January 2023 - Alsa-devel - mailman.alsa-project.org

[RFC PATCH 00/14] Introduce QC USB SND audio offloading support
by Wesley Cheng 13 Jan '23

13 Jan '23

Several Qualcomm based chipsets can support USB audio offloading to a dedicated audio DSP, which can take over issuing transfers to the USB host controller. The intention is to reduce the load on the main processors in the SoC, and allow them to be placed into lower power modes. There are several parts to this design: 1. Adding ASoC binding layer 2. Create a USB backend for Q6DSP 3. Introduce XHCI interrupter support 4. Create vendor ops for the USB SND driver Adding ASoC binding layer: soc-usb: Intention is to treat a USB port similar to a headphone jack. The port is always present on the device, but cable/pin status can be enabled/disabled. Expose mechanisms for USB backend ASoC drivers to communicate with USB SND. Create a USB backend for Q6DSP: q6usb: Basic backend driver that will be responsible for maintaining the resources needed to initiate a playback stream using the Q6DSP. Will be the entity that checks to make sure the connected USB audio device supports the requested PCM format. If it does not, the PCM open call will fail, and userpsace ALSA can take action accordingly. Introduce XHCI interrupter support: XHCI HCD supports multiple interrupters, which allows for events to be routed to different event rings. This is determined by "Interrupter Target" field specified in Section "6.4.1.1 Normal TRB" of the XHCI specification. Events in the offloading case will be routed to an event ring that is assigned to the audio DSP. Create vendor ops for the USB SND driver: qc_audio_offload: This particular driver has several components associated with it: - QMI stream request handler - XHCI interrupter and resource management - audio DSP memory management When the audio DSP wants to enable a playback stream, the request is first received by the ASoC platform sound card. Depending on the selected route, ASoC will bring up the individual DAIs in the path. The Q6USB backend DAI will send an AFE port start command (with enabling the USB playback path), and the audio DSP will handle the request accordingly. Part of the AFE USB port start handling will have an exchange of control messages using the QMI protocol. The qc_audio_offload driver will populate the buffer information: - Event ring base address - EP transfer ring base address and pass it along to the audio DSP. All endpoint management will now be handed over to the DSP, and the main processor is not involved in transfers. Overall, implementing this feature will still expose separate sound card and PCM devices for both the platorm card and USB audio device: 0 [SM8250MTPWCD938]: sm8250 - SM8250-MTP-WCD9380-WSA8810-VA-D SM8250-MTP-WCD9380-WSA8810-VA-DMIC 1 [Audio ]: USB-Audio - USB Audio Generic USB Audio at usb-xhci-hcd.1.auto-1.4, high speed This is to ensure that userspace ALSA entities can decide which route to take when executing the audio playback. In the above, if card#1 is selected, then USB audio data will take the legacy path over the USB PCM drivers, etc... This feature was validated using: - tinymix: set/enable the multimedia path to route to USB backend - tinyplay: issue playback on platform card Wesley Cheng (14): ASoC: Add SOC USB APIs for adding an USB backend ASoC: qcom: qdsp6: Introduce USB AFE port to q6dsp ASoC: qcom: Add USB backend ASoC driver for Q6 sound: usb: card: Introduce USB SND vendor op callbacks sound: usb: Export USB SND APIs for modules usb: core: hcd: Introduce USB HCD APIs for interrupter management usb: host: xhci: Add XHCI secondary interrupter support usb: dwc3: Add DT parameter to specify maximum number of interrupters sound: usb: Introduce QC USB SND offloading support sound: usb: card: Check for support for requested audio format sound: soc: soc-usb: Add PCM format check API for USB backend sound: soc: qcom: qusb6: Ensure PCM format is supported by USB audio device ASoC: dt-bindings: Add Q6USB backend bindings ASoC: dt-bindings: Update example for enabling USB offload on SM8250 .../bindings/sound/qcom,q6usb-dais.yaml | 55 + .../bindings/sound/qcom,sm8250.yaml | 13 + drivers/usb/core/hcd.c | 86 + drivers/usb/dwc3/core.c | 12 + drivers/usb/dwc3/core.h | 2 + drivers/usb/dwc3/host.c | 5 +- drivers/usb/host/xhci-mem.c | 219 ++- drivers/usb/host/xhci-plat.c | 2 + drivers/usb/host/xhci.c | 169 +- drivers/usb/host/xhci.h | 15 + .../sound/qcom,q6dsp-lpass-ports.h | 1 + include/linux/usb.h | 7 + include/linux/usb/hcd.h | 16 +- include/sound/q6usboffload.h | 20 + include/sound/soc-usb.h | 34 + sound/soc/Makefile | 2 +- sound/soc/qcom/Kconfig | 4 + sound/soc/qcom/qdsp6/Makefile | 1 + sound/soc/qcom/qdsp6/q6afe-dai.c | 47 + sound/soc/qcom/qdsp6/q6afe.c | 183 ++ sound/soc/qcom/qdsp6/q6afe.h | 46 +- sound/soc/qcom/qdsp6/q6dsp-lpass-ports.c | 23 + sound/soc/qcom/qdsp6/q6dsp-lpass-ports.h | 1 + sound/soc/qcom/qdsp6/q6routing.c | 8 + sound/soc/qcom/qdsp6/q6usb.c | 239 +++ sound/soc/soc-usb.c | 79 + sound/usb/Kconfig | 14 + sound/usb/Makefile | 2 +- sound/usb/card.c | 43 + sound/usb/card.h | 10 + sound/usb/endpoint.c | 2 + sound/usb/helper.c | 1 + sound/usb/pcm.c | 9 +- sound/usb/pcm.h | 12 + sound/usb/qcom/Makefile | 2 + sound/usb/qcom/qc_audio_offload.c | 1610 +++++++++++++++++ sound/usb/qcom/usb_audio_qmi_v01.c | 892 +++++++++ sound/usb/qcom/usb_audio_qmi_v01.h | 162 ++ 38 files changed, 3998 insertions(+), 50 deletions(-) create mode 100644 Documentation/devicetree/bindings/sound/qcom,q6usb-dais.yaml create mode 100644 include/sound/q6usboffload.h create mode 100644 include/sound/soc-usb.h create mode 100644 sound/soc/qcom/qdsp6/q6usb.c create mode 100644 sound/soc/soc-usb.c create mode 100644 sound/usb/qcom/Makefile create mode 100644 sound/usb/qcom/qc_audio_offload.c create mode 100644 sound/usb/qcom/usb_audio_qmi_v01.c create mode 100644 sound/usb/qcom/usb_audio_qmi_v01.h

