September 2021 - Alsa-devel - mailman.alsa-project.org

[PATCH] ALSA: rawmidi: Fix potential UAF from sequencer destruction
by John Keeping 30 Sep '21

30 Sep '21

If the sequencer device outlives the rawmidi device, then snd_rawmidi_dev_seq_free() will run after release_rawmidi_device() has freed the snd_rawmidi structure. This can easily be reproduced with CONFIG_DEBUG_KOBJECT_RELEASE. Keep a reference to the rawmidi device until the sequencer has been destroyed in order to avoid this. Signed-off-by: John Keeping <john(a)metanate.com> --- sound/core/rawmidi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index 6f30231bdb88..b015f5f69175 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -1860,6 +1860,7 @@ static void snd_rawmidi_dev_seq_free(struct snd_seq_device *device) struct snd_rawmidi *rmidi = device->private_data; rmidi->seq_dev = NULL; + put_device(&rmidi->dev); } #endif @@ -1936,6 +1937,9 @@ static int snd_rawmidi_dev_register(struct snd_device *device) #if IS_ENABLED(CONFIG_SND_SEQUENCER) if (!rmidi->ops || !rmidi->ops->dev_register) { /* own registration mechanism */ if (snd_seq_device_new(rmidi->card, rmidi->device, SNDRV_SEQ_DEV_ID_MIDISYNTH, 0, &rmidi->seq_dev) >= 0) { + /* Ensure we outlive the sequencer (see snd_rawmidi_dev_seq_free). */ + get_device(&rmidi->dev); + rmidi->seq_dev->private_data = rmidi; rmidi->seq_dev->private_free = snd_rawmidi_dev_seq_free; sprintf(rmidi->seq_dev->name, "MIDI %d-%d", rmidi->card->number, rmidi->device); -- 2.33.0

2 8

[PATCH] ASoC: dpcm: fix race condition to dpcm links in dpcm_be_dai_trigger
by Gyeongtaek Lee 30 Sep '21

30 Sep '21

If routing change and underrun stop is run at the same time, data abort can be occurred by the following sequence. CPU0: Processing underrun CPU1: Processing routing change dpcm_be_dai_trigger(): dpcm_be_disconnect(): for_each_dpcm_be(fe, stream, dpcm) { spin_lock_irqsave(&fe->card->dpcm_lock, flags); list_del(&dpcm->list_be); list_del(&dpcm->list_fe); spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); kfree(dpcm); struct snd_soc_pcm_runtime *be = dpcm->be; <-- Accessing freed memory To prevent this situation, dpcm_lock is needed during accessing the lists for dpcm links. Signed-off-by: Gyeongtaek Lee <gt82.lee(a)samsung.com> Cc: stable(a)vger.kernel.org --- sound/soc/soc-pcm.c | 53 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 50 insertions(+), 3 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 48f71bb81a2f..df2cd4c0dabe 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1993,17 +1993,63 @@ static int dpcm_fe_dai_hw_params(struct snd_pcm_substream *substream, return ret; } +struct dpcm_be_list { + unsigned int num; + struct snd_soc_pcm_runtime *be[]; +}; + +static int dpcm_create_be_list(struct snd_soc_pcm_runtime *fe, int stream, + struct dpcm_be_list **be_list) +{ + struct snd_soc_dpcm *dpcm; + struct dpcm_be_list *be; + int size = 0; + int ret = 0; + unsigned long flags; + + spin_lock_irqsave(&fe->card->dpcm_lock, flags); + + for_each_dpcm_be(fe, stream, dpcm) + size++; + + be = kzalloc(struct_size(be, be, size), GFP_ATOMIC); + if (!be) { + ret = -ENOMEM; + } else { + unsigned int i = 0; + + for_each_dpcm_be(fe, stream, dpcm) + be->be[i++] = dpcm->be; + + *be_list = be; + } + + spin_unlock_irqrestore(&fe->card->dpcm_lock, flags); + + return ret; +} + +static void dpcm_free_be_list(struct dpcm_be_list *be_list) +{ + kfree(be_list); +} + int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream, int cmd) { struct snd_soc_pcm_runtime *be; - struct snd_soc_dpcm *dpcm; + struct dpcm_be_list *be_list; int ret = 0; + int i; - for_each_dpcm_be(fe, stream, dpcm) { + ret = dpcm_create_be_list(fe, stream, &be_list); + if (ret < 0) + return ret; + + for(i = 0; i < be_list->num; i++) { struct snd_pcm_substream *be_substream; - be = dpcm->be; + be = be_list->be[i]; be_substream = snd_soc_dpcm_get_substream(be, stream); /* is this op for this BE ? */ @@ -2092,6 +2138,7 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream, if (ret < 0) dev_err(fe->dev, "ASoC: %s() failed at %s (%d)\n", __func__, be->dai_link->name, ret); + dpcm_free_be_list(be_list); return ret; } EXPORT_SYMBOL_GPL(dpcm_be_dai_trigger); base-commit: 4ac6d90867a4de2e12117e755dbd76e08d88697f -- 2.21.0

