September 2022 - Alsa-devel - mailman.alsa-project.org

A divide error bug in snd_pcm_write
by butt3rflyh4ck 29 Sep '22

29 Sep '22

Hi, there is a divide error bug in snd_pcm_write in sound/core/pcm_native.c in the latest kernel. ##Root Cause When open the device of /dev/snd/pcmC#D#p, there would attach a runtime to pcm->substream via snd_pcm_open_substream. see the code below: ``` int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream, struct file *file, struct snd_pcm_substream **rsubstream) { ...... runtime = kzalloc(sizeof(*runtime), GFP_KERNEL); if (runtime == NULL) return -ENOMEM; size = PAGE_ALIGN(sizeof(struct snd_pcm_mmap_status)); runtime->status = alloc_pages_exact(size, GFP_KERNEL); if (runtime->status == NULL) { kfree(runtime); return -ENOMEM; } memset(runtime->status, 0, size); size = PAGE_ALIGN(sizeof(struct snd_pcm_mmap_control)); runtime->control = alloc_pages_exact(size, GFP_KERNEL); if (runtime->control == NULL) { free_pages_exact(runtime->status, PAGE_ALIGN(sizeof(struct snd_pcm_mmap_status))); kfree(runtime); return -ENOMEM; } memset(runtime->control, 0, size); init_waitqueue_head(&runtime->sleep); init_waitqueue_head(&runtime->tsleep); runtime->status->state = SNDRV_PCM_STATE_OPEN; mutex_init(&runtime->buffer_mutex); atomic_set(&runtime->buffer_accessing, 0); substream->runtime = runtime; substream->private_data = pcm->private_data; substream->ref_count = 1; substream->f_flags = file->f_flags; substream->pid = get_pid(task_pid(current)); pstr->substream_opened++; *rsubstream = substream; return 0; } ``` It would kzmalloc a new runtime. And initialize runtime simply. If we write some data to the device. it would call snd_pcm_write or snd_pcm_writev. and read some date from the device, it would call snd_pcm_read or snd_pcm_readv. Anyway, the four function would use data of runtime, but some data of runtime is NULL not be initialized, see the code below: ``` static ssize_t snd_pcm_write(struct file *file, const char __user *buf, size_t count, loff_t * offset) { struct snd_pcm_file *pcm_file; struct snd_pcm_substream *substream; struct snd_pcm_runtime *runtime; snd_pcm_sframes_t result; pcm_file = file->private_data; substream = pcm_file->substream; if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime = substream->runtime; if (runtime->status->state == SNDRV_PCM_STATE_OPEN || runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED) return -EBADFD; if (!frame_aligned(runtime, count)) /////// [1] return -EINVAL; count = bytes_to_frames(runtime, count); /////// [2] result = snd_pcm_lib_write(substream, buf, count); if (result > 0) result = frames_to_bytes(runtime, result); return result; } ``` [1] call frame_aligned to aligned. ``` static inline int frame_aligned(struct snd_pcm_runtime *runtime, ssize_t bytes) { return bytes % runtime->byte_align == 0; } ``` but runtime->byte_align is NULL. [2] call bytes_to_frames. ``` static inline ssize_t frames_to_bytes(struct snd_pcm_runtime *runtime, snd_pcm_sframes_t size) { return size * runtime->frame_bits / 8; } ``` but runtime->frame_bits is NULL. ##reproduce it [ 1189.305083][ T4656] divide error: 0000 [#1] PREEMPT SMP [ 1189.305600][ T4656] CPU: 1 PID: 4656 Comm: snd_pcm_write Not tainted 6.0.0-rc7 #16 [ 1189.306157][ T4656] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 [ 1189.306760][ T4656] RIP: 0010:snd_pcm_write+0x33/0xa0 [ 1189.307155][ T4656] Code: 8b 38 48 85 ff 74 72 48 8b 9f c0 00 00 00 48 85 db 74 66 48 8b 83 00 01 00 00 f7 00 f7 ff ff ff 74 6b 48 89 d0 48 89 d1 31 d2 <48> f7 b3 91 [ 1189.308553][ T4656] RSP: 0018:ffffc9000adc7e68 EFLAGS: 00010246 [ 1189.309034][ T4656] RAX: 0000000000000000 RBX: ffff888048ec2000 RCX: 0000000000000000 [ 1189.309583][ T4656] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888046fc9c00 [ 1189.310163][ T4656] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000020026 [ 1189.310679][ T4656] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 1189.311226][ T4656] R13: ffffc9000adc7f08 R14: 0000000000000000 R15: 0000000000000000 [ 1189.311754][ T4656] FS: 00000000012d8880(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000 [ 1189.312350][ T4656] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1189.312780][ T4656] CR2: 0000000020000000 CR3: 000000004b496000 CR4: 00000000000006e0 [ 1189.313234][ T4656] Call Trace: [ 1189.313424][ T4656] <TASK> [ 1189.313597][ T4656] vfs_write+0xe6/0x4d0 [ 1189.313836][ T4656] ksys_write+0x60/0xe0 [ 1189.314071][ T4656] do_syscall_64+0x35/0xb0 [ 1189.314324][ T4656] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1189.314734][ T4656] RIP: 0033:0x44dc3d [ 1189.315007][ T4656] Code: 28 c3 e8 36 29 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f8 [ 1189.316338][ T4656] RSP: 002b:00007ffcbdf5ef38 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1189.317012][ T4656] RAX: ffffffffffffffda RBX: 0000000000400530 RCX: 000000000044dc3d [ 1189.317693][ T4656] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1189.318172][ T4656] RBP: 00007ffcbdf5ef50 R08: 0000000082000000 R09: 0000000000000000 [ 1189.318648][ T4656] R10: 000000000000ffff R11: 0000000000000246 R12: 00000000004030a0 [ 1189.319182][ T4656] R13: 0000000000000000 R14: 00000000004c5018 R15: 0000000000000000 Regrads, butt3rflyh4ck. -- Active Defense Lab of Venustech

