Alsa-devel April 2018

alsa-devel@alsa-project.org

144 participants
268 discussions

[alsa-devel] [PATCH] ALSA: dice: fix kernel NULL pointer dereference due to invalid calculation for array index
by Takashi Sakamoto 29 Apr '18

29 Apr '18

At a commit f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls'), maximum size of payload for tx isochronous packet is cached to reduce the number of function calls. This cache was programmed to updated at a first callback of ohci1394 IR context. However, the maximum size is required to queueing packets before starting the isochronous context. As a result, the cached value is reused to queue packets in next time to starting the isochronous context. Then the cache is updated in a first callback of the isochronous context. This can cause kernel NULL pointer dereference in a below call graph: (sound/firewire/amdtp-stream.c) amdtp_stream_start() ->queue_in_packet() ->queue_packet() (drivers/firewire/core-iso.c) ->fw_iso_context_queue() ->struct fw_card_driver.queue_iso() (drivers/firewire/ohci.c) = ohci_queue_iso() ->queue_iso_packet_per_buffer() buffer->pages[page] The issued dereference occurs in a case that: - target unit supports different stream formats for sampling transmission frequency. - maximum length of payload for tx stream in a first trial is bigger than the length in a second trial. In this case, correct number of pages are allocated for DMA and the 'pages' array has enough elements, while index of the element is wrongly calculated according to the old value of length of payload in a call of 'queue_in_packet()'. Then it causes the issue. This commit fixes the critical bug. This affects all of drivers in ALSA firewire stack in Linux kernel v4.12 or later. [12665.302360] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [12665.302415] IP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.302439] PGD 0 [12665.302440] P4D 0 [12665.302450] [12665.302470] Oops: 0000 [#1] SMP PTI [12665.302487] Modules linked in: ... [12665.303096] CPU: 1 PID: 12760 Comm: jackd Tainted: P OE 4.13.0-38-generic #43-Ubuntu [12665.303154] Hardware name: /DH77DF, BIOS KCH7710H.86A.0069.2012.0224.1825 02/24/2012 [12665.303215] task: ffff9ce87da2ae80 task.stack: ffffb5b8823d0000 [12665.303258] RIP: 0010:ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.303301] RSP: 0018:ffffb5b8823d3ab8 EFLAGS: 00010086 [12665.303337] RAX: ffff9ce4f4876930 RBX: 0000000000000008 RCX: ffff9ce88a3955e0 [12665.303384] RDX: 0000000000000000 RSI: 0000000034877f00 RDI: 0000000000000000 [12665.303427] RBP: ffffb5b8823d3b68 R08: ffff9ce8ccb390a0 R09: ffff9ce877639ab0 [12665.303475] R10: 0000000000000108 R11: 0000000000000000 R12: 0000000000000003 [12665.303513] R13: 0000000000000000 R14: ffff9ce4f4876950 R15: 0000000000000000 [12665.303554] FS: 00007f2ec467f8c0(0000) GS:ffff9ce8df280000(0000) knlGS:0000000000000000 [12665.303600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12665.303633] CR2: 0000000000000030 CR3: 00000002dcf90004 CR4: 00000000000606e0 [12665.303674] Call Trace: [12665.303698] fw_iso_context_queue+0x18/0x20 [firewire_core] [12665.303735] queue_packet+0x88/0xe0 [snd_firewire_lib] [12665.303770] amdtp_stream_start+0x19b/0x270 [snd_firewire_lib] [12665.303811] start_streams+0x276/0x3c0 [snd_dice] [12665.303840] snd_dice_stream_start_duplex+0x1bf/0x480 [snd_dice] [12665.303882] ? vma_gap_callbacks_rotate+0x1e/0x30 [12665.303914] ? __rb_insert_augmented+0xab/0x240 [12665.303936] capture_prepare+0x3c/0x70 [snd_dice] [12665.303961] snd_pcm_do_prepare+0x1d/0x30 [snd_pcm] [12665.303985] snd_pcm_action_single+0x3b/0x90 [snd_pcm] [12665.304009] snd_pcm_action_nonatomic+0x68/0x70 [snd_pcm] [12665.304035] snd_pcm_prepare+0x68/0x90 [snd_pcm] [12665.304058] snd_pcm_common_ioctl1+0x4c0/0x940 [snd_pcm] [12665.304083] snd_pcm_capture_ioctl1+0x19b/0x250 [snd_pcm] [12665.304108] snd_pcm_capture_ioctl+0x27/0x40 [snd_pcm] [12665.304131] do_vfs_ioctl+0xa8/0x630 [12665.304148] ? entry_SYSCALL_64_after_hwframe+0xe9/0x139 [12665.304172] ? entry_SYSCALL_64_after_hwframe+0xe2/0x139 [12665.304195] ? entry_SYSCALL_64_after_hwframe+0xdb/0x139 [12665.304218] ? entry_SYSCALL_64_after_hwframe+0xd4/0x139 [12665.304242] ? entry_SYSCALL_64_after_hwframe+0xcd/0x139 [12665.304265] ? entry_SYSCALL_64_after_hwframe+0xc6/0x139 [12665.304288] ? entry_SYSCALL_64_after_hwframe+0xbf/0x139 [12665.304312] ? entry_SYSCALL_64_after_hwframe+0xb8/0x139 [12665.304335] ? entry_SYSCALL_64_after_hwframe+0xb1/0x139 [12665.304358] SyS_ioctl+0x79/0x90 [12665.304374] ? entry_SYSCALL_64_after_hwframe+0x72/0x139 [12665.304397] entry_SYSCALL_64_fastpath+0x24/0xab [12665.304417] RIP: 0033:0x7f2ec3750ef7 [12665.304433] RSP: 002b:00007fff99e31388 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [12665.304465] RAX: ffffffffffffffda RBX: 00007fff99e312f0 RCX: 00007f2ec3750ef7 [12665.304494] RDX: 0000000000000000 RSI: 0000000000004140 RDI: 0000000000000007 [12665.304522] RBP: 0000556ebc63fd60 R08: 0000556ebc640560 R09: 0000000000000000 [12665.304553] R10: 0000000000000001 R11: 0000000000000246 R12: 0000556ebc63fcf0 [12665.304584] R13: 0000000000000000 R14: 0000000000000007 R15: 0000000000000000 [12665.304612] Code: 01 00 00 44 89 eb 45 31 ed 45 31 db 66 41 89 1e 66 41 89 5e 0c 66 45 89 5e 0e 49 8b 49 08 49 63 d4 4d 85 c0 49 63 ff 48 8b 14 d1 <48> 8b 72 30 41 8d 14 37 41 89 56 04 48 63 d3 0f 84 ce 00 00 00 [12665.304713] RIP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] RSP: ffffb5b8823d3ab8 [12665.304743] CR2: 0000000000000030 [12665.317701] ---[ end trace 9d55b056dd52a19f ]--- Fixes: f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls') Cc: <stable(a)vger.kernel.org> # v4.12+ Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> --- sound/firewire/amdtp-stream.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c index 4a1dc145327b..cb9acfe60f6a 100644 --- a/sound/firewire/amdtp-stream.c +++ b/sound/firewire/amdtp-stream.c @@ -773,8 +773,6 @@ static void amdtp_stream_first_callback(struct fw_iso_context *context, u32 cycle; unsigned int packets; - s->max_payload_length = amdtp_stream_get_max_payload(s); - /* * For in-stream, first packet has come. * For out-stream, prepared to transmit first packet @@ -879,6 +877,9 @@ int amdtp_stream_start(struct amdtp_stream *s, int channel, int speed) amdtp_stream_update(s); + if (s->direction == AMDTP_IN_STREAM) + s->max_payload_length = amdtp_stream_get_max_payload(s); + if (s->flags & CIP_NO_HEADER) s->tag = TAG_NO_CIP_HEADER; else -- 2.14.1

