1 Best regards --- Kuninori Morimoto

1 0

[alsa-devel] [PATCH 0/3] ALSA: add snd_card_disconnect_sync()
by Kuninori Morimoto 11 Oct '17

11 Oct '17

Hi Takashi-san, Mark Current ALSA (SoC) might be kernel panic if user unbinds sound driver during playback. > aplay xxx.wav & > echo xxxx > /sys/bus/platform/drivers/xxxx/unbind Main issue is we *can't* skip unbind with return -Exxx, because unbind operation doesn't checks return value from each driver. Thus, we *must* stop driver immediately when unbind. 1) is for ALSA 2) is for ALSA SoC 3) is for Renesas sound driver. I think almost all driver want to have 3) type patch on .remove but this patch-set doesn't care at this point. Please let me know if they should have it. Takashi Iwai (1): 1) ALSA: add snd_card_disconnect_sync() Kuninori Morimoto (2): 2) ASoC: add snd_soc_card_disconnect_sync() 3) ASoC: rsnd: call snd_soc_card_disconnect_sync() when remove include/sound/core.h | 2 ++ include/sound/soc.h | 2 ++ sound/core/init.c | 18 ++++++++++++++++++ sound/core/pcm.c | 4 ++++ sound/soc/sh/rcar/core.c | 2 ++ sound/soc/soc-core.c | 10 ++++++++++ 6 files changed, 38 insertions(+) -- 1.9.1 Best regards --- Kuninori Morimoto

1 0

[alsa-devel] [PATCH 0/9] sound: Add sanity checks for invalid EPs
by Takashi Iwai 10 Oct '17

10 Oct '17

Hi, this is a patchset to cover the codes that may submit URBs containing invalid EPs without validation, which result in the kernel warning from the USB core. The first patch adds a new helper for simplifying the EP check, and the rest applies it at needed places. USB devs: could you check the first patch? I tried usb_find_common_endpoints() and friends at first, but it made the code more complex in the end, because we're dealing with the fixed endpoints and the validation is required for them. The original issues were spotted by syzkaller, and I put a few others for covering more similar cases. thanks, Takashi === Takashi Iwai (9): usb: core: Add a helper function to check the validity of EP type in URB ALSA: bcd2000: Add a sanity check for invalid EPs ALSA: caiaq: Add a sanity check for invalid EPs ALSA: line6: Add a sanity check for invalid EPs ALSA: usb-audio: Add sanity checks for invalid EPs ALSA: usx2y: Add sanity checks for invalid EPs ALSA: hiface: Add sanity checks for invalid EPs ALSA: caiaq: Add yet more sanity checks for invalid EPs ALSA: line6: Add yet more sanity checks for invalid EPs drivers/usb/core/urb.c | 28 +++++++++++++++++++++++++--- include/linux/usb.h | 2 ++ sound/usb/bcd2000/bcd2000.c | 7 +++++++ sound/usb/caiaq/device.c | 7 +++++++ sound/usb/caiaq/input.c | 9 +++++++++ sound/usb/hiface/pcm.c | 9 +++++++-- sound/usb/line6/driver.c | 30 ++++++++++++++++++++++-------- sound/usb/line6/midi.c | 17 +++++++++++------ sound/usb/midi.c | 38 ++++++++++++++++++++++++++++++-------- sound/usb/usx2y/usbusx2y.c | 8 ++++++++ sound/usb/usx2y/usbusx2yaudio.c | 3 +++ 11 files changed, 131 insertions(+), 27 deletions(-) -- 2.14.2

3 14

[alsa-devel] [PATCH 6/8] Documentation: fix sound related doc refs
by Tom Saeger 10 Oct '17

10 Oct '17

Make sound doc refs valid. Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com> --- Documentation/sound/hd-audio/notes.rst | 2 +- Documentation/sound/kernel-api/writing-an-alsa-driver.rst | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/sound/hd-audio/notes.rst b/Documentation/sound/hd-audio/notes.rst index f59c3cdbfaf4..9f7347830ba4 100644 --- a/Documentation/sound/hd-audio/notes.rst +++ b/Documentation/sound/hd-audio/notes.rst @@ -192,7 +192,7 @@ preset model instead of PCI (and codec-) SSID look-up. What ``model`` option values are available depends on the codec chip. Check your codec chip from the codec proc file (see "Codec Proc-File" section below). It will show the vendor/product name of your codec -chip. Then, see Documentation/sound/HD-Audio-Models.rst file, +chip. Then, see Documentation/sound/hd-audio/models.rst file, the section of HD-audio driver. You can find a list of codecs and ``model`` options belonging to each codec. For example, for Realtek ALC262 codec chip, pass ``model=ultra`` for devices that are compatible diff --git a/Documentation/sound/kernel-api/writing-an-alsa-driver.rst b/Documentation/sound/kernel-api/writing-an-alsa-driver.rst index 58ffa3f5bda7..a0b268466cb1 100644 --- a/Documentation/sound/kernel-api/writing-an-alsa-driver.rst +++ b/Documentation/sound/kernel-api/writing-an-alsa-driver.rst @@ -2498,7 +2498,7 @@ Mic boost Mic-boost switch is set as “Mic Boost” or “Mic Boost (6dB)”. More precise information can be found in -``Documentation/sound/alsa/ControlNames.txt``. +``Documentation/sound/designs/control-names.rst``. Access Flags ------------ -- 2.14.2