12 84

Re: [PATCH 0/8] arm64: dts: renesas: Simple-Card / Audio-Graph-Card/Card2 dts for ULCB/KF
by Geert Uytterhoeven 13 Jan '23

13 Jan '23

Hi Morimoto-san, CC DT/ASoC On Wed, Dec 14, 2022 at 2:47 AM Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> wrote: > ALSA SoC is now supporting generic Sound Card driver such as > Simple-Card / Audio-Graph-Card/Card2, and it supports > "normal connection" and "special connections". > I'm its maintainer, thus I need/want to test these. > > I have been tested these by using my local patches to switching card, > but maintenance it locally is not useful for me, and users who want to > know the sample DT settings. > > And I have noticed that some local patch had bug, but no one noticed > about it (of course :) > > ULCB/KF is very good board to test these. > So, I want to upstream these. > > One note here is that this patch *should not* have effect to > existing normal users, but useful for test user. > So, this patch-set adds "3 card" x "2 use case" dtsi file, > and ulcb/ulcb-kf "include" one of them which doesn't change anything. > test user can switch to other card or other use case by changing > "include" dtsi. > > [1/8][2/8] are small tidyup patches for all SoC sound. Thanks for your series! I really wanted to review this earlier, but I am held back by my lack of understanding of the audio subsystem and the audio bindings. It is also not clear to me what really is hardware description (i.e. to be described in DT), and what is software policy (i.e. not to be described in DT)... Hence I have lots of questions ("A fool can ask more questions in a minute than a wise man can answer in an hour." ;-) What is the difference between "Simple Audio Card", "Audio Graph Card", and "Audio Graph Card2"? Why do we need to support all three of them? How come we can have no #sound-dai-cells, #sound-dai-cells = <0>, and #sound-dai-cells = <1>, for the same hardware? What is the real difference between Single DAI and Multi DAI? Why do we need to support both? > Kuninori Morimoto (8): > ARM: dts: renesas: #sound-dai-cells is used when simple-card > arm64: dts: renesas: #sound-dai-cells is used when simple-card > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card dtsi > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card2 dtsi > arm64: dts: renesas: add ulcb{-kf} Simple Audio Card dtsi The above three all describe the same hardware configuration? > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card2 dtsi MIX + TDM Split dtsi > arm64: dts: renesas: add ulcb{-kf} Audio Graph Card dtsi MIX + TDM Split dtsi > arm64: dts: renesas: add ulcb{-kf} Simple Audio Card MIX + TDM Split dtsi Is MIX and TDM Split a different hardware configuration, or software policy? Thanks! > arch/arm/boot/dts/r8a7742.dtsi | 2 +- > arch/arm/boot/dts/r8a7743.dtsi | 2 +- > arch/arm/boot/dts/r8a7744.dtsi | 2 +- > arch/arm/boot/dts/r8a7745.dtsi | 2 +- > arch/arm/boot/dts/r8a7778.dtsi | 2 +- > arch/arm/boot/dts/r8a7790.dtsi | 2 +- > arch/arm/boot/dts/r8a7791.dtsi | 2 +- > arch/arm/boot/dts/r8a7793.dtsi | 2 +- > arch/arm/boot/dts/r8a7794.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77951.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77960.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77961.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77965.