September 2020 - Alsa-devel - mailman.alsa-project.org

[PATCH] ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check
by Takashi Iwai 01 Sep '20

01 Sep '20

The PCM OSS mulaw plugin has a check of the format of the counter part whether it's a linear format. The check is with snd_BUG_ON() that emits WARN_ON() when the debug config is set, and it confuses syzkaller as if it were a serious issue. Let's drop snd_BUG_ON() for avoiding that. While we're at it, correct the error code to a more suitable, EINVAL. Reported-by: syzbot+23b22dc2e0b81cbfcc95(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/oss/mulaw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c index 3788906421a7..fe27034f2846 100644 --- a/sound/core/oss/mulaw.c +++ b/sound/core/oss/mulaw.c @@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct snd_pcm_substream *plug, snd_BUG(); return -EINVAL; } - if (snd_BUG_ON(!snd_pcm_format_linear(format->format))) - return -ENXIO; + if (!snd_pcm_format_linear(format->format)) + return -EINVAL; err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion", src_format, dst_format, -- 2.16.4

1 0

[PATCH v3] ASoC: tlv320adcx140: Fix accessing uninitialized adcx140->dev
by Camel Guo 01 Sep '20

01 Sep '20

From: Camel Guo <camelg(a)axis.com> In adcx140_i2c_probe, adcx140->dev is accessed before its initialization. This commit fixes this bug. Fixes: 689c7655b50c ("ASoC: tlv320adcx140: Add the tlv320adcx140 codec driver family") Signed-off-by: Camel Guo <camel.guo(a)axis.com> --- sound/soc/codecs/tlv320adcx140.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c index 5cd50d841177..7ae6ec374be3 100644 --- a/sound/soc/codecs/tlv320adcx140.c +++ b/sound/soc/codecs/tlv320adcx140.c @@ -980,6 +980,8 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, if (!adcx140) return -ENOMEM; + adcx140->dev = &i2c->dev; + adcx140->gpio_reset = devm_gpiod_get_optional(adcx140->dev, "reset", GPIOD_OUT_LOW); if (IS_ERR(adcx140->gpio_reset)) @@ -1007,7 +1009,7 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, ret); return ret; } - adcx140->dev = &i2c->dev; + i2c_set_clientdata(i2c, adcx140); return devm_snd_soc_register_component(&i2c->dev, -- 2.20.1

1 1

[PATCH v2] ASoC: tlv320adcx140: Fix accessing uninitialized adcx140->dev
by Camel Guo 01 Sep '20

01 Sep '20

From: Camel Guo <camelg(a)axis.com> In adcx140_i2c_probe, adcx140->dev is accessed before its initialization. This commit fixes this bug. Signed-off-by: Camel Guo <camel.guo(a)axis.com> --- sound/soc/codecs/tlv320adcx140.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c index 5cd50d841177..7ae6ec374be3 100644 --- a/sound/soc/codecs/tlv320adcx140.c +++ b/sound/soc/codecs/tlv320adcx140.c @@ -980,6 +980,8 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, if (!adcx140) return -ENOMEM; + adcx140->dev = &i2c->dev; + adcx140->gpio_reset = devm_gpiod_get_optional(adcx140->dev, "reset", GPIOD_OUT_LOW); if (IS_ERR(adcx140->gpio_reset)) @@ -1007,7 +1009,7 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, ret); return ret; } - adcx140->dev = &i2c->dev; + i2c_set_clientdata(i2c, adcx140); return devm_snd_soc_register_component(&i2c->dev, -- 2.20.1

