June 2020 - Alsa-devel - mailman.alsa-project.org

[PATCH] ALSA: hda - let hs_mic be picked ahead of hp_mic
by Hui Wang 25 Jun '20

25 Jun '20

We have a Dell AIO, there is neither internal speaker nor internal mic, only a multi-function audio jack on it. Users reported that after freshly installing the OS and plug a headset to the audio jack, the headset can't output sound. I reproduced this bug, at that moment, the Input Source is as below: Simple mixer control 'Input Source',0 Capabilities: cenum Items: 'Headphone Mic' 'Headset Mic' Item0: 'Headphone Mic' That is because the patch_realtek will set this audio jack as mic_in mode if Input Source's value is hp_mic. If it is not fresh installing, this issue will not happen since the systemd will run alsactl restore -f /var/lib/alsa/asound.state, this will set the 'Input Source' according to history value. If there is internal speaker or internal mic, this issue will not happen since there is valid sink/source in the pulseaudio, the PA will set the 'Input Source' according to active_port. To fix this issue, change the parser function to let the hs_mic be stored ahead of hp_mic. Cc: stable(a)vger.kernel.org Signed-off-by: Hui Wang <hui.wang(a)canonical.com> --- sound/pci/hda/hda_auto_parser.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c index 2c6d2becfe1a..824f4ac1a8ce 100644 --- a/sound/pci/hda/hda_auto_parser.c +++ b/sound/pci/hda/hda_auto_parser.c @@ -72,6 +72,12 @@ static int compare_input_type(const void *ap, const void *bp) if (a->type != b->type) return (int)(a->type - b->type); + /* If has both hs_mic and hp_mic, pick the hs_mic ahead of hp_mic. */ + if (a->is_headset_mic && b->is_headphone_mic) + return -1; /* don't swap */ + else if (a->is_headphone_mic && b->is_headset_mic) + return 1; /* swap */ + /* In case one has boost and the other one has not, pick the one with boost first. */ return (int)(b->has_boost_on_pin - a->has_boost_on_pin); -- 2.17.1

2 1

[PATCH 0/5] ASoC: add dailink .exit() callback
by Pierre-Louis Bossart 25 Jun '20

25 Jun '20

While looking at reboot issues and module load/unload tests, I found out some resources allocated in the dailink .init() callback are not properly released - there is no existing mechanism in the soc-core to do so. The addition of a dailink .exit() callback seems to be the simplest solution overall. It can be argued that the existing machine platform device .remove() callback can also perform the necessary cleanups, however as shown in the last two examples this might require a loop to identify components whereas the dailink .exit() already has all the necessary information to revert the actions done in the .init() step. Changes since RFC: Better commit messages and explanations rt5682 cases with snd_soc_component_set_jack() called in the .exit() Fred Oh (2): ASoC: intel: sof_rt5682: move disabling jack to dai link's exit() ASoC: intel: cml_rt1011_rt5682: disable jack in dailink .exit() Pierre-Louis Bossart (3): ASoC: soc-link: introduce exit() callback ASoC: Intel: bdw-rt5677: fix module load/unload issues ASoC: Intel: kbl-rt5660: use .exit() dailink callback to release gpiod include/sound/soc-link.h | 1 + include/sound/soc.h | 3 +++ sound/soc/intel/boards/bdw-rt5677.c | 18 ++++++++++++++-- sound/soc/intel/boards/cml_rt1011_rt5682.c | 8 ++++++++ sound/soc/intel/boards/kbl_rt5660.c | 17 +++++++++++++-- sound/soc/intel/boards/sof_rt5682.c | 24 ++++++++-------------- sound/soc/soc-core.c | 3 +++ sound/soc/soc-link.c | 6 ++++++ 8 files changed, 60 insertions(+), 20 deletions(-) base-commit: 39853b1438bf9b07349c8c44b48f6c2eda6f8840 -- 2.20.1