2 3

Re: [PATCH] ASoC: dt-bindings: rt5682s: fix the device-tree schema errors
by David Heidelberg 29 Sep '21

29 Sep '21

Our CI seems to be happy again. Thanks Reviewed-by: David Heidelberg <david(a)ixit.cz> Best regards David Heidelberg

1 0

[PATCH] ASoC: wm_adsp: Fix compilation when debugfs is disabled
by Simon Trimmer 29 Sep '21

29 Sep '21

Guard the use of component->debufs_root against CONFIG_DEBUG_FS Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Simon Trimmer <simont(a)opensource.cirrus.com> --- sound/soc/codecs/wm_adsp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c index f17c749c24c3..03cfaa82b031 100644 --- a/sound/soc/codecs/wm_adsp.c +++ b/sound/soc/codecs/wm_adsp.c @@ -1028,7 +1028,9 @@ int wm_adsp2_component_probe(struct wm_adsp *dsp, struct snd_soc_component *comp snprintf(preload, ARRAY_SIZE(preload), "%s Preload", dsp->cs_dsp.name); snd_soc_component_disable_pin(component, preload); +#if IS_ENABLED(CONFIG_DEBUG_FS) cs_dsp_init_debugfs(&dsp->cs_dsp, component->debugfs_root); +#endif dsp->component = component; -- 2.33.0

2 3

[PATCH] ASoC: ux500: mop500: Constify static snd_soc_ops
by Rikard Falkeborn 29 Sep '21

29 Sep '21

The struct mop500_ab8500_ops is only assigned to the ops field in the snd_soc_dai_link struct which is a pointer to const struct snd_soc_ops. Make it const to allow the compiler to put it in read-only memory. Signed-off-by: Rikard Falkeborn <rikard.falkeborn(a)gmail.com> --- sound/soc/ux500/mop500_ab8500.c | 2 +- sound/soc/ux500/mop500_ab8500.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/ux500/mop500_ab8500.c b/sound/soc/ux500/mop500_ab8500.c index 2c39c7a2fd7d..3e654e708f78 100644 --- a/sound/soc/ux500/mop500_ab8500.c +++ b/sound/soc/ux500/mop500_ab8500.c @@ -348,7 +348,7 @@ static int mop500_ab8500_hw_free(struct snd_pcm_substream *substream) return 0; } -struct snd_soc_ops mop500_ab8500_ops[] = { +const struct snd_soc_ops mop500_ab8500_ops[] = { { .hw_params = mop500_ab8500_hw_params, .hw_free = mop500_ab8500_hw_free, diff --git a/sound/soc/ux500/mop500_ab8500.h b/sound/soc/ux500/mop500_ab8500.h index 8138a4e9aaf5..087ef246d87d 100644 --- a/sound/soc/ux500/mop500_ab8500.h +++ b/sound/soc/ux500/mop500_ab8500.h @@ -11,7 +11,7 @@ #ifndef MOP500_AB8500_H #define MOP500_AB8500_H -extern struct snd_soc_ops mop500_ab8500_ops[]; +extern const struct snd_soc_ops mop500_ab8500_ops[]; int mop500_ab8500_machine_init(struct snd_soc_pcm_runtime *rtd); void mop500_ab8500_remove(struct snd_soc_card *card); -- 2.33.0

