April 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH 2/3] ASoC: add hikey960-i2s DT bindings
by Pengcheng Li 10 Apr '19

10 Apr '19

From: Youlin Wang <wangyoulin1(a)hisilicon.com> Adds DT bindings documentation for the hikey960-i2s driver and audio card device. Signed-off-by: Youlin Wang <wangyoulin1(a)hisilicon.com> Signed-off-by: Tanglei Han <hantanglei(a)huawei.com> Signed-off-by: Guangke Ji <jiguangke(a)huawei.com> Signed-off-by: Feng Chen <puck.chen(a)hisilicon.com> Signed-off-by: Kaihua Zhong <zhongkaihua(a)huawei.com> Signed-off-by: Jun Chen <chenjun14(a)huawei.com> Signed-off-by: John Stultz <john.stultz(a)linaro.org> Signed-off-by: Yiping Xu <xuyiping(a)hisilicon.com> Signed-off-by: Pengcheng Li <lipengcheng8(a)huawei.com> --- .../bindings/sound/hisilicon,hi3660-i2s.txt | 49 ++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/hisilicon,hi3660-i2s.txt diff --git a/Documentation/devicetree/bindings/sound/hisilicon,hi3660-i2s.txt b/Documentation/devicetree/bindings/sound/hisilicon,hi3660-i2s.txt new file mode 100644 index 0000000..654c234 --- /dev/null +++ b/Documentation/devicetree/bindings/sound/hisilicon,hi3660-i2s.txt @@ -0,0 +1,49 @@ +* Hisilicon 6210 i2s controller + +Required properties: + +- compatible: should be one of the following: + - "hisilicon,hi3660-i2s-1.0" +- reg: physical base address of the i2s controller unit and length of + memory mapped region. +- interrupts: should contain the i2s interrupt. +- clocks: a list of phandle + clock-specifier pairs, one for each entry + in clock-names. +- clock-names: should contain following: + - "dacodec" + - "i2s-base" +- dmas: DMA specifiers for tx dma. See the DMA client binding, + Documentation/devicetree/bindings/dma/dma.txt +- dma-names: should be "tx" and "rx" +- hisilicon,sysctrl-syscon: phandle to sysctrl syscon +- #sound-dai-cells: Should be set to 1 (for multi-dai) + +Example for the hi3660 i2s controller: + + i2s2: hisi_i2s { + compatible = "hisilicon,hi3660-i2s-1.0"; + reg = <0x0 0xe804f800 0x0 0x400>, + <0x0 0xe804e000 0x0 0x400>; + pinctrl-names = "default"; + pinctrl-0 = <&i2s2_pmx_func &i2s2_cfg_func>; + dmas = <&asp_dmac 18 &asp_dmac 19>; + dma-names = "rx", "tx"; + #sound-dai-cells = <0>; + }; + + sound { + compatible = "simple-audio-card"; + simple-audio-card,name = "hikey-hdmi"; + simple-audio-card,format = "i2s"; + + simple-audio-card,bitclock-master = <&sound_master>; + simple-audio-card,frame-master = <&sound_master>; + + sound_master: simple-audio-card,cpu { + sound-dai = <&i2s2>; + }; + + simple-audio-card,codec { + sound-dai = <&adv7533>; + }; + }; -- 2.8.0

2 1

[alsa-devel] [PATCH v3 0/4] ASoC: fsl: audmix: remove "model" attribute and fix ref leaks
by Viorel Suman 10 Apr '19

10 Apr '19

The latest audmix patch-set (v5) had the "model" attribute removed as requested by Nicolin Chen, but looks like (v4) version of DAI driver reached "for-next" branch - fix this by removing "model" attribute. Asside of this fix object reference leaks in machine probe reported by Julia Lawall. Viorel Suman (4): ASoC: fsl_audmix: remove "model" attribute dt-bindings: fsl,audmix: remove "model" attribute ASoC: imx-audmix: fix object reference leaks in probe ASoC: fsl_audmix: cache pdev->dev pointer Changes since V1: a) Removed "model" attribute from dt-bindings documentation b) Adressed Daniel's comments Changes since V2: a) Cache pdev->dev pointer in fsl_audmix probe as suggested by Nicolin .../devicetree/bindings/sound/fsl,audmix.txt | 4 -- sound/soc/fsl/fsl_audmix.c | 61 ++++++++++++---------- sound/soc/fsl/imx-audmix.c | 4 ++ 3 files changed, 36 insertions(+), 33 deletions(-) -- 2.7.4

2 6

[alsa-devel] [PATCH 0/2] ALSA: timer: cleanups
by Takashi Iwai 10 Apr '19

10 Apr '19

Hi, this is just a minor cleanup sereies of ALSA timer code. No functional changes. Takashi === Takashi Iwai (2): ALSA: timer: Simplify error path in snd_timer_open() ALSA: timer: Coding style fixes sound/core/timer.c | 57 +++++++++++++++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 22 deletions(-) -- 2.16.4