5 21

[PATCH] ASoC: rt1015: add missing header inclusion
by Tzung-Bi Shih 25 Jun '20

25 Jun '20

To fix compile error: error: implicit declaration of function 'ACPI_PTR' [-Werror,-Wimplicit-function-declaration] .acpi_match_table = ACPI_PTR(rt1015_acpi_match), ^ Adds the missing header inclusion and sorts in alphabetical. Signed-off-by: Tzung-Bi Shih <tzungbi(a)google.com> --- sound/soc/codecs/rt1015.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/sound/soc/codecs/rt1015.c b/sound/soc/codecs/rt1015.c index 1f61b4aa4353..548f68649064 100644 --- a/sound/soc/codecs/rt1015.c +++ b/sound/soc/codecs/rt1015.c @@ -8,23 +8,24 @@ // // +#include <linux/acpi.h> +#include <linux/delay.h> +#include <linux/firmware.h> #include <linux/fs.h> +#include <linux/gpio.h> +#include <linux/i2c.h> +#include <linux/init.h> #include <linux/module.h> #include <linux/moduleparam.h> -#include <linux/init.h> -#include <linux/delay.h> +#include <linux/platform_device.h> #include <linux/pm.h> #include <linux/regmap.h> -#include <linux/i2c.h> -#include <linux/platform_device.h> -#include <linux/firmware.h> -#include <linux/gpio.h> #include <sound/core.h> +#include <sound/initval.h> #include <sound/pcm.h> #include <sound/pcm_params.h> -#include <sound/soc.h> #include <sound/soc-dapm.h> -#include <sound/initval.h> +#include <sound/soc.h> #include <sound/tlv.h> #include "rl6231.h" -- 2.27.0.111.gc72c7da667-goog

3 2

[PATCH v5 0/7] TAS2562 issue fixes and slot programming
by Dan Murphy 24 Jun '20

24 Jun '20

Hello This series fixes issues tih the shut-down gpio device tree allocation and a code format issue found. While working on a project slot programming for the tx and rx paths needed to be enabled. In addition the vsense slot programming needed to be configurable and not directly a simpler adder to the isense slot. Finally the yaml conversion patch was moved to be the last patch in the series so that the fixes can be applied and the yaml can be reviewed appropriately and does not hold up the rest of the fixes. Dan Dan Murphy (7): dt-bindings: tas2562: Fix shut-down gpio property ASoC: tas2562: Update shutdown GPIO property ASoC: tas2562: Fix format issue for extra space before a comma ASoC: tas2562: Add rx and tx slot programming dt-bindings: tas2562: Add voltage sense slot property ASoC: tas2562: Add voltage sense slot configuration dt-bindings: tas2562: Convert the tas2562 binding to yaml .../devicetree/bindings/sound/tas2562.txt | 34 - .../devicetree/bindings/sound/tas2562.yaml | 77 + arch/arm/boot/compressed/fdt.h | 66 + arch/arm/boot/compressed/libfdt.h | 2072 +++++++++++++++++ arch/arm/boot/compressed/libfdt_internal.h | 173 ++ sound/soc/codecs/tas2562.c | 88 +- sound/soc/codecs/tas2562.h | 4 + 7 files changed, 2462 insertions(+), 52 deletions(-) delete mode 100644 Documentation/devicetree/bindings/sound/tas2562.txt create mode 100644 Documentation/devicetree/bindings/sound/tas2562.yaml create mode 100644 arch/arm/boot/compressed/fdt.h create mode 100644 arch/arm/boot/compressed/libfdt.h create mode 100644 arch/arm/boot/compressed/libfdt_internal.h -- 2.26.2

2 12

[PATCH] ASoC: rt5682: fix the pop noise while OMTP type headset plugin
by shumingf＠realtek.com 24 Jun '20

24 Jun '20

From: Shuming Fan <shumingf(a)realtek.com> To turn the headphone output switch off during jack type detection, it could avoid the pop noise when jack type switches to OMTP type. Signed-off-by: Shuming Fan <shumingf(a)realtek.com> --- sound/soc/codecs/rt5682.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c index 345c3548c1c5..e9514c81b9ba 100644 --- a/sound/soc/codecs/rt5682.c +++ b/sound/soc/codecs/rt5682.c @@ -932,7 +932,9 @@ int rt5682_headset_detect(struct snd_soc_component *component, int jack_insert) RT5682_PWR_ANLG_1, RT5682_PWR_FV2, RT5682_PWR_FV2); snd_soc_component_update_bits(component, RT5682_PWR_ANLG_3, RT5682_PWR_CBJ, RT5682_PWR_CBJ); - + snd_soc_component_update_bits(component, + RT5682_HP_CHARGE_PUMP_1, + RT5682_OSW_L_MASK | RT5682_OSW_R_MASK, 0); snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1, RT5682_TRIG_JD_MASK, RT5682_TRIG_JD_HIGH); @@ -956,6 +958,11 @@ int rt5682_headset_detect(struct snd_soc_component *component, int jack_insert) rt5682->jack_type = SND_JACK_HEADPHONE; break; } + + snd_soc_component_update_bits(component, + RT5682_HP_CHARGE_PUMP_1, + RT5682_OSW_L_MASK | RT5682_OSW_R_MASK, + RT5682_OSW_L_EN | RT5682_OSW_R_EN); } else { rt5682_enable_push_button_irq(component, false); snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_1, -- 2.25.1

