January 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH RFC 00/26] Kill set_fs() in ALSA codes
by Takashi Iwai 27 Mar '19

27 Mar '19

Hi, this is a slightly lengthy patchset, basically targeted for 4.13, thus it's still in RFC. The main purpose of this patchset is to get rid of get_fs() / set_fs() usages in ALSA codes. The patchset starts from a patch that looks fairly irrelevant with the goal (the conversion of HD-audio bind-mute code), but it's a step for the long trail. The biggest change in the patchset is the conversion of copy & silence PCM ops into the new copy_silence ops. It helped for reducing the code size and for handling the in-kernel buffer copies. The current patches are found in topic/kill-set_fs branch of my sound.git tree. thanks, Takashi === Takashi Iwai (26): ALSA: hda - Simplify bound-beep mute control for ALC268 ALSA: hda - Move bind-mixer switch codes to generic parser ALSA: hda - Remove the generic bind ctl helpers ALSA: hda - Remove the use of set_fs() ALSA: hda - Fix a typo in comment ALSA: hda - Remove superfluous header inclusions ALSA: opl3: Kill unused set_fs() ALSA: emu10k1: Get rid of set_fs() usage ALSA: pcm: Remove set_fs() in PCM core code ALSA: pcm: Introduce copy_silence PCM ops ALSA: Update document about copy_silence PCM ops ALSA: dummy: Convert to copy_silence ops ALSA: es1938: Convert to copy_silence ops ALSA: korg1212: Convert to copy_silence ops ALSA: nm256: Convert to copy_silence ops ALSA: rme32: Convert to copy_silence ops ALSA: rme96: Convert to copy_silence ops ALSA: rme9652: Convert to copy_silence ops ALSA: hdsp: Convert to copy_silence ops ALSA: gus: Convert to copy_silence ops ALSA: sb: Convert to copy_silence ops ALSA: sh: Convert to copy_silence ops ASoC: blackfin: Convert to copy_silence ops [media] solo6x10: Convert to copy_silence ops ALSA: pcm: Drop the old copy and silence ops ALSA: pcm: Kill set_fs() usage in OSS layer and USB gadget .../sound/kernel-api/writing-an-alsa-driver.rst | 110 +++++---- drivers/media/pci/solo6x10/solo6x10-g723.c | 11 +- drivers/usb/gadget/function/u_uac1.c | 8 +- include/sound/pcm.h | 19 +- sound/core/oss/pcm_oss.c | 62 ++--- sound/core/pcm_compat.c | 22 +- sound/core/pcm_lib.c | 174 +++++++++----- sound/core/pcm_native.c | 122 ++++++---- sound/drivers/dummy.c | 13 +- sound/drivers/opl3/opl3_oss.c | 14 -- sound/isa/gus/gus_pcm.c | 43 +--- sound/isa/sb/emu8000_pcm.c | 99 +++----- sound/pci/emu10k1/emufx.c | 127 ++++++----- sound/pci/es1938.c | 11 +- sound/pci/hda/hda_codec.c | 251 +++------------------ sound/pci/hda/hda_generic.c | 46 +++- sound/pci/hda/hda_local.h | 61 ----- sound/pci/hda/patch_realtek.c | 37 ++- sound/pci/korg1212/korg1212.c | 128 +++-------- sound/pci/nm256/nm256.c | 35 ++- sound/pci/rme32.c | 49 ++-- sound/pci/rme96.c | 52 ++--- sound/pci/rme9652/hdsp.c | 44 ++-- sound/pci/rme9652/rme9652.c | 46 ++-- sound/sh/sh_dac_audio.c | 40 +--- sound/soc/blackfin/bf5xx-ac97-pcm.c | 6 +- sound/soc/blackfin/bf5xx-ac97.c | 18 +- sound/soc/blackfin/bf5xx-i2s-pcm.c | 46 ++-- sound/soc/soc-pcm.c | 3 +- 29 files changed, 696 insertions(+), 1001 deletions(-) -- 2.12.2

3 40

[alsa-devel] [PATCH v4 0/3] Add NXP AUDMIX device and machine drivers
by Viorel Suman 26 Mar '19

