September 2022 - Alsa-devel - mailman.alsa-project.org

[PATCH v2] ASoC: wm_adsp: Handle optional legacy support
by Cristian Ciocaltea 05 Sep '22

05 Sep '22

The tracing capabilities for the speaker protection fw enabled via commit c55b3e46cb99 ("ASoC: wm_adsp: Add trace caps to speaker protection FW") are not be available on all platforms, such as the Valve's Steam Deck which is based on the Halo Core DSP. As a consequence, whenever the firmware is loaded, a rather misleading 'Failed to parse legacy: -19' error message is written to the kernel ring buffer: [ 288.977412] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: Firmware version: 3 [ 288.978002] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: cs35l41-dsp1-spk-prot.wmfw: Fri 02 Apr 2021 21:03:50 W. Europe Daylight Time [ 289.094065] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: Firmware: 400a4 vendor: 0x2 v0.33.0, 2 algorithms [ 289.095073] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: 0: ID cd v29.53.0 XM@94 YM@e [ 289.095665] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: 1: ID f20b v0.0.1 XM@170 YM@0 [ 289.096275] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: Protection: C:\Users\ocanavan\Desktop\cirrusTune_july2021.bin [ 291.172383] steamdeck kernel: cs35l41 spi-VLV1776:01: DSP1: Failed to parse legacy: -19 Update wm_adsp_buffer_init() to print a more descriptive info message when wm_adsp_buffer_parse_legacy() returns -ENODEV. Fixes: c55b3e46cb99 ("ASoC: wm_adsp: Add trace caps to speaker protection FW") Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea(a)collabora.com> --- Changes in v2: - Add a generic handling of the issue, not bound to a particular firmware, as suggested by Charles - Update commit message, including the subject, to reflect the changes sound/soc/codecs/wm_adsp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c index cfaa45ede916..8a2e9771bb50 100644 --- a/sound/soc/codecs/wm_adsp.c +++ b/sound/soc/codecs/wm_adsp.c @@ -1602,7 +1602,9 @@ static int wm_adsp_buffer_init(struct wm_adsp *dsp) if (list_empty(&dsp->buffer_list)) { /* Fall back to legacy support */ ret = wm_adsp_buffer_parse_legacy(dsp); - if (ret) + if (ret == -ENODEV) + adsp_info(dsp, "Legacy support not available\n"); + else if (ret) adsp_warn(dsp, "Failed to parse legacy: %d\n", ret); } base-commit: 568035b01cfb107af8d2e4bd2fb9aea22cf5b868 -- 2.37.2

3 2

[PATCH] ASoC: apple: mca: Postpone requesting of DMA channels
by Martin Povišer 05 Sep '22