2 1

[PATCH 1/2] ASoC: fsl-asoc-card: Add WM8524 support
by Shengjiu Wang 24 Jun '20

24 Jun '20

WM8524 only supports playback mode, and only works at slave mode. Signed-off-by: Shengjiu Wang <shengjiu.wang(a)nxp.com> --- sound/soc/fsl/fsl-asoc-card.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c index d0543a53764e..57ea1b072326 100644 --- a/sound/soc/fsl/fsl-asoc-card.c +++ b/sound/soc/fsl/fsl-asoc-card.c @@ -611,6 +611,15 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) priv->dai_link[2].dpcm_capture = 0; priv->card.dapm_routes = audio_map_tx; priv->card.num_dapm_routes = ARRAY_SIZE(audio_map_tx); + } else if (of_device_is_compatible(np, "fsl,imx-audio-wm8524")) { + codec_dai_name = "wm8524-hifi"; + priv->card.set_bias_level = NULL; + priv->dai_fmt |= SND_SOC_DAIFMT_CBS_CFS; + priv->dai_link[1].dpcm_capture = 0; + priv->dai_link[2].dpcm_capture = 0; + priv->cpu_priv.slot_width = 32; + priv->card.dapm_routes = audio_map_tx; + priv->card.num_dapm_routes = ARRAY_SIZE(audio_map_tx); } else { dev_err(&pdev->dev, "unknown Device Tree compatible\n"); ret = -EINVAL; @@ -760,6 +769,7 @@ static const struct of_device_id fsl_asoc_card_dt_ids[] = { { .compatible = "fsl,imx-audio-wm8962", }, { .compatible = "fsl,imx-audio-wm8960", }, { .compatible = "fsl,imx-audio-mqs", }, + { .compatible = "fsl,imx-audio-wm8524", }, {} }; MODULE_DEVICE_TABLE(of, fsl_asoc_card_dt_ids); -- 2.21.0

3 4

[PATCH] ALSA: usb-audio: Fix OOB access of mixer element list
by Takashi Iwai 24 Jun '20

