April 2018 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH v3 0/3] ALSA: usb-audio: Minor refactoring and UAC3 fix
by Takashi Iwai 07 Apr '18

07 Apr '18

Hi, this is a v3 patchset, addressing the silly mistakes in validator functions in the previous patchset. Takashi === v1->v2: Rename the helper function to be more specific Make validators to check sizes more strictly v2->v3: Fix clock selector validator v2 and v3 as suggested by Ruslan Takashi Iwai (3): ALSA: usb-audio: Refactor clock finder helpers ALSA: usb-audio: More strict sanity checks for clock parsers ALSA: usb-audio: Add sanity checks in UAC3 clock parsers sound/usb/clock.c | 128 +++++++++++++++++++++++------------------------------- 1 file changed, 54 insertions(+), 74 deletions(-) -- 2.16.2

2 9

[alsa-devel] [PATCH] ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation
by Takashi Iwai 07 Apr '18

07 Apr '18

The commit 02a5d6925cd3 ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write") split the PCM preparation code to a locked version, and it added a sanity check of runtime->oss.prepare flag along with the change. This leaded to an endless loop when the stream gets XRUN: namely, snd_pcm_oss_write3() and co call snd_pcm_oss_prepare() without setting runtime->oss.prepare flag and the loop continues until the PCM state reaches to another one. As the function is supposed to execute the preparation unconditionally, drop the invalid state check there. The bug was triggered by syzkaller. Fixes: 02a5d6925cd3 ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write") Reported-by: syzbot+7e3f31a52646f939c052(a)syzkaller.appspotmail.com Reported-by: syzbot+4f2016cf5185da7759dc(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/oss/pcm_oss.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 481ab0e94ffa..727647755aab 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1128,13 +1128,12 @@ static int snd_pcm_oss_get_active_substream(struct snd_pcm_oss_file *pcm_oss_fil } /* call with params_lock held */ +/* NOTE: this doesn't care whether runtime->oss.prepare is set or not */ static int snd_pcm_oss_prepare(struct snd_pcm_substream *substream) { int err; struct snd_pcm_runtime *runtime = substream->runtime; - if (!runtime->oss.prepare) - return 0; err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_PREPARE, NULL); if (err < 0) { pcm_dbg(substream->pcm, -- 2.16.3

1 0

[alsa-devel] Procedure for alsa modules compilation from git
by Pavel Hofman 07 Apr '18

07 Apr '18

Hi, May I ask for description/link describing current working compilation of alsa modules from git? I would like to compile only alsa modules, against my stock ubuntu kernel. Headers/sources in /usr/src, configured to current configuration from /boot/config... What is the oldest kernel to compile against (isch)? Would 4.4 work? I would like to make a small patch for ice1724, test, and send here for review/inclusion. I very much appreciate any help. I think it would be useful to many other occasional devels. Thanks a lot, Pavel.

2 2

[alsa-devel] [PATCH] usb: audio-v2: Correct the comment for struct uac_clock_selector_descriptor
by Takashi Iwai 06 Apr '18

06 Apr '18

The comment in UAC2 clock selector descriptor definition mentions the bAssocTerminal after baCSourceID[], but it doesn't exist in the actual definition. Let's correct it. Fixes: 5dd360ebd832 ("include/linux/usb/audio-v2.h: add more UAC2 details") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- include/linux/usb/audio-v2.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/usb/audio-v2.h b/include/linux/usb/audio-v2.h index aaafecf073ff..49699255cfd3 100644 --- a/include/linux/usb/audio-v2.h +++ b/include/linux/usb/audio-v2.h @@ -94,7 +94,7 @@ struct uac_clock_selector_descriptor { __u8 bClockID; __u8 bNrInPins; __u8 baCSourceID[]; - /* bmControls, bAssocTerminal and iClockSource omitted */ + /* bmControls and iClockSource omitted */ } __attribute__((packed)); /* 4.7.2.3 Clock Multiplier Descriptor */ -- 2.16.3