2 5

[PATCH] ASoC: wcd-mbhc-v2: Revert "ASoC: wcd-mbhc-v2: use pm_runtime_resume_and_get()"
by Krzysztof Kozlowski 29 Sep '22

29 Sep '22

This reverts commit ddea4bbf287b6028eaa15a185d0693856956ecf2 ("ASoC: wcd-mbhc-v2: use pm_runtime_resume_and_get()"), because it introduced double runtime PM put if pm_runtime_get_sync() returns -EACCES: wcd934x-codec wcd934x-codec.3.auto: WCD934X Minor:0x1 Version:0x401 wcd934x-codec wcd934x-codec.3.auto: Runtime PM usage count underflow! The commit claimed no changes in functionality except dropping the reference on -EACCESS. This is exactly the change introducing bug because function calls unconditionally pm_runtime_put_autosuspend() at the end. Cc: Bard Liao <yung-chuan.liao(a)linux.intel.com> Cc: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Cc: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Cc: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Cc: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Cc: Cezary Rojewski <cezary.rojewski(a)intel.com> Cc: <stable(a)vger.kernel.org> Fixes: ddea4bbf287b ("ASoC: wcd-mbhc-v2: use pm_runtime_resume_and_get()") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> --- sound/soc/codecs/wcd-mbhc-v2.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/sound/soc/codecs/wcd-mbhc-v2.c b/sound/soc/codecs/wcd-mbhc-v2.c index b16a18dbfe7a..1911750f7445 100644 --- a/sound/soc/codecs/wcd-mbhc-v2.c +++ b/sound/soc/codecs/wcd-mbhc-v2.c @@ -714,11 +714,12 @@ static int wcd_mbhc_initialise(struct wcd_mbhc *mbhc) struct snd_soc_component *component = mbhc->component; int ret; - ret = pm_runtime_resume_and_get(component->dev); + ret = pm_runtime_get_sync(component->dev); if (ret < 0 && ret != -EACCES) { dev_err_ratelimited(component->dev, - "pm_runtime_resume_and_get failed in %s, ret %d\n", + "pm_runtime_get_sync failed in %s, ret %d\n", __func__, ret); + pm_runtime_put_noidle(component->dev); return ret; } @@ -1096,11 +1097,12 @@ static void wcd_correct_swch_plug(struct work_struct *work) mbhc = container_of(work, struct wcd_mbhc, correct_plug_swch); component = mbhc->component; - ret = pm_runtime_resume_and_get(component->dev); + ret = pm_runtime_get_sync(component->dev); if (ret < 0 && ret != -EACCES) { dev_err_ratelimited(component->dev, - "pm_runtime_resume_and_get failed in %s, ret %d\n", + "pm_runtime_get_sync failed in %s, ret %d\n", __func__, ret); + pm_runtime_put_noidle(component->dev); return; } micbias_mv = wcd_mbhc_get_micbias(mbhc); -- 2.34.1

2 4

[PATCH] ASoC: mediatek: mt8186: Fix spelling mistake "slect" -> "select"
by Colin Ian King 29 Sep '22