24 Jun '20

The USB-audio mixer code holds a linked list of usb_mixer_elem_list, and several operations are performed for each mixer element. A few of them (snd_usb_mixer_notify_id() and snd_usb_mixer_interrupt_v2()) assume each mixer element being a usb_mixer_elem_info object that is a subclass of usb_mixer_elem_list, cast via container_of() and access it members. This may result in an out-of-bound access when a non-standard list element has been added, as spotted by syzkaller recently. This patch adds a new field, is_std_info, in usb_mixer_elem_list to indicate that the element is the usb_mixer_elem_info type or not, and skip the access to such an element if needed. Reported-by: syzbot+fb14314433463ad51625(a)syzkaller.appspotmail.com Reported-by: syzbot+2405ca3401e943c538b5(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/usb/mixer.c | 15 +++++++++++---- sound/usb/mixer.h | 9 +++++++-- sound/usb/mixer_quirks.c | 3 ++- 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 15769f266790..eab0fd4fd7c3 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -581,8 +581,9 @@ static int check_matrix_bitmap(unsigned char *bmap, * if failed, give up and free the control instance. */ -int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, - struct snd_kcontrol *kctl) +int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list, + struct snd_kcontrol *kctl, + bool is_std_info) { struct usb_mixer_interface *mixer = list->mixer; int err; @@ -596,6 +597,7 @@ int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, return err; } list->kctl = kctl; + list->is_std_info = is_std_info; list->next_id_elem = mixer->id_elems[list->id]; mixer->id_elems[list->id] = list; return 0; @@ -3234,8 +3236,11 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid) unitid = delegate_notify(mixer, unitid, NULL, NULL); for_each_mixer_elem(list, mixer, unitid) { - struct usb_mixer_elem_info *info = - mixer_elem_list_to_info(list); + struct usb_mixer_elem_info *info; + + if (!list->is_std_info) + continue; + info = mixer_elem_list_to_info(list); /* invalidate cache, so the value is read from the device */ info->cached = 0; snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, @@ -3315,6 +3320,8 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer, if (!list->kctl) continue; + if (!list->is_std_info) + continue; info = mixer_elem_list_to_info(list); if (count > 1 && info->control != control) diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h index 41ec9dc4139b..c29e27ac43a7 100644 --- a/sound/usb/mixer.h +++ b/sound/usb/mixer.h @@ -66,6 +66,7 @@ struct usb_mixer_elem_list { struct usb_mixer_elem_list *next_id_elem; /* list of controls with same id */ struct snd_kcontrol *kctl; unsigned int id; + bool is_std_info; usb_mixer_elem_dump_func_t dump; usb_mixer_elem_resume_func_t resume; }; @@ -103,8 +104,12 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid); int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval, int request, int validx, int value_set); -int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, - struct snd_kcontrol *kctl); +int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list, + struct snd_kcontrol *kctl, + bool is_std_info); + +#define snd_usb_mixer_add_control(list, kctl) \ + snd_usb_mixer_add_list(list, kctl, true) void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list, struct usb_mixer_interface *mixer, diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c index b6bcf2f92383..cec1cfd7edb7 100644 --- a/sound/usb/mixer_quirks.c +++ b/sound/usb/mixer_quirks.c @@ -158,7 +158,8 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer, return -ENOMEM; } kctl->private_free = snd_usb_mixer_elem_free; - return snd_usb_mixer_add_control(list, kctl); + /* don't use snd_usb_mixer_add_control() here, this is a special list element */ + return snd_usb_mixer_add_list(list, kctl, false); } /* -- 2.16.4

1 0

[snd_pcm] [5.8RC1] kernel BUG at mm/huge_memory.c:2613! (system stopped playing sound)
by Mikhail Gavrilov 24 Jun '20