26 Mar '19

The patchset adds NXP Audio Mixer (AUDMIX) device and machine drivers and related DT bindings documentation. Changes since V3: 1. Removed machine driver DT bindings documentation. 2. Trigger machine driver probe from device driver as suggested by Nicolin. Changes since V2: 1. Moved "dais" node from machine driver DTS node to device driver DTS node as suggested by Rob. Changes since V1: 1. Original patch split into distinct patches for the device driver and DT binding documentation. 2. Replaced AMIX with AUDMIX in both code and file names as it looks more RM-compliant. 3. Removed polarity control from CPU DAI driver as suggested by Nicolin. 4. Added machine driver and related DT binding documentation. Viorel Suman (3): ASoC: fsl: Add Audio Mixer CPU DAI driver ASoC: add fsl_audmix DT binding documentation ASoC: fsl: Add Audio Mixer machine driver .../devicetree/bindings/sound/fsl,audmix.txt | 54 ++ sound/soc/fsl/Kconfig | 16 + sound/soc/fsl/Makefile | 5 + sound/soc/fsl/fsl_audmix.c | 576 +++++++++++++++++++++ sound/soc/fsl/fsl_audmix.h | 102 ++++ sound/soc/fsl/imx-audmix.c | 327 ++++++++++++ 6 files changed, 1080 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/fsl,audmix.txt create mode 100644 sound/soc/fsl/fsl_audmix.c create mode 100644 sound/soc/fsl/fsl_audmix.h create mode 100644 sound/soc/fsl/imx-audmix.c -- 2.7.4

4 7

[alsa-devel] [PATCH v4] ALSA: core: Allow drivers to set R/W wait time.
by Liam Girdwood 26 Mar '19

26 Mar '19

Currently ALSA core blocks userspace for about 10 seconds for PCM R/W IO. This needs to be configurable for modern hardware like DSPs where no pointer update in milliseconds can indicate terminal DSP errors. Add a substream variable to set the wait time in ms. This allows userspace and drivers to recover more quickly from terminal DSP errors. Signed-off-by: Liam Girdwood <liam.r.girdwood(a)linux.intel.com> --- Changes since V1 :- o Remove API method and alow drivers to set directly. o Validate time is driver supplied times. V2 :- o Max wait calc now in ms. o checkpatch. v3:- o Remove driver supplied time validation. include/sound/pcm.h | 1 + sound/core/pcm_lib.c | 17 ++++++++++++----- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/include/sound/pcm.h b/include/sound/pcm.h index e054c583d3b3..fcdf358a25f0 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -462,6 +462,7 @@ struct snd_pcm_substream { /* -- timer section -- */ struct snd_timer *timer; /* timer */ unsigned timer_running: 1; /* time is running */ + long wait_time; /* time in ms for R/W to wait for avail */ /* -- next substream -- */ struct snd_pcm_substream *next; /* -- linked substreams -- */ diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c index 44b5ae833082..eecbfdc7a2c9 100644 --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -1832,12 +1832,19 @@ static int wait_for_avail(struct snd_pcm_substream *substream, if (runtime->no_period_wakeup) wait_time = MAX_SCHEDULE_TIMEOUT; else { - wait_time = 10; - if (runtime->rate) { - long t = runtime->period_size * 2 / runtime->rate; - wait_time = max(t, wait_time); + /* use wait time from substream if available */ + if (substream->wait_time) { + wait_time = substream->wait_time; + } else { + wait_time = 10; + + if (runtime->rate) { + long t = runtime->period_size * 2 / + runtime->rate; + wait_time = max(t, wait_time); + } + wait_time = msecs_to_jiffies(wait_time * 1000); } - wait_time = msecs_to_jiffies(wait_time * 1000); } for (;;) { -- 2.17.1

3 2

[alsa-devel] KASAN: slab-out-of-bounds Read in default_write_copy_kernel
by syzbot 20 Mar '19

