September 2022 - Alsa-devel - mailman.alsa-project.org

Re: general protection fault in release_urbs
by Takashi Iwai 30 Sep '22

30 Sep '22

On Fri, 30 Sep 2022 04:23:23 +0200, Sabri N. Ferreiro wrote: > > Hi, > > When I used fuzz testing to test Linux kernel 6.0.0-rc6, the kernel > triggered the following error: > HEAD commit: 521a547ced6477c54b4b0cc206000406c221b4d6 > git tree: upstream Could you retest with 6.0-rc7 or later? A commit reverting the change might influence on the behavior significantly. thanks, Takashi > kernel config: https://pastebin.com/raw/hekxU61F > console log: https://pastebin.com/KVwW9VQs > > It seems that the fuzzer failed to extract any C reproducer, but I > would so appreciate it if you have any idea how to solve this bug. > > general protection fault, probably for non-canonical address > 0xdffffc000000000d: 0000 [#1] PREEMPT SMP KASAN > KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] > CPU: 1 PID: 29906 Comm: syz-executor.4 Not tainted 6.0.0-rc6+ #3 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > 1.13.0-1ubuntu1.1 04/01/2014 > RIP: 0010:release_urb_ctx sound/usb/endpoint.c:97 [inline] > RIP: 0010:release_urbs sound/usb/endpoint.c:1046 [inline] > RIP: 0010:release_urbs+0x254/0x5a0 sound/usb/endpoint.c:1031 > Code: 44 89 fe 48 c1 e0 08 4c 8b 74 03 58 e8 75 b4 53 fa 45 85 ff 0f > 84 29 ff ff ff e8 07 b3 53 fa 49 8d 7e 68 48 89 f8 48 c1 e8 03 <42> 80 > 3c 20 00 0f 85 32 03 00 00 49 8d 7e 60 49 8b 4e 68 48 89 f8 > RSP: 0018:ffffc9001698f8d0 EFLAGS: 00010212 > RAX: 000000000000000d RBX: ffff88805fc44000 RCX: 0000000000040000 > RDX: ffffc900169d1000 RSI: ffff888018c21d40 RDI: 0000000000000068 > RBP: 0000000000000000 R08: ffffffff87273539 R09: 0000000000000000 > R10: 0000000000000005 R11: ffffed100bf88805 R12: dffffc0000000000 > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000120 > FS: 00007febd6e4e700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 000055555663ddc8 CR3: 0000000065e07000 CR4: 0000000000350ee0 > Call Trace: > <TASK> > snd_usb_endpoint_set_params+0x1aab/0x2550 > snd_mask_min include/sound/pcm_params.h:49 [inline] > params_format include/sound/pcm_params.h:315 [inline] > snd_usb_hw_params+0x934/0x1180 sound/usb/pcm.c:503 > snd_pcm_hw_params+0xbad/0x1da0 sound/core/pcm_native.c:767 > snd_pcm_kernel_ioctl+0x164/0x310 sound/core/pcm_native.c:3437 > snd_pcm_oss_change_params_locked+0x1834/0x3860 sound/core/oss/pcm_oss.c:976 > snd_pcm_oss_change_params+0x76/0xd0 sound/core/oss/pcm_oss.c:1116 > snd_pcm_oss_make_ready+0xb7/0x170 sound/core/oss/pcm_oss.c:1175 > snd_pcm_oss_get_ptr sound/core/oss/pcm_oss.c:2208 [inline] > snd_pcm_oss_ioctl+0x3cd/0x3270 sound/core/oss/pcm_oss.c:2729 > vfs_ioctl fs/ioctl.c:51 [inline] > __do_sys_ioctl fs/ioctl.c:870 [inline] > __se_sys_ioctl fs/ioctl.c:856 [inline] > __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > RIP: 0033:0x7febd66a80fd > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d > 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007febd6e4dbf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 > RAX: ffffffffffffffda RBX: 00007febd679c340 RCX: 00007febd66a80fd > RDX: 00000000200000c0 RSI: 00000000800c5011 RDI: 0000000000000003 > RBP: 00007febd6e4dc50 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000005f > R13: 00007ffc28c4cf7f R14: 00007ffc28c4d120 R15: 00007febd6e4dd80 > </TASK> > Modules linked in: > ---[ end trace 0000000000000000 ]--- > RIP: 0010:release_urb_ctx sound/usb/endpoint.c:97 [inline] > RIP: 0010:release_urbs sound/usb/endpoint.c:1046 [inline] > RIP: 0010:release_urbs+0x254/0x5a0 sound/usb/endpoint.c:1031 > Code: 44 89 fe 48 c1 e0 08 4c 8b 74 03 58 e8 75 b4 53 fa 45 85 ff 0f > 84 29 ff ff ff e8 07 b3 53 fa 49 8d 7e 68 48 89 f8 48 c1 e8 03 <42> 80 > 3c 20 00 0f 85 32 03 00 00 49 8d 7e 60 49 8b 4e 68 48 89 f8 > RSP: 0018:ffffc9001698f8d0 EFLAGS: 00010212 > RAX: 000000000000000d RBX: ffff88805fc44000 RCX: 0000000000040000 > RDX: ffffc900169d1000 RSI: ffff888018c21d40 RDI: 0000000000000068 > RBP: 0000000000000000 R08: ffffffff87273539 R09: 0000000000000000 > R10: 0000000000000005 R11: ffffed100bf88805 R12: dffffc0000000000 > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000120 > FS: 00007febd6e4e700(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000001b31424000 CR3: 0000000065e07000 CR4: 0000000000350ee0 > ---------------- > Code disassembly (best guess): > 0: 44 89 fe mov %r15d,%esi > 3: 48 c1 e0 08 shl $0x8,%rax > 7: 4c 8b 74 03 58 mov 0x58(%rbx,%rax,1),%r14 > c: e8 75 b4 53 fa callq 0xfa53b486 > 11: 45 85 ff test %r15d,%r15d > 14: 0f 84 29 ff ff ff je 0xffffff43 > 1a: e8 07 b3 53 fa callq 0xfa53b326 > 1f: 49 8d 7e 68 lea 0x68(%r14),%rdi > 23: 48 89 f8 mov %rdi,%rax > 26: 48 c1 e8 03 shr $0x3,%rax > * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction > 2f: 0f 85 32 03 00 00 jne 0x367 > 35: 49 8d 7e 60 lea 0x60(%r14),%rdi > 39: 49 8b 4e 68 mov 0x68(%r14),%rcx > 3d: 48 89 f8 mov %rdi,%rax >