24 Jun '20

Hi folks. After upgrade kernel to 5.8RC1 (git69119673bd50) my system stopped playing sound. In the kernel log, I see the message 'invalid opcode: 0000 [#1] SMP NOPTI' which probably related to this issue. [ 19.076508] page:ffffeb1b1dc14b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffeb1b1dc14b00 order:2 compound_mapcount:0 compound_pincount:0 [ 19.076515] flags: 0x17ffffc0010000(head) [ 19.076520] raw: 0017ffffc0010000 dead000000000100 dead000000000122 0000000000000000 [ 19.076524] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 19.076527] page dumped because: VM_BUG_ON_PAGE(!PageLocked(head)) [ 19.076561] ------------[ cut here ]------------ [ 19.076562] kernel BUG at mm/huge_memory.c:2613! [ 19.076581] invalid opcode: 0000 [#1] SMP NOPTI [ 19.076584] CPU: 12 PID: 1787 Comm: pulseaudio Not tainted 5.8.0-0.rc1.20200617git69119673bd50.1.fc33.x86_64 #1 [ 19.076586] Hardware name: System manufacturer System Product Name/ROG STRIX X570-I GAMING, BIOS 1407 04/02/2020 [ 19.076592] RIP: 0010:split_huge_page_to_list+0x86a/0xd90 [ 19.076596] Code: 48 c7 c6 c0 d5 38 9c 48 8d 50 ff a8 01 48 0f 45 da 48 89 df e8 b7 d0 f8 ff 0f 0b 48 c7 c6 88 f1 3b 9c 48 89 df e8 a6 d0 f8 ff <0f> 0b 48 8b 07 f6 c4 04 0f 84 b4 f9 ff ff 48 89 df e8 f0 59 fc ff [ 19.076599] RSP: 0018:ffffb580c249fad8 EFLAGS: 00010296 [ 19.076601] RAX: 0000000000000000 RBX: ffffeb1b1dc14b00 RCX: ffff93f1fbbdb5f8 [ 19.076603] RDX: 00000000ffffffd8 RSI: 0000000000000000 RDI: ffff93f1fbbdb5f0 [ 19.076605] RBP: ffff93f21e2ff688 R08: 0000000000000000 R09: 0000000000000000 [ 19.076606] R10: 0000000000000001 R11: 0000000000000000 R12: ffff93f21e2d5000 [ 19.076608] R13: ffffeb1b1dc14b00 R14: 0000000000000007 R15: ffffeb1b1dc14b00 [ 19.076610] FS: 00007f6f4e421880(0000) GS:ffff93f1fba00000(0000) knlGS:0000000000000000 [ 19.076612] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 19.076613] CR2: 00007f6f3ceab000 CR3: 0000000779996000 CR4: 00000000003406e0 [ 19.076615] Call Trace: [ 19.076622] ? rcu_read_lock_sched_held+0x3f/0x80 [ 19.076626] ? __alloc_pages_nodemask+0x3df/0x450 [ 19.076631] iommu_dma_alloc+0x316/0x580 [ 19.076637] dma_alloc_attrs+0x86/0x90 [ 19.076645] snd_dma_alloc_pages+0xdf/0x160 [snd_pcm] [ 19.076651] snd_dma_alloc_pages_fallback+0x5d/0x80 [snd_pcm] [ 19.076657] snd_malloc_sgbuf_pages+0x166/0x380 [snd_pcm] [ 19.076665] ? trace_kmalloc+0xf2/0x120 [ 19.076670] snd_dma_alloc_pages+0x64/0x160 [snd_pcm] [ 19.076676] do_alloc_pages+0x3c/0x90 [snd_pcm] [ 19.076683] snd_pcm_lib_malloc_pages+0x115/0x1a0 [snd_pcm] [ 19.076690] snd_pcm_hw_params+0x4de/0x5b0 [snd_pcm] [ 19.076694] ? _copy_from_user+0x6b/0xb0 [ 19.076700] snd_pcm_common_ioctl+0x209/0x1340 [snd_pcm] [ 19.076703] ? selinux_file_ioctl+0x132/0x1e0 [ 19.076711] snd_pcm_ioctl+0x23/0x30 [snd_pcm] [ 19.076715] ksys_ioctl+0x82/0xc0 [ 19.076718] __x64_sys_ioctl+0x16/0x20 [ 19.076722] do_syscall_64+0x52/0xb0 [ 19.076724] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 19.076727] RIP: 0033:0x7f6f4ed53e9b [ 19.076728] Code: Bad RIP value. [ 19.076730] RSP: 002b:00007ffe556b7e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 19.076732] RAX: ffffffffffffffda RBX: 00007ffe556b8020 RCX: 00007f6f4ed53e9b [ 19.076733] RDX: 