2 1

[alsa-devel] [PATCH 3/8] Documentation: fix input related doc refs
by Tom Saeger 10 Oct '17

10 Oct '17

Make `input` document refs valid including: - joystick - joystick-parport Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com> --- Documentation/admin-guide/kernel-parameters.txt | 10 +++++----- Documentation/hid/hiddev.txt | 2 +- Documentation/input/devices/xpad.rst | 3 ++- Documentation/sound/cards/joystick.rst | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index e857bbbc8575..411b41127eee 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -314,7 +314,7 @@ amijoy.map= [HW,JOY] Amiga joystick support Map of devices attached to JOY0DAT and JOY1DAT Format: <a>,<b> - See also Documentation/input/joystick.txt + See also Documentation/input/joydev/joystick.rst analog.map= [HW,JOY] Analog joystick and gamepad support Specifies type or capabilities of an analog joystick @@ -724,7 +724,7 @@ db9.dev[2|3]= [HW,JOY] Multisystem joystick support via parallel port (one device per port) Format: <port#>,<type> - See also Documentation/input/joystick-parport.txt + See also Documentation/input/devices/joystick-parport.rst ddebug_query= [KNL,DYNAMIC_DEBUG] Enable debug messages at early boot time. See @@ -1220,7 +1220,7 @@ [HW,JOY] Multisystem joystick and NES/SNES/PSX pad support via parallel port (up to 5 devices per port) Format: <port#>,<pad1>,<pad2>,<pad3>,<pad4>,<pad5> - See also Documentation/input/joystick-parport.txt + See also Documentation/input/devices/joystick-parport.rst gamma= [HW,DRM] @@ -1766,7 +1766,7 @@ ivrs_acpihid[00:14.5]=AMD0020:0 js= [HW,JOY] Analog joystick - See Documentation/input/joystick.txt. + See Documentation/input/joydev/joystick.rst. nokaslr [KNL] When CONFIG_RANDOMIZE_BASE is set, this disables @@ -4199,7 +4199,7 @@ TurboGraFX parallel port interface Format: <port#>,<js1>,<js2>,<js3>,<js4>,<js5>,<js6>,<js7> - See also Documentation/input/joystick-parport.txt + See also Documentation/input/devices/joystick-parport.rst udbg-immortal [PPC] When debugging early kernel crashes that happen after console_init() and before a proper diff --git a/Documentation/hid/hiddev.txt b/Documentation/hid/hiddev.txt index 6e8c9f1d2f22..638448707aa2 100644 --- a/Documentation/hid/hiddev.txt +++ b/Documentation/hid/hiddev.txt @@ -12,7 +12,7 @@ To support these disparate requirements, the Linux USB system provides HID events to two separate interfaces: * the input subsystem, which converts HID events into normal input device interfaces (such as keyboard, mouse and joystick) and a -normalised event interface - see Documentation/input/input.txt +normalised event interface - see Documentation/input/input.rst * the hiddev interface, which provides fairly raw HID events The data flow for a HID event produced by a device is something like diff --git a/Documentation/input/devices/xpad.rst b/Documentation/input/devices/xpad.rst index 5a709ab77c8d..b8bd65962dd8 100644 --- a/Documentation/input/devices/xpad.rst +++ b/Documentation/input/devices/xpad.rst @@ -230,4 +230,5 @@ Historic Edits 2005-03-19 - Dominic Cerquetti <binary1230(a)yahoo.com> - added stuff for dance pads, new d-pad->axes mappings -Later changes may be viewed with 'git log Documentation/input/xpad.txt' +Later changes may be viewed with +'git log --follow Documentation/input/devices/xpad.rst' diff --git a/Documentation/sound/cards/joystick.rst b/Documentation/sound/cards/joystick.rst index a6e468c81d02..488946fc1079 100644 --- a/Documentation/sound/cards/joystick.rst +++ b/Documentation/sound/cards/joystick.rst @@ -11,7 +11,7 @@ General First of all, you need to enable GAMEPORT support on Linux kernel for using a joystick with the ALSA driver. For the details of gameport -support, refer to Documentation/input/joystick.txt. +support, refer to Documentation/input/joydev/joystick.rst. The joystick support of ALSA drivers is different between ISA and PCI cards. In the case of ISA (PnP) cards, it's usually handled by the -- 2.14.2

2 1

[alsa-devel] [RESEND PATCH] ASoC: codecs: msm8916-wcd-digital: fix RX2 MIX1 and RX3 MIX1
by Jean-François Têtu 10 Oct '17