1 2

[PATCH 1/2] slimbus: stream: handle unsupported bitrates for presence rate
by Krzysztof Kozlowski 30 Sep '22

30 Sep '22

Handle errors of getting presence rate for unsupported stream bitrate, instead of sending -EINVAL in change content message. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> --- drivers/slimbus/stream.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/slimbus/stream.c b/drivers/slimbus/stream.c index f8eade1e0132..28fbecb3907d 100644 --- a/drivers/slimbus/stream.c +++ b/drivers/slimbus/stream.c @@ -204,7 +204,7 @@ int slim_stream_prepare(struct slim_stream_runtime *rt, { struct slim_controller *ctrl = rt->dev->ctrl; struct slim_port *port; - int num_ports, i, port_id; + int num_ports, i, port_id, prrate; pr_err("%s:%d AAAA\n", __func__, __LINE__); if (rt->ports) { @@ -222,6 +222,13 @@ int slim_stream_prepare(struct slim_stream_runtime *rt, rt->bps = cfg->bps; rt->direction = cfg->direction; + prrate = slim_get_prate_code(cfg->rate); + if (prrate < 0) { + dev_err(&rt->dev->dev, "Cannot get presence rate for rate %d Hz\n", + cfg->rate); + return -EINVAL; + } + if (cfg->rate % ctrl->a_framer->superfreq) { /* * data rate not exactly multiple of super frame, @@ -242,7 +249,7 @@ int slim_stream_prepare(struct slim_stream_runtime *rt, port = &rt->ports[i]; port->state = SLIM_PORT_DISCONNECTED; port->id = port_id; - port->ch.prrate = slim_get_prate_code(cfg->rate); + port->ch.prrate = prrate; port->ch.id = cfg->chs[i]; port->ch.data_fmt = SLIM_CH_DATA_FMT_NOT_DEFINED; port->ch.aux_fmt = SLIM_CH_AUX_FMT_NOT_APPLICABLE; -- 2.34.1