2 1

[alsa-devel] [PATCH v2 0/3] ASoc: TAS6424: Add support for mute, standby, and faster power on
by Jean-Jacques Hiblot 28 Apr '18

28 Apr '18

mute and standby pins are available on the codec. If they are connected, they should be managed by the driver, instead of relying on gpio hogs or on the initial state of the GPIOs. This series also includes a patch to improve the start-up time of the channels by disabling built-in DC diagnostics. Those diagnosdtics basically serve to detect : - wires shorted together - wire shorted to ground or vbat - wire disconnected This is not useful for all platforms and the addition to the startup time is quite noticeable (230ms). The diagnostics can be enabled/disabled using a dedicated ALSA control. Changes in v2: - use a ALSA control to enable/disable the auto diagnostics instead of relying on a DTS property. - fixed typos - use gpios (plural) instead of gpio in the documentation of the bindings Jean-Jacques Hiblot (3): ASoC: tas6424: Add support for the standby pin ASoC: tas6424: Add support for the mute pin ASoC: tas6424: Allow disabling auto diagnostics for faster power-on .../devicetree/bindings/sound/ti,tas6424.txt | 2 + sound/soc/codecs/tas6424.c | 78 +++++++++++++++++++++- sound/soc/codecs/tas6424.h | 4 ++ 3 files changed, 81 insertions(+), 3 deletions(-) -- 2.7.4

4 10

[alsa-devel] [PATCH] ASoC: Intel: cht-bsw-rt5672: allow for topology-defined codec-dai setup
by Pierre-Louis Bossart 28 Apr '18

28 Apr '18

Hard-coded setups conflict with topology defined ones. Move this code to codec_fixup so that SOF can override codec dai settings, e.g. to only use 2 channels. Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> --- sound/soc/intel/boards/cht_bsw_rt5672.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/sound/soc/intel/boards/cht_bsw_rt5672.c b/sound/soc/intel/boards/cht_bsw_rt5672.c index c14a52d2f714..49cf30cb471b 100644 --- a/sound/soc/intel/boards/cht_bsw_rt5672.c +++ b/sound/soc/intel/boards/cht_bsw_rt5672.c @@ -189,13 +189,6 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime) if (devm_acpi_dev_add_driver_gpios(codec->dev, cht_rt5672_gpios)) dev_warn(runtime->dev, "Unable to add GPIO mapping table\n"); - /* TDM 4 slots 24 bit, set Rx & Tx bitmask to 4 active slots */ - ret = snd_soc_dai_set_tdm_slot(codec_dai, 0xF, 0xF, 4, 24); - if (ret < 0) { - dev_err(runtime->dev, "can't set codec TDM slot %d\n", ret); - return ret; - } - /* Select codec ASRC clock source to track I2S1 clock, because codec * is in slave mode and 100fs I2S format (BCLK = 100 * LRCLK) cannot * be supported by RT5672. Otherwise, ASRC will be disabled and cause @@ -252,6 +245,7 @@ static int cht_codec_fixup(struct snd_soc_pcm_runtime *rtd, SNDRV_PCM_HW_PARAM_RATE); struct snd_interval *channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS); + int ret; /* The DSP will covert the FE rate to 48k, stereo, 24bits */ rate->min = rate->max = 48000; @@ -259,6 +253,26 @@ static int cht_codec_fixup(struct snd_soc_pcm_runtime *rtd, /* set SSP2 to 24-bit */ params_set_format(params, SNDRV_PCM_FORMAT_S24_LE); + + /* + * Default mode for SSP configuration is TDM 4 slot + */ + ret = snd_soc_dai_set_fmt(rtd->codec_dai, + SND_SOC_DAIFMT_DSP_B | + SND_SOC_DAIFMT_IB_NF | + SND_SOC_DAIFMT_CBS_CFS); + if (ret < 0) { + dev_err(rtd->dev, "can't set format to TDM %d\n", ret); + return ret; + } + + /* TDM 4 slots 24 bit, set Rx & Tx bitmask to 4 active slots */ + ret = snd_soc_dai_set_tdm_slot(rtd->codec_dai, 0xF, 0xF, 4, 24); + if (ret < 0) { + dev_err(rtd->dev, "can't set codec TDM slot %d\n", ret); + return ret; + } + return 0; } @@ -315,8 +329,6 @@ static struct snd_soc_dai_link cht_dailink[] = { .nonatomic = true, .codec_dai_name = "rt5670-aif1", .codec_name = "i2c-10EC5670:00", - .dai_fmt = SND_SOC_DAIFMT_DSP_B | SND_SOC_DAIFMT_IB_NF - | SND_SOC_DAIFMT_CBS_CFS, .init = cht_codec_init, .be_hw_params_fixup = cht_codec_fixup, .dpcm_playback = 1, -- 2.14.1