05 Sep '22

Move the requesting of DMA channels further down from 'probe' to 'pcm_new'. This is to spare the allocated DMA channel resources as we typically only ever use one or two of the clusters for PCM streaming. Before we would request DMA channels for all clusters. (This is prompted by a change in the Audio DMA Controller driver, which will now be allocating cache SRAM to channels.) Signed-off-by: Martin Povišer <povik+lin(a)cutebit.org> --- sound/soc/apple/mca.c | 79 +++++++++++++++++++++++++------------------ 1 file changed, 46 insertions(+), 33 deletions(-) diff --git a/sound/soc/apple/mca.c b/sound/soc/apple/mca.c index aa67d57c9a9b..69643524796e 100644 --- a/sound/soc/apple/mca.c +++ b/sound/soc/apple/mca.c @@ -885,6 +885,43 @@ static snd_pcm_uframes_t mca_pointer(struct snd_soc_component *component, return snd_dmaengine_pcm_pointer(substream); } +static struct dma_chan *mca_request_dma_channel(struct mca_cluster *cl, unsigned int stream) +{ + bool is_tx = (stream == SNDRV_PCM_STREAM_PLAYBACK); +#ifndef USE_RXB_FOR_CAPTURE + char *name = devm_kasprintf(cl->host->dev, GFP_KERNEL, + is_tx ? "tx%da" : "rx%da", cl->no); +#else + char *name = devm_kasprintf(cl->host->dev, GFP_KERNEL, + is_tx ? "tx%da" : "rx%db", cl->no); +#endif + return of_dma_request_slave_channel(cl->host->dev->of_node, name); + +} + +static void mca_pcm_free(struct snd_soc_component *component, + struct snd_pcm *pcm) +{ + struct snd_soc_pcm_runtime *rtd = snd_pcm_chip(pcm); + struct mca_cluster *cl = mca_dai_to_cluster(asoc_rtd_to_cpu(rtd, 0)); + unsigned int i; + + if (rtd->dai_link->no_pcm) + return; + + for_each_pcm_streams(i) { + struct snd_pcm_substream *substream = + rtd->pcm->streams[i].substream; + + if (!substream || !cl->dma_chans[i]) + continue; + + dma_release_channel(cl->dma_chans[i]); + cl->dma_chans[i] = NULL; + } +} + + static int mca_pcm_new(struct snd_soc_component *component, struct snd_soc_pcm_runtime *rtd) { @@ -897,17 +934,21 @@ static int mca_pcm_new(struct snd_soc_component *component, for_each_pcm_streams(i) { struct snd_pcm_substream *substream = rtd->pcm->streams[i].substream; - struct dma_chan *chan = cl->dma_chans[i]; + struct dma_chan *chan; if (!substream) continue; - if (!chan) { - dev_err(component->dev, "missing DMA channel for stream %d on SERDES %d\n", - i, cl->no); + chan = mca_request_dma_channel(cl, i); + + if (IS_ERR_OR_NULL(chan)) { + dev_err(component->dev, "unable to obtain DMA channel (stream %d cluster %d): %pe\n", + i, cl->no, chan); + mca_pcm_free(component, rtd->pcm); return -EINVAL; } + cl->dma_chans[i] = chan; snd_pcm_set_managed_buffer(substream, SNDRV_DMA_TYPE_DEV_IRAM, chan->device->dev, 512 * 1024 * 6, SIZE_MAX); @@ -924,6 +965,7 @@ static const struct snd_soc_component_driver mca_component = { .trigger = mca_trigger, .pointer = mca_pointer, .pcm_construct = mca_pcm_new, + .pcm_destruct = mca_pcm_free, }; static void apple_mca_release(struct mca_data *mca) @@ -1019,7 +1061,6 @@ static int apple_mca_probe(struct platform_device *pdev) struct snd_soc_dai_driver *fe = &dai_drivers[mca->nclusters + i]; struct snd_soc_dai_driver *be = &dai_drivers[i]; - int stream; cl->host = mca; cl->no = i; @@ -1041,34 +1082,6 @@ static int apple_mca_probe(struct platform_device *pdev) goto err_release; } - for_each_pcm_streams(stream) { - struct dma_chan *chan; - bool is_tx = (stream == SNDRV_PCM_STREAM_PLAYBACK); -#ifndef USE_RXB_FOR_CAPTURE - char *name = devm_kasprintf(&pdev->dev, GFP_KERNEL, - is_tx ? "tx%da" : "rx%da", - i); -#else - char *name = devm_kasprintf(&pdev->dev, GFP_KERNEL, - is_tx ? "tx%da" : "rx%db", - i); -#endif - - chan = of_dma_request_slave_channel(pdev->dev.of_node, - name); - if (IS_ERR(chan)) { - if (PTR_ERR(chan) != -EPROBE_DEFER) - dev_err(&pdev->dev, - "no %s DMA channel: %ld\n", - name, PTR_ERR(chan)); - - ret = PTR_ERR(chan); - goto err_release; - } - - cl->dma_chans[stream] = chan; - } - fe->id = i; fe->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "mca-pcm-%d", i); -- 2.33.0

2 1

[PATCH 0/3] ASoC: soc-pcm.c: random cleanup
by Kuninori Morimoto 05 Sep '22

05 Sep '22

Hi Mark These are not related, but random cleanup patches for soc-pcm.c Kuninori Morimoto (3): ASoC: soc-pcm.c: remove unnecessary codec2codec_close_delayed_work() ASoC: soc-pcm.c: add soc_pcm_ret() ASoC: soc-pcm.c: check fe condition at out of loop sound/soc/soc-pcm.c | 112 +++++++++++++++++++------------------------- 1 file changed, 47 insertions(+), 65 deletions(-) -- 2.25.1

2 4

[PATCH] ALSA: hda/sigmatel: Fix unused variable warning for beep power change
by Takashi Iwai 05 Sep '22