20 Mar '19

Hello, syzbot found the following crash on: HEAD commit: 7c98a4261827 Merge tag 'ceph-for-4.20-rc4' of https://gith.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=142c8893400000 kernel config: https://syzkaller.appspot.com/x/.config?x=73e2bc0cb6463446 dashboard link: https://syzkaller.appspot.com/bug?extid=d4503ae45b65c5bc1194 compiler: gcc (GCC) 8.0.1 20180413 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1789354d400000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=162ebe2b400000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+d4503ae45b65c5bc1194(a)syzkaller.appspotmail.com RDX: 0000000056da83a0 RSI: 00000000200000c0 RDI: 0000000000000004 RBP: 00000000006cf018 R08: 0000000000000001 R09: 0000000000000037 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 ================================================================== BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:352 [inline] BUG: KASAN: slab-out-of-bounds in default_write_copy_kernel+0xe1/0x140 sound/core/pcm_lib.c:1946 Read of size 64 at addr ffff8881cee03c40 by task syz-executor636/6021 CPU: 1 PID: 6021 Comm: syz-executor636 Not tainted 4.20.0-rc3+ #347 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 memcpy+0x23/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:352 [inline] default_write_copy_kernel+0xe1/0x140 sound/core/pcm_lib.c:1946 interleaved_copy+0xd1/0x110 sound/core/pcm_lib.c:2007 __snd_pcm_lib_xfer+0x115f/0x1f23 sound/core/pcm_lib.c:2227 snd_pcm_oss_write3+0xe9/0x220 sound/core/oss/pcm_oss.c:1237 io_playback_transfer+0x27d/0x310 sound/core/oss/io.c:47 snd_pcm_plug_write_transfer+0x374/0x490 sound/core/oss/pcm_plugin.c:620 snd_pcm_oss_write2+0x25d/0x450 sound/core/oss/pcm_oss.c:1366 snd_pcm_oss_write1 sound/core/oss/pcm_oss.c:1432 [inline] snd_pcm_oss_write+0x567/0xa60 sound/core/oss/pcm_oss.c:2775 __vfs_write+0x119/0x9f0 fs/read_write.c:485 vfs_write+0x1fc/0x560 fs/read_write.c:549 ksys_write+0x101/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x444119 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffdf4510538 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000444119 RDX: 0000000056da83a0 RSI: 00000000200000c0 RDI: 0000000000000004 RBP: 00000000006cf018 R08: 0000000000000001 R09: 0000000000000037 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 Allocated by task 6021: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 __do_kmalloc_node mm/slab.c:3684 [inline] __kmalloc_node+0x50/0x70 mm/slab.c:3691 kmalloc_node include/linux/slab.h:589 [inline] kvmalloc_node+0x65/0xf0 mm/util.c:416 kvmalloc include/linux/mm.h:577 [inline] kvzalloc include/linux/mm.h:585 [inline] snd_pcm_plugin_alloc+0x577/0x770 sound/core/oss/pcm_plugin.c:70 snd_pcm_plug_alloc+0x218/0x340 sound/core/oss/pcm_plugin.c:117 snd_pcm_oss_change_params_locked+0x2209/0x3c60 sound/core/oss/pcm_oss.c:1038 snd_pcm_oss_make_ready_locked+0xbc/0x130 sound/core/oss/pcm_oss.c:1183 snd_pcm_oss_write1 sound/core/oss/pcm_oss.c:1397 [inline] snd_pcm_oss_write+0x51e/0xa60 sound/core/oss/pcm_oss.c:2775 __vfs_write+0x119/0x9f0 fs/read_write.c:485 vfs_write+0x1fc/0x560 fs/read_write.c:549 ksys_write+0x101/0x260 fs/read_write.c:598 __do_sys_write fs/read_write.c:610 [inline] __se_sys_write fs/read_write.c:607 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:607 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 2446: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xcf/0x230 mm/slab.c:3817 blk_mq_hw_sysfs_release+0x42/0x60 block/blk-mq-sysfs.c:25 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:70 [inline] kobject_put.cold.9+0x287/0x2e4 lib/kobject.c:708 blk_mq_release+0xf2/0x210 block/blk-mq.c:2478 __blk_release_queue+0x228/0x510 block/blk-sysfs.c:862 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff8881cee03c40 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes inside of 32-byte region [ffff8881cee03c40, ffff8881cee03c60) The buggy address belongs to the page: page:ffffea00073b80c0 count:1 mapcount:0 mapping:ffff8881da8001c0 index:0xffff8881cee03fc1 flags: 0x2fffc0000000200(slab) raw: 02fffc0000000200 ffffea0007433308 ffff8881da801248 ffff8881da8001c0 raw: ffff8881cee03fc1 ffff8881cee03000 000000010000003f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881cee03b00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff8881cee03b80: fb fb fb fb fc fc fc fc 00 fc fc fc fc fc fc fc > ffff8881cee03c00: fb fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc ^ ffff8881cee03c80: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ffff8881cee03d00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 1