1 2

[PATCH] ASoC: nau8825: Add TDM support
by David Lin 30 Sep '22

30 Sep '22

Support TDM format for NAU88L25. Signed-off-by: David Lin <CTLIN0(a)nuvoton.com> --- sound/soc/codecs/nau8825.c | 97 ++++++++++++++++++++++++++++++++++++++ sound/soc/codecs/nau8825.h | 14 ++++++ 2 files changed, 111 insertions(+) diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c index b3cdbe884c05..6a2c2e373efd 100644 --- a/sound/soc/codecs/nau8825.c +++ b/sound/soc/codecs/nau8825.c @@ -1425,10 +1425,107 @@ static int nau8825_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt) return 0; } +/** + * nau8825_set_tdm_slot - configure DAI TDM. + * @dai: DAI + * @tx_mask: bitmask representing active TX slots. + * @rx_mask: bitmask representing active RX slots. + * @slots: Number of slots in use. + * @slot_width: Width in bits for each slot. + * + * Configures a DAI for TDM operation. Support TDM 4/8 slots. + * The limitation is DAC and ADC need shift 4 slots at 8 slots mode. + */ +static int nau8825_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask, + unsigned int rx_mask, int slots, int slot_width) +{ + struct snd_soc_component *component = dai->component; + struct nau8825 *nau8825 = snd_soc_component_get_drvdata(component); + unsigned int ctrl_val = 0, ctrl_offset = 0, value = 0, dac_s, adc_s; + + if (slots != 4 && slots != 8) { + dev_err(nau8825->dev, "Only support 4 or 8 slots!\n"); + return -EINVAL; + } + + /* The driver is limited to 1-channel for ADC, and 2-channel for DAC on TDM mode */ + if (hweight_long((unsigned long) tx_mask) != 1 || + hweight_long((unsigned long) rx_mask) != 2) { + dev_err(nau8825->dev, + "The limitation is 1-channel for ADC, and 2-channel for DAC on TDM mode.\n"); + return -EINVAL; + } + + if (((tx_mask & 0xf) && (tx_mask & 0xf0)) || + ((rx_mask & 0xf) && (rx_mask & 0xf0)) || + ((tx_mask & 0xf) && (rx_mask & 0xf0)) || + ((rx_mask & 0xf) && (tx_mask & 0xf0))) { + dev_err(nau8825->dev, + "Slot assignment of DAC and ADC need to set same interval.\n"); + return -EINVAL; + } + + /* The offset of fixed 4 slots for 8 slots support */ + if (rx_mask & 0xf0) { + regmap_update_bits(nau8825->regmap, NAU8825_REG_I2S_PCM_CTRL2, + NAU8825_I2S_PCM_TS_EN_MASK, NAU8825_I2S_PCM_TS_EN); + regmap_read(nau8825->regmap, NAU8825_REG_I2S_PCM_CTRL1, &value); + ctrl_val |= NAU8825_TDM_OFFSET_EN; + ctrl_offset = 4 * slot_width; + if (!(value & NAU8825_I2S_PCMB_MASK)) + ctrl_offset += 1; + dac_s = (rx_mask & 0xf0) >> 4; + adc_s = fls((tx_mask & 0xf0) >> 4); + } else { + dac_s = rx_mask & 0xf; + adc_s = fls(tx_mask & 0xf); + } + + ctrl_val |= NAU8825_TDM_MODE; + + switch (dac_s) { + case 0x3: + ctrl_val |= 1 << NAU8825_TDM_DACR_RX_SFT; + break; + case 0x5: + ctrl_val |= 2 << NAU8825_TDM_DACR_RX_SFT; + break; + case 0x6: + ctrl_val |= 1 << NAU8825_TDM_DACL_RX_SFT; + ctrl_val |= 2 << NAU8825_TDM_DACR_RX_SFT; + break; + case 0x9: + ctrl_val |= 3 << NAU8825_TDM_DACR_RX_SFT; + break; + case 0xa: + ctrl_val |= 1 << NAU8825_TDM_DACL_RX_SFT; + ctrl_val |= 3 << NAU8825_TDM_DACR_RX_SFT; + break; + case 0xc: + ctrl_val |= 2 << NAU8825_TDM_DACL_RX_SFT; + ctrl_val |= 3 << NAU8825_TDM_DACR_RX_SFT; + break; + default: + return -EINVAL; + } + + ctrl_val |= adc_s - 1; + + regmap_update_bits(nau8825->regmap, NAU8825_REG_TDM_CTRL, + NAU8825_TDM_MODE | NAU8825_TDM_OFFSET_EN | + NAU8825_TDM_DACL_RX_MASK | NAU8825_TDM_DACR_RX_MASK | + NAU8825_TDM_TX_MASK, ctrl_val); + regmap_update_bits(nau8825->regmap, NAU8825_REG_LEFT_TIME_SLOT, + NAU8825_TSLOT_L0_MASK, ctrl_offset); + + return 0; +} + static const struct snd_soc_dai_ops nau8825_dai_ops = { .startup = nau8825_dai_startup, .hw_params = nau8825_hw_params, .set_fmt = nau8825_set_dai_fmt, + .set_tdm_slot = nau8825_set_tdm_slot, }; #define NAU8825_RATES SNDRV_PCM_RATE_8000_192000 diff --git a/sound/soc/codecs/nau8825.h b/sound/soc/codecs/nau8825.h index 6d112b6145df..d84191a7beb2 100644 --- a/sound/soc/codecs/nau8825.h +++ b/sound/soc/codecs/nau8825.h @@ -225,6 +225,15 @@ #define NAU8825_JKDET_PULL_EN (1 << 9) /* 0 - enable pull, 1 - disable */ #define NAU8825_JKDET_OUTPUT_EN (1 << 8) /* 0 - enable input, 1 - enable output */ +/* TDM_CTRL (0x1b) */ +#define NAU8825_TDM_MODE (0x1 << 15) +#define NAU8825_TDM_OFFSET_EN (0x1 << 14) +#define NAU8825_TDM_DACL_RX_SFT 6 +#define NAU8825_TDM_DACL_RX_MASK (0x3 << NAU8825_TDM_DACL_RX_SFT) +#define NAU8825_TDM_DACR_RX_SFT 4 +#define NAU8825_TDM_DACR_RX_MASK (0x3 << NAU8825_TDM_DACR_RX_SFT) +#define NAU8825_TDM_TX_MASK 0x3 + /* I2S_PCM_CTRL1 (0x1c) */ #define NAU8825_I2S_BP_SFT 7 #define NAU8825_I2S_BP_MASK (1 << NAU8825_I2S_BP_SFT) @@ -249,6 +258,9 @@ #define NAU8825_I2S_TRISTATE (1 << 15) /* 0 - normal mode, 1 - Hi-Z output */ #define NAU8825_I2S_LRC_DIV_SFT 12 #define NAU8825_I2S_LRC_DIV_MASK (0x3 << NAU8825_I2S_LRC_DIV_SFT) +#define NAU8825_I2S_PCM_TS_EN_SFT 10 +#define NAU8825_I2S_PCM_TS_EN_MASK (1 << NAU8825_I2S_PCM_TS_EN_SFT) +#define NAU8825_I2S_PCM_TS_EN (1 << NAU8825_I2S_PCM_TS_EN_SFT) #define NAU8825_I2S_MS_SFT 3 #define NAU8825_I2S_MS_MASK (1 << NAU8825_I2S_MS_SFT) #define NAU8825_I2S_MS_MASTER (1 << NAU8825_I2S_MS_SFT) @@ -259,6 +271,8 @@ #define NAU8825_FS_ERR_CMP_SEL_SFT 14 #define NAU8825_FS_ERR_CMP_SEL_MASK (0x3 << NAU8825_FS_ERR_CMP_SEL_SFT) #define NAU8825_DIS_FS_SHORT_DET (1 << 13) +#define NAU8825_TSLOT_L0_MASK 0x3ff +#define NAU8825_TSLOT_R0_MASK 0x3ff /* BIQ_CTRL (0x20) */ #define NAU8825_BIQ_WRT_SFT 4 -- 2.25.1

2 1

[PATCH] ASoC: Intel: sof_rt5682: remove SOF_RT1015_SPEAKER_AMP_100FS flag
by Brent Lu 30 Sep '22