1 3

[alsa-devel] [sound:topic/misc-core-fixes 16/17] sound/core/timer.c:348 snd_timer_open() warn: inconsistent returns 'mutex:&register_mutex'.
by Dan Carpenter 10 Apr '19

10 Apr '19

tree: https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git topic/misc-core-fixes head: 58e224117e101df0a90fa69ed8f32d6e1881c642 commit: 3d2ebce824f281b246de1f513f8863d95540df50 [16/17] ALSA: timer: Simplify error path in snd_timer_open() New smatch warnings: sound/core/timer.c:348 snd_timer_open() warn: inconsistent returns 'mutex:&register_mutex'. Locked on: line 309 Unlocked on: line 348 Old smatch warnings: sound/core/timer.c:1226 snd_timer_proc_read() error: we previously assumed 'timer->card' could be null (see line 1219) # https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?id=… git remote add sound https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git git remote update sound git checkout 3d2ebce824f281b246de1f513f8863d95540df50 vim +348 sound/core/timer.c 53d2f744 Takashi Iwai 2005-11-17 250 int snd_timer_open(struct snd_timer_instance **ti, 53d2f744 Takashi Iwai 2005-11-17 251 char *owner, struct snd_timer_id *tid, ^1da177e Linus Torvalds 2005-04-16 252 unsigned int slave_id) ^1da177e Linus Torvalds 2005-04-16 253 { 53d2f744 Takashi Iwai 2005-11-17 254 struct snd_timer *timer; 53d2f744 Takashi Iwai 2005-11-17 255 struct snd_timer_instance *timeri = NULL; 9b7d869e Takashi Iwai 2017-11-05 256 int err; ^1da177e Linus Torvalds 2005-04-16 257 3d2ebce8 Takashi Iwai 2019-03-28 258 mutex_lock(&register_mutex); ^1da177e Linus Torvalds 2005-04-16 259 if (tid->dev_class == SNDRV_TIMER_CLASS_SLAVE) { ^1da177e Linus Torvalds 2005-04-16 260 /* open a slave instance */ ^1da177e Linus Torvalds 2005-04-16 261 if (tid->dev_sclass <= SNDRV_TIMER_SCLASS_NONE || ^1da177e Linus Torvalds 2005-04-16 262 tid->dev_sclass > SNDRV_TIMER_SCLASS_OSS_SEQUENCER) { cf74dcf3 Takashi Iwai 2014-02-04 263 pr_debug("ALSA: timer: invalid slave class %i\n", cf74dcf3 Takashi Iwai 2014-02-04 264 tid->dev_sclass); 3d2ebce8 Takashi Iwai 2019-03-28 265 err = -EINVAL; 3d2ebce8 Takashi Iwai 2019-03-28 266 goto unlock; ^1da177e Linus Torvalds 2005-04-16 267 } ^1da177e Linus Torvalds 2005-04-16 268 timeri = snd_timer_instance_new(owner, NULL); 2fd43d11 Clemens Ladisch 2005-10-12 269 if (!timeri) { 3d2ebce8 Takashi Iwai 2019-03-28 270 err = -ENOMEM; 3d2ebce8 Takashi Iwai 2019-03-28 271 goto unlock; 2fd43d11 Clemens Ladisch 2005-10-12 272 } ^1da177e Linus Torvalds 2005-04-16 273 timeri->slave_class = tid->dev_sclass; ^1da177e Linus Torvalds 2005-04-16 274 timeri->slave_id = tid->device; ^1da177e Linus Torvalds 2005-04-16 275 timeri->flags |= SNDRV_TIMER_IFLG_SLAVE; ^1da177e Linus Torvalds 2005-04-16 276 list_add_tail(&timeri->open_list, &snd_timer_slave_list); 9b7d869e Takashi Iwai 2017-11-05 277 err = snd_timer_check_slave(timeri); 9b7d869e Takashi Iwai 2017-11-05 278 if (err < 0) { 9b7d869e Takashi Iwai 2017-11-05 279 snd_timer_close_locked(timeri); 9b7d869e Takashi Iwai 2017-11-05 280 timeri = NULL; 9b7d869e Takashi Iwai 2017-11-05 281 } 3d2ebce8 Takashi Iwai 2019-03-28 282 goto unlock; ^1da177e Linus Torvalds 2005-04-16 283 } ^1da177e Linus Torvalds 2005-04-16 284 ^1da177e Linus Torvalds 2005-04-16 285 /* open a master instance */ ^1da177e Linus Torvalds 2005-04-16 286 timer = snd_timer_find(tid); ee2da997 Johannes Berg 2008-07-09 287 #ifdef CONFIG_MODULES ee2da997 Johannes Berg 2008-07-09 288 if (!timer) { 1a60d4c5 Ingo Molnar 2006-01-16 289 mutex_unlock(&register_mutex); ^1da177e Linus Torvalds 2005-04-16 290 snd_timer_request(tid); 1a60d4c5 Ingo Molnar 2006-01-16 291 mutex_lock(&register_mutex); ^1da177e