2 1

[alsa-devel] [PATCH] ALSA: cs46xx: fix spelling mistake: "amplifer" -> "amplifier"
by Colin King 27 Apr '18

27 Apr '18

From: Colin Ian King <colin.king(a)canonical.com> Trivial fix to spelling mistake in module parameter description text Signed-off-by: Colin Ian King <colin.king(a)canonical.com> --- sound/pci/cs46xx/cs46xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/pci/cs46xx/cs46xx.c b/sound/pci/cs46xx/cs46xx.c index 655fbea1692c..4910d3f46d4b 100644 --- a/sound/pci/cs46xx/cs46xx.c +++ b/sound/pci/cs46xx/cs46xx.c @@ -58,7 +58,7 @@ MODULE_PARM_DESC(id, "ID string for the CS46xx soundcard."); module_param_array(enable, bool, NULL, 0444); MODULE_PARM_DESC(enable, "Enable CS46xx soundcard."); module_param_array(external_amp, bool, NULL, 0444); -MODULE_PARM_DESC(external_amp, "Force to enable external amplifer."); +MODULE_PARM_DESC(external_amp, "Force to enable external amplifier."); module_param_array(thinkpad, bool, NULL, 0444); MODULE_PARM_DESC(thinkpad, "Force to enable Thinkpad's CLKRUN control."); module_param_array(mmap_valid, bool, NULL, 0444); -- 2.17.0

2 1

[alsa-devel] [PATCH] ASoC: core: Allow codec_conf DT lookups to match parent of_node
by Charles Keepax 27 Apr '18

27 Apr '18

For devices implemented as a MFD it is common to only have a single node in devicetree representing the whole device. As such when looking up codec_conf mappings we should match against both the devices of_node and the devices parent's of_node, as is already done for DAIs and platform components. Signed-off-by: Charles Keepax <ckeepax(a)opensource.cirrus.com> --- sound/soc/soc-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 052089f16ea02..4b068ccf4e13a 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -1383,7 +1383,12 @@ static void soc_set_name_prefix(struct snd_soc_card *card, for (i = 0; i < card->num_configs; i++) { struct snd_soc_codec_conf *map = &card->codec_conf[i]; - if (map->of_node && component->dev->of_node != map->of_node) + struct device_node *component_of_node = component->dev->of_node; + + if (!component_of_node && component->dev->parent) + component_of_node = component->dev->parent->of_node; + + if (map->of_node && component_of_node != map->of_node) continue; if (map->dev_name && strcmp(component->name, map->dev_name)) continue; -- 2.11.0

2 1

[alsa-devel] Unable to handle kernel paging request in snd_seq_oss_readq_puts
by DaeRyong Jeong 27 Apr '18