30 Sep '22

This flag could be removed since we now have API to query bclk fequency setting in the topology. The dai link structure itself also provides DAI format information instead of figuring it out with fs number. Signed-off-by: Brent Lu <brent.lu(a)intel.com> --- sound/soc/intel/boards/sof_realtek_common.c | 86 +++++++++++---------- sound/soc/intel/boards/sof_realtek_common.h | 2 +- sound/soc/intel/boards/sof_rt5682.c | 6 +- 3 files changed, 47 insertions(+), 47 deletions(-) diff --git a/sound/soc/intel/boards/sof_realtek_common.c b/sound/soc/intel/boards/sof_realtek_common.c index b9643ca2e2f2..ff2851fc8930 100644 --- a/sound/soc/intel/boards/sof_realtek_common.c +++ b/sound/soc/intel/boards/sof_realtek_common.c @@ -253,63 +253,70 @@ EXPORT_SYMBOL_NS(sof_rt1015p_codec_conf, SND_SOC_INTEL_SOF_REALTEK_COMMON); * RT1015 audio amplifier */ +static const struct { + unsigned int tx; + unsigned int rx; +} rt1015_tdm_mask[] = { + {.tx = 0x0, .rx = 0x1}, + {.tx = 0x0, .rx = 0x2}, +}; + static int rt1015_hw_params(struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params) { struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); + struct snd_soc_dai_link *dai_link = rtd->dai_link; struct snd_soc_dai *codec_dai; - int i, fs = 64, ret; + int i, clk_freq, ret; - for_each_rtd_codec_dais(rtd, i, codec_dai) { - ret = snd_soc_dai_set_pll(codec_dai, 0, RT1015_PLL_S_BCLK, - params_rate(params) * fs, - params_rate(params) * 256); - if (ret) - return ret; + clk_freq = sof_dai_get_bclk(rtd); - ret = snd_soc_dai_set_sysclk(codec_dai, RT1015_SCLK_S_PLL, - params_rate(params) * 256, - SND_SOC_CLOCK_IN); - if (ret) - return ret; + if (clk_freq <= 0) { + dev_err(rtd->dev, "fail to get bclk freq, ret %d\n", clk_freq); + return -EINVAL; } - return 0; -} - -static int rt1015_hw_params_pll_and_tdm(struct snd_pcm_substream *substream, - struct snd_pcm_hw_params *params) -{ - struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); - struct snd_soc_dai *codec_dai; - int i, fs = 100, ret; - for_each_rtd_codec_dais(rtd, i, codec_dai) { ret = snd_soc_dai_set_pll(codec_dai, 0, RT1015_PLL_S_BCLK, - params_rate(params) * fs, + clk_freq, params_rate(params) * 256); - if (ret) + if (ret) { + dev_err(codec_dai->dev, "fail to set pll, ret %d\n", + ret); return ret; + } ret = snd_soc_dai_set_sysclk(codec_dai, RT1015_SCLK_S_PLL, params_rate(params) * 256, SND_SOC_CLOCK_IN); - if (ret) + if (ret) { + dev_err(codec_dai->dev, "fail to set sysclk, ret %d\n", + ret); return ret; - } - /* rx slot 1 for RT1015_DEV0_NAME */ - ret = snd_soc_dai_set_tdm_slot(asoc_rtd_to_codec(rtd, 0), - 0x0, 0x1, 4, 24); - if (ret) - return ret; + } - /* rx slot 2 for RT1015_DEV1_NAME */ - ret = snd_soc_dai_set_tdm_slot(asoc_rtd_to_codec(rtd, 1), - 0x0, 0x2, 4, 24); - if (ret) - return ret; + switch (dai_link->dai_fmt & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_DSP_A: + case SND_SOC_DAIFMT_DSP_B: + /* 4-slot TDM */ + ret = snd_soc_dai_set_tdm_slot(codec_dai, + rt1015_tdm_mask[i].tx, + rt1015_tdm_mask[i].rx, + 4, + params_width(params)); + if (ret < 0) { + dev_err(codec_dai->dev, "fail to set tdm slot, ret %d\n", + ret); + return ret; + } + break; + default: + dev_dbg(codec_dai->dev, "codec is in I2S mode\n"); + break; + } + } - return 0; + return ret; } static struct snd_soc_ops rt1015_ops = { @@ -351,15 +358,12 @@ void sof_rt1015_codec_conf(struct snd_soc_card *card) } EXPORT_SYMBOL_NS(sof_rt1015_codec_conf, SND_SOC_INTEL_SOF_REALTEK_COMMON); -void sof_rt1015_dai_link(struct snd_soc_dai_link *link, unsigned int fs) +void sof_rt1015_dai_link(struct snd_soc_dai_link *link) { link->codecs = rt1015_components; link->num_codecs = ARRAY_SIZE(rt1015_components); link->init = speaker_codec_init_lr; link->ops = &rt1015_ops; - - if (fs == 100) - rt1015_ops.hw_params = rt1015_hw_params_pll_and_tdm; } EXPORT_SYMBOL_NS(sof_rt1015_dai_link, SND_SOC_INTEL_SOF_REALTEK_COMMON); diff --git a/sound/soc/intel/boards/sof_realtek_common.h b/sound/soc/intel/boards/sof_realtek_common.h index 778443421090..3ae99d8239e0 100644 --- a/sound/soc/intel/boards/sof_realtek_common.h +++ b/sound/soc/intel/boards/sof_realtek_common.h @@ -32,7 +32,7 @@ void sof_rt1015p_codec_conf(struct snd_soc_card *card); #define RT1015_DEV0_NAME "i2c-10EC1015:00" #define RT1015_DEV1_NAME "i2c-10EC1015:01" -void sof_rt1015_dai_link(struct snd_soc_dai_link *link, unsigned int fs); +void sof_rt1015_dai_link(struct snd_soc_dai_link *link); void sof_rt1015_codec_conf(struct snd_soc_card *card); #define RT1308_CODEC_DAI "rt1308-aif" diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c index 045965312245..7d54b8ed3e83 100644 --- a/sound/soc/intel/boards/sof_rt5682.c +++ b/sound/soc/intel/boards/sof_rt5682.c @@ -46,7 +46,6 @@ ((quirk << SOF_RT5682_NUM_HDMIDEV_SHIFT) & SOF_RT5682_NUM_HDMIDEV_MASK) #define SOF_RT1011_SPEAKER_AMP_PRESENT BIT(13) #define SOF_RT1015_SPEAKER_AMP_PRESENT BIT(14) -#define SOF_RT1015_SPEAKER_AMP_100FS BIT(15) #define SOF_RT1015P_SPEAKER_AMP_PRESENT BIT(16) #define SOF_MAX98373_SPEAKER_AMP_PRESENT BIT(17) #define SOF_MAX98360A_SPEAKER_AMP_PRESENT BIT(18) @@ -132,7 +131,6 @@ static const struct dmi_system_id sof_rt5682_quirk_table[] = { SOF_RT5682_SSP_CODEC(0) | SOF_SPEAKER_AMP_PRESENT | SOF_RT1015_SPEAKER_AMP_PRESENT | - SOF_RT1015_SPEAKER_AMP_100FS | SOF_RT5682_SSP_AMP(1)), }, { @@ -739,8 +737,7 @@ static struct snd_soc_dai_link *sof_card_dai_links_create(struct device *dev, links[id].id = id; if (sof_rt5682_quirk & SOF_RT1015_SPEAKER_AMP_PRESENT) { - sof_rt1015_dai_link(&links[id], (sof_rt5682_quirk & - SOF_RT1015_SPEAKER_AMP_100FS) ? 100 : 64); + sof_rt1015_dai_link(&links[id]); } else if (sof_rt5682_quirk & SOF_RT1015P_SPEAKER_AMP_PRESENT) { sof_rt1015p_dai_link(&links[id]); } else if (sof_rt5682_quirk & SOF_RT1019_SPEAKER_AMP_PRESENT) { @@ -1010,7 +1007,6 @@ static const struct platform_device_id board_ids[] = { SOF_RT5682_SSP_CODEC(0) | SOF_SPEAKER_AMP_PRESENT | SOF_RT1015_SPEAKER_AMP_PRESENT | - SOF_RT1015_SPEAKER_AMP_100FS | SOF_RT5682_SSP_AMP(1)), }, { -- 2.25.1