Linus Torvalds 2005-04-16 292 timer = snd_timer_find(tid); ^1da177e Linus Torvalds 2005-04-16 293 } ^1da177e Linus Torvalds 2005-04-16 294 #endif 2fd43d11 Clemens Ladisch 2005-10-12 295 if (!timer) { 3d2ebce8 Takashi Iwai 2019-03-28 296 err = -ENODEV; 3d2ebce8 Takashi Iwai 2019-03-28 297 goto unlock; 2fd43d11 Clemens Ladisch 2005-10-12 298 } ^1da177e Linus Torvalds 2005-04-16 299 if (!list_empty(&timer->open_list_head)) { 2fd43d11 Clemens Ladisch 2005-10-12 300 timeri = list_entry(timer->open_list_head.next, 53d2f744 Takashi Iwai 2005-11-17 301 struct snd_timer_instance, open_list); ^1da177e Linus Torvalds 2005-04-16 302 if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) { 3d2ebce8 Takashi Iwai 2019-03-28 303 err = -EBUSY; 3d2ebce8 Takashi Iwai 2019-03-28 304 timeri = NULL; 3d2ebce8 Takashi Iwai 2019-03-28 305 goto unlock; ^1da177e Linus Torvalds 2005-04-16 306 } ^1da177e Linus Torvalds 2005-04-16 307 } 9b7d869e Takashi Iwai 2017-11-05 308 if (timer->num_instances >= timer->max_instances) { 9b7d869e Takashi Iwai 2017-11-05 309 return -EBUSY; ^^^^^^^^^^^^^^ delete the stray return 3d2ebce8 Takashi Iwai 2019-03-28 310 goto unlock; ^^^^^^^^^^^ 9b7d869e Takashi Iwai 2017-11-05 311 } ^1da177e Linus Torvalds 2005-04-16 312 timeri = snd_timer_instance_new(owner, timer); 2fd43d11 Clemens Ladisch 2005-10-12 313 if (!timeri) { 3d2ebce8 Takashi Iwai 2019-03-28 314 err = -ENOMEM; 3d2ebce8 Takashi Iwai 2019-03-28 315 goto unlock; 2fd43d11 Clemens Ladisch 2005-10-12 316 } 230323da Takashi Iwai 2016-01-21 317 /* take a card refcount for safe disconnection */ 230323da Takashi Iwai 2016-01-21 318 if (timer->card) 230323da Takashi Iwai 2016-01-21 319 get_device(&timer->card->card_dev); ^1da177e Linus Torvalds 2005-04-16 320 timeri->slave_class = tid->dev_sclass; ^1da177e Linus Torvalds 2005-04-16 321 timeri->slave_id = slave_id; 8ddc0563 Vegard Nossum 2016-08-29 322 8ddc0563 Vegard Nossum 2016-08-29 323 if (list_empty(&timer->open_list_head) && timer->hw.open) { 3d2ebce8 Takashi Iwai 2019-03-28 324 err = timer->hw.open(timer); 8ddc0563 Vegard Nossum 2016-08-29 325 if (err) { 8ddc0563 Vegard Nossum 2016-08-29 326 kfree(timeri->owner); 8ddc0563 Vegard Nossum 2016-08-29 327 kfree(timeri); 3d2ebce8 Takashi Iwai 2019-03-28 328 timeri = NULL; 8ddc0563 Vegard Nossum 2016-08-29 329 8ddc0563 Vegard Nossum 2016-08-29 330 if (timer->card) 8ddc0563 Vegard Nossum 2016-08-29 331 put_device(&timer->card->card_dev); 8ddc0563 Vegard Nossum 2016-08-29 332 module_put(timer->module); 3d2ebce8 Takashi Iwai 2019-03-28 333 goto unlock; 8ddc0563 Vegard Nossum 2016-08-29 334 } 8ddc0563 Vegard Nossum 2016-08-29 335 } 8ddc0563 Vegard Nossum 2016-08-29 336 ^1da177e Linus Torvalds 2005-04-16 337 list_add_tail(&timeri->open_list, &timer->open_list_head); 9b7d869e Takashi Iwai 2017-11-05 338 timer->num_instances++; 9b7d869e Takashi Iwai 2017-11-05 339 err = snd_timer_check_master(timeri); 9b7d869e Takashi Iwai 2017-11-05 340 if (err < 0) { 9b7d869e Takashi Iwai 2017-11-05 341 snd_timer_close_locked(timeri); 9b7d869e Takashi Iwai 2017-11-05 342 timeri = NULL; 9b7d869e Takashi Iwai 2017-11-05 343 } 3d2ebce8 Takashi Iwai 2019-03-28 344 3d2ebce8 Takashi Iwai 2019-03-28 345 unlock: 1a60d4c5 Ingo Molnar 2006-01-16 346 mutex_unlock(&register_mutex); ^1da177e Linus Torvalds 2005-04-16 347 *ti = timeri; 9b7d869e Takashi Iwai 2017-11-05 @348 return err; ^1da177e Linus Torvalds 2005-04-16 349 } 98856392 Takashi Iwai 2017-06-16 350 EXPORT_SYMBOL(snd_timer_open); ^1da177e Linus Torvalds 2005-04-16 351 --- 0-DAY kernel test infrastructure Open Source Technology Center https://lists.01.org/pipermail/kbuild-all Intel Corporation