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77990.dtsi | 2 +- > arch/arm64/boot/dts/renesas/r8a77995.dtsi | 2 +- > .../boot/dts/renesas/salvator-common.dtsi | 3 - > .../ulcb-audio-graph-card-mix+split.dtsi | 89 +++++++++ > .../dts/renesas/ulcb-audio-graph-card.dtsi | 85 +++++++++ > .../ulcb-audio-graph-card2-mix+split.dtsi | 111 +++++++++++ > .../dts/renesas/ulcb-audio-graph-card2.dtsi | 26 +++ > .../ulcb-kf-audio-graph-card-mix+split.dtsi | 162 ++++++++++++++++ > .../dts/renesas/ulcb-kf-audio-graph-card.dtsi | 88 +++++++++ > .../ulcb-kf-audio-graph-card2-mix+split.dtsi | 177 ++++++++++++++++++ > .../renesas/ulcb-kf-audio-graph-card2.dtsi | 30 +++ > .../ulcb-kf-simple-audio-card-mix+split.dtsi | 137 ++++++++++++++ > .../renesas/ulcb-kf-simple-audio-card.dtsi | 85 +++++++++ > arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 66 ++----- > .../ulcb-simple-audio-card-mix+split.dtsi | 86 +++++++++ > .../dts/renesas/ulcb-simple-audio-card.dtsi | 89 +++++++++ > arch/arm64/boot/dts/renesas/ulcb.dtsi | 60 ++---- > 34 files changed, 1212 insertions(+), 120 deletions(-) > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card2-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-audio-graph-card2.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card2-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-audio-graph-card2.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-simple-audio-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-kf-simple-audio-card.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-simple-audio-card-mix+split.dtsi > create mode 100644 arch/arm64/boot/dts/renesas/ulcb-simple-audio-card.dtsi Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert(a)linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds

2 3

Coverity: snd_usb_pcm_has_fixed_rate(): Null pointer dereferences
by coverity-bot 13 Jan '23

13 Jan '23

Hello! This is an experimental semi-automated report about issues detected by Coverity from a scan of next-20230111 as part of the linux-next scan project: https://scan.coverity.com/projects/linux-next-weekly-scan You're getting this email because you were associated with the identified lines of code (noted below) that were touched by commits: Mon Jan 9 16:05:21 2023 +0100 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Coverity reported the following: *** CID 1530547: Null pointer dereferences (REVERSE_INULL) sound/usb/pcm.c:166 in snd_usb_pcm_has_fixed_rate() 160 bool snd_usb_pcm_has_fixed_rate(struct snd_usb_substream *subs) 161 { 162 const struct audioformat *fp; 163 struct snd_usb_audio *chip = subs->stream->chip; 164 int rate = -1; 165 vvv CID 1530547: Null pointer dereferences (REVERSE_INULL) vvv Null-checking "subs" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 166 if (!subs) 167 return false; 168 if (!(chip->quirk_flags & QUIRK_FLAG_FIXED_RATE)) 169 return false; 170 list_for_each_entry(fp, &subs->fmt_list, list) { 171 if (fp->rates & SNDRV_PCM_RATE_CONTINUOUS) If this is a false positive, please let us know so we can mark it as such, or teach the Coverity rules to be smarter. If not, please make sure fixes get into linux-next. :) For patches fixing this, please include these lines (but double-check the "Fixes" first): Reported-by: coverity-bot <keescook+coverity-bot(a)chromium.org> Addresses-Coverity-ID: 1530547 ("Null pointer dereferences") Fixes: 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Thanks for your attention! -- Coverity-bot