1 0

WARNING in snd_pcm_plugin_build_mulaw
by syzbot 01 Sep '20

01 Sep '20

Hello, syzbot found the following issue on: HEAD commit: 15bc20c6 Merge tag 'tty-5.9-rc3' of git://git.kernel.org/p.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1268efb1900000 kernel config: https://syzkaller.appspot.com/x/.config?x=891ca5711a9f1650 dashboard link: https://syzkaller.appspot.com/bug?extid=23b22dc2e0b81cbfcc95 compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11a95f41900000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11a452f2900000 The issue was bisected to: commit f3ca3f5b0966cfc2737178cca8a7a65b09991898 Author: Fabio Estevam <festevam(a)gmail.com> Date: Fri Mar 27 15:57:21 2020 +0000 dt-bindings: sound: cs42l51: Remove unneeded I2C unit name bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15395f41900000 final oops: https://syzkaller.appspot.com/x/report.txt?x=17395f41900000 console output: https://syzkaller.appspot.com/x/log.txt?x=13395f41900000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+23b22dc2e0b81cbfcc95(a)syzkaller.appspotmail.com Fixes: f3ca3f5b0966 ("dt-bindings: sound: cs42l51: Remove unneeded I2C unit name") ------------[ cut here ]------------ WARNING: CPU: 0 PID: 6835 at sound/core/oss/mulaw.c:332 snd_pcm_plugin_build_mulaw+0x4ef/0x6e0 sound/core/oss/mulaw.c:332 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 6835 Comm: syz-executor088 Not tainted 5.9.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1f0/0x31e lib/dump_stack.c:118 panic+0x264/0x7a0 kernel/panic.c:231 __warn+0x227/0x250 kernel/panic.c:600 report_bug+0x1b1/0x2e0 lib/bug.c:198 handle_bug+0x42/0x80 arch/x86/kernel/traps.c:234 exc_invalid_op+0x16/0x40 arch/x86/kernel/traps.c:254 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536 RIP: 0010:snd_pcm_plugin_build_mulaw+0x4ef/0x6e0 sound/core/oss/mulaw.c:332 Code: 0f 0b bb fa ff ff ff eb cd e8 fd e3 2d fb 0f 0b bb fa ff ff ff eb bf e8 ef e3 2d fb 0f 0b bb fa ff ff ff eb b1 e8 e1 e3 2d fb <0f> 0b bb fa ff ff ff eb a3 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 77 RSP: 0018:ffffc90001ed7950 EFLAGS: 00010293 RAX: ffffffff8647143f RBX: 0000000000000000 RCX: ffff88808dcbc540 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffff86471e70 R08: ffffffff864710ee R09: fffff520003daf47 R10: fffff520003daf47 R11: 0000000000000000 R12: 1ffff920003daf45 R13: ffffc90001ed7a18 R14: ffffc90001ed7a28 R15: ffffc90001ed7a28 snd_pcm_plug_format_plugins+0xbbd/0x1640 sound/core/oss/pcm_plugin.c:494 snd_pcm_oss_change_params_locked+0x2c29/0x4410 sound/core/oss/pcm_oss.c:952 snd_pcm_oss_change_params sound/core/oss/pcm_oss.c:1084 [inline] snd_pcm_oss_make_ready+0x115/0x2b0 sound/core/oss/pcm_oss.c:1143 snd_pcm_oss_sync+0x265/0x900 sound/core/oss/pcm_oss.c:1642 snd_pcm_oss_release+0x119/0x270 sound/core/oss/pcm_oss.c:2546 __fput+0x34f/0x7b0 fs/file_table.c:281 task_work_run+0x137/0x1c0 kernel/task_work.c:141 exit_task_work include/linux/task_work.h:25 [inline] do_exit+0x5f3/0x1f20 kernel/exit.c:806 do_group_exit+0x161/0x2d0 kernel/exit.c:903 __do_sys_exit_group+0x13/0x20 kernel/exit.c:914 __se_sys_exit_group+0x10/0x10 kernel/exit.c:912 __x64_sys_exit_group+0x37/0x40 kernel/exit.c:912 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x440038 Code: Bad RIP value. RSP: 002b:00007ffe721a2058 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440038 RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 RBP: 00000000004bf870 R08: 00000000000000e7 R09: ffffffffffffffd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00000000006d1180 R14: 0000000000000000 R15: 0000000000000000 Kernel Offset: disabled Rebooting in 86400 seconds.. --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

3 2

[PATCH] ASoC: tlv320adcx140: Fix accessing uninitialized abcx140->dev
by Camel Guo 01 Sep '20