05 Sep '22

The newly added stac_check_power_status() caused a compile warning when CONFIG_SND_HDA_INPUT_BEEP is disabled. Fix it. Fixes: 414d38ba8710 ("ALSA: hda/sigmatel: Keep power up while beep is enabled") Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/pci/hda/patch_sigmatel.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c index 066bfccd2587..7f340f18599c 100644 --- a/sound/pci/hda/patch_sigmatel.c +++ b/sound/pci/hda/patch_sigmatel.c @@ -4447,7 +4447,9 @@ static int stac_suspend(struct hda_codec *codec) static int stac_check_power_status(struct hda_codec *codec, hda_nid_t nid) { +#ifdef CONFIG_SND_HDA_INPUT_BEEP struct sigmatel_spec *spec = codec->spec; +#endif int ret = snd_hda_gen_check_power_status(codec, nid); #ifdef CONFIG_SND_HDA_INPUT_BEEP -- 2.35.3

1 0

[PATCH] ALSA: usb-audio: Refcount multiple accesses on the single clock
by Takashi Iwai 05 Sep '22

05 Sep '22

When a clock source is connected to multiple nodes / endpoints, the current USB-audio driver tries to set up at each time one of them is configured. Although it reads the current rate and updates only if it differs, some devices seem unhappy with this behavior and spew the errors when reading/updating the rate unnecessarily. This patch tries to reduce the redundant clock setup by introducing a refcount for each clock source. When the stream is actually running, a clock rate is "locked", and it bypasses the clock and/or refuse to change any longer. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215934 Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/usb/card.c | 1 + sound/usb/card.h | 3 +- sound/usb/endpoint.c | 90 +++++++++++++++++++++++++++++++++++++++----- sound/usb/usbaudio.h | 1 + 4 files changed, 85 insertions(+), 10 deletions(-) diff --git a/sound/usb/card.c b/sound/usb/card.c index 376962291c4d..0fff96a5d3ab 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -635,6 +635,7 @@ static int snd_usb_audio_create(struct usb_interface *intf, INIT_LIST_HEAD(&chip->pcm_list); INIT_LIST_HEAD(&chip->ep_list); INIT_LIST_HEAD(&chip->iface_ref_list); + INIT_LIST_HEAD(&chip->clock_ref_list); INIT_LIST_HEAD(&chip->midi_list); INIT_LIST_HEAD(&chip->mixer_list); diff --git a/sound/usb/card.h b/sound/usb/card.h index 87f042d06ce0..ca75f2206170 100644 --- a/sound/usb/card.h +++ b/sound/usb/card.h @@ -44,6 +44,7 @@ struct audioformat { struct snd_usb_substream; struct snd_usb_iface_ref; +struct snd_usb_clock_ref; struct snd_usb_endpoint; struct snd_usb_power_domain; @@ -62,6 +63,7 @@ struct snd_urb_ctx { struct snd_usb_endpoint { struct snd_usb_audio *chip; struct snd_usb_iface_ref *iface_ref; + struct snd_usb_clock_ref *clock_ref; int opened; /* open refcount; protect with chip->mutex */ atomic_t running; /* running status */ @@ -138,7 +140,6 @@ struct snd_usb_endpoint { unsigned int cur_period_frames; unsigned int cur_period_bytes; unsigned int cur_buffer_periods; - unsigned char cur_clock; spinlock_t lock; struct list_head list; diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c index 743b8287cfcd..df5a70013a85 100644 --- a/sound/usb/endpoint.c +++ b/sound/usb/endpoint.c @@ -35,6 +35,14 @@ struct snd_usb_iface_ref { struct list_head list; }; +/* clock refcounting */ +struct snd_usb_clock_ref { + unsigned char clock; + atomic_t locked; + int rate; + struct list_head list; +}; + /* * snd_usb_endpoint is a model that abstracts everything related to an * USB endpoint and its streaming. @@ -591,6 +599,25 @@ iface_ref_find(struct snd_usb_audio *chip, int iface) return ip; } +/* Similarly, a refcount object for clock */ +static struct snd_usb_clock_ref * +clock_ref_find(struct snd_usb_audio *chip, int clock) +{ + struct snd_usb_clock_ref *ref; + + list_for_each_entry(ref, &chip->clock_ref_list, list) + if (ref->clock == clock) + return ref; + + ref = kzalloc(sizeof(*ref), GFP_KERNEL); + if (!ref) + return NULL; + ref->clock = clock; + atomic_set(&ref->locked, 0); + list_add_tail(&ref->list, &chip->clock_ref_list); + return ref; +} + /* * Get the existing endpoint object corresponding EP * Returns NULL if not present. @@ -768,6 +795,14 @@ snd_usb_endpoint_open(struct snd_usb_audio *chip, goto unlock; } + if (fp->protocol != UAC_VERSION_1) { + ep->clock_ref = clock_ref_find(chip, fp->clock); + if (!ep->clock_ref) { + ep = NULL; + goto unlock; + } + } + ep->cur_audiofmt = fp; ep->cur_channels = fp->channels; ep->cur_rate = params_rate(params); @@ -777,7 +812,6 @@ snd_usb_endpoint_open(struct snd_usb_audio *chip, ep->cur_period_frames = params_period_size(params); ep->cur_period_bytes = ep->cur_period_frames * ep->cur_frame_bytes; ep->cur_buffer_periods = params_periods(params); - ep->cur_clock = fp->clock; if (ep->type == SND_USB_ENDPOINT_TYPE_SYNC) endpoint_set_syncinterval(chip, ep); @@ -894,8 +928,8 @@ void snd_usb_endpoint_close(struct snd_usb_audio *chip, ep->altsetting = 0; ep->cur_audiofmt = NULL; ep->cur_rate = 0; - ep->cur_clock = 0; ep->iface_ref = NULL; + ep->clock_ref = NULL; usb_audio_dbg(chip, "EP 0x%x closed\n", ep->ep_num); } mutex_unlock(&chip->mutex); @@ -907,6 +941,8 @@ void snd_usb_endpoint_suspend(struct snd_usb_endpoint *ep) ep->need_setup = true; if (ep->iface_ref) ep->iface_ref->need_setup = true; + if (ep->clock_ref) + ep->clock_ref->rate = 0; } /* @@ -1314,6 +1350,33 @@ static int snd_usb_endpoint_set_params(struct snd_usb_audio *chip, return 0; } +static int init_sample_rate(struct snd_usb_audio *chip, + struct snd_usb_endpoint *ep) +{ + struct snd_usb_clock_ref *clock = ep->clock_ref; + int err; + + if (clock) { + if (atomic_read(&clock->locked)) + return 0; + if (clock->rate == ep->cur_rate) + return 0; + if (clock->rate && clock->rate != ep->cur_rate) { + usb_audio_dbg(chip, "Mismatched sample rate %d vs %d for EP 0x%x\n", + clock->rate, ep->cur_rate, ep->ep_num); + return -EINVAL; + } + } + + err = snd_usb_init_sample_rate(chip, ep->cur_audiofmt, ep->cur_rate); + if (err < 0) + return err; + + if (clock) + clock->rate = ep->cur_rate; + return 0; +} + /* * snd_usb_endpoint_configure: Configure the endpoint * @@ -1343,8 +1406,7 @@ int snd_usb_endpoint_configure(struct snd_usb_audio *chip, * to update at each EP configuration */ if (ep->cur_audiofmt->protocol == UAC_VERSION_1) { - err = snd_usb_init_sample_rate(chip, ep->cur_audiofmt, - ep->cur_rate); + err = init_sample_rate(chip, ep); if (err < 0) goto unlock; } @@ -1374,7 +1436,7 @@ int snd_usb_endpoint_configure(struct snd_usb_audio *chip, if (err < 0) goto unlock; - err = snd_usb_init_sample_rate(chip, ep->cur_audiofmt, ep->cur_rate); + err = init_sample_rate(chip, ep); if (err < 0) goto unlock; @@ -1407,15 +1469,15 @@ int snd_usb_endpoint_configure(struct snd_usb_audio *chip, /* get the current rate set to the given clock by any endpoint */ int snd_usb_endpoint_get_clock_rate(struct snd_usb_audio *chip, int clock) { - struct snd_usb_endpoint *ep; + struct snd_usb_clock_ref *ref; int rate = 0; if (!clock) return 0; mutex_lock(&chip->mutex); - list_for_each_entry(ep, &chip->ep_list, list) { - if (ep->cur_clock == clock && ep->cur_rate) { - rate = ep->cur_rate; + list_for_each_entry(ref, &chip->clock_ref_list, list) { + if (ref->clock == clock) { + rate = ref->rate; break; } } @@ -1456,6 +1518,9 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep) if (atomic_inc_return(&ep->running) != 1) return 0; + if (ep->clock_ref) + atomic_inc(&ep->clock_ref->locked); + ep->active_mask = 0; ep->unlink_mask = 0; ep->phase = 0; @@ -1565,6 +1630,9 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep, bool keep_pending) if (ep->sync_source) WRITE_ONCE(ep->sync_source->sync_sink, NULL); stop_urbs(ep, false, keep_pending); + if (ep->clock_ref) + if (!atomic_dec_return(&ep->clock_ref->locked)) + ep->clock_ref->rate = 0; } } @@ -1591,12 +1659,16 @@ void snd_usb_endpoint_free_all(struct snd_usb_audio *chip) { struct snd_usb_endpoint *ep, *en; struct snd_usb_iface_ref *ip, *in; + struct snd_usb_clock_ref *cp, *cn; list_for_each_entry_safe(ep, en, &chip->ep_list, list) kfree(ep); list_for_each_entry_safe(ip, in, &chip->iface_ref_list, list) kfree(ip); + + list_for_each_entry_safe(cp, cn, &chip->clock_ref_list, list) + kfree(ip); } /* diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h index 044cd7ab27cb..ffbb4b0d09a0 100644 --- a/sound/usb/usbaudio.h +++ b/sound/usb/usbaudio.h @@ -45,6 +45,7 @@ struct snd_usb_audio { struct list_head pcm_list; /* list of pcm streams */ struct list_head ep_list; /* list of audio-related endpoints */ struct list_head iface_ref_list; /* list of interface refcounts */ + struct list_head clock_ref_list; /* list of clock refcounts */ int pcm_devs; struct list_head midi_list; /* list of midi interfaces */ -- 2.35.3