1 0

[syzbot] KASAN: use-after-free Read in snd_pcm_oss_poll
by syzbot 12 Jan '23

12 Jan '23

Hello, syzbot found the following issue on: HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=16d906ea480000 kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5 dashboard link: https://syzkaller.appspot.com/bug?extid=ee73befabe68e7907adf compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.… kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+ee73befabe68e7907adf(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849 Read of size 8 at addr ffff8880222ed980 by task syz-executor.0/13421 CPU: 0 PID: 13421 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report+0xc0/0xf0 mm/kasan/report.c:517 snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849 vfs_poll include/linux/poll.h:88 [inline] io_poll_check_events io_uring/poll.c:279 [inline] io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327 handle_tw_list+0xa8/0x460 io_uring/io_uring.c:1169 tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1224 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fbb08c8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fbb099a6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007fbb08dabf88 RCX: 00007fbb08c8c0c9 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbb08dabf8c RBP: 00007fbb08dabf80 R08: 00007ffdf79a3080 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 00007fbb08dabf8c R13: 00007ffdf794d43f R14: 00007fbb099a6300 R15: 0000000000022000 </TASK> Allocated by task 13421: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:580 [inline] kzalloc include/linux/slab.h:720 [inline] snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2433 [inline] snd_pcm_oss_open.part.0+0x558/0x1330 sound/core/oss/pcm_oss.c:2535 snd_pcm_oss_open+0x44/0x60 sound/core/oss/pcm_oss.c:2499 soundcore_open+0x452/0x620 sound/sound_core.c:593 chrdev_open+0x26a/0x770 fs/char_dev.c:414 do_dentry_open+0x6cc/0x13f0 fs/open.c:883 do_open fs/namei.c:3558 [inline] path_openat+0x1bc1/0x2b40 fs/namei.c:3715 do_filp_open+0x1ba/0x410 fs/namei.c:3742 do_sys_openat2+0x16d/0x4c0 fs/open.c:1311 do_sys_open fs/open.c:1327 [inline] __do_sys_openat fs/open.c:1343 [inline] __se_sys_openat fs/open.c:1338 [inline] __x64_sys_openat+0x143/0x1f0 fs/open.c:1338 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 13421: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2415 [inline] snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2405 [inline] snd_pcm_oss_release+0x182/0x300 sound/core/oss/pcm_oss.c:2592 __fput+0x27c/0xa90 fs/file_table.c:321 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff8880222ed980 which belongs to the cache kmalloc-16 of size 16 The buggy address is located 0 bytes inside of 16-byte region [ffff8880222ed980, ffff8880222ed990) The buggy address belongs to the physical page: page:ffffea000088bb40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x222ed anon flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffff8880124413c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000800080 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5107, tgid 5107 (syz-executor.1), ts 750843463810, free_ts 748166918947 prep_new_page mm/page_alloc.c:2549 [inline] get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324 __alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590 __alloc_pages_node include/linux/gfp.h:237 [inline] alloc_slab_page mm/slub.c:1853 [inline] allocate_slab+0xa7/0x350 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292 __slab_alloc_node mm/slub.c:3345 [inline] slab_alloc_node mm/slub.c:3442 [inline] __kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc_node+0x4d/0xd0 mm/slab_common.c:974 kmalloc_node include/linux/slab.h:610 [inline] kvmalloc_node+0xa2/0x1a0 mm/util.c:603 xt_jumpstack_alloc net/netfilter/x_tables.c:1354 [inline] xt_replace_table+0x1a7/0x8c0 net/netfilter/x_tables.c:1393 __do_replace+0x1d7/0x8e0 net/ipv4/netfilter/ip_tables.c:1067 do_replace net/ipv4/netfilter/ip_tables.c:1140 [inline] do_ipt_set_ctl+0x89d/0xb10 net/ipv4/netfilter/ip_tables.c:1630 nf_setsockopt+0x87/0xe0 net/netfilter/nf_sockopt.c:101 ip_setsockopt+0xf2/0x110 net/ipv4/ip_sockglue.c:1445 tcp_setsockopt+0x9f/0x100 net/ipv4/tcp.c:3802 __sys_setsockopt+0x2c6/0x5b0 net/socket.c:2246 __do_sys_setsockopt net/socket.c:2257 [inline] __se_sys_setsockopt net/socket.c:2254 [inline] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2254 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1451 [inline] free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501 free_unref_page_prepare mm/page_alloc.c:3387 [inline] free_unref_page+0x1d/0x490 mm/page_alloc.c:3482 __unfreeze_partials+0x17c/0x1a0 mm/slub.c:2637 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook mm/slab.h:769 [inline] slab_alloc_node mm/slub.c:3452 [inline] slab_alloc mm/slub.c:3460 [inline] __kmem_cache_alloc_lru mm/slub.c:3467 [inline] kmem_cache_alloc+0x175/0x320 mm/slub.c:3476 kmem_cache_zalloc include/linux/slab.h:710 [inline] alloc_buffer_head+0x24/0x150 fs/buffer.c:2946 alloc_page_buffers+0x284/0x790 fs/buffer.c:871 create_empty_buffers+0x30/0xf30 fs/buffer.c:1585 ext4_block_write_begin+0x10a7/0x15f0 fs/ext4/inode.c:1080 ext4_da_write_begin+0x450/0xb70 fs/ext4/inode.c:3082 generic_perform_write+0x256/0x570 mm/filemap.c:3772 ext4_buffered_write_iter+0x15b/0x460 fs/ext4/file.c:285 ext4_file_write_iter+0x8bf/0x1710 fs/ext4/file.c:700 __kernel_write_iter+0x262/0x730 fs/read_write.c:517 Memory state around the buggy address: ffff8880222ed880: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc ffff8880222ed900: fa fb fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc >ffff8880222ed980: fa fb fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc ^ ffff8880222eda00: 00 00 fc fc 00 00 fc fc fa fb fc fc 00 00 fc fc ffff8880222eda80: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 1