1 0

[alsa-devel] KASAN: use-after-free Read in snd_timer_process_callbacks
by syzbot 10 Apr '19

10 Apr '19

Hello, syzbot found the following crash on: HEAD commit: ac5b84a1 Add linux-next specific files for 20190408 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=10ae80b7200000 kernel config: https://syzkaller.appspot.com/x/.config?x=42a33a21877c9c95 dashboard link: https://syzkaller.appspot.com/bug?extid=58813d77154713f4de15 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=102b9f5d200000 The bug was bisected to: commit a7588c896b05444929ecb3d0115481988720abf6 Author: Takashi Iwai <tiwai(a)suse.de> Date: Wed Mar 27 15:56:08 2019 +0000 ALSA: timer: Check ack_list emptiness instead of bit flag bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1100d3ab200000 final crash: https://syzkaller.appspot.com/x/report.txt?x=1300d3ab200000 console output: https://syzkaller.appspot.com/x/log.txt?x=1500d3ab200000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+58813d77154713f4de15(a)syzkaller.appspotmail.com Fixes: a7588c896b05 ("ALSA: timer: Check ack_list emptiness instead of bit flag") ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xd2/0xf5 lib/list_debug.c:42 Read of size 8 at addr ffff8880a497a7a0 by task swapper/1/0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.1.0-rc3-next-20190408 #20 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 __list_del_entry_valid+0xd2/0xf5 lib/list_debug.c:42 __list_del_entry include/linux/list.h:117 [inline] list_del_init include/linux/list.h:176 [inline] snd_timer_process_callbacks+0x7f/0x2f0 sound/core/timer.c:763 snd_timer_interrupt sound/core/timer.c:883 [inline] snd_timer_interrupt+0x578/0xdd0 sound/core/timer.c:804 snd_hrtimer_callback+0x219/0x3e0 sound/core/hrtimer.c:64 __run_hrtimer kernel/time/hrtimer.c:1389 [inline] __hrtimer_run_queues+0x33e/0xde0 kernel/time/hrtimer.c:1451 hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline] smp_apic_timer_interrupt+0x120/0x570 arch/x86/kernel/apic/apic.c:1060 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:767 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x95/0xe0 kernel/locking/spinlock.c:184 Code: 48 c7 c0 70 9b 92 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 39 48 83 3d 22 d5 78 01 00 74 24 48 89 df 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 dc e1 33 fa 65 8b 05 25 27 e8 78 RSP: 0018:ffff8880ae907920 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff112536e RBX: 0000000000000282 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: ffff8880aa292bc0 RDI: 0000000000000282 RBP: ffff8880ae907930 R08: ffff8880aa292340 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888097bafab8 R13: ffff8880aa20bb00 R14: ffff888097baf8b0 R15: 0000000000000001 spin_unlock_irqrestore include/linux/spinlock.h:384 [inline] test_clear_page_writeback+0x397/0x13b0 mm/page-writeback.c:2741 end_page_writeback+0x22a/0x4f0 mm/filemap.c:1311 ext4_finish_bio+0x63e/0xb10 fs/ext4/page-io.c:119 ext4_end_bio+0x190/0x6a0 fs/ext4/page-io.c:343 bio_endio+0x5f8/0xad0 block/bio.c:1879 req_bio_endio block/blk-core.c:196 [inline] blk_update_request+0x317/0xba0 block/blk-core.c:1457 scsi_end_request+0x7f/0x860 drivers/scsi/scsi_lib.c:579 scsi_io_completion+0x20a/0x1420 drivers/scsi/scsi_lib.c:964 scsi_finish_command+0x3ba/0x670 drivers/scsi/scsi.c:219 scsi_softirq_done+0x33b/0x3e0 drivers/scsi/scsi_lib.c:1464 blk_done_softirq+0x304/0x4d0 block/blk-softirq.c:37 __do_softirq+0x266/0x95a kernel/softirq.c:293 invoke_softirq kernel/softirq.c:374 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:414 exiting_irq arch/x86/include/asm/apic.h:536 [inline] do_IRQ+0x114/0x1d0 arch/x86/kernel/irq.c:258 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:583 </IRQ> RIP: 0010:native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:58 Code: ff ff ff 48 89 c7 48 89 45 d8 e8 c9 80 8f fa 48 8b 45 d8 e9 ce fe ff ff 48 89 df e8 b8 80 8f fa eb 82 90 90 90 90 90 90 fb f4 <c3> 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f4 c3 90 90 90 90 90 90 RSP: 0018:ffff8880aa2a7d78 EFLAGS: 00000282 ORIG_RAX: ffffffffffffffdd RAX: 1ffffffff1125371 RBX: ffff8880aa292340 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000006 RDI: ffff8880aa292bbc RBP: ffff8880aa2a7da8 R08: ffff8880aa292340 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffffffff88929b78 R14: 0000000000000001 R15: 0000000000000000 arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:567 default_idle_call+0x36/0x90 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x386/0x570 kernel/sched/idle.c:262 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:353 start_secondary+0x360/0x4d0 arch/x86/kernel/smpboot.c:267 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Allocated by task 7668: save_stack+0x45/0xd0 mm/kasan/common.c:75 set_track mm/kasan/common.c:87 [inline] __kasan_kmalloc mm/kasan/common.c:497 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:470 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:511 kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3621 kmalloc include/linux/slab.h:547 [inline] kzalloc include/linux/slab.h:742 [inline] snd_timer_instance_new+0x4f/0x3d0 sound/core/timer.c:109 snd_timer_open+0x8a7/0x1760 sound/core/timer.c:313 snd_seq_timer_open+0x240/0x590 sound/core/seq/seq_timer.c:290 queue_use+0xcb/0x240 sound/core/seq/seq_queue.c:502 snd_seq_queue_alloc+0x2c5/0x4d0 sound/core/seq/seq_queue.c:189 snd_seq_ioctl_create_queue+0xb0/0x330 sound/core/seq/seq_clientmgr.c:1522 snd_seq_ioctl+0x224/0x3e0 sound/core/seq/seq_clientmgr.c:2138 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 7668: save_stack+0x45/0xd0 mm/kasan/common.c:75 set_track mm/kasan/common.c:87 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:459 kasan_slab_free+0xe/0x10 mm/kasan/common.c:467 __cache_free mm/slab.c:3498 [inline] kfree+0xcf/0x230 mm/slab.c:3821 snd_timer_close_locked+0x6fd/0xd60 sound/core/timer.c:405 snd_timer_close+0x2e/0x70 sound/core/timer.c:430 snd_seq_timer_close+0x91/0xd0 sound/core/seq/seq_timer.c:329 queue_delete+0x52/0xb0 sound/core/seq/seq_queue.c:147 snd_seq_queue_client_leave+0x36/0x170 sound/core/seq/seq_queue.c:584 seq_free_client1.part.0+0xf3/0x270 sound/core/seq/seq_clientmgr.c:263 seq_free_client1 sound/core/seq/seq_clientmgr.c:256 [inline] seq_free_client+0x80/0xf0 sound/core/seq/seq_clientmgr.c:285 snd_seq_release+0x55/0xf0 sound/core/seq/seq_clientmgr.c:366 __fput+0x2e5/0x8d0 fs/file_table.c:278 ____fput+0x16/0x20 fs/file_table.c:309 task_work_run+0x14a/0x1c0 kernel/task_work.c:113 get_signal+0x1961/0x1d50 kernel/signal.c:2391 do_signal+0x87/0x1940 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880a497a700 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 160 bytes inside of 256-byte region [ffff8880a497a700, ffff8880a497a800) The buggy address belongs to the page: page:ffffea0002925e80 count:1 mapcount:0 mapping:ffff88812c3f07c0 index:0xffff8880a497a200 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffff88812c3f1638 ffff88812c3f1638 ffff88812c3f07c0 raw: ffff8880a497a200 ffff8880a497a0c0 000000010000000b 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a497a680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a497a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff8880a497a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880a497a800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a497a880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 1

[alsa-devel] [PATCH V1] ASoC: fsl_esai: replace fall-through with break
by S.j. Wang 10 Apr '19

10 Apr '19

case ESAI_HCKT_EXTAL and case ESAI_HCKR_EXTAL should be independent of each other, so replace fall-through with break. Fixes: 16bbeb2b43c3 ("ASoC: fsl_esai: Mark expected switch fall-through") Signed-off-by: Shengjiu Wang <shengjiu.wang(a)nxp.com> --- sound/soc/fsl/fsl_esai.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c index c7410bbfd2af..bad0dfed6b68 100644 --- a/sound/soc/fsl/fsl_esai.c +++ b/sound/soc/fsl/fsl_esai.c @@ -251,7 +251,7 @@ static int fsl_esai_set_dai_sysclk(struct snd_soc_dai *dai, int clk_id, break; case ESAI_HCKT_EXTAL: ecr |= ESAI_ECR_ETI; - /* fall through */ + break; case ESAI_HCKR_EXTAL: ecr |= esai_priv->synchronous ? ESAI_ECR_ETI : ESAI_ECR_ERI; break; -- 1.9.1