00007ffe556b8020 RSI: 00000000c2604111 RDI: 0000000000000016 [ 19.076735] RBP: 00005562734fdfa0 R08: 0000000000000000 R09: 0000000000000000 [ 19.076737] R10: 0000000000000004 R11: 0000000000000246 R12: 00005562734fdf20 [ 19.076738] R13: 00007ffe556b7e54 R14: 0000000000000000 R15: 00007ffe556b8020 [ 19.076743] Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_nat_tftp nf_conntrack_tftp tun bridge stp llc nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_mangle iptable_raw iptable_security ip_set nf_tables nfnetlink ip6table_filter ip6_tables iptable_filter cmac bnep sunrpc vfat fat hid_logitech_hidpp joydev hid_logitech_dj mt76x2u mt76x2_common mt76x02_usb mt76_usb mt76x02_lib mt76 edac_mce_amd amd_energy kvm_amd kvm gspca_zc3xx gspca_main irqbypass eeepc_wmi asus_wmi btusb sparse_keymap btrtl video wmi_bmof btbcm btintel bluetooth ecdh_generic uvcvideo ecc videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 snd_usb_audio videobuf2_common snd_usbmidi_lib videodev snd_rawmidi pcspkr iwlmvm mc [ 19.076777] mac80211 snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio libarc4 snd_hda_codec_hdmi iwlwifi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep cfg80211 snd_seq snd_seq_device rfkill snd_pcm snd_timer snd soundcore k10temp sp5100_tco i2c_piix4 acpi_cpufreq binfmt_misc ip_tables amdgpu iommu_v2 gpu_sched ttm crct10dif_pclmul drm_kms_helper crc32_pclmul crc32c_intel cec drm ghash_clmulni_intel ccp igb nvme nvme_core xhci_pci dca xhci_pci_renesas i2c_algo_bit wmi pinctrl_amd fuse [ 19.076798] ---[ end trace 14b750353357325c ]--- [ 19.076801] RIP: 0010:split_huge_page_to_list+0x86a/0xd90 [ 19.076804] Code: 48 c7 c6 c0 d5 38 9c 48 8d 50 ff a8 01 48 0f 45 da 48 89 df e8 b7 d0 f8 ff 0f 0b 48 c7 c6 88 f1 3b 9c 48 89 df e8 a6 d0 f8 ff <0f> 0b 48 8b 07 f6 c4 04 0f 84 b4 f9 ff ff 48 89 df e8 f0 59 fc ff [ 19.076806] RSP: 0018:ffffb580c249fad8 EFLAGS: 00010296 [ 19.076808] RAX: 0000000000000000 RBX: ffffeb1b1dc14b00 RCX: ffff93f1fbbdb5f8 [ 19.076809] RDX: 00000000ffffffd8 RSI: 0000000000000000 RDI: ffff93f1fbbdb5f0 [ 19.076811] RBP: ffff93f21e2ff688 R08: 0000000000000000 R09: 0000000000000000 [ 19.076812] R10: 0000000000000001 R11: 0000000000000000 R12: ffff93f21e2d5000 [ 19.076814] R13: ffffeb1b1dc14b00 R14: 0000000000000007 R15: ffffeb1b1dc14b00 [ 19.076816] FS: 00007f6f4e421880(0000) GS:ffff93f1fba00000(0000) knlGS:0000000000000000 [ 19.076817] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 19.076819] CR2: 00007f6f3ceab000 CR3: 0000000779996000 CR4: 00000000003406e0 [ 26.761111] logitech-hidpp-device 0003:046D:4087.000B: HID++ 4.2 device connected. [ 37.568414] rfkill: input handler enabled [ 43.157188] page:ffffeb1b1daca200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffeb1b1daca200 order:2 compound_mapcount:0 compound_pincount:0 [ 43.157192] flags: 0x17ffffc0010000(head) [ 43.157195] raw: 0017ffffc0010000 dead000000000100 dead000000000122 0000000000000000 [ 43.157197] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 43.157198] page dumped because: VM_BUG_ON_PAGE(!PageLocked(head)) [ 43.157209] ------------[ cut here ]------------ I would be happy to test any patch which fixes it. -- Best Regards, Mike Gavrilov.