Re: (subset) [PATCH v2 00/27] ARM: pxa: remove all unused boards&drivers
by Mark Brown 12 Jan '23

12 Jan '23

On Thu, 05 Jan 2023 14:45:55 +0100, Arnd Bergmann wrote: > Most of the legacy PXA board files were marked as unused in linux-5.19 and > can get removed in linux-6.3. There is support for pxa250/pxa270/pxa300 > using devicetree already, which supports a number of boards, but progress > on converting the remaining ones has stalled over the past few years. > > The two boards that are left in the tree for now are the three 'sharpsl' > variants (spitz/akita/borzoi) and the 'gumstix' family of machines. > Both of these are supported by qemu, which can be helpful for completing > the DT conversion. > > [...] Applied to https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next Thanks! [14/27] ASoC: PXA: make SND_PXA2XX_SOC_AC97 user-selectable commit: 5eab9265759e2fb042aa452931c3d06ab7ab8dae [15/27] ASoC: pxa: remove unused board support (no commit info) All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark

1 0

[PATCH v2 0/5] ASoC: Intel: Balance ACPI device refcount
by Andy Shevchenko 12 Jan '23

12 Jan '23

While looking for the open coded put_device(&adev->dev) cases, where adev stands for ACPI device, I noticed that in a few ASoC Intel driver, among others, the refcount is not balanced properly in some cases. This series fixes that issue and converts to use acpi_dev_put(). Changelog v2: - split Intel drivers out from others (Pierre) - sent with cover letter (Mark) Andy Shevchenko (5): ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after use ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use ASoC: Intel: sof_es8336: Drop reference count of ACPI device after use sound/soc/intel/boards/bytcht_es8316.c | 20 ++++++++++++-------- sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++------ sound/soc/intel/boards/bytcr_rt5651.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 2 +- sound/soc/intel/boards/sof_es8336.c | 14 ++++++++------ 5 files changed, 28 insertions(+), 22 deletions(-) -- 2.39.0

3 7

[PATCH] ASoC: soc-pcm.c: Introduce a count to record the times of setting DAIs parameters
by Chancel Liu 12 Jan '23