[alsa-devel] KASAN: slab-out-of-bounds Write in default_read_copy_kernel
by syzbot 19 Mar '19

19 Mar '19

Hello, syzbot found the following crash on: HEAD commit: abb8d6ecbd8f Merge tag 'trace-v4.20-rc5' of git://git.kern.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=17932f4d400000 kernel config: https://syzkaller.appspot.com/x/.config?x=b9cc5a440391cbfd dashboard link: https://syzkaller.appspot.com/bug?extid=12f17c177de05efea72d compiler: gcc (GCC) 8.0.1 20180413 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16c27125400000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=152a2a43400000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+12f17c177de05efea72d(a)syzkaller.appspotmail.com RDX: 0000000000000001 RSI: 0000000020001640 RDI: 0000000000000003 RBP: 00000000006cf018 R08: 0000000000000001 R09: 0000000000000037 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 ================================================================== BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:352 [inline] BUG: KASAN: slab-out-of-bounds in default_read_copy_kernel+0xe1/0x140 sound/core/pcm_lib.c:1988 Write of size 64 at addr ffff8881cec699c0 by task syz-executor520/6056 CPU: 1 PID: 6056 Comm: syz-executor520 Not tainted 4.20.0-rc5+ #365 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 memcpy+0x37/0x50 mm/kasan/kasan.c:303 memcpy include/linux/string.h:352 [inline] default_read_copy_kernel+0xe1/0x140 sound/core/pcm_lib.c:1988 interleaved_copy+0xd1/0x110 sound/core/pcm_lib.c:2007 __snd_pcm_lib_xfer+0x115f/0x1f23 sound/core/pcm_lib.c:2227 snd_pcm_oss_read3+0x1c8/0x410 sound/core/oss/pcm_oss.c:1274 io_capture_transfer+0x27d/0x310 sound/core/oss/io.c:73 snd_pcm_plug_read_transfer+0x1d7/0x3b0 sound/core/oss/pcm_plugin.c:651 snd_pcm_oss_read2+0x221/0x450 sound/core/oss/pcm_oss.c:1474 snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1531 [inline] snd_pcm_oss_read+0x638/0x830 sound/core/oss/pcm_oss.c:2752 do_loop_readv_writev fs/read_write.c:700 [inline] do_iter_read+0x4a3/0x650 fs/read_write.c:924 vfs_readv+0x175/0x1c0 fs/read_write.c:986 do_readv+0x11a/0x310 fs/read_write.c:1019 __do_sys_readv fs/read_write.c:1106 [inline] __se_sys_readv fs/read_write.c:1103 [inline] __x64_sys_readv+0x75/0xb0 fs/read_write.c:1103 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x444079 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffc8067a328 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000444079 RDX: 0000000000000001 RSI: 0000000020001640 RDI: 0000000000000003 RBP: 00000000006cf018 R08: 0000000000000001 R09: 0000000000000037 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 R13: ffffffffffffffff R14: 0000000000000000 R15: 0000000000000000 Allocated by task 6056: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 __do_kmalloc_node mm/slab.c:3684 [inline] __kmalloc_node+0x50/0x70 mm/slab.c:3691 kmalloc_node include/linux/slab.h:589 [inline] kvmalloc_node+0x65/0xf0 mm/util.c:416 kvmalloc include/linux/mm.h:577 [inline] kvzalloc include/linux/mm.h:585 [inline] snd_pcm_plugin_alloc+0x577/0x770 sound/core/oss/pcm_plugin.c:70 snd_pcm_plug_alloc+0x149/0x340 sound/core/oss/pcm_plugin.c:129 snd_pcm_oss_change_params_locked+0x2209/0x3c60 sound/core/oss/pcm_oss.c:1038 snd_pcm_oss_make_ready_locked+0xbc/0x130 sound/core/oss/pcm_oss.c:1183 snd_pcm_oss_read1 sound/core/oss/pcm_oss.c:1507 [inline] snd_pcm_oss_read+0x417/0x830 sound/core/oss/pcm_oss.c:2752 do_loop_readv_writev fs/read_write.c:700 [inline] do_iter_read+0x4a3/0x650 fs/read_write.c:924 vfs_readv+0x175/0x1c0 fs/read_write.c:986 do_readv+0x11a/0x310 fs/read_write.c:1019 __do_sys_readv fs/read_write.c:1106 [inline] __se_sys_readv fs/read_write.c:1103 [inline] __x64_sys_readv+0x75/0xb0 fs/read_write.c:1103 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 9: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xcf/0x230 mm/slab.c:3817 kzfree+0x28/0x30 mm/slab_common.c:1564 aa_free_task_ctx security/apparmor/include/task.h:61 [inline] apparmor_task_free+0x13a/0x1e0 security/apparmor/lsm.c:95 security_task_free+0x4a/0x80 security/security.c:1007 __put_task_struct+0x195/0x620 kernel/fork.c:724 put_task_struct include/linux/sched/task.h:96 [inline] delayed_put_task_struct+0x2ff/0x4c0 kernel/exit.c:181 __rcu_reclaim kernel/rcu/rcu.h:240 [inline] rcu_do_batch kernel/rcu/tree.c:2437 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2716 [inline] rcu_process_callbacks+0x100a/0x1ac0 kernel/rcu/tree.c:2697 __do_softirq+0x308/0xb7e kernel/softirq.c:292 The buggy address belongs to the object at ffff8881cec699c0 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes inside of 32-byte region [ffff8881cec699c0, ffff8881cec699e0) The buggy address belongs to the page: page:ffffea00073b1a40 count:1 mapcount:0 mapping:ffff8881da8001c0 index:0xffff8881cec69fc1 flags: 0x2fffc0000000200(slab) raw: 02fffc0000000200 ffffea00073a3748 ffff8881da801248 ffff8881da8001c0 raw: ffff8881cec69fc1 ffff8881cec69000 000000010000003f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881cec69880: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff8881cec69900: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc > ffff8881cec69980: fb fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc ^ ffff8881cec69a00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff8881cec69a80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