2 2

[PATCH] MAINTAINERS: rectify entry in ARM/APPLE MACHINE SOUND DRIVERS
by Lukas Bulwahn 05 Sep '22

05 Sep '22

Commit 3df5d0d97289 ("ASoC: apple: mca: Start new platform driver") adds a new sound driver at the location "sound/soc/apple/", but it adds a file entry referring to the non-existing location "drivers/sound/apple/*". Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Repair this file reference in ARM/APPLE MACHINE SOUND DRIVERS. Signed-off-by: Lukas Bulwahn <lukas.bulwahn(a)gmail.com> --- Martin, please ack. Mark, please pick this patch on top of the commit above. MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 29443aad5031..c239d7e69158 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1904,7 +1904,7 @@ L: asahi(a)lists.linux.dev L: alsa-devel(a)alsa-project.org (moderated for non-subscribers) S: Maintained F: Documentation/devicetree/bindings/sound/apple,* -F: drivers/sound/apple/* +F: sound/soc/apple/ ARM/ARTPEC MACHINE SUPPORT M: Jesper Nilsson <jesper.nilsson(a)axis.com> -- 2.17.1

2 2

[PATCH] ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
by Takashi Iwai 05 Sep '22

05 Sep '22

There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant. Reported-and-tested-by: butt3rflyh4ck <butterflyhuangxx(a)gmail.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/CAFcO6XN7JDM4xSXGhtusQfS2mSBcx50VJKwQpCq=WeLt57aa… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/oss/pcm_oss.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 90c3a367d7de..02df915eb3c6 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1672,14 +1672,14 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) runtime = substream->runtime; if (atomic_read(&substream->mmap_count)) goto __direct; - err = snd_pcm_oss_make_ready(substream); - if (err < 0) - return err; atomic_inc(&runtime->oss.rw_ref); if (mutex_lock_interruptible(&runtime->oss.params_lock)) { atomic_dec(&runtime->oss.rw_ref); return -ERESTARTSYS; } + err = snd_pcm_oss_make_ready_locked(substream); + if (err < 0) + goto unlock; format = snd_pcm_oss_format_from(runtime->oss.format); width = snd_pcm_format_physical_width(format); if (runtime->oss.buffer_used > 0) { -- 2.35.3

2 1

A new null-ptr-deref Write bug in snd_pcm_format_set_silence
by butt3rflyh4ck 05 Sep '22