12 Jan '23

The commit 1da681e52853 ("ASoC: soc-pcm.c: Clear DAIs parameters after stream_active is updated") tries to make sure DAIs parameters can be cleared properly through moving the cleanup to the place where stream_active is updated. However, it will cause the cleanup only happening in soc_pcm_close(). Suppose a case: aplay -Dhw:0 44100.wav 48000.wav. The case calls soc_pcm_open()->soc_pcm_hw_params()->soc_pcm_hw_free()-> soc_pcm_hw_params()->soc_pcm_hw_free()->soc_pcm_close() in order. The parameters would be remained in the system even if the playback of 44100.wav is finished. The case requires us clearing parameters in phase of soc_pcm_hw_free(). We shouldn't use stream_active to decide if we must do the cleanup since it is finally updated in soc_pcm_close(). This patch introduces a usage count called hw_params_count in snd_soc_dai structure. It records the times of setting parameters to this DAI then decreases each time soc_pcm_hw_free() is called. If the count decreases to 0, it means this DAI is not used now and we should clear the parameters. Fixes: 1da681e52853 ("ASoC: soc-pcm.c: Clear DAIs parameters after stream_active is updated") Signed-off-by: Chancel Liu <chancel.liu(a)nxp.com> --- include/sound/soc-dai.h | 3 +++ sound/soc/soc-pcm.c | 16 +++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h index ea7509672086..a7e589a0fe72 100644 --- a/include/sound/soc-dai.h +++ b/include/sound/soc-dai.h @@ -451,6 +451,9 @@ struct snd_soc_dai { unsigned int channels; unsigned int sample_bits; + /* Count of setting DAI parameters */ + unsigned int hw_params_count; + /* parent platform/codec */ struct snd_soc_component *component; diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 579a44d81d9a..2c2a5dcf9e06 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -711,14 +711,10 @@ static int soc_pcm_clean(struct snd_soc_pcm_runtime *rtd, if (!rollback) { snd_soc_runtime_deactivate(rtd, substream->stream); - /* clear the corresponding DAIs parameters when going to be inactive */ - for_each_rtd_dais(rtd, i, dai) { - if (snd_soc_dai_active(dai) == 0) - soc_pcm_set_dai_params(dai, NULL); + for_each_rtd_dais(rtd, i, dai) if (snd_soc_dai_stream_active(dai, substream->stream) == 0) snd_soc_dai_digital_mute(dai, 1, substream->stream); - } } for_each_rtd_dais(rtd, i, dai) @@ -949,6 +945,14 @@ static int soc_pcm_hw_clean(struct snd_soc_pcm_runtime *rtd, snd_soc_dpcm_mutex_assert_held(rtd); + /* clear the corresponding DAIs parameters when hw_params_count decreases to 0 */ + for_each_rtd_dais(rtd, i, dai) + if (snd_soc_dai_stream_valid(dai, substream->stream)) { + dai->hw_params_count--; + if (dai->hw_params_count == 0) + soc_pcm_set_dai_params(dai, NULL); + } + /* run the stream event */ snd_soc_dapm_stream_stop(rtd, substream->stream); @@ -1051,6 +1055,7 @@ static int __soc_pcm_hw_params(struct snd_soc_pcm_runtime *rtd, soc_pcm_set_dai_params(codec_dai, &codec_params); snd_soc_dapm_update_dai(substream, &codec_params, codec_dai); + codec_dai->hw_params_count++; } for_each_rtd_cpu_dais(rtd, i, cpu_dai) { @@ -1068,6 +1073,7 @@ static int __soc_pcm_hw_params(struct snd_soc_pcm_runtime *rtd, /* store the parameters for each DAI */ soc_pcm_set_dai_params(cpu_dai, params); snd_soc_dapm_update_dai(substream, params, cpu_dai); + cpu_dai->hw_params_count++; } ret = snd_soc_pcm_component_hw_params(substream, params); -- 2.25.1