29 Sep '22

There are some spelling mistakes in dev_err messages. Fix them. Signed-off-by: Colin Ian King <colin.i.king(a)gmail.com> --- sound/soc/mediatek/mt8186/mt8186-afe-gpio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sound/soc/mediatek/mt8186/mt8186-afe-gpio.c b/sound/soc/mediatek/mt8186/mt8186-afe-gpio.c index 274c0c8ec2f2..eda913fa147a 100644 --- a/sound/soc/mediatek/mt8186/mt8186-afe-gpio.c +++ b/sound/soc/mediatek/mt8186/mt8186-afe-gpio.c @@ -170,25 +170,25 @@ static int mt8186_afe_gpio_adda_ul(struct device *dev, bool enable) if (enable) { ret = mt8186_afe_gpio_select(dev, MT8186_AFE_GPIO_CLK_MISO_ON); if (ret) { - dev_err(dev, "%s(), MISO CLK ON slect fail!\n", __func__); + dev_err(dev, "%s(), MISO CLK ON select fail!\n", __func__); return ret; } ret = mt8186_afe_gpio_select(dev, MT8186_AFE_GPIO_DAT_MISO_ON); if (ret) { - dev_err(dev, "%s(), MISO DAT ON slect fail!\n", __func__); + dev_err(dev, "%s(), MISO DAT ON select fail!\n", __func__); return ret; } } else { ret = mt8186_afe_gpio_select(dev, MT8186_AFE_GPIO_DAT_MISO_OFF); if (ret) { - dev_err(dev, "%s(), MISO DAT OFF slect fail!\n", __func__); + dev_err(dev, "%s(), MISO DAT OFF select fail!\n", __func__); return ret; } ret = mt8186_afe_gpio_select(dev, MT8186_AFE_GPIO_CLK_MISO_OFF); if (ret) { - dev_err(dev, "%s(), MISO CLK OFF slect fail!\n", __func__); + dev_err(dev, "%s(), MISO CLK OFF select fail!\n", __func__); return ret; } } -- 2.37.1

3 2

Re: [RESEND] ASoC: amd: acp: Add setbias level for rt5682s codec in machine driver
by Mark Brown 29 Sep '22

29 Sep '22

On Thu, Sep 29, 2022 at 12:38:22PM +0530, Venkata Prasad Potturu wrote: > From: Venkata Prasad Potturu <venkataprasad.potturu(a)amd.com> > > Add set_bais_level function for rt5682s codec to enable bclk and lrclk > before codec widgets power on and disable bclk and lrclk after widgets > power down, to avoid pop noise Please allow a reasonable time for review...

1 0

[PATCH 0/8] ALSA: hda: Add model option to codec drivers, too
by Takashi Iwai 29 Sep '22

29 Sep '22

Hi, this is a trivial patch set to add the "model" option to each HD-audio codec driver that works equivalently with snd-hda-intel or SOF driver's model option. It makes it easer for users to specify the quirk to the right target. Takashi === Takashi Iwai (8): ALSA: hda/realtek: Add model option to codec driver, too ALSA: hda/cirrus: Add model option to codec driver, too ALSA: hda/conexant: Add model option to codec driver, too ALSA: hda/cs8409: Add model option to codec driver, too ALSA: hda/analog: Add model option to codec driver, too ALSA: hda/sigmatel: Add model option to codec driver, too ALSA: hda/via: Add model option to codec driver, too ALSA: doc: Explain more about model option Documentation/sound/hd-audio/notes.rst | 16 ++++++++++++++++ sound/pci/hda/patch_analog.c | 10 ++++++++++ sound/pci/hda/patch_cirrus.c | 10 ++++++++++ sound/pci/hda/patch_conexant.c | 10 ++++++++++ sound/pci/hda/patch_cs8409.c | 10 ++++++++++ sound/pci/hda/patch_realtek.c | 11 +++++++++++ sound/pci/hda/patch_sigmatel.c | 11 +++++++++++ sound/pci/hda/patch_via.c | 11 +++++++++++ 8 files changed, 89 insertions(+) -- 2.35.3

2 10

[PATCH] ALSA: hda/realtek: Add quirk for HP Zbook Firefly 14 G9 model
by Takashi Iwai 29 Sep '22