2 1

[PATCH] ASoC: ti: Constify static snd_soc_ops
by Rikard Falkeborn 29 Sep '21

29 Sep '21

These are only assigned to the ops field in the snd_soc_dai_link struct which is a pointer to const struct snd_soc_ops. Make them const to allow the compiler to put them in read-only memory. Signed-off-by: Rikard Falkeborn <rikard.falkeborn(a)gmail.com> --- sound/soc/ti/davinci-evm.c | 2 +- sound/soc/ti/omap-abe-twl6040.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/ti/davinci-evm.c b/sound/soc/ti/davinci-evm.c index b043a0070d20..68d69e32681a 100644 --- a/sound/soc/ti/davinci-evm.c +++ b/sound/soc/ti/davinci-evm.c @@ -73,7 +73,7 @@ static int evm_hw_params(struct snd_pcm_substream *substream, return 0; } -static struct snd_soc_ops evm_ops = { +static const struct snd_soc_ops evm_ops = { .startup = evm_startup, .shutdown = evm_shutdown, .hw_params = evm_hw_params, diff --git a/sound/soc/ti/omap-abe-twl6040.c b/sound/soc/ti/omap-abe-twl6040.c index 2e3d1eea77c1..da809c7f25a4 100644 --- a/sound/soc/ti/omap-abe-twl6040.c +++ b/sound/soc/ti/omap-abe-twl6040.c @@ -96,7 +96,7 @@ static int omap_abe_dmic_hw_params(struct snd_pcm_substream *substream, return 0; } -static struct snd_soc_ops omap_abe_dmic_ops = { +static const struct snd_soc_ops omap_abe_dmic_ops = { .hw_params = omap_abe_dmic_hw_params, }; -- 2.33.0

2 1

[PATCH] ASoC: rt5682s Minor modifications to look more sensibly
by derek.fang＠realtek.com 29 Sep '21

29 Sep '21

From: Derek Fang <derek.fang(a)realtek.com> These modifications wouldn't affect the driver's behavior, but the code could look more sensibly. 1. Remove the volatile reg (0x0000) in reg_default. 2. Use dev_dbg instead of pr_debug. 3. Revise the macro RT5682S_PLLB_SRC_MASK to 0x1 because the mux is only two-source. Signed-off-by: Derek Fang <derek.fang(a)realtek.com> --- sound/soc/codecs/rt5682s.c | 3 +-- sound/soc/codecs/rt5682s.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c index d3e965b2e707..122adeb7beb1 100644 --- a/sound/soc/codecs/rt5682s.c +++ b/sound/soc/codecs/rt5682s.c @@ -72,7 +72,6 @@ static void rt5682s_apply_patch_list(struct rt5682s_priv *rt5682s, } const struct reg_default rt5682s_reg[] = { - {0x0000, 0x0001}, {0x0002, 0x8080}, {0x0003, 0x0001}, {0x0005, 0x0000}, @@ -769,7 +768,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_ count++; } while (val == 0 && count < 50); - pr_debug("%s, val=%d, count=%d\n", __func__, val, count); + dev_dbg(component->dev, "%s, val=%d, count=%d\n", __func__, val, count); switch (val) { case 0x1: diff --git a/sound/soc/codecs/rt5682s.h b/sound/soc/codecs/rt5682s.h index 7c755e5efb81..55f1febb81e9 100644 --- a/sound/soc/codecs/rt5682s.h +++ b/sound/soc/codecs/rt5682s.h @@ -1094,7 +1094,7 @@ #define RT5682S_PLLA_K_BP_SFT 6 /* PLL M/N/K Code Control 7 (0x009e) */ -#define RT5682S_PLLB_SRC_MASK (0x3 << 0) +#define RT5682S_PLLB_SRC_MASK (0x1) #define RT5682S_PLLB_SRC_DFIN (0x1) #define RT5682S_PLLB_SRC_PLLA (0x0) -- 2.17.1

2 1

[PATCH alsa-ucm-conf 0/5] bytcr-rt5640: Fixes and improvements
by Hans de Goede 29 Sep '21