1 1

[PATCH] ASoC: amd: add logic to check dmic hardware runtime
by Vijendar Mukunda 23 Jun '20

23 Jun '20

Add logic to check DMIC hardware exists or not on the platform at runtime. Add module param for overriding DMIC hardware check at runtime. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> --- sound/soc/amd/renoir/rn-pci-acp3x.c | 29 +++++++++++++++++++++++++++++ sound/soc/amd/renoir/rn_acp3x.h | 2 ++ 2 files changed, 31 insertions(+) diff --git a/sound/soc/amd/renoir/rn-pci-acp3x.c b/sound/soc/amd/renoir/rn-pci-acp3x.c index 859ed67..faa7566 100644 --- a/sound/soc/amd/renoir/rn-pci-acp3x.c +++ b/sound/soc/amd/renoir/rn-pci-acp3x.c @@ -5,6 +5,7 @@ //Copyright 2020 Advanced Micro Devices, Inc. #include <linux/pci.h> +#include <linux/acpi.h> #include <linux/module.h> #include <linux/io.h> #include <linux/delay.h> @@ -18,6 +19,16 @@ static int acp_power_gating; module_param(acp_power_gating, int, 0644); MODULE_PARM_DESC(acp_power_gating, "Enable acp power gating"); +/** + * dmic_acpi_check = -1 - Checks ACPI method to know DMIC hardware status runtime + * = 0 - Skips the DMIC device creation and returns probe failure + * = 1 - Assumes that platform has DMIC support and skips ACPI + * method check + */ +static int dmic_acpi_check = ACP_DMIC_AUTO; +module_param(dmic_acpi_check, int, 0644); +MODULE_PARM_DESC(dmic_acpi_check, "checks Dmic hardware runtime"); + struct acp_dev_data { void __iomem *acp_base; struct resource *res; @@ -157,6 +168,8 @@ static int snd_rn_acp_probe(struct pci_dev *pci, { struct acp_dev_data *adata; struct platform_device_info pdevinfo[ACP_DEVS]; + acpi_handle handle; + acpi_integer dmic_status; unsigned int irqflags; int ret, index; u32 addr; @@ -201,6 +214,22 @@ static int snd_rn_acp_probe(struct pci_dev *pci, if (ret) goto disable_msi; + if (!dmic_acpi_check) { + ret = -ENODEV; + goto de_init; + } else if (dmic_acpi_check == ACP_DMIC_AUTO) { + handle = ACPI_HANDLE(&pci->dev); + ret = acpi_evaluate_integer(handle, "_WOV", NULL, &dmic_status); + if (ACPI_FAILURE(ret)) { + ret = -EINVAL; + goto de_init; + } + if (!dmic_status) { + ret = -ENODEV; + goto de_init; + } + } + adata->res = devm_kzalloc(&pci->dev, sizeof(struct resource) * 2, GFP_KERNEL); diff --git a/sound/soc/amd/renoir/rn_acp3x.h b/sound/soc/amd/renoir/rn_acp3x.h index 75228e3..1462039 100644 --- a/sound/soc/amd/renoir/rn_acp3x.h +++ b/sound/soc/amd/renoir/rn_acp3x.h @@ -55,6 +55,8 @@ #define MAX_BUFFER (CAPTURE_MAX_PERIOD_SIZE * CAPTURE_MAX_NUM_PERIODS) #define MIN_BUFFER MAX_BUFFER +#define ACP_DMIC_AUTO -1 + struct pdm_dev_data { u32 pdm_irq; void __iomem *acp_base; -- 2.7.4