1 0

[alsa-devel] [PATCH v2] ASoC: wm8350: remove snd_soc_codec
by Kuninori Morimoto 06 Apr '18

06 Apr '18

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> codec is replace to component. It seems no-one is using it, Let's remove it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Acked-by: Charles Keepax <ckeepax(a)opensource.cirrus.com> --- v1 -> v2 - added Charles's Acked-by include/linux/mfd/wm8350/audio.h | 3 --- 1 file changed, 3 deletions(-) diff --git a/include/linux/mfd/wm8350/audio.h b/include/linux/mfd/wm8350/audio.h index bd581c6..0bc41c4c 100644 --- a/include/linux/mfd/wm8350/audio.h +++ b/include/linux/mfd/wm8350/audio.h @@ -617,11 +617,8 @@ struct wm8350_audio_platform_data { u32 codec_current_charge:2; /* codec current @ vmid charge */ }; -struct snd_soc_codec; - struct wm8350_codec { struct platform_device *pdev; - struct snd_soc_codec *codec; struct wm8350_audio_platform_data *platform_data; }; -- 1.9.1

1 0

[alsa-devel] KASAN: use-after-free Read in snd_pcm_timer_resolution
by syzbot 05 Apr '18

05 Apr '18

Hello, syzbot hit the following crash on upstream commit 0b412605ef5f5c64b31f19e2910b1d5eba9929c3 (Thu Mar 29 01:07:23 2018 +0000) Merge tag 'drm-fixes-for-v4.16-rc8' of git://people.freedesktop.org/~airlied/linux syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=8e62ff4e07aa2ce87826 So far this crash happened 3 times on upstream. C reproducer: https://syzkaller.appspot.com/x/repro.c?id=6219387178582016 syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=5176598244360192 Raw console output: https://syzkaller.appspot.com/x/log.txt?id=5815694612496384 Kernel config: https://syzkaller.appspot.com/x/.config?id=-8440362230543204781 compiler: gcc (GCC) 7.1.1 20170620 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+8e62ff4e07aa2ce87826(a)syzkaller.appspotmail.com It will help syzbot understand when the bug is fixed. See footer for details. If you forward the report, please keep this part and the footer. ================================================================== BUG: KASAN: use-after-free in snd_pcm_timer_resolution+0xa3/0xc0 sound/core/pcm_timer.c:72 Read of size 4 at addr ffff8801bdd58490 by task syzkaller702213/13238 CPU: 0 PID: 13238 Comm: syzkaller702213 Not tainted 4.16.0-rc7+ #370 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x23c/0x360 mm/kasan/report.c:412 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432 snd_pcm_timer_resolution+0xa3/0xc0 sound/core/pcm_timer.c:72 snd_timer_resolution sound/core/timer.c:439 [inline] snd_timer_notify1+0x10f/0x400 sound/core/timer.c:462 snd_timer_start1+0x586/0x8f0 sound/core/timer.c:522 snd_timer_start+0x5d/0xa0 sound/core/timer.c:634 snd_timer_user_start.isra.12+0xde/0x130 sound/core/timer.c:1878 snd_timer_user_continue sound/core/timer.c:1902 [inline] __snd_timer_user_ioctl+0x1771/0x2c10 sound/core/timer.c:1977 snd_timer_user_ioctl+0x5f/0x7d sound/core/timer.c:1992 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x4453c9 RSP: 002b:00007ffd46abffe8 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004453c9 RDX: 00000000004453c9 RSI: 00000000000054a2 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000046ac0168 R09: 0000000046ac0168 R10: 0000000046ac0168 R11: 0000000000000217 R12: 00000000000142ea R13: 0000000000402c90 R14: 00000000006d1440 R15: 0000000000000000 Allocated by task 13234: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:552 