4 6

[PATCH v2] ALSA: hda/realtek: More robust component matching for CS35L41
by Takashi Iwai 30 Sep '22

30 Sep '22

As the previous commit implies, a system may have a different SPI bus number that is embedded in the device string. And, assuming the fixed bus number is rather fragile; it may be assigned differently depending on the configuration or on the boot environment. Once when a bus number change happens, the binding fails, resulting in the silence. This patch tries to make the matching a bit more relaxed, allowing to bind with a different bus number (or without it). So the previous fix, the introduction of ALC245_FIXUP_CS35L41_SPI1_2 fixup became superfluous, and this is unified to ALC245_FIXUP_CS35L41_SPI_2. Fixes: 225f6e1bc151 ("ALSA: hda/realtek: Add quirk for HP Zbook Firefly 14 G9 model") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- v1->v2: Add missing linux/ctype.h inclusion sound/pci/hda/patch_realtek.c | 62 +++++++++++++++++++++-------------- 1 file changed, 37 insertions(+), 25 deletions(-) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 3dc19174670e..bce82b834cec 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -18,6 +18,7 @@ #include <linux/module.h> #include <linux/input.h> #include <linux/leds.h> +#include <linux/ctype.h> #include <sound/core.h> #include <sound/jack.h> #include <sound/hda_codec.h> @@ -6704,23 +6705,51 @@ static void comp_generic_playback_hook(struct hda_pcm_stream *hinfo, struct hda_ } } +struct cs35l41_dev_name { + const char *bus; + const char *hid; + int index; +}; + +/* match the device name in a slightly relaxed manner */ +static int comp_match_cs35l41_dev_name(struct device *dev, void *data) +{ + struct cs35l41_dev_name *p = data; + const char *d = dev_name(dev); + int n = strlen(p->bus); + char tmp[32]; + + /* check the bus name */ + if (strncmp(d, p->bus, n)) + return 0; + /* skip the bus number */ + if (isdigit(d[n])) + n++; + /* the rest must be exact matching */ + snprintf(tmp, sizeof(tmp), "-%s:00-cs35l41-hda.%d", p->hid, p->index); + return !strcmp(d + n, tmp); +} + static void cs35l41_generic_fixup(struct hda_codec *cdc, int action, const char *bus, const char *hid, int count) { struct device *dev = hda_codec_dev(cdc); struct alc_spec *spec = cdc->spec; - char *name; + struct cs35l41_dev_name *rec; int ret, i; switch (action) { case HDA_FIXUP_ACT_PRE_PROBE: for (i = 0; i < count; i++) { - name = devm_kasprintf(dev, GFP_KERNEL, - "%s-%s:00-cs35l41-hda.%d", bus, hid, i); - if (!name) + rec = devm_kmalloc(dev, sizeof(*rec), GFP_KERNEL); + if (!rec) return; + rec->bus = bus; + rec->hid = hid; + rec->index = i; spec->comps[i].codec = cdc; - component_match_add(dev, &spec->match, component_compare_dev_name, name); + component_match_add(dev, &spec->match, + comp_match_cs35l41_dev_name, rec); } ret = component_master_add_with_match(dev, &comp_master_ops, spec->match); if (ret) @@ -6738,17 +6767,12 @@ static void cs35l41_fixup_i2c_two(struct hda_codec *cdc, const struct hda_fixup static void cs35l41_fixup_spi_two(struct hda_codec *codec, const struct hda_fixup *fix, int action) { - cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 2); -} - -static void cs35l41_fixup_spi1_two(struct hda_codec *codec, const struct hda_fixup *fix, int action) -{ - cs35l41_generic_fixup(codec, action, "spi1", "CSC3551", 2); + cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 2); } static void cs35l41_fixup_spi_four(struct hda_codec *codec, const struct hda_fixup *fix, int action) { - cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 4); + cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 4); } static void alc287_fixup_legion_16achg6_speakers(struct hda_codec *cdc, const struct hda_fixup *fix, @@ -7137,8 +7161,6 @@ enum { ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED, ALC245_FIXUP_CS35L41_SPI_2, ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED, - ALC245_FIXUP_CS35L41_SPI1_2, - ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED, ALC245_FIXUP_CS35L41_SPI_4, ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED, ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED, @@ -8986,16 +9008,6 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id = ALC285_FIXUP_HP_GPIO_LED, }, - [ALC245_FIXUP_CS35L41_SPI1_2] = { - .type = HDA_FIXUP_FUNC, - .v.func = cs35l41_fixup_spi1_two, - }, - [ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED] = { - .type = HDA_FIXUP_FUNC, - .v.func = cs35l41_fixup_spi1_two, - .chained = true, - .chain_id = ALC285_FIXUP_HP_GPIO_LED, - }, [ALC245_FIXUP_CS35L41_SPI_4] = { .type = HDA_FIXUP_FUNC, .v.func = cs35l41_fixup_spi_four, @@ -9358,7 +9370,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x103c, 0x8aa3, "HP ProBook 450 G9 (MB 8AA1)", ALC236_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8aa8, "HP EliteBook 640 G9 (MB 8AA6)", ALC236_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8aab, "HP EliteBook 650 G9 (MB 8AA9)", ALC236_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), -- 2.35.3