27 Apr '18

We report the crash: unable to handle kernel paging request in snd_seq_oss_readq_puts This crash has been found in v4.16 using RaceFuzzer (a modified version of Syzkaller), which we describe more at the end of this report. Our analysis shows that the race occurs when invoking two syscalls concurrently, write$eventfd and write$sndseq. Analysis: We think the concurrent execution of snd_virmidi_output_trigger() and snd_midi_event_encode_byte() causes the crash. Since the first call site of snd_seq_kernel_client_dispatch() in snd_virmidi_output_trigger() is not protected by substream->runtime->lock, it is possible that snd_seq_oss_readq_puts() and snd_midi_event_encode_byte() are executed concurrently in the call sequences as below, and snd_seq_oss_readq_puts() accesses ev->data.ex.ptr before it is initialized. Thread Interleaving: CPU1 (snd_virmidi_output_trigger) CPU2(snd_midi_event_encode_byte) ev->type = SNDRV_SEQ_EVENT_SYSEX; if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) { if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0) ... /* In snd_seq_oss_readq_puts(), * data has the same value with ev->data.ext.ptr * which is not initialized yet */ rec.c[1] = *data++; ev->data.ext.len = dev->read; ev->data.ext.ptr = dev->buf; Call sequence: CPU1 snd_rawmidi_write snd_rawmidi_kernel_write1 snd_rawmidi_output_trigger snd_virmidi_output_trigger snd_seq_kernel_client_dispatch (line #178 in v4.16) snd_seq_deliver_event deliver_to_subscribers snd_seq_deliver_single_event.constprop.14 snd_seq_oss_event_input snd_seq_oss_midi_input send_midi_event snd_seq_oss_readq_sysex snd_seq_dump_var_event readq_dump_sysex snd_seq_oss_readq_puts CPU2 snd_rawmidi_write snd_rawmidi_kernel_write1 snd_rawmidi_output_trigger snd_virmidi_output_trigger snd_midi_event_encode snd_midi_event_encode_byte Crash log: ================================================================== BUG: KASAN: null-ptr-deref in snd_seq_oss_readq_puts+0xc5/0x160 sound/core/seq/oss/seq_oss_readq.c:112 Read of size 1 at addr 0000000000000049 by task syz-executor0/12892 CPU: 1 PID: 12892 Comm: syz-executor0 Not tainted 4.16.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x171/0x227 lib/dump_stack.c:53 kasan_report_error mm/kasan/report.c:352 [inline] kasan_report.cold.7+0x13b/0x2f5 mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] __asan_load1+0x47/0x50 mm/kasan/kasan.c:695 snd_seq_oss_readq_puts+0xc5/0x160 sound/core/seq/oss/seq_oss_readq.c:112 readq_dump_sysex+0x3f/0x50 sound/core/seq/oss/seq_oss_readq.c:133 snd_seq_dump_var_event+0x375/0x3a0 sound/core/seq/seq_memory.c:107 snd_seq_oss_readq_sysex+0xec/0x100 sound/core/seq/oss/seq_oss_readq.c:146 send_midi_event sound/core/seq/oss/seq_oss_midi.c:615 [inline] snd_seq_oss_midi_input+0x332/0x710 sound/core/seq/oss/seq_oss_midi.c:535 snd_seq_oss_event_input+0xe9/0x130 sound/core/seq/oss/seq_oss_event.c:439 snd_seq_deliver_single_event.constprop.14+0x4bd/0x5a0 sound/core/seq/seq_clientmgr.c:622 deliver_to_subscribers sound/core/seq/seq_clientmgr.c:677 [inline] snd_seq_deliver_event+0x274/0x5d0 sound/core/seq/seq_clientmgr.c:812 snd_seq_kernel_client_dispatch+0xe2/0x100 sound/core/seq/seq_clientmgr.c:2330 snd_virmidi_output_trigger+0x156/0x420 sound/core/seq/seq_virmidi.c:178 snd_rawmidi_output_trigger sound/core/rawmidi.c:150 [inline] snd_rawmidi_kernel_write1+0x383/0x410 sound/core/rawmidi.c:1288 snd_rawmidi_write+0x241/0xa30 sound/core/rawmidi.c:1338 __vfs_write+0xed/0x510 fs/read_write.c:480 vfs_write+0x195/0x380 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xd7/0x1c0 fs/read_write.c:581 do_syscall_64+0x209/0x5d0 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453bb9 RSP: 002b:00007f46902c2af8 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00000000007080d8 RCX: 0000000000453bb9 RDX: 00000000000000f3 RSI: 0000000020004f0d RDI: 0000000000000006 RBP: 0000000000005ed0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004ab432 R13: 00000000ffffffff R14: 0000000000000006 R15: 0000000020004f0d ================================================================== Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 12892 Comm: syz-executor0 Tainted: G B 4.16.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x171/0x227 lib/dump_stack.c:53 panic+0x1c9/0x44c kernel/panic.c:183 kasan_end_report+0x47/0x4f mm/kasan/report.c:180 kasan_report_error mm/kasan/report.c:359 [inline] kasan_report.cold.7+0xc9/0x2f5 mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] __asan_load1+0x47/0x50 mm/kasan/kasan.c:695 snd_seq_oss_readq_puts+0xc5/0x160 sound/core/seq/oss/seq_oss_readq.c:112 readq_dump_sysex+0x3f/0x50 sound/core/seq/oss/seq_oss_readq.c:133 snd_seq_dump_var_event+0x375/0x3a0 sound/core/seq/seq_memory.c:107 snd_seq_oss_readq_sysex+0xec/0x100 sound/core/seq/oss/seq_oss_readq.c:146 send_midi_event sound/core/seq/oss/seq_oss_midi.c:615 [inline] snd_seq_oss_midi_input+0x332/0x710 sound/core/seq/oss/seq_oss_midi.c:535 snd_seq_oss_event_input+0xe9/0x130 sound/core/seq/oss/seq_oss_event.c:439 snd_seq_deliver_single_event.constprop.14+0x4bd/0x5a0 sound/core/seq/seq_clientmgr.c:622 deliver_to_subscribers