kmem_cache_alloc_trace+0x136/0x740 mm/slab.c:3608 kmalloc include/linux/slab.h:512 [inline] kzalloc include/linux/slab.h:701 [inline] snd_pcm_attach_substream+0x3c5/0xb60 sound/core/pcm.c:1006 snd_pcm_open_substream+0x95/0x3b0 sound/core/pcm_native.c:2372 snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2309 [inline] snd_pcm_oss_open+0x7cf/0x1540 sound/core/oss/pcm_oss.c:2391 soundcore_open+0x321/0x630 sound/sound_core.c:597 chrdev_open+0x257/0x730 fs/char_dev.c:417 do_dentry_open+0x667/0xd40 fs/open.c:752 vfs_open+0x107/0x220 fs/open.c:866 do_last fs/namei.c:3379 [inline] path_openat+0x1151/0x3530 fs/namei.c:3519 do_filp_open+0x25b/0x3b0 fs/namei.c:3554 do_sys_open+0x502/0x6d0 fs/open.c:1059 SYSC_openat fs/open.c:1086 [inline] SyS_openat+0x30/0x40 fs/open.c:1080 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 13234: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:520 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:527 __cache_free mm/slab.c:3486 [inline] kfree+0xd9/0x260 mm/slab.c:3801 snd_pcm_detach_substream+0x134/0x290 sound/core/pcm.c:1057 snd_pcm_release_substream.part.44+0x23d/0x300 sound/core/pcm_native.c:2361 snd_pcm_release_substream+0x59/0x70 sound/core/pcm_native.c:2362 snd_pcm_oss_release_file.part.18+0x71/0xa0 sound/core/oss/pcm_oss.c:2268 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2263 [inline] snd_pcm_oss_release+0x104/0x280 sound/core/oss/pcm_oss.c:2448 __fput+0x327/0x7e0 fs/file_table.c:209 ____fput+0x15/0x20 fs/file_table.c:243 task_work_run+0x199/0x270 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x9bb/0x1ad0 kernel/exit.c:865 do_group_exit+0x149/0x400 kernel/exit.c:968 SYSC_exit_group kernel/exit.c:979 [inline] SyS_exit_group+0x1d/0x20 kernel/exit.c:977 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff8801bdd58180 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 784 bytes inside of 2048-byte region [ffff8801bdd58180, ffff8801bdd58980) The buggy address belongs to the page: page:ffffea0006f75600 count:1 mapcount:0 mapping:ffff8801bdd58180 index:0x0 compound_mapcount: 0 flags: 0x2fffc0000008100(slab|head) raw: 02fffc0000008100 ffff8801bdd58180 0000000000000000 0000000100000003 raw: ffffea0007330d20 ffffea0007268aa0 ffff8801dac00c40 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801bdd58380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801bdd58400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff8801bdd58480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801bdd58500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801bdd58580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== --- This bug is generated by a dumb bot. It may contain errors. See https://goo.gl/tpsmEJ for details. Direct all questions to syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. If you forgot to add the Reported-by tag, once the fix for this bug is merged into any tree, please reply to this email with: #syz fix: exact-commit-title If you want to test a patch for this bug, please reply with: #syz test: git://repo/address.git branch and provide the patch inline or as an attachment. To mark this as a duplicate of another syzbot report, please reply with: #syz dup: exact-subject-of-another-report If it's a one-off invalid bug report, please reply with: #syz invalid Note: if the crash happens again, it will cause creation of a new bug report. Note: all commands must start from beginning of the line in the email body.