10 Oct '17

The kcontrol for the third input (rxN_mix1_inp3) of both RX2 and RX3 mixers are not using the correct control register. This simple patch fixes this. Signed-off-by: Jean-François Têtu <jean-francois.tetu(a)savoirfairelinux.com> --- sound/soc/codecs/msm8916-wcd-digital.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c index 66df8f810f0d..a10a724eb448 100644 --- a/sound/soc/codecs/msm8916-wcd-digital.c +++ b/sound/soc/codecs/msm8916-wcd-digital.c @@ -238,7 +238,7 @@ static const struct soc_enum rx_mix2_inp1_chain_enum = SOC_ENUM_SINGLE( static const struct soc_enum rx2_mix1_inp_enum[] = { SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 0, 6, rx_mix1_text), SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 3, 6, rx_mix1_text), - SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 0, 6, rx_mix1_text), + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B2_CTL, 0, 6, rx_mix1_text), }; /* RX2 MIX2 */ @@ -249,7 +249,7 @@ static const struct soc_enum rx2_mix2_inp1_chain_enum = SOC_ENUM_SINGLE( static const struct soc_enum rx3_mix1_inp_enum[] = { SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 0, 6, rx_mix1_text), SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 3, 6, rx_mix1_text), - SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 0, 6, rx_mix1_text), + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B2_CTL, 0, 6, rx_mix1_text), }; /* DEC */ -- 2.14.2

2 2

[alsa-devel] usb/sound: use-after-free in snd_usb_mixer_interrupt
by Andrey Konovalov 10 Oct '17

10 Oct '17

Hi! I've got the following report while fuzzing the kernel with syzkaller. On commit 8a5776a5f49812d29fe4b2d0a2d71675c3facf3f (4.14-rc4). gadgetfs: bound to dummy_udc driver usb 1-1: new full-speed USB device number 2 using dummy_hcd gadgetfs: connected gadgetfs: disconnected gadgetfs: connected usb 1-1: config 1 has an invalid interface number: 1 but max is 0 usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 1 usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 usb 1-1: too many endpoints for config 1 interface 1 altsetting 174: 131, using maximum allowed: 30 usb 1-1: config 1 interface 1 altsetting 174 has 0 endpoint descriptors, different from the interface de scriptor's value: 131 usb 1-1: config 1 interface 1 has no altsetting 0 usb 1-1: New USB device found, idVendor=0dba, idProduct=1000 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=252 usb 1-1: SerialNumber: a gadgetfs: configuration #1 hub 1-1:1.0: USB hub found hub 1-1:1.0: config failed, can't read hub descriptor (err -22) snd-usb-audio: probe of 1-1:1.0 failed with error -22 ================================================================== BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0 Read of size 8 at addr ffff8800636f8900 by task swapper/1/0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.14.0-rc4-43418-g43a3f84d2109-dirty #391 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 print_address_description+0x78/0x280 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 kasan_report+0x23d/0x350 mm/kasan/report.c:409 __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430 snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490 __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779 usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845 dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965 call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281 expire_timers kernel/time/timer.c:1320 __run_timers+0x87f/0xd40 kernel/time/timer.c:1620 run_timer_softirq+0x83/0x140 kernel/time/timer.c:1646 __do_softirq+0x2ee/0xc0f kernel/softirq.c:284 invoke_softirq kernel/softirq.c:364 irq_exit+0x171/0x1a0 kernel/softirq.c:405 exiting_irq ./arch/x86/include/asm/apic.h:638 smp_apic_timer_interrupt+0x2b9/0x8d0 arch/x86/kernel/apic/apic.c:1048 apic_timer_interrupt+0x9d/0xb0 </IRQ> RIP: 0010:native_safe_halt+0x6/0x10 ./arch/x86/include/asm/irqflags.h:53 RSP: 0018:ffff88006bac7b90 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: dffffc0000000020 RBX: 1ffff1000d758f76 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88006baa3a64 RBP: ffff88006bac7b90 R08: ffffffff813d5301 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1000d758f82 R13: ffff88006bac7cd0 R14: ffffffff8881ecc8 R15: 0000000000000000 arch_safe_halt ./arch/x86/include/asm/paravirt.h:93 default_idle+0x127/0x690 arch/x86/kernel/process.c:341 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:332 default_idle_call+0x3b/0x60 kernel/sched/idle.c:98 cpuidle_idle_call kernel/sched/idle.c:156 do_idle+0x33a/0x410 kernel/sched/idle.c:246 cpu_startup_entry+0x1d/0x20 kernel/sched/idle.c:351 start_secondary+0x3de/0x500 arch/x86/kernel/smpboot.c:278 secondary_startup_64+0xa5/0xa5 arch/x86/kernel/head_64.S:235 Allocated by task 1484: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772 kmalloc ./include/linux/slab.h:493 kzalloc ./include/linux/slab.h:666 snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540 create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516 snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560 create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59 snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560 usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Freed by task 1484: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524 slab_free_hook mm/slub.c:1390 slab_free_freelist_hook mm/slub.c:1412 slab_free mm/slub.c:2988 kfree+0xf6/0x2f0 mm/slub.c:3919 snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244 snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250 __snd_device_free+0x1ff/0x380 sound/core/device.c:91 snd_device_free_all+0x8f/0xe0 sound/core/device.c:244 snd_card_do_free sound/core/init.c:461 release_card_device+0x47/0x170 sound/core/init.c:181 device_release+0x13f/0x210 drivers/base/core.c:814 kobject_cleanup lib/kobject.c:648 kobject_release lib/kobject.c:677 kref_put ./include/linux/kref.h:70 kobject_put+0x145/0x240 lib/kobject.c:694 put_device+0x25/0x30 drivers/base/core.c:1931 snd_card_free_when_closed sound/core/init.c:489 snd_card_free+0x156/0x220 sound/core/init.c:514 usb_audio_probe+0x1e36/0x2c10 sound/usb/card.c:648 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 The buggy address belongs to the object at ffff8800636f8900 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes inside of 192-byte region [ffff8800636f8900, ffff8800636f89c0) The buggy address belongs to the page: page:ffffea00018dbe00 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x100000000000100(slab) raw: 0100000000000100 0000000000000000 0000000000000000 0000000180100010 raw: ffffea00018dbc00 0000000400000004 ffff88006c003380 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8800636f8800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800636f8880: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc >ffff8800636f8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800636f8980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8800636f8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