2 2

[alsa-devel] snd_hda_codec_hdmi: `hdaudio hdaudioC0D2: Unable to bind the codec`
by Paul Menzel 18 Feb '19

18 Feb '19

Dear Linux folks, With drm-tip (v4.19-rc3-946-g09b295662edd) Linux prints `snd_hda_codec_hdmi hdaudioC0D2: No i915 binding for Intel HDMI/DP codec` to the log. ``` […] [ 12.481788] snd_hda_codec_realtek hdaudioC0D0: autoconfig for ALC671: line_outs=1 (0x21/0x0/0x0/0x0/0x0) type:line [ 12.482536] snd_hda_codec_realtek hdaudioC0D0: speaker_outs=1 (0x17/0x0/0x0/0x0/0x0) [ 12.483184] snd_hda_codec_realtek hdaudioC0D0: hp_outs=1 (0x14/0x0/0x0/0x0/0x0) [ 12.483737] snd_hda_codec_realtek hdaudioC0D0: mono: mono_out=0x0 [ 12.484198] snd_hda_codec_realtek hdaudioC0D0: inputs: [ 12.484582] snd_hda_codec_realtek hdaudioC0D0: Front Mic=0x19 [ 12.485100] snd_hda_codec_realtek hdaudioC0D0: Rear Mic=0x18 [ 12.485519] snd_hda_codec_realtek hdaudioC0D0: Line=0x1a [ 12.497685] snd_hda_codec_hdmi hdaudioC0D2: No i915 binding for Intel HDMI/DP codec [ 12.498311] hdaudio hdaudioC0D2: Unable to bind the codec [ 12.498789] input: HDA Intel PCH Front Mic as /devices/pci0000:00/0000:00:1f.3/sound/card0/input6 [ 12.499567] input: HDA Intel PCH Rear Mic as /devices/pci0000:00/0000:00:1f.3/sound/card0/input7 [ 12.500268] input: HDA Intel PCH Line as /devices/pci0000:00/0000:00:1f.3/sound/card0/input8 [ 12.501039] input: HDA Intel PCH Line Out as /devices/pci0000:00/0000:00:1f.3/sound/card0/input9 [ 12.501683] input: HDA Intel PCH Front Headphone as /devices/pci0000:00/0000:00:1f.3/sound/card0/input10 [ 17.743338] [drm:intel_pch_type [i915]] Found SunrisePoint PCH […] ``` Is that an error or just a notice? Kind regards, Paul