05 Sep '22

Hi, there is a new null-ptr-deref Write bug in snd_pcm_format_set_slience in sound/core/pcm_misc.c in the latest upstream kernel and can reproduce it. We call SNDCTL_DSP_SYNC and SNDCTL_DSP_SPEED in multiple threads to trigger the vulnerability. See the Call Trace: ================================================================== Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memset+0x20/0x40 mm/kasan/shadow.c:44 snd_pcm_format_set_silence sound/core/pcm_misc.c:441 [inline] snd_pcm_format_set_silence+0x215/0x350 sound/core/pcm_misc.c:424 snd_pcm_oss_sync+0x60e/0x800 sound/core/oss/pcm_oss.c:1690 snd_pcm_oss_ioctl+0x2087/0x3420 sound/core/oss/pcm_oss.c:2634 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ================================================================== We can see the function snd_pcm_format_set_silence code below: ``` int snd_pcm_format_set_silence(snd_pcm_format_t format, void *data, unsigned int samples) { int width; unsigned char *dst; const unsigned char *pat; if (!valid_format(format)) return -EINVAL; if (samples == 0) return 0; width = pcm_formats[(INT)format].phys; /* physical width */ pat = pcm_formats[(INT)format].silence; if (!width || !pat) return -EINVAL; /* signed or 1 byte data */ if (pcm_formats[(INT)format].signd == 1 || width <= 8) { unsigned int bytes = samples * width / 8; memset(data, *pat, bytes); ///// [1] ---------> data is NULL return 0; } ...... } ``` [1], the data pointer is NULL, we can know snd_pcm_format_set_silence called in line 1690 in sound/core/oss/pcm_oss.c from call stack trace. let we see code below: ``` static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) { int err = 0; unsigned int saved_f_flags; struct snd_pcm_substream *substream; struct snd_pcm_runtime *runtime; snd_pcm_format_t format; unsigned long width; size_t size; substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; if (substream != NULL) { runtime = substream->runtime; if (atomic_read(&substream->mmap_count)) goto __direct; err = snd_pcm_oss_make_ready(substream); if (err < 0) return err; atomic_inc(&runtime->oss.rw_ref); if (mutex_lock_interruptible(&runtime->oss.params_lock)) { atomic_dec(&runtime->oss.rw_ref); return -ERESTARTSYS; } format = snd_pcm_oss_format_from(runtime->oss.format); width = snd_pcm_format_physical_width(format); if (runtime->oss.buffer_used > 0) { #ifdef OSS_DEBUG pcm_dbg(substream->pcm, "sync: buffer_used\n"); #endif size = (8 * (runtime->oss.period_bytes - runtime->oss.buffer_used) + 7) / width; snd_pcm_format_set_silence(format, runtime->oss.buffer + runtime->oss.buffer_used, ///// [2] size); err = snd_pcm_oss_sync1(substream, runtime->oss.period_bytes); if (err < 0) goto unlock; } else if (runtime->oss.period_ptr > 0) { ``` [2] runtime->oss.buffer + runtime->oss.buffer_used is the data pointer, but runtime->oss.buffer is NULL here but it doesn't make sense. runtime->oss.buffter is allocated by kvzalloc, if runtime->oss_buffer is NULL, it would return an ENOMEM error. Maybe I think there is a race condition, the runtime->oss.buffer is freed and set to NULL but we can use runtime->oss.buffter via ioctl. ###reproduce it [ 167.258988][T25615] ================================================================== [ 167.265917][T25615] BUG: KASAN: null-ptr-deref in snd_pcm_format_set_silence+0x215/0x350 [ 167.266704][T25615] Write of size 16383 at addr 0000000000000001 by task snd_pcm_format_/25615 [ 167.267506][T25615] [ 167.267732][T25615] CPU: 0 PID: 25615 Comm: snd_pcm_format_ Not tainted 6.0.0-rc3-00299-gd895ec7938c4 #11 [ 167.268617][T25615] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 167.269410][T25615] Call Trace: [ 167.269697][T25615] <TASK> [ 167.269977][T25615] dump_stack_lvl+0xcd/0x134 [ 167.270428][T25615] ? snd_pcm_format_set_silence+0x215/0x350 [ 167.270985][T25615] kasan_report+0xb1/0x1e0 [ 167.271405][T25615] ? snd_pcm_format_set_silence+0x215/0x350 [ 167.271964][T25615] kasan_check_range+0x13d/0x180 [ 167.272440][T25615] memset+0x20/0x40 [ 167.272809][T25615] snd_pcm_format_set_silence+0x215/0x350 [ 167.273366][T25615] snd_pcm_oss_sync+0x60e/0x800 [ 167.273831][T25615] snd_pcm_oss_ioctl+0x2087/0x3420 [ 167.274320][T25615] ? snd_pcm_oss_release+0x300/0x300 [ 167.274817][T25615] ? __fget_files+0x26a/0x440 [ 167.275262][T25615] ? bpf_lsm_file_ioctl+0x5/0x10 [ 167.275731][T25615] ? snd_pcm_oss_release+0x300/0x300 [ 167.276222][T25615] __x64_sys_ioctl+0x193/0x200 [ 167.276677][T25615] do_syscall_64+0x35/0xb0 [ 167.277108][T25615] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 167.277679][T25615] RIP: 0033:0x44af9d [ 167.278058][T25615] Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff 8 [ 167.279792][T25615] RSP: 002b:00007f0cb636a178 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 167.280546][T25615] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044af9d [ 167.281285][T25615] RDX: 0000000000000000 RSI: 0000000000005001 RDI: 0000000000000003 [ 167.282001][T25615] RBP: 00007f0cb636a1a0 R08: 0000000000000000 R09: 0000000000000000 [ 167.282715][T25615] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcfea8e08e [ 167.283432][T25615] R13: 00007ffcfea8e08f R14: 0000000000000000 R15: 00007f0cb636a640 [ 167.284164][T25615] </TASK> [ 167.284453][T25615] ================================================================== If needed I would provide a reproduce. Regards, butt3rflyh4ck. -- Active Defense Lab of Venustech