2 3

[alsa-devel] [PATCH] ALSA: seq: Add sanity check for user-space pointer delivery
by Takashi Iwai 10 Oct '17

10 Oct '17

The sequencer event may contain a user-space pointer with its SNDRV_SEQ_EXT_USRPTR bit, and we assure that its delivery is limited with non-atomic mode. Otherwise the copy_from_user() may hit the fault and cause a problem. Although the core code doesn't set such a flag (only set at snd_seq_write()), any wild driver may set it mistakenly and lead to an unexpected crash. This patch adds a sanity check of such events at the delivery core code to filter out the invalid invocation in the atomic mode. Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/seq/seq_clientmgr.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 6c9cba2166d9..84759d9c54bf 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -802,6 +802,10 @@ static int snd_seq_deliver_event(struct snd_seq_client *client, struct snd_seq_e return -EMLINK; } + if (snd_seq_ev_is_variable(event) && + snd_BUG_ON(atomic && (event->data.ext.len & SNDRV_SEQ_EXT_USRPTR))) + return -EINVAL; + if (event->queue == SNDRV_SEQ_ADDRESS_SUBSCRIBERS || event->dest.client == SNDRV_SEQ_ADDRESS_SUBSCRIBERS) result = deliver_to_subscribers(client, event, atomic, hop); -- 2.14.2

1 0

[alsa-devel] [PATCH 1/2] ASoC: dapm: add initialization for w_param_text pointer
by Arnd Bergmann 10 Oct '17

10 Oct '17

We now allocate the array conditionally, but we always pass the pointer to the new snd_soc_dapm_free_kcontrol() function, which introduces a warning for the case that it is not initialized: sound/soc/soc-dapm.c: In function 'snd_soc_dapm_new_pcm': sound/soc/soc-dapm.c:3940:2: error: 'w_param_text' may be used uninitialized in this function [-Werror=maybe-uninitialized] As snd_soc_dapm_free_kcontrol() is global, it doesn't get inlined and gcc fails to notice that we don't actually access the array in that case, so the code is actually safe. Adding an initialization for the array pointer shuts up the warning. Fixes: 19ad683abc85 ("ASoC: dapm: Avoid creating kcontrol for params") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> --- sound/soc/soc-dapm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index ceec185c871f..19babdae1a06 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -3905,6 +3905,8 @@ int snd_soc_dapm_new_pcm(struct snd_soc_card *card, ret = -ENOMEM; goto param_fail; } + } else { + w_param_text = NULL; } dev_dbg(card->dev, "ASoC: adding %s widget\n", link_name); -- 2.9.0

2 3

[alsa-devel] [PATCH 0/2 v2] ASoC: soc-core: add missing component functions
by Kuninori Morimoto 10 Oct '17

10 Oct '17

Hi Mark These are v2 of one of "replace to component" patch set. These add missing functions which exist in "platforms" but not exist in "component". Kuninori Morimoto (3): ASoC: soc-core: add component lookup functions ASoC: soc-core: add snd_soc_add_component() ASoC: soc-core: remove unnecessary message from snd_soc_register_component() include/sound/soc.h | 7 +++++++ sound/soc/soc-core.c | 58 ++++++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 54 insertions(+), 11 deletions(-) -- 1.9.1

2 4

[alsa-devel] [bug report] ASoC: Intel: Refactor common IPC/mailbox code into generic APIs
by Dan Carpenter 10 Oct '17

10 Oct '17

Hello Jin Yao, The patch a33c1ec5cf82: "ASoC: Intel: Refactor common IPC/mailbox code into generic APIs" from Apr 7, 2015, leads to the following static checker warning: sound/soc/intel/common/sst-ipc.c:242 sst_ipc_reply_find_msg() error: uninitialized symbol 'mask'. sound/soc/intel/common/sst-ipc.c 226 struct ipc_message *sst_ipc_reply_find_msg(struct sst_generic_ipc *ipc, 227 u64 header) 228 { 229 struct ipc_message *msg; 230 u64 mask; 231 232 if (ipc->ops.reply_msg_match != NULL) 233 header = ipc->ops.reply_msg_match(header, &mask); What should "mask" be initialized to if ops.reply_msg_match is NULL? 234 235 if (list_empty(&ipc->rx_list)) { 236 dev_err(ipc->dev, "error: rx list empty but received 0x%llx\n", 237 header); 238 return NULL; 239 } 240 241 list_for_each_entry(msg, &ipc->rx_list, list) { 242 if ((msg->header & mask) == header) ^^^^^^^^^^^^^^^^^^ Used uninitialized here. 243 return msg; 244 } 245 246 return NULL; 247 } regards, dan carpenter