4 3

[syzbot] KASAN: use-after-free Read in snd_rawmidi_poll
by syzbot 12 Jan '23

12 Jan '23

Hello, syzbot found the following issue on: HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=1748baa1480000 kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5 dashboard link: https://syzkaller.appspot.com/bug?extid=e3ec01fd2d18c9264c3b compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.… kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e3ec01fd2d18c9264c3b(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in snd_rawmidi_poll+0x559/0x680 sound/core/rawmidi.c:1655 Read of size 8 at addr ffff8881479ea708 by task syz-executor.0/7629 CPU: 1 PID: 7629 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report+0xc0/0xf0 mm/kasan/report.c:517 snd_rawmidi_poll+0x559/0x680 sound/core/rawmidi.c:1655 vfs_poll include/linux/poll.h:88 [inline] io_poll_check_events io_uring/poll.c:279 [inline] io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327 handle_tw_list+0xa8/0x460 io_uring/io_uring.c:1169 tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1224 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f66cbc8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f66cc936168 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 RAX: fffffffffffffe00 RBX: 00007f66cbdabf80 RCX: 00007f66cbc8c0c9 RDX: 0000000000000001 RSI: 0000000020000800 RDI: 0000000000000006 RBP: 00007f66cbce7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe231decef R14: 00007f66cc936300 R15: 0000000000022000 </TASK> Allocated by task 7629: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:580 [inline] snd_rawmidi_open+0x39a/0xb70 sound/core/rawmidi.c:482 snd_open+0x223/0x460 sound/core/sound.c:169 chrdev_open+0x26a/0x770 fs/char_dev.c:414 do_dentry_open+0x6cc/0x13f0 fs/open.c:883 do_open fs/namei.c:3558 [inline] path_openat+0x1bc1/0x2b40 fs/namei.c:3715 do_filp_open+0x1ba/0x410 fs/namei.c:3742 do_sys_openat2+0x16d/0x4c0 fs/open.c:1311 do_sys_open fs/open.c:1327 [inline] __do_sys_openat fs/open.c:1343 [inline] __se_sys_openat fs/open.c:1338 [inline] __x64_sys_openat+0x143/0x1f0 fs/open.c:1338 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 7629: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800 snd_rawmidi_release+0x6a/0xf0 sound/core/rawmidi.c:619 __fput+0x27c/0xa90 fs/file_table.c:321 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff8881479ea700 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 8 bytes inside of 32-byte region [ffff8881479ea700, ffff8881479ea720) The buggy address belongs to the physical page: page:ffffea00051e7a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1479ea flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff) raw: 057ff00000000200 ffff888012441500 ffffea0001debd00 dead000000000004 raw: 0000000000000000 0000000000400040 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 9844741481, free_ts 0 prep_new_page mm/page_alloc.c:2549 [inline] get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324 __alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590 alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2114 alloc_pages+0x233/0x270 mm/mempolicy.c:2276 alloc_slab_page mm/slub.c:1851 [inline] allocate_slab+0x25f/0x350 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292 __slab_alloc_node mm/slub.c:3345 [inline] slab_alloc_node mm/slub.c:3442 [inline] __kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc+0x4a/0xd0 mm/slab_common.c:980 kmalloc include/linux/slab.h:584 [inline] usb_get_configuration+0x381/0x3b60 drivers/usb/core/config.c:919 usb_enumerate_device drivers/usb/core/hub.c:2405 [inline] usb_new_device+0x56a/0x7b0 drivers/usb/core/hub.c:2543 register_root_hub+0x421/0x573 drivers/usb/core/hcd.c:1017 usb_add_hcd.cold+0x100c/0x13a1 drivers/usb/core/hcd.c:2991 vhci_hcd_probe+0x14f/0x3a0 drivers/usb/usbip/vhci_hcd.c:1362 platform_probe+0x100/0x1f0 drivers/base/platform.c:1400 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xb90 drivers/base/dd.c:639 page_owner free stack trace missing Memory state around the buggy address: ffff8881479ea600: 00 00 00 00 fc fc fc fc 00 00 00 07 fc fc fc fc ffff8881479ea680: fa fb fb fb fc fc fc fc 00 00 00 07 fc fc fc fc >ffff8881479ea700: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc ^ ffff8881479ea780: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ffff8881479ea800: 00 00 00 01 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 1

[PATCH 0/5] Add tdm support in acp machine driver
by Venkata Prasad Potturu 12 Jan '23

12 Jan '23

This patch set is to add new cpu dai, refactor dai format implementation and add tdm support in acp machine driver. Venkata Prasad Potturu (5): ASoC: amd: acp: Refactor i2s bclk calculation ASoC: amd: acp: Add new cpu dai's in machine driver ASoC: amd: acp: Refactor dai format implementation ASoC: amd: acp: Add tdm support in machine driver ASoC: amd: acp: Enable tdm support for skyrim platforms sound/soc/amd/acp/acp-legacy-mach.c | 13 ++ sound/soc/amd/acp/acp-mach-common.c | 275 +++++++++++++++++++++++----- sound/soc/amd/acp/acp-mach.h | 4 + sound/soc/amd/acp/acp-sof-mach.c | 14 ++ 4 files changed, 256 insertions(+), 50 deletions(-) -- 2.25.1

2 7

[PATCH] ASoC: SOF: sof-audio: Check snd_sof_widget pointer not NULL
by AngeloGioacchino Del Regno 12 Jan '23