3 2

[alsa-devel] [PATCH] ALSA: usb: improve delay reporting
by Georg Chini 05 Apr '18

05 Apr '18

Currently, the kernel uses only the number of USB frames to interpolate the delay between sending or receiving URB's. This limits the granuarity of the delay reports to one millisecond because the frame counter is updated in a millisecond interval. This patch additionally uses time stamps to achieve higher precision of the reported delay. If the time difference computed using time stamps does not deviate more than one millisecond from the difference computed using frames, it is assumed that the system time difference delivers the more precise delay estimate. This will significantly increase the precision of the reported delay in the majority of cases where sound card clock and system clock are almost in sync while falling back to the old method for the rare cases where the two times differ too much. As a downside, the possible worst case error increases from 2ms to 3ms. --- sound/usb/card.h | 1 + sound/usb/pcm.c | 47 +++++++++++++++++++++++++++++++---------------- 2 files changed, 32 insertions(+), 16 deletions(-) diff --git a/sound/usb/card.h b/sound/usb/card.h index ed87cc83eb47..8835d9628cac 100644 --- a/sound/usb/card.h +++ b/sound/usb/card.h @@ -149,6 +149,7 @@ struct snd_usb_substream { int last_frame_number; /* stored frame number */ int last_delay; /* stored delay */ + struct timespec last_update_time; /* time when last_delay was updated */ struct { int marker; diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 3cbfae6604f9..6d40cb0b8777 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -46,9 +46,8 @@ snd_pcm_uframes_t snd_usb_pcm_delay(struct snd_usb_substream *subs, int current_frame_number; int frame_diff; int est_delay; - - if (!subs->last_delay) - return 0; /* short path */ + int time_diff; + struct timespec now; current_frame_number = usb_get_current_frame_number(subs->dev); /* @@ -58,9 +57,21 @@ snd_pcm_uframes_t snd_usb_pcm_delay(struct snd_usb_substream *subs, */ frame_diff = (current_frame_number - subs->last_frame_number) & 0xff; - /* Approximation based on number of samples per USB frame (ms), - some truncation for 44.1 but the estimate is good enough */ - est_delay = frame_diff * rate / 1000; + /* Estimate time since last update of last_delay */ + snd_pcm_gettime(subs->pcm_substream->runtime, &now); + time_diff = (now.tv_sec - subs->last_update_time.tv_sec) * 1000000000; + time_diff += (int)now.tv_nsec - subs->last_update_time.tv_nsec; + time_diff /= 1000; + + if (abs(time_diff - frame_diff * 1000) < 1000) { + /* System time and sound card time do not differ + * too much. Use system time to calculate delay */ + est_delay = time_diff * rate / 1000000; + } else { + /* Approximation based on number of samples per USB frame (ms), + some truncation for 44.1 but the estimate is good enough */ + est_delay = frame_diff * rate / 1000; + } if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK) est_delay = subs->last_delay - est_delay; else @@ -853,6 +864,8 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) subs->hwptr_done = 0; subs->transfer_done = 0; subs->last_delay = 0; + subs->last_update_time.tv_sec = 0; + subs->last_update_time.tv_nsec = 0; subs->last_frame_number = 0; runtime->delay = 0; @@ -1334,7 +1347,9 @@ static void retire_capture_urb(struct snd_usb_substream *subs, /* realign last_frame_number */ subs->last_frame_number = current_frame_number; - subs->last_frame_number &= 0xFF; /* keep 8 LSBs */ + + /* Take time stamp for delay accounting */ + snd_pcm_gettime(runtime, &subs->last_update_time); spin_unlock_irqrestore(&subs->lock, flags); /* copy a data chunk */ @@ -1550,7 +1565,9 @@ static void prepare_playback_urb(struct snd_usb_substream *subs, /* realign last_frame_number */ subs->last_frame_number = usb_get_current_frame_number(subs->dev); - subs->last_frame_number &= 0xFF; /* keep 8 LSBs */ + + /* Take time stamp for delay accounting */ + snd_pcm_gettime(runtime, &subs->last_update_time); if (subs->trigger_tstamp_pending_update) { /* this is the first actual URB submitted, @@ -1597,6 +1614,12 @@ static void retire_playback_urb(struct snd_usb_substream *subs, subs->last_delay -= processed; runtime->delay = subs->last_delay; + /* realign last_frame_number */ + subs->last_frame_number = usb_get_current_frame_number(subs->dev); + + /* Take time stamp for delay accounting */ + snd_pcm_gettime(runtime, &subs->last_update_time); + /* * Report when delay estimate is off by more than 2ms. * The error should be lower than 2ms since the estimate relies @@ -1607,14 +1630,6 @@ static void retire_playback_urb(struct snd_usb_substream *subs, "delay: estimated %d, actual %d\n", est_delay, subs->last_delay); - if (!subs->running) { - /* update last_frame_number for delay counting here since - * prepare_playback_urb won't be called during pause - */ - subs->last_frame_number = - usb_get_current_frame_number(subs->dev) & 0xff; - } - out: spin_unlock_irqrestore(&subs->lock, flags); } -- 2.16.2