3 7

[alsa-devel] [PATCH 0/5] ALSA: seq: More cleanups and fixes
by Takashi Iwai 09 Apr '19

09 Apr '19

Hi, this is a patchset for ALSA sequencer to clean up / minor improvement of some code as well as the fixes for remaining issues caught (spontaneously) by syzkaller. Takashi === Takashi Iwai (5): ALSA: seq: Use kvmalloc() for cell pools ALSA: seq: Align temporary re-locking with irqsave version ALSA: seq: Remove superfluous irqsave flags ALSA: seq: Protect in-kernel ioctl calls with mutex ALSA: seq: Fix race of get-subscription call vs port-delete ioctls sound/core/seq/seq_clientmgr.c | 38 +++++++++++++++++--------------------- sound/core/seq/seq_fifo.c | 14 ++++++-------- sound/core/seq/seq_memory.c | 30 ++++++++++++++---------------- sound/core/seq/seq_ports.c | 28 ++++++++++++++-------------- sound/core/seq/seq_ports.h | 5 +++-- 5 files changed, 54 insertions(+), 61 deletions(-) -- 2.16.4

1 5

[alsa-devel] [PATCH v5 00/14] ASoC: Sound Open Firmware (SOF) core
by Pierre-Louis Bossart 09 Apr '19