2 12

[alsa-devel] [PATCH] ASoC: Use __printf markup to silence compiler
by Mathieu Malaterre 12 Feb '19

12 Feb '19

Silence warnings (triggered at W=1) by adding relevant __printf attributes. sound/soc/soc-dapm.c:149:2: warning: function 'pop_dbg' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] Signed-off-by: Mathieu Malaterre <malat(a)debian.org> --- sound/soc/soc-dapm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index a5178845065b..92a2e7dab5fe 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -133,6 +133,7 @@ static void pop_wait(u32 pop_time) schedule_timeout_uninterruptible(msecs_to_jiffies(pop_time)); } +__printf(3, 4) static void pop_dbg(struct device *dev, u32 pop_time, const char *fmt, ...) { va_list args; -- 2.19.2

2 1

[alsa-devel] [PATCH 0/2][RFC] ASoC: soc-core: modern style dai_link control
by Kuninori Morimoto 12 Feb '19

12 Feb '19

Hi Mark These are [RFC] patches which adds new rule for modern style dai_link. Many sound are using CPU component as Platform component, and then it has below settings on legacy style dai_link dai_link->platform_of_node = dai_link->cpu_of_node But, this duplicated component will be just ignored because it is already selected when CPU component binding. We want to allow "no Platform" on modern style dai_link. And, current legacy style dai_link allows no Platform settings, then, soc-core will select snd-soc-dummy platform for it automatically. In modern style, we need to have CPU/Codec/Platform as array/pointer style. Thus, this kind of "implicit" selection will be just un-understandable. These 2 patches adds new rule for modern style, and have no effect to legacy style. But, I can't test for *all* board/situation. Thus, I added [RFC] for these. Kuninori Morimoto (2): ASoC: soc-core: allow no Platform on dai_link ASoC: soc-core: no more implicit snd-soc-dummy platform on modern dai_link include/sound/soc.h | 2 +- sound/soc/generic/simple-card-utils.c | 4 ++ sound/soc/soc-core.c | 80 ++++++++++++++++++++++------------- 3 files changed, 56 insertions(+), 30 deletions(-) -- 2.7.4

3 11

[alsa-devel] pcm_dshare calculates size incorrectly on buffer rollover
by Brendan Shanks 11 Feb '19