1 0

[alsa-devel] [pull] amdgpu pre-reqs for stoney ACP audio support
by Alex Deucher 10 Oct '17

10 Oct '17

Hi Dave, Mark, This branch against Linus' master contains the 3 pre-requisite patches for Stoney ACP audio. Mark needs these patches to apply the rest of the Stoney ACP patch set on the audio side. Please pull. Thanks! The following changes since commit 68ebe3cbe786a954481d6ded0dc83f7d551640bf: Merge tag 'nfs-for-4.14-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs (2017-10-09 10:55:37 -0700) are available in the git repository at: git://people.freedesktop.org/~agd5f/linux linus-acp-prereq for you to fetch changes up to 1e4448648333a8fb7830a7a4b76c86e160a79b1e: drm/amdgpu Moving amdgpu asic types to a separate file (2017-10-09 17:54:24 -0400) ---------------------------------------------------------------- Akshu Agrawal (1): drm/amdgpu Moving amdgpu asic types to a separate file Vijendar Mukunda (2): drm/amd/amdgpu: Added asic_type as ACP DMA driver platform data ASoC: AMD: Added asic_type as ACP DMA driver platform data drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 ++ drivers/gpu/drm/amd/include/amd_shared.h | 29 ++---------------- include/drm/amd_asic_type.h | 52 ++++++++++++++++++++++++++++++++ sound/soc/amd/acp-pcm-dma.c | 8 ++--- sound/soc/amd/acp.h | 7 +++++ 5 files changed, 65 insertions(+), 33 deletions(-) create mode 100644 include/drm/amd_asic_type.h

1 0

[alsa-devel] [PATCH v2] ALSA: seq: resize buffer for overflow
by Mark Salyzyn 09 Oct '17