2 4

[alsa-devel] [PATCH v2 0/3] ALSA: usb-audio: Minor refactoring and UAC3 fix
by Takashi Iwai 05 Apr '18

05 Apr '18

Hi, this is a v2 patchset (now with a shiny cover letter!) for refactoring and hardening UAC2 and UAC3 clock parsers. BTW, it'll be great if anyone can double-check that this rewrite doesn't break things, especially with a UAC3 device. thanks, Takashi === v1->v2: Rename the helper function to be more specific Make validators to check sizes more strictly Takashi Iwai (3): ALSA: usb-audio: Refactor clock finder helpers ALSA: usb-audio: More strict sanity checks for clock parsers ALSA: usb-audio: Add sanity checks in UAC3 clock parsers sound/usb/clock.c | 128 +++++++++++++++++++++++------------------------------- 1 file changed, 54 insertions(+), 74 deletions(-) -- 2.16.2

2 6

[alsa-devel] SOF 1.1 Release
by Liam Girdwood 05 Apr '18

05 Apr '18

Sound Open Firmware 1.1 has now been released and available here :- git://git.alsa-project.org/sound-open-firmware.git git://git.alsa-project.org/sound-open-firmware-tools.git Significant changes since 1.0 :- o Support for Playback/Capture on Intel Apollolake and Cannonlake platforms. o Initial support for Intel Haswell and Broadwell platforms. o Support for DMA based firmware tracing to host userspace. o SIMD optimisations for SRC on xtensa ISA. o Initial support for running firmware components on host. Plans for 1.2 :- o Playback/Capture on Haswell/Broadwell. o SIMD optimisations for volume and mixer. o Improved host based component testing. o Initial runtime module support. SOF Linux driver dependencies for ALSA/ASoC have also started to upstream. Driver patches will continue to flow in anticipation for base SOF driver in 4.18. Thanks Liam

1 0

Re: [alsa-devel] [PATCH 00/15] ARM: pxa: switch to DMA slave maps
by Ulf Hansson 05 Apr '18

05 Apr '18

On 4 April 2018 at 21:56, Boris Brezillon <boris.brezillon(a)bootlin.com> wrote: > On Wed, 04 Apr 2018 21:49:26 +0200 > Robert Jarzmik <robert.jarzmik(a)free.fr> wrote: > >> Ulf Hansson <ulf.hansson(a)linaro.org> writes: >> >> > On 2 April 2018 at 16:26, Robert Jarzmik <robert.jarzmik(a)free.fr> wrote: >> >> Hi, >> >> >> >> This serie is aimed at removing the dmaengine slave compat use, and transfer >> >> knowledge of the DMA requestors into architecture code. >> >> As this looks like a patch bomb, each maintainer expressing for his tree either >> >> an Ack or "I want to take through my tree" will be spared in the next iterations >> >> of this serie. >> > >> > Perhaps an option is to send this hole series as PR for 3.17 rc1, that >> > would removed some churns and make this faster/easier? Well, if you >> > receive the needed acks of course. >> For 3.17-rc1 it looks a bit optimistic with the review time ... If I have all > > Especially since 3.17-rc1 has been released more than 3 years ago :-), > but I guess you meant 4.17-rc1. Yeah, I realize that I was a bit lost in time yesterday. Even more people have been having fun about it (me too). :-) Kind regards Uffe

2 1