2 3

[PATCH] ALSA: usb-audio: Register card at the last interface
by Takashi Iwai 04 Sep '22

04 Sep '22

The USB-audio driver matches per interface, and as default, it registers the card instance at the very first instance. This can be a problem for the devices that have multiple interfaces to be probed, as the udev rule isn't applied properly for the later appearing interfaces. Although we introduced the delayed_register option and the quirks for covering those shortcomings, it's nothing but a workaround for specific devices. This patch is an another attempt to fix the problem in a more generic way. Now the driver checks the whole USB device descriptor at the very first time when an interface is attached to a sound card. It looks at each matching interface in the descriptor and remembers the last matching one. The snd_card_register() is invoked only when this last interface is probed. After this change, the quirks for the delayed registration become superfluous, hence they are removed along with the patch. OTOH, the delayed_register option is still kept, as it might be useful for some corner cases (e.g. a special driver overtakes the interface probe from the standard driver, and the last interface probe may miss). Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/usb/card.c | 32 +++++++++++++++++++++++++------- sound/usb/quirks.c | 42 ------------------------------------------ sound/usb/quirks.h | 2 -- sound/usb/usbaudio.h | 1 + 4 files changed, 26 insertions(+), 51 deletions(-) diff --git a/sound/usb/card.c b/sound/usb/card.c index 706d249a9ad6..3aea241435fb 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -690,7 +690,7 @@ static bool get_alias_id(struct usb_device *dev, unsigned int *id) return false; } -static bool check_delayed_register_option(struct snd_usb_audio *chip, int iface) +static int check_delayed_register_option(struct snd_usb_audio *chip) { int i; unsigned int id, inum; @@ -699,14 +699,31 @@ static bool check_delayed_register_option(struct snd_usb_audio *chip, int iface) if (delayed_register[i] && sscanf(delayed_register[i], "%x:%x", &id, &inum) == 2 && id == chip->usb_id) - return iface < inum; + return inum; } - return false; + return -1; } static const struct usb_device_id usb_audio_ids[]; /* defined below */ +/* look for the last interface that matches with our ids and remember it */ +static void find_last_interface(struct snd_usb_audio *chip) +{ + struct usb_host_config *config = chip->dev->actconfig; + struct usb_interface *intf; + int i; + + if (!config) + return; + for (i = 0; i < config->desc.bNumInterfaces; i++) { + intf = config->interface[i]; + if (usb_match_id(intf, usb_audio_ids)) + chip->last_iface = intf->altsetting[0].desc.bInterfaceNumber; + } + usb_audio_dbg(chip, "Found last interface = %d\n", chip->last_iface); +} + /* look for the corresponding quirk */ static const struct snd_usb_audio_quirk * get_alias_quirk(struct usb_device *dev, unsigned int id) @@ -813,6 +830,7 @@ static int usb_audio_probe(struct usb_interface *intf, err = -ENODEV; goto __error; } + find_last_interface(chip); } if (chip->num_interfaces >= MAX_CARD_INTERFACES) { @@ -862,11 +880,11 @@ static int usb_audio_probe(struct usb_interface *intf, chip->need_delayed_register = false; /* clear again */ } - /* we are allowed to call snd_card_register() many times, but first - * check to see if a device needs to skip it or do anything special + /* register card if we reach to the last interface or to the specified + * one given via option */ - if (!snd_usb_registration_quirk(chip, ifnum) && - !check_delayed_register_option(chip, ifnum)) { + if (check_delayed_register_option(chip) == ifnum || + chip->last_iface == ifnum) { err = snd_card_register(chip->card); if (err < 0) goto __error; diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index 5b4d8f5eade2..8c3b0be909eb 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -1728,48 +1728,6 @@ void snd_usb_audioformat_attributes_quirk(struct snd_usb_audio *chip, } } -/* - * registration quirk: - * the registration is skipped if a device matches with the given ID, - * unless the interface reaches to the defined one. This is for delaying - * the registration until the last known interface, so that the card and - * devices appear at the same time. - */ - -struct registration_quirk { - unsigned int usb_id; /* composed via USB_ID() */ - unsigned int interface; /* the interface to trigger register */ -}; - -#define REG_QUIRK_ENTRY(vendor, product, iface) \ - { .usb_id = USB_ID(vendor, product), .interface = (iface) } - -static const struct registration_quirk registration_quirks[] = { - REG_QUIRK_ENTRY(0x0951, 0x16d8, 2), /* Kingston HyperX AMP */ - REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */ - REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ - REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ - REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */ - REG_QUIRK_ENTRY(0x0ecb, 0x1f4c, 2), /* JBL Quantum 400 */ - REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ - REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ - REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ - { 0 } /* terminator */ -}; - -/* return true if skipping registration */ -bool snd_usb_registration_quirk(struct snd_usb_audio *chip, int iface) -{ - const struct registration_quirk *q; - - for (q = registration_quirks; q->usb_id; q++) - if (chip->usb_id == q->usb_id) - return iface < q->interface; - - /* Register as normal */ - return false; -} - /* * driver behavior quirk flags */ diff --git a/sound/usb/quirks.h b/sound/usb/quirks.h index 31abb7cb01a5..f9bfd5ac7bab 100644 --- a/sound/usb/quirks.h +++ b/sound/usb/quirks.h @@ -48,8 +48,6 @@ void snd_usb_audioformat_attributes_quirk(struct snd_usb_audio *chip, struct audioformat *fp, int stream); -bool snd_usb_registration_quirk(struct snd_usb_audio *chip, int iface); - void snd_usb_init_quirk_flags(struct snd_usb_audio *chip); #endif /* __USBAUDIO_QUIRKS_H */ diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h index ffbb4b0d09a0..2c6575029b1c 100644 --- a/sound/usb/usbaudio.h +++ b/sound/usb/usbaudio.h @@ -37,6 +37,7 @@ struct snd_usb_audio { unsigned int quirk_flags; unsigned int need_delayed_register:1; /* warn for delayed registration */ int num_interfaces; + int last_iface; int num_suspended_intf; int sample_rate_read_error; -- 2.35.3