09 Oct '17

Can not replicate, issue discovered in fuzzing. Stack trace below. No functional or performance testing done regarding the fix. Trap at (reformatted): snd_seq_oss_readq_puts(struct seq_oss_readq *q, int dev, unsigned char *data, int len) { union evrec rec; int result; memset(&rec, 0, sizeof(rec)); rec.c[0] = SEQ_MIDIPUTC; rec.c[2] = dev; while (len-- > 0) { rec.c[1] = *data++; // data is RBX HERE 'data' pointer just passed a page boundary, so the buffer supplied was short. Caller must have been handed an ev->type equal to SNDDRV_SEQ_EVENT_SYSEX, which resulted in handing off ev->data.ext.ptr[ev->data.ext.len] buffer. Intuited that the source of the event and buffer was referenced in snd_midi_event_encode_byte() passing a larger length than the allocated buffer. BUG: unable to handle kernel paging request at ffffc900008ab000 IP: [<ffffffff82e2fc05>] snd_seq_oss_readq_puts+0xd5/0x170 sound/core/seq/oss/seq_oss_readq.c:112 PGD 1da091067 PUD 1da092067 Oops: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 3264 Comm: XXXXXXXX Hardware name: XXXXXXXXXX task: ffff8801cdd9e000 task.stack: ffff8801ce648000 RIP: 0010:[<ffffffff82e2fc05>] [<ffffffff82e2fc05>] snd_seq_oss_readq_puts+0xd5/0x170 sound/core/seq/oss/seq_oss_readq.c:112 RSP: 0018:ffff8801ce64f1c0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffc900008ab000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff858e5780 RBP: ffff8801ce64f260 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 1ffff10039cc9df2 R12: 000000003fffffa4 R13: dffffc0000000000 R14: ffff8801ce64f238 R15: ffffc900008ab001 FS: 00007fe3d3d9e700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900008ab000 CR3: 00000001d19b7000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 1ffff10039cc9e3b ffff8801ce64f1f8 ffff8801d0b9aa00 0000000041b58ab3 ffffffff841daf3c ffffffff82e2fb30 0000000000000286 0000000000000005 ffffffff838aa5d5 ffffffff861962c0 dffffc0000000000 ffff8801ce64f260 Call Trace: [<ffffffff82e2ebbe>] send_midi_event sound/core/seq/oss/seq_oss_midi.c:616 [inline] [<ffffffff82e2ebbe>] snd_seq_oss_midi_input+0x8ce/0xa70 sound/core/seq/oss/seq_oss_midi.c:535 [<ffffffff82e2758d>] snd_seq_oss_event_input+0x15d/0x220 sound/core/seq/oss/seq_oss_event.c:439 [<ffffffff82e0b650>] snd_seq_deliver_single_event.constprop.11+0x310/0x7c0 sound/core/seq/seq_clientmgr.c:621 [<ffffffff82e0be16>] deliver_to_subscribers sound/core/seq/seq_clientmgr.c:676 [inline] [<ffffffff82e0be16>] snd_seq_deliver_event+0x316/0x740 sound/core/seq/seq_clientmgr.c:807 [<ffffffff82e0cf9e>] snd_seq_kernel_client_dispatch+0x11e/0x150 sound/core/seq/seq_clientmgr.c:2314 [<ffffffff82e31775>] dummy_input+0x235/0x320 sound/core/seq/seq_dummy.c:104 [<ffffffff82e0b650>] snd_seq_deliver_single_event.constprop.11+0x310/0x7c0 sound/core/seq/seq_clientmgr.c:621 [<ffffffff82e0bc2d>] snd_seq_deliver_event+0x12d/0x740 sound/core/seq/seq_clientmgr.c:818 [<ffffffff82e0d0ed>] snd_seq_dispatch_event+0x11d/0x520 sound/core/seq/seq_clientmgr.c:892 [<ffffffff82e1117e>] snd_seq_check_queue.part.3+0x38e/0x510 sound/core/seq/seq_queue.c:285 [<ffffffff82e11d8d>] snd_seq_check_queue sound/core/seq/seq_queue.c:357 [inline] [<ffffffff82e11d8d>] snd_seq_enqueue_event+0x32d/0x3d0 sound/core/seq/seq_queue.c:363 [<ffffffff82e0c444>] snd_seq_client_enqueue_event+0x204/0x3e0 sound/core/seq/seq_clientmgr.c:951 [<ffffffff82e0cc55>] kernel_client_enqueue.part.10+0xb5/0xd0 sound/core/seq/seq_clientmgr.c:2251 [<ffffffff82e0cd3f>] kernel_client_enqueue sound/core/seq/seq_clientmgr.c:2241 [inline] [<ffffffff82e0cd3f>] snd_seq_kernel_client_enqueue_blocking+0xcf/0x110 sound/core/seq/seq_clientmgr.c:2279 [<ffffffff82e27f68>] insert_queue sound/core/seq/oss/seq_oss_rw.c:189 [inline] [<ffffffff82e27f68>] snd_seq_oss_write+0x538/0x850 sound/core/seq/oss/seq_oss_rw.c:148 [<ffffffff82e1fab4>] odev_write+0x64/0x90 sound/core/seq/oss/seq_oss.c:177 [<ffffffff8156ab43>] __vfs_write+0x103/0x680 fs/read_write.c:510 [<ffffffff8156ec70>] vfs_write+0x170/0x4e0 fs/read_write.c:560 [<ffffffff81572669>] SYSC_write fs/read_write.c:607 [inline] [<ffffffff81572669>] SyS_write+0xd9/0x1b0 fs/read_write.c:599 [<ffffffff838aad85>] entry_SYSCALL_64_fastpath+0x23/0xc6 Code: 4d 9a eb 4e e8 2d aa 53 fe 4c 8d 7b 01 48 89 d8 48 89 d9 48 c1 e8 03 83 e1 07 42 0f b6 04 28 38 c8 7f 08 84 c0 0f 85 80 00 00 00 <41> 0f b6 47 ff 41 83 ec 01 48 8b b5 68 ff ff ff 48 8b bd 70 ff RIP [<ffffffff82e2fc05>] snd_seq_oss_readq_puts+0xd5/0x170 sound/core/seq/oss/seq_oss_readq.c:112 RSP <ffff8801ce64f1c0> CR2: ffffc900008ab000 Signed-off-by: Mark Salyzyn <salyzyn(a)android.com> v2: removed nested locks in snd_midi_event_resize_buffer --- sound/core/seq/seq_midi_event.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/sound/core/seq/seq_midi_event.c b/sound/core/seq/seq_midi_event.c index 90bbbdbeba03..ed3206ef0cd4 100644 --- a/sound/core/seq/seq_midi_event.c +++ b/sound/core/seq/seq_midi_event.c @@ -192,8 +192,7 @@ EXPORT_SYMBOL(snd_midi_event_no_status); /* * resize buffer */ -#if 0 -int snd_midi_event_resize_buffer(struct snd_midi_event *dev, int bufsize) +static int snd_midi_event_resize_buffer(struct snd_midi_event *dev, int bufsize) { unsigned char *new_buf, *old_buf; unsigned long flags; @@ -203,16 +202,13 @@ int snd_midi_event_resize_buffer(struct snd_midi_event *dev, int bufsize) new_buf = kmalloc(bufsize, GFP_KERNEL); if (new_buf == NULL) return -ENOMEM; - spin_lock_irqsave(&dev->lock, flags); old_buf = dev->buf; dev->buf = new_buf; dev->bufsize = bufsize; reset_encode(dev); - spin_unlock_irqrestore(&dev->lock, flags); kfree(old_buf); return 0; } -#endif /* 0 */ /* * read bytes and encode to sequencer event if finished @@ -297,6 +293,8 @@ int snd_midi_event_encode_byte(struct snd_midi_event *dev, int c, } else if (dev->type == ST_SYSEX) { if (c == MIDI_CMD_COMMON_SYSEX_END || dev->read >= dev->bufsize) { + if (dev->read > dev->bufsize) + snd_midi_event_resize_buffer(dev, dev->read); ev->flags &= ~SNDRV_SEQ_EVENT_LENGTH_MASK; ev->flags |= SNDRV_SEQ_EVENT_LENGTH_VARIABLE; ev->type = SNDRV_SEQ_EVENT_SYSEX; -- 2.14.2.920.gcf0c67979c-goog