1 0

[PATCH -next 0/4] Fix PM disable depth imbalance in probe
by Zhang Qilong 30 Sep '22

30 Sep '22

The pm_runtime_enable will increase power disable depth. Thus a pairing decrement is needed on the error handling path to keep it balanced according to context. We fix it by moving pm_runtime_enable to the endding of probe. Zhang Qilong (4): ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe sound/soc/codecs/mt6660.c | 8 ++++++-- sound/soc/codecs/wm5102.c | 6 +++--- sound/soc/codecs/wm5110.c | 6 +++--- sound/soc/codecs/wm8997.c | 6 +++--- 4 files changed, 15 insertions(+), 11 deletions(-) -- 2.25.1

3 7

[PATCH] ASoC: core: clarify the driver name initialization
by Jaroslav Kysela 30 Sep '22

30 Sep '22

The driver field in the struct snd_ctl_card_info is a valid user space identifier. Actually, many ASoC drivers do not care and let to initialize this field using a standard wrapping method. Unfortunately, in this way, this field becomes unusable and unreadable for the drivers with longer card names. Also, there is a possibility to have clashes (driver field has only limit of 15 characters). This change will print an error when the wrapping is used. The developers of the affected drivers should fix the problem. Also, it does not make sense to set the driver field to the card name composed from DMI. This card name is longer in most (all?) cases. Use a generic "ASoC-DMI" string here. Signed-off-by: Jaroslav Kysela <perex(a)perex.cz> --- sound/soc/soc-core.c | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index e824ff1a9fc0..fd037208c222 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -1840,21 +1840,22 @@ static void soc_check_tplg_fes(struct snd_soc_card *card) } } -#define soc_setup_card_name(name, name1, name2, norm) \ - __soc_setup_card_name(name, sizeof(name), name1, name2, norm) -static void __soc_setup_card_name(char *name, int len, - const char *name1, const char *name2, - int normalization) +#define soc_setup_card_name(card, name, name1, name2) \ + __soc_setup_card_name(card, name, sizeof(name), name1, name2) +static void __soc_setup_card_name(struct snd_soc_card *card, + char *name, int len, + const char *name1, const char *name2) { + const char *src = name1 ? name1 : name2; int i; - snprintf(name, len, "%s", name1 ? name1 : name2); + snprintf(name, len, "%s", src); - if (!normalization) + if (name != card->snd_card->driver) return; /* - * Name normalization + * Name normalization (driver field) * * The driver name is somewhat special, as it's used as a key for * searches in the user-space. @@ -1874,6 +1875,14 @@ static void __soc_setup_card_name(char *name, int len, break; } } + + /* + * The driver field should contain a valid string from the user view. + * The wrapping usually does not work so well here. Set a smaller string + * in the specific ASoC driver. + */ + if (strlen(src) > len - 1) + dev_err(card->dev, "ASoC: driver name too long '%s' -> '%s'\n", src, name); } static void soc_cleanup_card_resources(struct snd_soc_card *card) @@ -1928,6 +1937,7 @@ static int snd_soc_bind_card(struct snd_soc_card *card) struct snd_soc_pcm_runtime *rtd; struct snd_soc_component *component; struct snd_soc_dai_link *dai_link; + const char *fallback; int ret, i; mutex_lock(&client_mutex); @@ -2041,12 +2051,15 @@ static int snd_soc_bind_card(struct snd_soc_card *card) /* try to set some sane longname if DMI is available */ snd_soc_set_dmi_name(card, NULL); - soc_setup_card_name(card->snd_card->shortname, - card->name, NULL, 0); - soc_setup_card_name(card->snd_card->longname, - card->long_name, card->name, 0); - soc_setup_card_name(card->snd_card->driver, - card->driver_name, card->name, 1); + soc_setup_card_name(card, card->snd_card->shortname, + card->name, NULL); + fallback = card->name; + soc_setup_card_name(card, card->snd_card->longname, + card->long_name, fallback); + if (card->long_name == card->dmi_longname) + fallback = "ASoC-DMI"; + soc_setup_card_name(card, card->snd_card->driver, + card->driver_name, fallback); if (card->components) { /* the current implementation of snd_component_add() accepts */ -- 2.35.3

2 3

[PATCH] ALSA: hda/realtek: More robust component matching for CS35L41
by Takashi Iwai 30 Sep '22