3 2

KASAN: slab-out-of-bounds Write in snd_usb_mixer_interrupt
by syzbot 23 Jun '20

23 Jun '20

Hello, syzbot found the following crash on: HEAD commit: 7ae77150 Merge tag 'powerpc-5.8-1' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12b9b0a1100000 kernel config: https://syzkaller.appspot.com/x/.config?x=be4578b3f1083656 dashboard link: https://syzkaller.appspot.com/bug?extid=2405ca3401e943c538b5 compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1589f7cd100000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10162bf1100000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+2405ca3401e943c538b5(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: slab-out-of-bounds in snd_usb_mixer_notify_id sound/usb/mixer.c:3240 [inline] BUG: KASAN: slab-out-of-bounds in snd_usb_mixer_interrupt+0xaa7/0xc30 sound/usb/mixer.c:3379 Write of size 4 at addr ffff8880a39c5ae0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1e9/0x30e lib/dump_stack.c:118 print_address_description+0x66/0x5a0 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report+0x132/0x1d0 mm/kasan/report.c:530 snd_usb_mixer_notify_id sound/usb/mixer.c:3240 [inline] snd_usb_mixer_interrupt+0xaa7/0xc30 sound/usb/mixer.c:3379 __usb_hcd_giveback_urb+0x333/0x4b0 drivers/usb/core/hcd.c:1650 dummy_timer+0x75c/0x3ff0 drivers/usb/gadget/udc/dummy_hcd.c:1966 call_timer_fn+0x91/0x160 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers+0x776/0x970 kernel/time/timer.c:1773 run_timer_softirq+0x46/0x80 kernel/time/timer.c:1786 __do_softirq+0x268/0x80c kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x223/0x230 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x113/0x280 arch/x86/kernel/apic/apic.c:1107 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 </IRQ> RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61 Code: 80 e1 07 80 c1 03 38 c1 7c bc 48 89 df e8 9a 17 9b f9 eb b2 cc cc cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d 56 46 4a 00 fb f4 <c3> 90 e9 07 00 00 00 0f 00 2d 46 46 4a 00 f4 c3 cc cc 41 56 53 65 RSP: 0018:ffffffff89207d48 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff12577b9 RBX: 0000000000000000 RCX: ffffffffffffffff RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff89282364 RBP: 1ffff1104351204e R08: ffffffff817a4660 R09: fffffbfff1250361 R10: fffffbfff1250361 R11: 0000000000000000 R12: 0000000000000001 R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88821a890270 arch_safe_halt arch/x86/include/asm/paravirt.h:150 [inline] acpi_safe_halt+0x87/0xe0 drivers/acpi/processor_idle.c:111 acpi_idle_do_entry drivers/acpi/processor_idle.c:525 [inline] acpi_idle_enter+0x3f4/0xac0 drivers/acpi/processor_idle.c:651 cpuidle_enter_state+0x2d7/0x7b0 drivers/cpuidle/cpuidle.c:234 cpuidle_enter+0x59/0x90 drivers/cpuidle/cpuidle.c:345 call_cpuidle kernel/sched/idle.c:117 [inline] cpuidle_idle_call kernel/sched/idle.c:207 [inline] do_idle+0x49c/0x650 kernel/sched/idle.c:269 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:365 start_kernel+0x674/0x777 init/main.c:1041 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242 Allocated by task 12: save_stack mm/kasan/common.c:48 [inline] set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc+0x103/0x140 mm/kasan/common.c:494 kmem_cache_alloc_trace+0x234/0x300 mm/slab.c:3551 kmalloc include/linux/slab.h:555 [inline] kzalloc include/linux/slab.h:669 [inline] add_single_ctl_with_resume sound/usb/mixer_quirks.c:147 [inline] snd_mbox1_create_sync_switch sound/usb/mixer_quirks.c:719 [inline] snd_usb_mixer_apply_create_quirk+0x1333/0x4fc0 sound/usb/mixer_quirks.c:2654 snd_usb_create_mixer+0x22d8/0x2e90 sound/usb/mixer.c:3538 snd_usb_create_quirk sound/usb/quirks.c:563 [inline] create_composite_quirk+0x221/0x510 sound/usb/quirks.c:48 usb_audio_probe+0xc3d/0x2500 sound/usb/card.c:668 usb_probe_interface+0x614/0xac0 drivers/usb/core/driver.c:374 really_probe+0x761/0xf60 drivers/base/dd.c:524 driver_probe_device+0xe6/0x230 drivers/base/dd.c:697 bus_for_each_drv+0x108/0x170 drivers/base/bus.c:431 __device_attach+0x20c/0x3a0 drivers/base/dd.c:870 bus_probe_device+0xb8/0x1f0 drivers/base/bus.c:491 device_add+0x1828/0x1ba0 drivers/base/core.c:2557 usb_set_configuration+0x19d2/0x1f20 drivers/usb/core/message.c:2032 usb_generic_driver_probe+0x82/0x140 drivers/usb/core/generic.c:241 usb_probe_device+0x12d/0x1d0 drivers/usb/core/driver.c:272 really_probe+0x761/0xf60 drivers/base/dd.c:524 driver_probe_device+0xe6/0x230 drivers/base/dd.c:697 bus_for_each_drv+0x108/0x170 drivers/base/bus.c:431 __device_attach+0x20c/0x3a0 drivers/base/dd.c:870 bus_probe_device+0xb8/0x1f0 drivers/base/bus.c:491 device_add+0x1828/0x1ba0 drivers/base/core.c:2557 usb_new_device+0xcc3/0x1650 drivers/usb/core/hub.c:2554 hub_port_connect drivers/usb/core/hub.c:5208 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x2823/0x4cb0 drivers/usb/core/hub.c:5576 process_one_work+0x76e/0xfd0 kernel/workqueue.c:2268 worker_thread+0xa7f/0x1450 kernel/workqueue.c:2414 kthread+0x353/0x380 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351 Freed by task 4844: save_stack mm/kasan/common.c:48 [inline] set_track mm/kasan/common.c:56 [inline] kasan_set_free_info mm/kasan/common.c:316 [inline] __kasan_slab_free+0x114/0x170 mm/kasan/common.c:455 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x220 mm/slab.c:3757 tomoyo_path_perm+0x59b/0x740 security/tomoyo/file.c:842 security_inode_getattr+0xc0/0x140 security/security.c:1278 vfs_getattr fs/stat.c:121 [inline] vfs_statx_fd fs/stat.c:151 [inline] vfs_fstat include/linux/fs.h:3319 [inline] __do_sys_newfstat fs/stat.c:398 [inline] __se_sys_newfstat fs/stat.c:395 [inline] __x64_sys_newfstat+0x97/0x150 fs/stat.c:395 do_syscall_64+0xf3/0x1b0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 The buggy address belongs to the object at ffff8880a39c5a80 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 32 bytes to the right of 64-byte region [ffff8880a39c5a80, ffff8880a39c5ac0) The buggy address belongs to the page: page:ffffea00028e7140 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea000299a688 ffffea00028e3948 ffff8880aa400380 raw: 0000000000000000 ffff8880a39c5000 0000000100000020 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a39c5980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880a39c5a00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc >ffff8880a39c5a80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ^ ffff8880a39c5b00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880a39c5b80: 00 00 00 00 01 fc fc fc fc fc fc fc fc fc fc fc ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 0