sound/core/seq/seq_clientmgr.c:677 [inline] snd_seq_deliver_event+0x274/0x5d0 sound/core/seq/seq_clientmgr.c:812 snd_seq_kernel_client_dispatch+0xe2/0x100 sound/core/seq/seq_clientmgr.c:2330 snd_virmidi_output_trigger+0x156/0x420 sound/core/seq/seq_virmidi.c:178 snd_rawmidi_output_trigger sound/core/rawmidi.c:150 [inline] snd_rawmidi_kernel_write1+0x383/0x410 sound/core/rawmidi.c:1288 snd_rawmidi_write+0x241/0xa30 sound/core/rawmidi.c:1338 __vfs_write+0xed/0x510 fs/read_write.c:480 vfs_write+0x195/0x380 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xd7/0x1c0 fs/read_write.c:581 do_syscall_64+0x209/0x5d0 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453bb9 RSP: 002b:00007f46902c2af8 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00000000007080d8 RCX: 0000000000453bb9 RDX: 00000000000000f3 RSI: 0000000020004f0d RDI: 0000000000000006 RBP: 0000000000005ed0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004ab432 R13: 00000000ffffffff R14: 0000000000000006 R15: 0000000020004f0d Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Rebooting in 86400 seconds.. BUG: unable to handle kernel paging request at ffffe0000000007c IP: snd_seq_oss_readq_puts+0xc9/0x160 sound/core/seq/oss/seq_oss_readq.c:112 PGD 0 P4D 0 Oops: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 30835 Comm: syz-executor0 Not tainted 4.16.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 RIP: 0010:snd_seq_oss_readq_puts+0xc9/0x160 sound/core/seq/oss/seq_oss_readq.c:112 RSP: 0018:ffff880237427238 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 000000000000000e RCX: ffffffff83159785 RDX: 1ffffc000000000f RSI: ffffffff83159775 RDI: ffff880237427269 RBP: ffff8802374272d0 R08: ffff88022e7f63c0 R09: ffff880237427268 R10: ffffed0046e84e4d R11: ffff88023742726f R12: ffffe0000000007c R13: ffffe0000000007d R14: ffff880237427268 R15: ffff8802374272a8 FS: 00007fa616b6b700(0000) GS:ffff8800bae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffe0000000007c CR3: 00000002316cc000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: readq_dump_sysex+0x3f/0x50 sound/core/seq/oss/seq_oss_readq.c:133 snd_seq_dump_var_event+0x375/0x3a0 sound/core/seq/seq_memory.c:107 snd_seq_oss_readq_sysex+0xec/0x100 sound/core/seq/oss/seq_oss_readq.c:146 send_midi_event sound/core/seq/oss/seq_oss_midi.c:615 [inline] snd_seq_oss_midi_input+0x332/0x710 sound/core/seq/oss/seq_oss_midi.c:535 snd_seq_oss_event_input+0xe9/0x130 sound/core/seq/oss/seq_oss_event.c:439 snd_seq_deliver_single_event.constprop.14+0x4bd/0x5a0 sound/core/seq/seq_clientmgr.c:622 deliver_to_subscribers sound/core/seq/seq_clientmgr.c:677 [inline] snd_seq_deliver_event+0x274/0x5d0 sound/core/seq/seq_clientmgr.c:812 snd_seq_kernel_client_dispatch+0xe2/0x100 sound/core/seq/seq_clientmgr.c:2330 snd_virmidi_output_trigger+0x156/0x420 sound/core/seq/seq_virmidi.c:178 snd_rawmidi_output_trigger sound/core/rawmidi.c:150 [inline] snd_rawmidi_kernel_write1+0x383/0x410 sound/core/rawmidi.c:1288 snd_rawmidi_write+0x241/0xa30 sound/core/rawmidi.c:1338 __vfs_write+0xed/0x510 fs/read_write.c:480 vfs_write+0x195/0x380 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xd7/0x1c0 fs/read_write.c:581 do_syscall_64+0x209/0x5d0 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453bb9 RSP: 002b:00007fa616b6aaf8 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000708020 RCX: 0000000000453bb9 RDX: 0000000000000008 RSI: 0000000020002ff8 RDI: 0000000000000006 RBP: 0000000000005ef0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004ad178 R13: 00000000ffffffff R14: 0000000000000006 R15: 0000000020002ff8 Code: 8d 7e 02 c6 45 98 05 e8 26 a1 5c fe 44 88 6d 9a eb 4a e8 7b 47 36 fe 4c 89 e7 4d 8d 6c 24 01 83 eb 01 e8 bb a0 5c fe 49 8d 7e 01 <45> 0f b6 24 24 e8 fd a0 5c fe 48 8b bd 70 ff ff ff 4c 89 f6 45 RIP: snd_seq_oss_readq_puts+0xc9/0x160 sound/core/seq/oss/seq_oss_readq.c:112 RSP: ffff880237427238 CR2: ffffe0000000007c ---[ end trace 029460d043170cd7 ]--- = About RaceFuzzer RaceFuzzer is a customized version of Syzkaller, specifically tailored to find race condition bugs in the Linux kernel. While we leverage many different technique, the notable feature of RaceFuzzer is in leveraging a custom hypervisor (QEMU/KVM) to interleave the scheduling. In particular, we modified the hypervisor to intentionally stall a per-core execution, which is similar to supporting per-core breakpoint functionality. This allows RaceFuzzer to force the kernel to deterministically trigger racy condition (which may rarely happen in practice due to randomness in scheduling). RaceFuzzer's C repro always pinpoints two racy syscalls. Since C repro's scheduling synchronization should be performed at the user space, its reproducibility is limited (reproduction may take from 1 second to 10 minutes (or even more), depending on a bug). This is because, while RaceFuzzer precisely interleaves the scheduling at the kernel's instruction level when finding this bug, C repro cannot fully utilize such a feature. Please disregard all code related to "should_hypercall" in the C repro, as this is only for our debugging purposes using our own hypervisor.