09 Apr '19

Sound Open Firmware (SOF) is a host and DSP architecture agnostic audio DSP firmware. SOF is not tied to any specific host architecture or any specific physical IO communication type (it will work with on SoC DSPs, or DSP connected via SPI/I2C). SOF is also not coupled to any particular DSP architecture and has abstraction similar to Linux to allow porting to other DSP architectures. https://www.sofproject.org/ This patch series introduces the SOF core and utilities. Support for Intel devices is provided as a follow-up series. The SOF core manages all the core DSP services and ALSA/ASoC IO. The core is responsible for loading firmware, parsing topology, exposing PCMs and kcontrols, providing debug and trace mechanisms and performing IPC between host and DSP. The SOF core also has logic to allow reuse of existing machine drivers for other platforms/machines without any code modification. i.e. DAI links can be modified at runtime to bind with SOF and SOF topologies instead of existing hard coded DAI links and topology. Future patches will simplify the IPC interface to allow e.g. for the use of RPMsg or mailboxes on other hardware, the changes are not included just yet. This patchset is dependent on 3 patches already shared on alsa-devel but not yet merged: ASoC: topology: Align tplg pointer increment across all kcontrols ASoC: core: support driver alias names for FE topology overrides ASoC: dapm: set power_check callback for widgets that shouldnt be always on Changes since v4: feedback from Mark: Removed need for private field in soc_runtime Completely reworked IPC, now much simpler and robust. IPC refactoring work will continue to e.g. allow for different types of IPC hardware and a better split between core and platform-specific drivers. Feedback from Takashi: Clarified endianness and alignment issues for page tables Removed useless mutexes Removed unneeded initializations, return types and wrappers Use snd_mask_set_format() Trace code flow optimization Removed checks on preallocate_pages() Test status of open/close functions. Released reference when pm_runtime_get_sync fails Fixed multiple memory allocation issues Fixed static analysis warnings Fixed error checks with copy_to_user() Added support for multi-core DSPs Fixed leaked references with firmware handling on resume Multiple topology fixes/improvements (enum/switch, mux, removal of duplicate connections, widget power not reported as ON) Code simplifications (removed set-but-unused, typecasts, etc). Changes since v3: Addressed dozens ofcomments from Takashi Iwai, Mark Brown, Andy Shevchenko, Daniel Baluta (Thanks!) Hardened memory allocation, fixed module load/unload oops or errors (now at hundreds of cycles on ApolloLake devices) Fixed suspend/resume and removed use of suspend_late, now using snd_soc_pm_ops and standard flow Fixed topology free (multiple patches already contributed for ASoC-core) Fixed debugfs/pm_runtime interaction Removed error checks on debugfs, changed to EXPORT_SYMBOL_GPL Added filenames in debug messages, ues hex_dump_to_buffer Removed "sof-audio" platform device and added better error checks on probe Reworked data structures to remove mix of const/variable fields and duplication of pointers for platform-specific changes Removed redundant ops tables Fixed trace/logger issues Fixed issues with loader (alignment and block size errors) Fixed release_firmware handling (was all over the place) Simplified PCI handling Added comments on non-atomic triggers Removed enum controls (not supported in topology) Simplified include file dependencies Fix cppcheck warnings Fixed Kconfigs to deal with Kbuild warnings on exotic architectures Precisions: The code in this patchset is directly squashed from the SOF development branch [1], which tracks Mark Brown's for-next branch on a weekly basis and the configurations used for testing are based on the defconfigs at [2]. The patches are also used backported for Chromebook devices. Full disclosure on known limitation and issues (full list at [3]) a) the interaction with ASoC is not always perfect, there are a couple of points where a better solution is desired (use of private data, support for link DMA, etc). The known points are explicitly documented in the code and will be updated. To be clearer, it's our belief that SOF does not cripple ASoC in any way, and that merging this SOF core does not harm others. It's just complicated to get things right, especially on a couple of cases where the topology and DPCM frameworks generate complex flows that very few people understand. b) The get/put methods for controls generate an IPC and possibly a wake-up. This is not optimal and is being fixed. c) runtime_pm is being hardened and the use of SMART_SUSPEND was suggested. Thank you for reviews and comments, we appreciate the time spent commenting on this large patchset. Thanks in particular to Alan Cox and Andy Shevchenko for their comments on an earlier version. This patchset also includes contributions from Daniel Baluta for loading code on non-Intel platforms. Pierre [1] https://github.com/thesofproject/linux [2] https://github.com/thesofproject/kconfig [3] https://github.com/thesofproject/linux/issues Liam Girdwood (12): ASoC: SOF: Add Sound Open Firmware driver core ASoC: SOF: Add Sound Open Firmware KControl support ASoC: SOF: Add driver debug support. ASoC: SOF: Add support for IPC IO between DSP and Host ASoC: SOF: Add PCM operations support ASoC: SOF: Add support for loading topologies ASoC: SOF: Add DSP firmware logger support ASoC: SOF: Add DSP HW abstraction operations ASoC: SOF: Add firmware loader support ASoC: SOF: Add userspace ABI support ASoC: SOF: Add PM support ASoC: SOF: Add Nocodec machine driver support Pierre-Louis Bossart (2): ASoC: SOF: Add xtensa support ASoC: SOF: Add utils include/sound/sof.h | 100 + include/sound/sof/control.h | 158 ++ include/sound/sof/dai-intel.h | 178 ++ include/sound/sof/dai.h | 75 + include/sound/sof/header.h | 158 ++ include/sound/sof/info.h | 118 ++ include/sound/sof/pm.h | 48 + include/sound/sof/stream.h | 148 ++ include/sound/sof/topology.h | 256 +++ include/sound/sof/trace.h | 66 + include/sound/sof/xtensa.h | 44 + include/uapi/sound/sof/abi.h | 62 + include/uapi/sound/sof/eq.h | 172 ++ include/uapi/sound/sof/fw.h | 78 + include/uapi/sound/sof/header.h | 27 + include/uapi/sound/sof/manifest.h | 188 ++ include/uapi/sound/sof/tokens.h | 103 + include/uapi/sound/sof/tone.h | 21 + include/uapi/sound/sof/trace.h | 97 + sound/soc/sof/control.c | 544 ++++++ sound/soc/sof/core.c | 489 +++++ sound/soc/sof/debug.c | 219 +++ sound/soc/sof/ipc.c | 742 ++++++++ sound/soc/sof/loader.c | 376 ++++ sound/soc/sof/nocodec.c | 109 ++ sound/soc/sof/ops.c | 204 ++ sound/soc/sof/ops.h | 403 ++++ sound/soc/sof/pcm.c | 723 +++++++ sound/soc/sof/pm.c | 373 ++++ sound/soc/sof/sof-priv.h | 616 ++++++ sound/soc/sof/topology.c | 2913 +++++++++++++++++++++++++++++ sound/soc/sof/trace.c | 295 +++ sound/soc/sof/utils.c | 112 ++ sound/soc/sof/xtensa/Kconfig | 2 + sound/soc/sof/xtensa/Makefile | 5 + sound/soc/sof/xtensa/core.c | 138 ++ 36 files changed, 10360 insertions(+) create mode 100644 include/sound/sof.h create mode 100644 include/sound/sof/control.h create mode 100644 include/sound/sof/dai-intel.h create mode 100644 include/sound/sof/dai.h create mode 100644 include/sound/sof/header.h create mode 100644 include/sound/sof/info.h create mode 100644 include/sound/sof/pm.h create mode 100644 include/sound/sof/stream.h create mode 100644 include/sound/sof/topology.h create mode 100644 include/sound/sof/trace.h create mode 100644 include/sound/sof/xtensa.h create mode 100644 include/uapi/sound/sof/abi.h create mode 100644 include/uapi/sound/sof/eq.h create mode 100644 include/uapi/sound/sof/fw.h create mode 100644 include/uapi/sound/sof/header.h create mode 100644 include/uapi/sound/sof/manifest.h create mode 100644 include/uapi/sound/sof/tokens.h create mode 100644 include/uapi/sound/sof/tone.h create mode 100644 include/uapi/sound/sof/trace.h create mode 100644 sound/soc/sof/control.c create mode 100644 sound/soc/sof/core.c create mode 100644 sound/soc/sof/debug.c create mode 100644 sound/soc/sof/ipc.c create mode 100644 sound/soc/sof/loader.c create mode 100644 sound/soc/sof/nocodec.c create mode 100644 sound/soc/sof/ops.c create mode 100644 sound/soc/sof/ops.h create mode 100644 sound/soc/sof/pcm.c create mode 100644 sound/soc/sof/pm.c create mode 100644 sound/soc/sof/sof-priv.h create mode 100644 sound/soc/sof/topology.c create mode 100644 sound/soc/sof/trace.c create mode 100644 sound/soc/sof/utils.c create mode 100644 sound/soc/sof/xtensa/Kconfig create mode 100644 sound/soc/sof/xtensa/Makefile create mode 100644 sound/soc/sof/xtensa/core.c -- 2.17.1