29 Sep '22

HP Zbook Firefly 14 G9 model (103c:8abb) requires yet another binding with CS35L41 codec, but with a slightly different configuration. It's over spi1 instead of spi0. Create a new fixup entry for that. Cc: <stable(a)vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/pci/hda/patch_realtek.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index f9d46ae4c7b7..3dc19174670e 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -6741,6 +6741,11 @@ static void cs35l41_fixup_spi_two(struct hda_codec *codec, const struct hda_fixu cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 2); } +static void cs35l41_fixup_spi1_two(struct hda_codec *codec, const struct hda_fixup *fix, int action) +{ + cs35l41_generic_fixup(codec, action, "spi1", "CSC3551", 2); +} + static void cs35l41_fixup_spi_four(struct hda_codec *codec, const struct hda_fixup *fix, int action) { cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 4); @@ -7132,6 +7137,8 @@ enum { ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED, ALC245_FIXUP_CS35L41_SPI_2, ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED, + ALC245_FIXUP_CS35L41_SPI1_2, + ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED, ALC245_FIXUP_CS35L41_SPI_4, ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED, ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED, @@ -8979,6 +8986,16 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id = ALC285_FIXUP_HP_GPIO_LED, }, + [ALC245_FIXUP_CS35L41_SPI1_2] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs35l41_fixup_spi1_two, + }, + [ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs35l41_fixup_spi1_two, + .chained = true, + .chain_id = ALC285_FIXUP_HP_GPIO_LED, + }, [ALC245_FIXUP_CS35L41_SPI_4] = { .type = HDA_FIXUP_FUNC, .v.func = cs35l41_fixup_spi_four, @@ -9341,6 +9358,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x103c, 0x8aa3, "HP ProBook 450 G9 (MB 8AA1)", ALC236_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8aa8, "HP EliteBook 640 G9 (MB 8AA6)", ALC236_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8aab, "HP EliteBook 650 G9 (MB 8AA9)", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), -- 2.35.3

1 0

[PATCH] ALSA: asihpi - Remove unused struct hpi_subsys_response
by Yuan Can 29 Sep '22

29 Sep '22

After commit 3285ea10e9b0("ALSA: asihpi - Interrelated HPI tidy up."), struct hpi_subsys_response is not used any more and can be removed as well. Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/pci/asihpi/hpimsgx.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/sound/pci/asihpi/hpimsgx.c b/sound/pci/asihpi/hpimsgx.c index f7427f8eb630..d0caef299481 100644 --- a/sound/pci/asihpi/hpimsgx.c +++ b/sound/pci/asihpi/hpimsgx.c @@ -93,11 +93,6 @@ static void HPIMSGX__cleanup(u16 adapter_index, void *h_owner); #pragma pack(push, 1) #endif -struct hpi_subsys_response { - struct hpi_response_header h; - struct hpi_subsys_res s; -}; - struct hpi_adapter_response { struct hpi_response_header h; struct hpi_adapter_res a; -- 2.17.1

2 1

[PATCH -next] ALSA: sb: Use DIV_ROUND_UP() instead of open-coding it
by Shang XiaoJing 29 Sep '22

29 Sep '22

Use DIV_ROUND_UP() instead of open-coding it, which intents and makes it more clear what is going on for the casual reviewer. The Coccinelle references Commit e4d8aef21403 ("ALSA: usb: Use DIV_ROUND_UP() instead of open-coding it"). Signed-off-by: Shang XiaoJing <shangxiaojing(a)huawei.com> --- sound/isa/sb/emu8000_pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/isa/sb/emu8000_pcm.c b/sound/isa/sb/emu8000_pcm.c index f8d90a1e989b..c8afc4347c54 100644 --- a/sound/isa/sb/emu8000_pcm.c +++ b/sound/isa/sb/emu8000_pcm.c @@ -236,7 +236,7 @@ static int emu8k_pcm_open(struct snd_pcm_substream *subs) /* use timer to update periods.. (specified in msec) */ snd_pcm_hw_constraint_minmax(runtime, SNDRV_PCM_HW_PARAM_PERIOD_TIME, - (1000000 + HZ - 1) / HZ, UINT_MAX); + DIV_ROUND_UP(1000000, HZ), UINT_MAX); return 0; } -- 2.17.1

2 1

Re: linux-next: Tree for Sep 28 (Kconfig: SND_SOC_QDSP6)
by Randy Dunlap 29 Sep '22

29 Sep '22

On 9/28/22 12:26, broonie(a)kernel.org wrote: > Hi all, > > Changes since 20220927: > on x86_64, when QCOM_APR is not set and COMPILE_TEST=y: WARNING: unmet direct dependencies detected for SND_SOC_QDSP6 Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_SOC_QCOM [=y] && QCOM_APR [=n] && COMMON_CLK [=y] Selected by [y]: - SND_SOC_SC8280XP [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && SND_SOC_QCOM [=y] && (QCOM_APR [=n] || COMPILE_TEST [=y]) && SOUNDWIRE [=y] && COMMON_CLK [=y] -- ~Randy

1 0

[PATCH 0/1]
by Jason Zhu 29 Sep '22

29 Sep '22

ASoC soc dai Jason Zhu (1): ASoC: soc-dai: export some symbols sound/soc/soc-dai.c | 10 ++++++++++ 1 file changed, 10 insertions(+) -- 2.34.1

4 12