1 0

[PATCH v5 0/2] lib/string_helpers: Introduce parse_int_array_user()
by Cezary Rojewski 04 Sep '22

04 Sep '22

Continuation of recent upstream discussion [1] regarding user string tokenization. First, parse_int_array_user() is introduced to allow for splitting specified user string into a sequence of integers. Makes use of get_options() internally so the parsing logic is not duplicated. With that done, redundant parts of the sound driver are removed. Originally similar functionality was added for the SOF sound driver. As more users are on the horizon, it is desirable to update existing string_helpers code and provide a unified solution. Changes in v5: - fixed kernel doc for parse_int_array_user() Changes in v4: - renamed the function to parse_int_array_user() - at the name several local variable names have been reworded to match the above Changes in v3: - relocated tokenize_user_input() implementation to string_helpers as requested by Matthew Changes in v2: - reused get_options() so no parsing logic is duplicated - simplified __user variant with help of memdup_user_nul() Both suggested by Andy, thanks for thorough review [1]: https://lore.kernel.org/alsa-devel/20220707091301.1282291-1-cezary.rojewski… Cezary Rojewski (2): lib/string_helpers: Introduce parse_int_array_user() ASoC: SOF: Remove strsplit_u32() and tokenize_input() include/linux/string_helpers.h | 2 + lib/string_helpers.c | 44 +++++++++++++ sound/soc/sof/sof-client-probes.c | 104 ++++++------------------------ 3 files changed, 64 insertions(+), 86 deletions(-) -- 2.25.1

2 6