11 Feb '19

I'm working on an embedded system based on an Ambarella H1 SoC (32-bit ARM Cortex A9). Audio playback through ALSA (and GStreamer) works fine when playing to the raw hw device. When playing through dshare (my normal configuration), playback stops after exactly 7 hours 16 minutes, for about 3 minutes. During the 3 minutes, the playback thread consumes an entire CPU core. After the 3 minutes, GStreamer reports an xrun, recovers from it, and playback goes back to normal. After some debugging, the problem seems to be in snd_pcm_dshare_sync_area(). When dshare->appl_ptr rolls over to 0, 'size' becomes huge, 3036676576. 'slave_size' is also much bigger than it should be, 1258291680. This is what 'size' is set to when the for loop starts, and I believe the for loop then spends ~3 minutes copying a huge amount of samples. This also explains the 7h16m time, it's linked to the PCM boundary which is 1258291200. At 48 kHz, 1258291200 samples takes 7h16m54s. I'm not sure what the fix should be though. Is this really a bug in dshare, or are bad values being set somewhere else? GStreamer? Or maybe the period/buffer size (480/9600) is causing problems? Any advice is appreciated, my modified snd_pcm_dshare_sync_area() and the output are below. Brendan Shanks $ more /proc/asound/card0/pcm1p/sub0/hw_params access: MMAP_INTERLEAVED format: S16_LE subformat: STD channels: 4 rate: 48000 (48000/1) period_size: 480 buffer_size: 9600 $ more /proc/asound/card0/pcm1p/sub0/sw_params tstamp_mode: ENABLE period_step: 1 avail_min: 480 start_threshold: 1 stop_threshold: 1258291200 silence_threshold: 0 silence_size: 1258291200 boundary: 1258291200 --- output from running 'gst-launch-1.0 -e audiotestsrc ! alsasink' with prints included as below snd_pcm_dshare_sync_area size 3036676576, dshare->appl_ptr 0 dshare->last_appl_ptr 1258290720 slave_hw_ptr1 1258282080 slave_period_size 480 slave_hw_ptr2 1258282080 slave_buffer_size 9600 slave_hw_ptr3 1258291680 slave_boundary 1258291200 slave_hw_ptr4 1258291680 slave_appl_ptr 0 slave_size1 1258291680 size 1258291680 appl_ptr 9120 size 1258291680 boundary 1258291200 last_appl_ptr 0 slave_appl_ptr 0 dshare->slave_appl_ptr 480 exiting snd_pcm_dshare_sync_area size 3036676576, dshare->appl_ptr 0 dshare->last_appl_ptr 1258290720 slave_hw_ptr1 8965920 slave_period_size 480 slave_hw_ptr2 8965920 slave_buffer_size 9600 slave_hw_ptr3 8975520 slave_boundary 1258291200 slave_hw_ptr4 8975520 slave_appl_ptr 8975040 slave_size1 480 size 480 appl_ptr 9120 size 480 boundary 1258291200 last_appl_ptr 0 slave_appl_ptr 8640 dshare->slave_appl_ptr 8975520 exiting --- snd_pcm_dshare_sync_area() from alsa-lib-1.1.6 with prints added: static void snd_pcm_dshare_sync_area(snd_pcm_t *pcm) { snd_pcm_direct_t *dshare = pcm->private_data; snd_pcm_uframes_t slave_hw_ptr, slave_appl_ptr, slave_size; snd_pcm_uframes_t appl_ptr, size; const snd_pcm_channel_area_t *src_areas, *dst_areas; int print = 0; /* calculate the size to transfer */ size = dshare->appl_ptr - dshare->last_appl_ptr; if (! size) return; if (size > 9600) { printf("snd_pcm_dshare_sync_area size %lu, dshare->appl_ptr %lu dshare->last_appl_ptr %lu\n", size, dshare->appl_ptr, dshare->last_appl_ptr); print = 1; } slave_hw_ptr = dshare->slave_hw_ptr; if (print) printf("slave_hw_ptr1 %lu slave_period_size %lu", slave_hw_ptr, dshare->slave_period_size); /* don't write on the last active period - this area may be cleared * by the driver during write operation... */ slave_hw_ptr -= slave_hw_ptr % dshare->slave_period_size; if (print) printf("slave_hw_ptr2 %lu slave_buffer_size %lu", slave_hw_ptr, dshare->slave_buffer_size); slave_hw_ptr += dshare->slave_buffer_size; if (print) printf("slave_hw_ptr3 %lu slave_boundary %lu", slave_hw_ptr, dshare->slave_boundary); if (dshare->slave_hw_ptr > dshare->slave_boundary) slave_hw_ptr -= dshare->slave_boundary; if (print) printf("slave_hw_ptr4 %lu slave_appl_ptr %lu", slave_hw_ptr, dshare->slave_appl_ptr); if (slave_hw_ptr < dshare->slave_appl_ptr) slave_size = slave_hw_ptr + (dshare->slave_boundary - dshare->slave_appl_ptr); else slave_size = slave_hw_ptr - dshare->slave_appl_ptr; if (print) printf("slave_size1 %lu", slave_size); if (slave_size < size) size = slave_size; if (! size) return; if (print) printf("size %lu", size); /* add sample areas here */ src_areas = snd_pcm_mmap_areas(pcm); dst_areas = snd_pcm_mmap_areas(dshare->spcm); appl_ptr = dshare->last_appl_ptr % pcm->buffer_size; if (print) printf("appl_ptr %lu size %lu boundary %lu", appl_ptr, size, pcm->boundary); dshare->last_appl_ptr += size; dshare->last_appl_ptr %= pcm->boundary; if (print) printf("last_appl_ptr %lu", dshare->last_appl_ptr); slave_appl_ptr = dshare->slave_appl_ptr % dshare->slave_buffer_size; if (print) printf("slave_appl_ptr %lu", slave_appl_ptr); dshare->slave_appl_ptr += size; dshare->slave_appl_ptr %= dshare->slave_boundary; if (print) printf("dshare->slave_appl_ptr %lu", dshare->slave_appl_ptr); for (;;) { snd_pcm_uframes_t transfer = size; if (appl_ptr + transfer > pcm->buffer_size) transfer = pcm->buffer_size - appl_ptr; if (slave_appl_ptr + transfer > dshare->slave_buffer_size) transfer = dshare->slave_buffer_size - slave_appl_ptr; share_areas(dshare, src_areas, dst_areas, appl_ptr, slave_appl_ptr, transfer); size -= transfer; if (! size) break; slave_appl_ptr += transfer; slave_appl_ptr %= dshare->slave_buffer_size; appl_ptr += transfer; appl_ptr %= pcm->buffer_size; } if (print) printf("exiting");