2 2

[alsa-devel] usb/sound/line6: trying to register non-static key in podhd_disconnect
by Andrey Konovalov 09 Oct '17

09 Oct '17

Hi! I've got the following report while fuzzing the kernel with syzkaller. On commit e19b205be43d11bff638cad4487008c48d21c103 (4.14-rc2). INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 1 PID: 1845 Comm: kworker/1:2 Not tainted 4.14.0-rc2-42613-g1488251d1a98 #238 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 register_lock_class+0x6c4/0x1a00 kernel/locking/lockdep.c:769 __lock_acquire+0x27e/0x4550 kernel/locking/lockdep.c:3385 lock_acquire+0x259/0x620 kernel/locking/lockdep.c:4002 del_timer_sync+0x12c/0x280 kernel/time/timer.c:1237 podhd_disconnect+0x8c/0x160 sound/usb/line6/podhd.c:299 line6_probe+0x844/0x1310 sound/usb/line6/driver.c:783 podhd_probe+0x64/0x70 sound/usb/line6/podhd.c:474 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

2 7

[alsa-devel] [PATCH] ASoC: Intel: cht_bsw_max98090: remove useless code, align with ChromeOS driver
by Pierre-Louis Bossart 09 Oct '17

09 Oct '17

Remove dead code which was missed in previous changes. This is not visible with git diff but there is a test+return on the same condition just above. Also reuse local variable instead of fetching the jack information twice. Tested on Acer R11 (cyan) Fixes: 3bbda5a38601 ('ASoC: Intel: cht_bsw_max98090_ti: Fix jack initialization') Cc: Thierry Escande <thierry.escande(a)collabora.com> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> --- sound/soc/intel/boards/cht_bsw_max98090_ti.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c index 74c047a4b05c..119da5503fee 100644 --- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c +++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c @@ -219,10 +219,6 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime) return ret; } - - if (ctx->ts3a227e_present) - snd_soc_jack_notifier_register(jack, &cht_jack_nb); - ret = snd_soc_jack_add_gpiods(runtime->card->dev->parent, jack, ARRAY_SIZE(hs_jack_gpios), hs_jack_gpios); @@ -323,7 +319,7 @@ static int cht_max98090_headset_init(struct snd_soc_component *component) return ret; } - return ts3a227e_enable_jack_detect(component, &ctx->jack); + return ts3a227e_enable_jack_detect(component, jack); } static const struct snd_soc_ops cht_aif1_ops = { -- 2.11.0

3 2

[alsa-devel] [BUG] sound/core/seq: A possible sleep-in-atomic bug in snd_virmidi_dev_receive_event
by Jia-Ju Bai 09 Oct '17

09 Oct '17

According to seq_virmidi.c, the driver may sleep under a read spinlock. The function call path is: snd_virmidi_dev_receive_event (acquire the spinlock) snd_seq_dump_var_event copy_from_user --> may sleep This bug is found by my static analysis tool and my code review. Thanks, Jia-Ju Bai

2 1

[alsa-devel] Applied "ASoC: cygnus: Remove unnecessary active_slots check" to the asoc tree
by Mark Brown 09 Oct '17

09 Oct '17

The patch ASoC: cygnus: Remove unnecessary active_slots check has been applied to the asoc tree at git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark >From 4c75968a1bbfb3f190e2e624c83929451e4730ac Mon Sep 17 00:00:00 2001 From: Christos Gkekas <chris.gekas(a)gmail.com> Date: Sun, 8 Oct 2017 19:20:30 +0100 Subject: [PATCH] ASoC: cygnus: Remove unnecessary active_slots check Variable active_slots is unsigned so checking whether it is less than zero is not necessary. Signed-off-by: Christos Gkekas <chris.gekas(a)gmail.com> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- sound/soc/bcm/cygnus-ssp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/bcm/cygnus-ssp.c b/sound/soc/bcm/cygnus-ssp.c index cd8aef8ed8a5..abafadc0b534 100644 --- a/sound/soc/bcm/cygnus-ssp.c +++ b/sound/soc/bcm/cygnus-ssp.c @@ -986,7 +986,7 @@ static int cygnus_set_dai_tdm_slot(struct snd_soc_dai *cpu_dai, active_slots = hweight32(tx_mask); - if ((active_slots < 0) || (active_slots > 16)) + if (active_slots > 16) return -EINVAL; /* Slot value must be even */ -- 2.14.1

1 0

[alsa-devel] [PATCH] ASoC: img-parallel-out: Check pm_runtime_get_sync return code
by Ed Blake 09 Oct '17