2 3

[alsa-devel] [PATCH] ALSA: hda - Fix incorrect usage of IS_REACHABLE()
by Takashi Iwai 27 Apr '18

27 Apr '18

The commit c469652bb5e8 ("ALSA: hda - Use IS_REACHABLE() for dependency on input") simplified the dependencies with IS_REACHABLE() macro, but it broke due to its incorrect usage: it should have been IS_REACHABLE(CONFIG_INPUT) instead of IS_REACHABLE(INPUT). Fixes: c469652bb5e8 ("ALSA: hda - Use IS_REACHABLE() for dependency on input") Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 8c238e51bb5a..2dd34dd77447 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -3832,7 +3832,7 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec, } } -#if IS_REACHABLE(INPUT) +#if IS_REACHABLE(CONFIG_INPUT) static void gpio2_mic_hotkey_event(struct hda_codec *codec, struct hda_jack_callback *event) { -- 2.16.3

1 0

[alsa-devel] rt5645 Jack detect code on an Asus T100HA not being able to distinguish between headphones vs headset ?
by Hans de Goede 27 Apr '18

27 Apr '18

Hi Bard, I'm having some trouble with the rt5645.c codec code not being able to distinguish between headphones vs headset on an Asus T100HA laptop. It recognizes everything as headphones. This statement in the jack-detect code: dev_dbg(component->dev, "val = %d\n", val); Always prints 4 for the value, no matter what I plug in. Also the headset microphone input does not work, not even if I select it manually. The ACPI id for the device is 10EC3270, and I opened the tablet and the marking on the codec says: ALC3270, so I guess we may need some special handling for the jack-detect (and headset microphone input) on this variant, can you help? I checked and the jack connector does seem to be of the TRRS type. Regards, Hans

1 0

[alsa-devel] [asoc:for-4.18 91/91] sound/soc/mediatek/common/mtk-afe-platform-driver.c:65:15: error: 'struct snd_soc_pcm_runtime' has no member named 'platform'
by kbuild test robot 27 Apr '18