30 Sep '22

As the previous commit implies, a system may have a different SPI bus number that is embedded in the device string. And, assuming the fixed bus number is rather fragile; it may be assigned differently depending on the configuration or on the boot environment. Once when a bus number change happens, the binding fails, resulting in the silence. This patch tries to make the matching a bit more relaxed, allowing to bind with a different bus number (or without it). So the previous fix, the introduction of ALC245_FIXUP_CS35L41_SPI1_2 fixup became superfluous, and this is unified to ALC245_FIXUP_CS35L41_SPI_2. Fixes: 225f6e1bc151 ("ALSA: hda/realtek: Add quirk for HP Zbook Firefly 14 G9 model") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/pci/hda/patch_realtek.c | 61 +++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 25 deletions(-) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 3dc19174670e..cd670884cfd0 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -6704,23 +6704,51 @@ static void comp_generic_playback_hook(struct hda_pcm_stream *hinfo, struct hda_ } } +struct cs35l41_dev_name { + const char *bus; + const char *hid; + int index; +}; + +/* match the device name in a slightly relaxed manner */ +static int comp_match_cs35l41_dev_name(struct device *dev, void *data) +{ + struct cs35l41_dev_name *p = data; + const char *d = dev_name(dev); + int n = strlen(p->bus); + char tmp[32]; + + /* check the bus name */ + if (strncmp(d, p->bus, n)) + return 0; + /* skip the bus number */ + if (isdigit(d[n])) + n++; + /* the rest must be exact matching */ + snprintf(tmp, sizeof(tmp), "-%s:00-cs35l41-hda.%d", p->hid, p->index); + return !strcmp(d + n, tmp); +} + static void cs35l41_generic_fixup(struct hda_codec *cdc, int action, const char *bus, const char *hid, int count) { struct device *dev = hda_codec_dev(cdc); struct alc_spec *spec = cdc->spec; - char *name; + struct cs35l41_dev_name *rec; int ret, i; switch (action) { case HDA_FIXUP_ACT_PRE_PROBE: for (i = 0; i < count; i++) { - name = devm_kasprintf(dev, GFP_KERNEL, - "%s-%s:00-cs35l41-hda.%d", bus, hid, i); - if (!name) + rec = devm_kmalloc(dev, sizeof(*rec), GFP_KERNEL); + if (!rec) return; + rec->bus = bus; + rec->hid = hid; + rec->index = i; spec->comps[i].codec = cdc; - component_match_add(dev, &spec->match, component_compare_dev_name, name); + component_match_add(dev, &spec->match, + comp_match_cs35l41_dev_name, rec); } ret = component_master_add_with_match(dev, &comp_master_ops, spec->match); if (ret) @@ -6738,17 +6766,12 @@ static void cs35l41_fixup_i2c_two(struct hda_codec *cdc, const struct hda_fixup static void cs35l41_fixup_spi_two(struct hda_codec *codec, const struct hda_fixup *fix, int action) { - cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 2); -} - -static void cs35l41_fixup_spi1_two(struct hda_codec *codec, const struct hda_fixup *fix, int action) -{ - cs35l41_generic_fixup(codec, action, "spi1", "CSC3551", 2); + cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 2); } static void cs35l41_fixup_spi_four(struct hda_codec *codec, const struct hda_fixup *fix, int action) { - cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 4); + cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 4); } static void alc287_fixup_legion_16achg6_speakers(struct hda_codec *cdc, const struct hda_fixup *fix, @@ -7137,8 +7160,6 @@ enum { ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED, ALC245_FIXUP_CS35L41_SPI_2, ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED, - ALC245_FIXUP_CS35L41_SPI1_2, - ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED, ALC245_FIXUP_CS35L41_SPI_4, ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED, ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED, @@ -8986,16 +9007,6 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id = ALC285_FIXUP_HP_GPIO_LED, }, - [ALC245_FIXUP_CS35L41_SPI1_2] = { - .type = HDA_FIXUP_FUNC, - .v.func = cs35l41_fixup_spi1_two, - }, - [ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED] = { - .type = HDA_FIXUP_FUNC, - .v.func = cs35l41_fixup_spi1_two, - .chained = true, - .chain_id = ALC285_FIXUP_HP_GPIO_LED, - }, [ALC245_FIXUP_CS35L41_SPI_4] = { .type = HDA_FIXUP_FUNC, .v.func = cs35l41_fixup_spi_four, @@ -9358,7 +9369,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x103c, 0x8aa3, "HP ProBook 450 G9 (MB 8AA1)", ALC236_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8aa8, "HP EliteBook 640 G9 (MB 8AA6)", ALC236_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8aab, "HP EliteBook 650 G9 (MB 8AA9)", ALC236_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), -- 2.35.3

1 0

[PATCH] ASoC: soc-pcm: fix fe and be race when accessing substream->runtime
by Eugeniu Rosca 29 Sep '22

29 Sep '22

From: xiao jin <jin.xiao(a)intel.com> After start of fe and be, fe might go to close without triggering STOP, and substream->runtime is freed. However, be is still at START state and its substream->runtime still points to the freed runtime. Later on, FE is opened/started again, and triggers STOP. snd_pcm_do_stop => dpcm_fe_dai_trigger => dpcm_fe_dai_do_trigger => dpcm_be_dai_trigger => dpcm_do_trigger => soc_pcm_trigger => skl_platform_pcm_trigger skl_platform_pcm_trigger accesses the freed old runtime data and kernel panic. The patch fixes it by assigning be_substream->runtime in dpcm_be_dai_startup when be's state is START. Signed-off-by: xiao jin <jin.xiao(a)intel.com> Signed-off-by: Zhang Yanmin <yanmin.zhang(a)intel.com> Signed-off-by: Eugeniu Rosca <erosca(a)de.adit-jv.com> --- sound/soc/soc-pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 4f60c0a83311..6ca1d02065ce 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -1608,6 +1608,8 @@ int dpcm_be_dai_startup(struct snd_soc_pcm_runtime *fe, int stream) if (be->dpcm[stream].users++ != 0) continue; + be_substream->runtime = be->dpcm[stream].runtime; + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_NEW) && (be->dpcm[stream].state != SND_SOC_DPCM_STATE_CLOSE)) continue; @@ -1615,7 +1617,6 @@ int dpcm_be_dai_startup(struct snd_soc_pcm_runtime *fe, int stream) dev_dbg(be->dev, "ASoC: open %s BE %s\n", stream ? "capture" : "playback", be->dai_link->name); - be_substream->runtime = be->dpcm[stream].runtime; err = __soc_pcm_open(be, be_substream); if (err < 0) { be->dpcm[stream].users--; -- 2.37.2