6 42

[alsa-devel] [PATCH] ALSA: timer: Revert active callback sync check at close
by Takashi Iwai 09 Apr '19

09 Apr '19

This is essentially a revert of the commit a7588c896b05 ("ALSA: timer: Check ack_list emptiness instead of bit flag"). The intended change by the commit turns out to be insufficient, as snd_timer_close*() always calls snd_timer_stop() that deletes the ack_list beforehand. In theory, we can change the behavior of snd_timer_stop() to sync the pending ack_list, but this will become a deadlock for the callback like sequencer that calls again snd_timer_stop() from itself. So, reverting the change is a more straightforward solution. Fixes: a7588c896b05 ("ALSA: timer: Check ack_list emptiness instead of bit flag") Reported-by: syzbot+58813d77154713f4de15(a)syzkaller.appspotmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- include/sound/timer.h | 1 + sound/core/timer.c | 11 ++++++----- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/include/sound/timer.h b/include/sound/timer.h index bcfee20ea226..7ae226ab6990 100644 --- a/include/sound/timer.h +++ b/include/sound/timer.h @@ -43,6 +43,7 @@ #define SNDRV_TIMER_IFLG_START 0x00000004 #define SNDRV_TIMER_IFLG_AUTO 0x00000008 /* auto restart */ #define SNDRV_TIMER_IFLG_FAST 0x00000010 /* fast callback (do not use tasklet) */ +#define SNDRV_TIMER_IFLG_CALLBACK 0x00000020 /* timer callback is active */ #define SNDRV_TIMER_IFLG_EXCLUSIVE 0x00000040 /* exclusive owner - no more instances */ #define SNDRV_TIMER_IFLG_EARLY_EVENT 0x00000080 /* write early event to the poll queue */ diff --git a/sound/core/timer.c b/sound/core/timer.c index bb7e90ab90f8..df52d2960179 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -372,7 +372,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri) timer->num_instances--; /* wait, until the active callback is finished */ spin_lock_irq(&timer->lock); - while (!list_empty(&timeri->ack_list)) { + while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) { spin_unlock_irq(&timer->lock); udelay(10); spin_lock_irq(&timer->lock); @@ -748,19 +748,20 @@ static void snd_timer_process_callbacks(struct snd_timer *timer, ti = list_first_entry(head, struct snd_timer_instance, ack_list); + /* remove from ack_list and make empty */ + list_del_init(&ti->ack_list); + if (!(ti->flags & SNDRV_TIMER_IFLG_DEAD)) { ticks = ti->pticks; ti->pticks = 0; resolution = ti->resolution; - + ti->flags |= SNDRV_TIMER_IFLG_CALLBACK; spin_unlock(&timer->lock); if (ti->callback) ti->callback(ti, resolution, ticks); spin_lock(&timer->lock); + ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK; } - - /* remove from ack_list and make empty */ - list_del_init(&ti->ack_list); } } -- 2.16.4

1 0

[alsa-devel] [PATCH 0/2] ASoC: fsl: audmix: fix two issues
by Viorel Suman 09 Apr '19

09 Apr '19

The latest audmix patch-set (v5) had the "model" attribute removed as requested by Nicolin Chen, but looks like (v4) version of DAI driver reached "for-next" branch - fix this. Asside of this fix object reference leaks in machine probe reported by Julia Lawall. Viorel Suman (2): ASoC: fsl_audmix: remove "model" attribute ASoC: imx-audmix: fix object reference leaks in probe sound/soc/fsl/fsl_audmix.c | 61 ++++++++++++++++++++++++---------------------- sound/soc/fsl/imx-audmix.c | 31 +++++++++-------------- 2 files changed, 43 insertions(+), 49 deletions(-) -- 2.7.4

2 5