12 Jan '23

In function sof_unprepare_widgets_in_path(), check if swidget is actually not NULL, as the widget may not have been initialized at all. This commit solves the following kernel panic seen on MediaTek MT8195: [ 18.025215] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000014 [ 18.034266] Mem abort info: [ 18.037314] ESR = 0x0000000096000004 [ 18.041314] EC = 0x25: DABT (current EL), IL = 32 bits [ 18.046876] SET = 0, FnV = 0 [ 18.050180] EA = 0, S1PTW = 0 [ 18.053572] FSC = 0x04: level 0 translation fault [ 18.058700] Data abort info: [ 18.061832] ISV = 0, ISS = 0x00000004 [ 18.065919] CM = 0, WnR = 0 [ 18.069137] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000115495000 [ 18.075826] [0000000000000014] pgd=0000000000000000, p4d=0000000000000000 [ 18.082867] Internal error: Oops: 0000000096000004 [#1] SMP [ 18.088688] Modules linked in: af_alg qrtr btusb btrtl btintel btmtk btbcm bluetooth 8021q garp uvcvideo mrp stp ecdh_generic llc ecc videobuf2_vmalloc mt7921e mt7921_common mt76_connac_lib mt76 mac80211 snd_sof_ipc_msg_injector snd_sof_ipc_flood_test cfg80211 snd_sof_mt8195 mtk_adsp_common snd_sof_xtensa_dsp snd_sof_of panfrost rfkill snd_sof crct10dif_ce cros_ec_sensors cros_ec_lid_angle gpu_sched sbs_battery cros_usbpd_logger cros_ec_sensors_core hid_multitouch snd_sof_utils fuse ipv6 [ 18.132109] CPU: 5 PID: 657 Comm: wireplumber Tainted: G W 6.2.0-rc3-next-20230111+ #230 [ 18.141834] Hardware name: Acer Tomato (rev2) board (DT) [ 18.147392] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 18.154600] pc : sof_unprepare_widgets_in_path.isra.0+0x28/0x10c [snd_sof] [ 18.161735] lr : sof_walk_widgets_in_order+0x198/0x1d0 [snd_sof] [ 18.167996] sp : ffff80000eb0b870 [ 18.171558] x29: ffff80000eb0b870 x28: 0000000000000001 x27: ffff5d8e178c4c00 [ 18.178939] x26: ffffbd50140fd758 x25: ffffbd50140fd760 x24: 0000000000000000 [ 18.186321] x23: 0000000000000000 x22: ffff5d8e109dd080 x21: ffff5d8e0a429280 [ 18.193702] x20: 0000000000000000 x19: ffff5d8e11fe4800 x18: 0000000000000000 [ 18.201083] x17: 0000000000000000 x16: ffffbd5073deabb0 x15: 0000000000000000 [ 18.208464] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 18.215846] x11: 0000000000000000 x10: 0000000000002780 x9 : ffffbd50140eb4bc [ 18.223228] x8 : ffff5d8e1b5327e0 x7 : 0000000000000000 x6 : ffff5d8e1b530000 [ 18.230610] x5 : 0000000000000003 x4 : 0000000000000001 x3 : 0000000000000000 [ 18.237991] x2 : 0000000000000000 x1 : ffff5d8e11fe4800 x0 : ffff5d8e0a429280 [ 18.245372] Call trace: [ 18.248066] sof_unprepare_widgets_in_path.isra.0+0x28/0x10c [snd_sof] [ 18.254847] sof_walk_widgets_in_order+0x198/0x1d0 [snd_sof] [ 18.260760] sof_widget_list_free+0x7c/0xbc [snd_sof] [ 18.266066] sof_pcm_hw_free+0x10c/0x1c0 [snd_sof] [ 18.271110] snd_soc_pcm_component_hw_free+0x8c/0xe0 [ 18.276327] soc_pcm_hw_clean+0x60/0x11c [ 18.280498] dpcm_fe_dai_hw_free+0x98/0x110 [ 18.284930] snd_pcm_common_ioctl+0xc48/0x1a2c [ 18.289624] snd_pcm_ioctl+0x38/0x50 [ 18.293448] __arm64_sys_ioctl+0xb0/0xf4 [ 18.297620] invoke_syscall+0x50/0x120 [ 18.301618] el0_svc_common.constprop.0+0x17c/0x1b0 [ 18.306744] do_el0_svc+0x40/0xc4 [ 18.310307] el0_svc+0x48/0xf0 [ 18.313611] el0t_64_sync_handler+0xb8/0xc0 [ 18.318041] el0t_64_sync+0x1a0/0x1a4 [ 18.321953] Code: aa0103f3 f90013f5 aa0003f5 f9406834 (39405280) [ 18.328293] ---[ end trace 0000000000000000 ]--- Fixes: 9862dcf70245 ("ASoC: SOF: don't unprepare widget used other pipelines") Fixes: ce59804d2643 ("ASoC: SOF: clear prepare state when widget is unprepared") Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> --- sound/soc/sof/sof-audio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/sof/sof-audio.c b/sound/soc/sof/sof-audio.c index e1ab8380e7d8..1988717762b3 100644 --- a/sound/soc/sof/sof-audio.c +++ b/sound/soc/sof/sof-audio.c @@ -274,7 +274,7 @@ sof_unprepare_widgets_in_path(struct snd_sof_dev *sdev, struct snd_soc_dapm_widg struct snd_soc_dapm_path *p; /* return if the widget is in use or if it is already unprepared */ - if (!swidget->prepared || swidget->use_count > 1) + if (!swidget || !swidget->prepared || swidget->use_count > 1) return; widget_ops = tplg_ops ? tplg_ops->widget : NULL; -- 2.39.0

2 3