09 Oct '17

Check the the pm_runtime_get_sync return code and return if an error. Signed-off-by: Ed Blake <ed.blake(a)sondrel.com> --- sound/soc/img/img-parallel-out.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c index 2fc8a6372206..acc005217be0 100644 --- a/sound/soc/img/img-parallel-out.c +++ b/sound/soc/img/img-parallel-out.c @@ -153,6 +153,7 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) { struct img_prl_out *prl = snd_soc_dai_get_drvdata(dai); u32 reg, control_set = 0; + int ret; switch (fmt & SND_SOC_DAIFMT_INV_MASK) { case SND_SOC_DAIFMT_NB_NF: @@ -164,7 +165,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) return -EINVAL; } - pm_runtime_get_sync(prl->dev); + ret = pm_runtime_get_sync(prl->dev); + if (ret < 0) + return ret; + reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL); reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set; img_prl_out_writel(prl, reg, IMG_PRL_OUT_CTL); -- 2.11.0

2 1

[alsa-devel] [PATCH v2 0/2] ASoC: img-i2s-in: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-i2s-in driver. The first patch adds system PM suspend / resume handling and the second patch adds runtime PM. Changes in v2: - Changed from ASoC specific pm callbacks to device ones - Errors returned from pm_runtime_get_sync are now handled Ed Blake (2): ASoC: img-i2s-in: Add suspend / resume handling ASoC: img-i2s-in: Add runtime PM sound/soc/img/img-i2s-in.c | 130 ++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 118 insertions(+), 12 deletions(-) -- 2.11.0

2 4

[alsa-devel] [PATCH v2 0/2] ASoC: img-i2s-out: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-i2s-out driver. The first patch adds system PM suspend / resume handling and the second patch adds control of the sys clock to runtime PM. Changes in v2: - Changed from ASoC specific pm callbacks to device ones - Errors returned from pm_runtime_get_sync are now handled Ed Blake (2): ASoC: img-i2s-out: Add suspend / resume handling ASoC: img-i2s-out: Add control of sys clock to runtime PM sound/soc/img/img-i2s-out.c | 108 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 85 insertions(+), 23 deletions(-) -- 2.11.0

2 4

[alsa-devel] [PATCH v2 0/2] ASoC: img-spdif-in: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-spdif-in driver. The first patch adds system PM suspend / resume handling and the second patch adds runtime PM. Changes in v2: - Changed from ASoC specific pm callbacks to device ones Ed Blake (2): ASoC: img-spdif-in: Add suspend / resume handling ASoC: img-spdif-in: Add runtime PM sound/soc/img/img-spdif-in.c | 110 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 99 insertions(+), 11 deletions(-) -- 2.11.0

2 4

[alsa-devel] [PATCH v2 0/2] dma: img-spdif-out: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-spdif-out driver. The first patch adds system PM suspend / resume handling and the second patch adds control of the sys clock to runtime PM. Changes in v2: - Changed from ASoC specific pm callbacks to device ones Ed Blake (2): ASoC: img-spdif-out: Add suspend / resume handling ASoC: img-spdif-out: Add control of sys clock to runtime PM sound/soc/img/img-spdif-out.c | 73 +++++++++++++++++++++++++++++++++++-------- 1 file changed, 60 insertions(+), 13 deletions(-) -- 2.11.0

2 3

[alsa-devel] [PATCH 0/3] dma: img-spdif-out: Add power management
by Ed Blake 09 Oct '17

09 Oct '17

This patch set adds power managment to the img-spdif-out driver. The first patch renames existing 'suspend' and 'resume' functions to 'runtime_suspend' and 'runtime_resume', which is what they actually are, the second patch adds system PM suspend / resume handling and the third patch adds control of the sys clock to runtime PM. Ed Blake (3): ASoC: img-spdif-out: Rename suspend / resume funcs ASoC: img-spdif-out: Add suspend / resume handling ASoC: img-spdif-out: Add control of sys clock to runtime PM sound/soc/img/img-spdif-out.c | 89 +++++++++++++++++++++++++++++++++---------- 1 file changed, 68 insertions(+), 21 deletions(-) -- 1.9.1

2 7

[alsa-devel] [PATCH] sound/soc: fix typos in Kconfig (trivial)
by Nik Nyby 09 Oct '17

09 Oct '17

This fixes a few typos in the snd_designware description. Signed-off-by: Nik Nyby <nikolas(a)gnu.org> --- sound/soc/dwc/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/dwc/Kconfig b/sound/soc/dwc/Kconfig index c6fd95fa5ca6..aa0c6ec4d93c 100644 --- a/sound/soc/dwc/Kconfig +++ b/sound/soc/dwc/Kconfig @@ -4,8 +4,8 @@ config SND_DESIGNWARE_I2S select SND_SOC_GENERIC_DMAENGINE_PCM help Say Y or M if you want to add support for I2S driver for - Synopsys desigwnware I2S device. The device supports upto - maximum of 8 channels each for play and record. + Synopsys designware I2S device. The device supports up to + a maximum of 8 channels each for play and record. config SND_DESIGNWARE_PCM bool "PCM PIO extension for I2S driver" -- 2.14.2

2 2