4 10

A divide error bug in snd_pcm_write
by butt3rflyh4ck 29 Sep '22

29 Sep '22

Hi, there is a divide error bug in snd_pcm_write in sound/core/pcm_native.c in the latest kernel. ##Root Cause When open the device of /dev/snd/pcmC#D#p, there would attach a runtime to pcm->substream via snd_pcm_open_substream. see the code below: ``` int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream, struct file *file, struct snd_pcm_substream **rsubstream) { ...... runtime = kzalloc(sizeof(*runtime), GFP_KERNEL); if (runtime == NULL) return -ENOMEM; size = PAGE_ALIGN(sizeof(struct snd_pcm_mmap_status)); runtime->status = alloc_pages_exact(size, GFP_KERNEL); if (runtime->status == NULL) { kfree(runtime); return -ENOMEM; } memset(runtime->status, 0, size); size = PAGE_ALIGN(sizeof(struct snd_pcm_mmap_control)); runtime->control = alloc_pages_exact(size, GFP_KERNEL); if (runtime->control == NULL) { free_pages_exact(runtime->status, PAGE_ALIGN(sizeof(struct snd_pcm_mmap_status))); kfree(runtime); return -ENOMEM; } memset(runtime->control, 0, size); init_waitqueue_head(&runtime->sleep); init_waitqueue_head(&runtime->tsleep); runtime->status->state = SNDRV_PCM_STATE_OPEN; mutex_init(&runtime->buffer_mutex); atomic_set(&runtime->buffer_accessing, 0); substream->runtime = runtime; substream->private_data = pcm->private_data; substream->ref_count = 1; substream->f_flags = file->f_flags; substream->pid = get_pid(task_pid(current)); pstr->substream_opened++; *rsubstream = substream; return 0; } ``` It would kzmalloc a new runtime. And initialize runtime simply. If we write some data to the device. it would call snd_pcm_write or snd_pcm_writev. and read some date from the device, it would call snd_pcm_read or snd_pcm_readv. Anyway, the four function would use data of runtime, but some data of runtime is NULL not be initialized, see the code below: ``` static ssize_t snd_pcm_write(struct file *file, const char __user *buf, size_t count, loff_t * offset) { struct snd_pcm_file *pcm_file; struct snd_pcm_substream *substream; struct snd_pcm_runtime *runtime; snd_pcm_sframes_t result; pcm_file = file->private_data; substream = pcm_file->substream; if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; if (runtime->status->state == SNDRV_PCM_STATE_OPEN || runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED) return -EBADFD; if (!frame_aligned(runtime, count)) /////// [1] return -EINVAL; count = bytes_to_frames(runtime, count); /////// [2] result = snd_pcm_lib_write(substream, buf, count); if (result > 0) result = frames_to_bytes(runtime, result); return result; } ``` [1] call frame_aligned to aligned. ``` static inline int frame_aligned(struct snd_pcm_runtime *runtime, ssize_t bytes) { return bytes % runtime->byte_align == 0; } ``` but runtime->byte_align is NULL. [2] call bytes_to_frames. ``` static inline ssize_t frames_to_bytes(struct snd_pcm_runtime *runtime, snd_pcm_sframes_t size) { return size * runtime->frame_bits / 8; } ``` but runtime->frame_bits is NULL. ##reproduce it [ 1189.305083][ T4656] divide error: 0000 [#1] PREEMPT SMP [ 1189.305600][ T4656] CPU: 1 PID: 4656 Comm: snd_pcm_write Not tainted 6.0.0-rc7 #16 [ 1189.306157][ T4656] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 [ 1189.306760][ T4656] RIP: 0010:snd_pcm_write+0x33/0xa0 [ 1189.307155][ T4656] Code: 8b 38 48 85 ff 74 72 48 8b 9f c0 00 00 00 48 85 db 74 66 48 8b 83 00 01 00 00 f7 00 f7 ff ff ff 74 6b 48 89 d0 48 89 d1 31 d2 <48> f7 b3 91 [ 1189.308553][ T4656] RSP: 0018:ffffc9000adc7e68 EFLAGS: 00010246 [ 1189.309034][ T4656] RAX: 0000000000000000 RBX: ffff888048ec2000 RCX: 0000000000000000 [ 1189.309583][ T4656] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888046fc9c00 [ 1189.310163][ T4656] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000020026 [ 1189.310679][ T4656] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 1189.311226][ T4656] R13: ffffc9000adc7f08 R14: 0000000000000000 R15: 0000000000000000 [ 1189.311754][ T4656] FS: 00000000012d8880(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 [ 1189.312350][ T4656] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1189.312780][ T4656] CR2: 0000000020000000 CR3: 000000004b496000 CR4: 00000000000006e0 [ 1189.313234][ T4656] Call Trace: [ 1189.313424][ T4656] <TASK> [ 1189.313597][ T4656] vfs_write+0xe6/0x4d0 [ 1189.313836][ T4656] ksys_write+0x60/0xe0 [ 1189.314071][ T4656] do_syscall_64+0x35/0xb0 [ 1189.314324][ T4656] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1189.314734][ T4656] RIP: 0033:0x44dc3d [ 1189.315007][ T4656] Code: 28 c3 e8 36 29 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f8 [ 1189.316338][ T4656] RSP: 002b:00007ffcbdf5ef38 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1189.317012][ T4656] RAX: ffffffffffffffda RBX: 0000000000400530 RCX: 000000000044dc3d [ 1189.317693][ T4656] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1189.318172][ T4656] RBP: 00007ffcbdf5ef50 R08: 0000000082000000 R09: 0000000000000000 [ 1189.318648][ T4656] R10: 000000000000ffff R11: 0000000000000246 R12: 00000000004030a0 [ 1189.319182][ T4656] R13: 0000000000000000 R14: 00000000004c5018 R15: 0000000000000000 Regrads, butt3rflyh4ck. -- Active Defense Lab of Venustech

2 5