01 Sep '20

From: Camel Guo <camelg(a)axis.com> in adcx140_i2c_probe, adcx140->dev is accessed before its initialization. This commit fixes this bug. Signed-off-by: Camel Guo <camel.guo(a)axis.com> --- sound/soc/codecs/tlv320adcx140.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c index 5cd50d841177..7ae6ec374be3 100644 --- a/sound/soc/codecs/tlv320adcx140.c +++ b/sound/soc/codecs/tlv320adcx140.c @@ -980,6 +980,8 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, if (!adcx140) return -ENOMEM; + adcx140->dev = &i2c->dev; + adcx140->gpio_reset = devm_gpiod_get_optional(adcx140->dev, "reset", GPIOD_OUT_LOW); if (IS_ERR(adcx140->gpio_reset)) @@ -1007,7 +1009,7 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, ret); return ret; } - adcx140->dev = &i2c->dev; + i2c_set_clientdata(i2c, adcx140); return devm_snd_soc_register_component(&i2c->dev, -- 2.20.1

2 1

[PATCH 00/10] sound: convert tasklets to use new tasklet_setup()
by Allen Pais 01 Sep '20

01 Sep '20

From: Allen Pais <allen.lkml(a)gmail.com> Commit 12cc923f1ccc ("tasklet: Introduce new initialization API")' introduced a new tasklet initialization API. This series converts all the sound drivers to use the new tasklet_setup() API Allen Pais (10): sound: core: convert tasklets to use new tasklet_setup() API sound: firewire: convert tasklets to use new tasklet_setup() API sound: asihpi: convert tasklets to use new tasklet_setup() API sound: riptide: convert tasklets to use new tasklet_setup() API sound: rm9652: convert tasklets to use new tasklet_setup() API sound/soc: fsl_esai: convert tasklets to use new tasklet_setup() API sound/soc: sh: convert tasklets to use new tasklet_setup() API sound/soc: txx9: convert tasklets to use new tasklet_setup() API sound: midi: convert tasklets to use new tasklet_setup() API sound: ua101: convert tasklets to use new tasklet_setup() API sound/core/timer.c | 7 +++---- sound/firewire/amdtp-stream.c | 8 ++++---- sound/pci/asihpi/asihpi.c | 9 ++++----- sound/pci/riptide/riptide.c | 6 +++--- sound/pci/rme9652/hdsp.c | 6 +++--- sound/pci/rme9652/hdspm.c | 7 +++---- sound/soc/fsl/fsl_esai.c | 7 +++---- sound/soc/sh/siu_pcm.c | 10 ++++------ sound/soc/txx9/txx9aclc.c | 7 +++---- sound/usb/midi.c | 7 +++---- sound/usb/misc/ua101.c | 7 +++---- 11 files changed, 36 insertions(+), 45 deletions(-) -- 2.17.1

4 22

[PATCH v3 0/3] ASoC: soundwire: fix port_ready[] dynamic allocation
by Bard Liao 01 Sep '20

01 Sep '20

The existing code allocates memory for the total number of ports. This only works if the ports are contiguous, but will break if e.g. a Devices uses port0, 1, and 14. The port_ready[] array would contain 3 elements, which would lead to an out-of-bounds access. Conversely in other cases, the wrong port index would be used leading to timeouts on prepare. This can be fixed by allocating for the worst-case of 15 ports (DP0..DP14). In addition since the number is now fixed, we can use an array instead of a dynamic allocation. Changes in v3: - Add ASoC tag in the cover letter title. - Edit the title and commit message of the third patch for better understanding. Changes in v2: - Split patches into sdw and asoc patches. Please note that "soundwire: fix port_ready[] dynamic allocation in mipi_disco" and "ASoC: codecs: fix port_ready[] dynamic allocation in ASoC codecs" should be merged at the same time. Pierre-Louis Bossart (3): soundwire: add definition for maximum number of ports soundwire: fix port_ready[] dynamic allocation in mipi_disco ASoC: codecs: soundwire: remove port_ready[] usage from codecs. drivers/soundwire/mipi_disco.c | 18 +----------------- drivers/soundwire/slave.c | 4 ++++ include/linux/soundwire/sdw.h | 5 +++-- sound/soc/codecs/max98373-sdw.c | 15 +-------------- sound/soc/codecs/rt1308-sdw.c | 14 +------------- sound/soc/codecs/rt5682-sdw.c | 15 +-------------- sound/soc/codecs/rt700-sdw.c | 15 +-------------- sound/soc/codecs/rt711-sdw.c | 15 +-------------- sound/soc/codecs/rt715-sdw.c | 33 +-------------------------------- 9 files changed, 14 insertions(+), 120 deletions(-) -- 2.17.1

2 5