29 Sep '21

Hi Jaroslav, Here is a patch series with 2 bug-fixes for X86 devices with a rt5640 codec (these 2 are a resend) + 3 patches adding support for the second headset-jack (on the dock) found on the HP elitepad 1000 G2. The new kernel-bits for the second headset-jack have already landed, so this is ready for merging. Regards, Hans

2 6

[PATCH alsa-ucm-conf 1/2] bytcr-rt5640: Fix 'Headphone Switch' / 'Headset Mic Switch' no longer getting set
by Hans de Goede 29 Sep '21

29 Sep '21

Commit 446d0a71b47f ("codecs/rt5640: Move out BayTrail-specific pin switches") moved the setting of the 'Headphone Switch' / 'Headset Mic Switch' into "If.hp" resp "If.hsmic" blocks. But instead of making them part of the True {} block inside that If, the statements where added add the top-level of the If {} block where they are no-ops. Move them to inside the True blocks so that these Switches again get properly turned on/off. This fixes the Headphones and Headset-mic no longer working on bytcr-rt5640 devices. Cc: Dmitry Osipenko <digetx(a)gmail.com> Fixes: 446d0a71b47f ("codecs/rt5640: Move out BayTrail-specific pin switches") Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- ucm2/bytcr-rt5640/HiFi.conf | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/ucm2/bytcr-rt5640/HiFi.conf b/ucm2/bytcr-rt5640/HiFi.conf index a5b47df..08127e0 100644 --- a/ucm2/bytcr-rt5640/HiFi.conf +++ b/ucm2/bytcr-rt5640/HiFi.conf @@ -100,16 +100,18 @@ If.mono { If.hp { Condition { Type String Empty "" } - True.Include.hs.File "/codecs/rt5640/HeadPhones.conf" + True { + Include.hs.File "/codecs/rt5640/HeadPhones.conf" - SectionDevice."Headphones" { - EnableSequence [ - cset "name='Headphone Switch' on" - ] + SectionDevice."Headphones" { + EnableSequence [ + cset "name='Headphone Switch' on" + ] - DisableSequence [ - cset "name='Headphone Switch' off" - ] + DisableSequence [ + cset "name='Headphone Switch' off" + ] + } } } @@ -178,15 +180,17 @@ If.in3 { If.hsmic { Condition { Type String Empty "" } - True.Include.hsmic.File "/codecs/rt5640/HeadsetMic.conf" + True { + Include.hsmic.File "/codecs/rt5640/HeadsetMic.conf" - SectionDevice."Headset" { - EnableSequence [ - cset "name='Headset Mic Switch' on" - ] + SectionDevice."Headset" { + EnableSequence [ + cset "name='Headset Mic Switch' on" + ] - DisableSequence [ - cset "name='Headset Mic Switch' off" - ] + DisableSequence [ + cset "name='Headset Mic Switch' off" + ] + } } } -- 2.31.1

2 2

[PATCH 0/9] ALSA: usb-audio: More fixes / improvements on PCM
by Takashi Iwai 29 Sep '21

29 Sep '21

Hi, this is a patch set for USB-audio to fix and improve the PCM stream handling. The primary target is the enhancement of the low-latency playback that was introduced recently for dealing with the small period size (that is used typically by JACK). There are a few other fixes that are relevant with it. The current patches are found in topic/usb-audio branch of sound.git tree, too. Takashi === Takashi Iwai (9): ALSA: usb-audio: Restrict rates for the shared clocks ALSA: usb-audio: Fix possible race at sync of urb completions ALSA: usb-audio: Rename early_playback_start flag with lowlatency_playback ALSA: usb-audio: Disable low-latency playback for free-wheel mode ALSA: usb-audio: Disable low-latency mode for implicit feedback sync ALSA: usb-audio: Check available frames for the next packet size ALSA: usb-audio: Add spinlock to stop_urbs() ALSA: usb-audio: Improved lowlatency playback support ALSA: usb-audio: Avoid killing in-flight URBs during draining sound/usb/card.h | 11 ++- sound/usb/endpoint.c | 230 +++++++++++++++++++++++++++++++------------ sound/usb/endpoint.h | 13 ++- sound/usb/pcm.c | 157 ++++++++++++++++++++++------- 4 files changed, 305 insertions(+), 106 deletions(-) -- 2.26.2

1 9