27 Apr '18

tree: https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-4.18 head: 58edf3255ca3025444c016241611453585453089 commit: 58edf3255ca3025444c016241611453585453089 [91/91] ASoC: mediatek: preallocate pages use platform device config: arm-allmodconfig (attached as .config) compiler: arm-linux-gnueabi-gcc (Debian 7.2.0-11) 7.2.0 reproduce: wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross git checkout 58edf3255ca3025444c016241611453585453089 # save the attached .config to linux build tree make.cross ARCH=arm All error/warnings (new ones prefixed by >>): sound/soc/mediatek/common/mtk-afe-platform-driver.c: In function 'mtk_afe_pcm_new': >> sound/soc/mediatek/common/mtk-afe-platform-driver.c:65:15: error: 'struct snd_soc_pcm_runtime' has no member named 'platform' rtd->platform->dev, ^~ >> sound/soc/mediatek/common/mtk-afe-platform-driver.c:67:1: warning: control reaches end of non-void function [-Wreturn-type] } ^ vim +65 sound/soc/mediatek/common/mtk-afe-platform-driver.c 55 56 static int mtk_afe_pcm_new(struct snd_soc_pcm_runtime *rtd) 57 { 58 size_t size; 59 struct snd_pcm *pcm = rtd->pcm; 60 struct snd_soc_component *component = snd_soc_rtdcom_lookup(rtd, AFE_PCM_NAME); 61 struct mtk_base_afe *afe = snd_soc_component_get_drvdata(component); 62 63 size = afe->mtk_afe_hardware->buffer_bytes_max; 64 return snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, > 65 rtd->platform->dev, 66 size, size); > 67 } 68 --- 0-DAY kernel test infrastructure Open Source Technology Center https://lists.01.org/pipermail/kbuild-all Intel Corporation

1 0

[alsa-devel] [PATCH] ASoC: dai playback and capture active may be greater than 1
by Jerome Brunet 27 Apr '18

27 Apr '18

At the moment playback_active and capture_active are using only 1 bit so the maximum active count is 1. However, snd_soc_runtime_activate() may be called several time on the same dai. This happens when a dai is part of several dai_links. It is often the case for "snd-soc-dummy-dai". This is a problem if snd_soc_runtime_activate() is called an even number of times on a dai. In this case the active count overflow back to 0. As consequence, ASoC functions, such as soc_dpcm_runtime_update(), won't run correctly. Storing these usage counts on plain 'unsigned int' solves the problem. Fixes: f0fba2ad1b6b ("ASoC: multi-component - ASoC Multi-Component Support") Signed-off-by: Jerome Brunet <jbrunet(a)baylibre.com> --- Hi, I found this problem while working on ASoC support for a new platform. During a playback, using DPCM, if I changed the backend dai, nothing happened, old backend path is not pruned, new backend path is not added. Here is how it goes: 1 FE and 2 BE, all 3 using snd-soc-dummy-dai for the codec_dai (ATM). On playback start: - BE #1 activates and increments snd-soc-dummy-dai's playback_active - FE activates and increments snd-soc-dummy-dai's playback_active The playback works but snd-soc-dummy-dai's playback_active value is now 0. Through a mux kcontrol, change BE client of FE, from BE #1 to BE #2. -> trigger soc_dpcm_runtime_update(). -> checks fe's codec_dai playback_active which is zero so playback path processing is skipped, keeping the old invalid path. * No change since initial RFC [0], just droppped the RFC prefix. [0]: https://lkml.kernel.org/r/20180419140612.11049-1-jbrunet@baylibre.com include/sound/soc-dai.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h index 8ad11669e4d8..35ebb0be5114 100644 --- a/include/sound/soc-dai.h +++ b/include/sound/soc-dai.h @@ -294,8 +294,8 @@ struct snd_soc_dai { struct snd_soc_dai_driver *driver; /* DAI runtime info */ - unsigned int capture_active:1; /* stream is in use */ - unsigned int playback_active:1; /* stream is in use */ + unsigned int capture_active; /* stream usage count */ + unsigned int playback_active; /* stream usage count */ unsigned int probed:1; unsigned int active; -- 2.14.3

1 0

← Newer
1
2
3
4
5
6
7
8
9
...
27
Older →

Jump to page:

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Alsa-devel April 2018