2 2

[alsa-devel] [PATCH 1/1] seq: arecordmidi: Add num-events option
by pmalani＠chromium.org 11 Feb '19

11 Feb '19

From: Prashant Malani <pmalani(a)chromium.org> Add a command line option to automatically exit after recording a fixed number of MIDI events. This allows a program using arecordmidi to expect a MIDI file to be written automatically when the specified number of events have been received, instead of having to send a SIGINT or SIGTERM programmatically. It also avoids the need to have the arecordmidi process running in the background, and then constantly stat the output file to check if any bytes have been written to it (this makes for less predictable and longer-running tests). This functionality finds use in Chrome OS functional testing, since having to send SIGTERM/SIGINT programmatically and then wait for the output file adds unpredictability and delay to the tests. The addition of this command-line option should (hopefully) not break any existing usage. Signed-off-by: Prashant Malani <pmalani(a)chromium.org> diff --git a/seq/aplaymidi/arecordmidi.c b/seq/aplaymidi/arecordmidi.c index 19dbb7d..ca25bfa 100644 --- a/seq/aplaymidi/arecordmidi.c +++ b/seq/aplaymidi/arecordmidi.c @@ -690,7 +690,8 @@ static void help(const char *argv0) " -t,--ticks=ticks resolution in ticks per beat or frame\n" " -s,--split-channels create a track for each channel\n" " -m,--metronome=client:port play a metronome signal\n" - " -i,--timesig=nn:dd time signature\n", + " -i,--timesig=nn:dd time signature\n" + " -n,--num-events=events fixed number of events to record, then exit\n", argv0); } @@ -706,7 +707,7 @@ static void sighandler(int sig) int main(int argc, char *argv[]) { - static const char short_options[] = "hVlp:b:f:t:sdm:i:"; + static const char short_options[] = "hVlp:b:f:t:sdm:i:n:"; static const struct option long_options[] = { {"help", 0, NULL, 'h'}, {"version", 0, NULL, 'V'}, @@ -719,6 +720,7 @@ int main(int argc, char *argv[]) {"dump", 0, NULL, 'd'}, {"metronome", 1, NULL, 'm'}, {"timesig", 1, NULL, 'i'}, + {"num-events", 1, NULL, 'n'}, { } }; @@ -727,6 +729,9 @@ int main(int argc, char *argv[]) struct pollfd *pfds; int npfds; int c, err; + /* If |num_events| isn't specified, leave it at 0. */ + int num_events = 0; + int events_received = 0; init_seq(); @@ -775,6 +780,11 @@ int main(int argc, char *argv[]) case 'i': time_signature(optarg); break; + case 'n': + num_events = atoi(optarg); + if (num_events <= 0) + fatal("num_events must be greater than 0"); + break; default: help(argv[0]); return 1; @@ -864,13 +874,20 @@ int main(int argc, char *argv[]) err = snd_seq_event_input(seq, &event); if (err < 0) break; - if (event) + if (event) { record_event(event); + events_received++; + } } while (err > 0); if (stop) break; + if (num_events && (events_received == num_events)) + break; } + if (num_events && events_received < num_events) + fputs("Warning: Received signal before num_events\n", stdout); + finish_tracks(); write_file(); -- 2.20.1.495.gaa96b0ce6b-goog

5 10