November 2023 - Alsa-devel - mailman.alsa-project.org

ucm: fix TOCTOU race condition
by GitHub pull_request - opened 16 Nov '23

16 Nov '23

alsa-project/alsa-lib pull request #367 was opened from szsam: Separately checking the state of a file before operating on it may allow an attacker to modify the file between the two operations. Fix by calling readlink first. If that fails, then path should not be a symbolic link and we call open() followed by fstat(). open() with O_NOFOLLOW will return an error if the file is a symlink. Request URL : https://github.com/alsa-project/alsa-lib/pull/367 Patch URL : https://github.com/alsa-project/alsa-lib/pull/367.patch Repository URL: https://github.com/alsa-project/alsa-lib

1 0

[PATCH] ASoC: SOF: topology: Fix mem leak in sof_dai_load()
by Kamil Duljas 16 Nov '23

16 Nov '23

The function has multiple return points at which it is not released previously allocated memory. Signed-off-by: Kamil Duljas <kamil.duljas(a)gmail.com> --- sound/soc/sof/topology.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c index a3a3af252259..ef8f8991f025 100644 --- a/sound/soc/sof/topology.c +++ b/sound/soc/sof/topology.c @@ -1736,8 +1736,10 @@ static int sof_dai_load(struct snd_soc_component *scomp, int index, /* perform pcm set op */ if (ipc_pcm_ops && ipc_pcm_ops->pcm_setup) { ret = ipc_pcm_ops->pcm_setup(sdev, spcm); - if (ret < 0) + if (ret < 0) { + kfree(spcm); return ret; + } } dai_drv->dobj.private = spcm; @@ -1747,6 +1749,7 @@ static int sof_dai_load(struct snd_soc_component *scomp, int index, ARRAY_SIZE(stream_tokens), private->array, le32_to_cpu(private->size)); if (ret) { + kfree(dai_drv->dobj.private); dev_err(scomp->dev, "error: parse stream tokens failed %d\n", le32_to_cpu(private->size)); return ret; @@ -1764,9 +1767,9 @@ static int sof_dai_load(struct snd_soc_component *scomp, int index, ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, sdev->dev, PAGE_SIZE, &spcm->stream[stream].page_table); if (ret < 0) { + kfree(dai_drv->dobj.private); dev_err(scomp->dev, "error: can't alloc page table for %s %d\n", caps->name, ret); - return ret; } @@ -1782,9 +1785,10 @@ static int sof_dai_load(struct snd_soc_component *scomp, int index, stream = SNDRV_PCM_STREAM_CAPTURE; /* do we need to allocate capture PCM DMA pages */ - if (!spcm->pcm.capture) + if (!spcm->pcm.capture) { + kfree(dai_drv->dobj.private); return ret; - + } caps = &spcm->pcm.caps[stream]; /* allocate capture page table buffer */ @@ -1810,7 +1814,7 @@ static int sof_dai_load(struct snd_soc_component *scomp, int index, free_playback_tables: if (spcm->pcm.playback) snd_dma_free_pages(&spcm->stream[SNDRV_PCM_STREAM_PLAYBACK].page_table); - + kfree(dai_drv->dobj.private); return ret; } -- 2.35.2.windows.1

2 2

[PATCH] ASoC: amd: acp: add missing SND_SOC_AMD_ACP_LEGACY_COMMON flag for ACP70
by Syed Saba Kareem 16 Nov '23

16 Nov '23

add missing dependent SND_SOC_AMD_ACP_LEGACY_COMMON flag for ACP70 platform. Signed-off-by: Syed Saba Kareem <Syed.SabaKareem(a)amd.com> --- sound/soc/amd/acp/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/amd/acp/Kconfig b/sound/soc/amd/acp/Kconfig index c8ac0027f741..84c963241dc5 100644 --- a/sound/soc/amd/acp/Kconfig +++ b/sound/soc/amd/acp/Kconfig @@ -80,6 +80,7 @@ config SND_AMD_ASOC_ACP70 select SND_SOC_AMD_ACP_PCM select SND_SOC_AMD_ACP_I2S select SND_SOC_AMD_ACP_PDM + select SND_SOC_AMD_ACP_LEGACY_COMMON help This option enables Acp7.0 PDM support on AMD platform. Say Y if you want to enable AUDIO on ACP7.0 -- 2.25.1

2 1

Speaker volume control doesn't work by default on Lenovo Yoga 7 (AMD 7840hs)
by GitHub issues - edited 16 Nov '23

16 Nov '23

alsa-project/alsa-lib issue #366 was edited from smaug----: (Not sure which alsa-repo is the correct one for this issue, or is this perhaps a Fedora issue) By default controlling headphone output volume works, but speaker output seems to be either muted or very loud. The following tweak fixes the issue. +++ /usr/share/alsa-card-profile/mixer/paths/analog-output-speaker.conf 2023-11-14 02:45:24.182339962 +0200 @@ -79,8 +79,6 @@ override-map.2 = all-left,all-right [Element Master] -switch = mute -volume = merge override-map.1 = all override-map.2 = all-left,all-right @@ -243,4 +241,8 @@ override-map.1 = all-center override-map.2 = all-center,lfe +[Element Master] +switch = mute +volume = ignore + .include analog-output.conf.common Issue URL : https://github.com/alsa-project/alsa-lib/issues/366 Repository URL: https://github.com/alsa-project/alsa-lib

1 0

Speaker volume control doesn't work by default on Lenovo Yoga 7 (AMD 7840hs)
by GitHub issues - opened 16 Nov '23

16 Nov '23

alsa-project/alsa-lib issue #366 was opened from smaug----: (Not sure which alsa-repo is the correct one for this issue, or is this even a Fedora issue) By default controlling headphone output volume works, but speaker output seems to be either muted or very loud. The following tweak fixes the issue. +++ /usr/share/alsa-card-profile/mixer/paths/analog-output-speaker.conf 2023-11-14 02:45:24.182339962 +0200 @@ -79,8 +79,6 @@ override-map.2 = all-left,all-right [Element Master] -switch = mute -volume = merge override-map.1 = all override-map.2 = all-left,all-right @@ -243,4 +241,8 @@ override-map.1 = all-center override-map.2 = all-center,lfe +[Element Master] +switch = mute +volume = ignore + .include analog-output.conf.common Issue URL : https://github.com/alsa-project/alsa-lib/issues/366 Repository URL: https://github.com/alsa-project/alsa-lib

1 0

[PATCH v3 00/16] ALSA/ASoC: hda: Address format selection limitations and ambiguity
by Cezary Rojewski 16 Nov '23

16 Nov '23

Patchset aims to address format selection restrictions present currently in the HDAudio library. Formats which we are concerned about are 20 and 24 valid bits per sample within 32 bit depth container. One may identify them as S20_LE and S24_LE except that those, according to comments found in include/uapi/sound/asound.h, are for LSB-aligned scenarios. HDAudio streams expect MSB-aligned data, no matter if we are speaking of HOST (SDxFMT) or LINK (PPLCxFMT) side - chapter 4.5.1 of the public HDAudio specification. In short, S20_LE and S24_LE are invalid options. Right now, given the implementation of snd_hdac_query_supported_pcm() within sound/hda/hdac_device.c, even if a codec responds with: "I support all possible formats specified within HDAudio specification", there will be no option to open a 20/32 or 24/32 stream. The kernel will force the stream to be opened using the highest available bit depth. After discussing subject initially with Jaroslav and Takashi, suggestion was made to utilize 'subformat' option to address the problem. The eye-opening discussion begun much earlier though, in 2019 [1]. Paired with PRs for alsa-utils [2] and alsa-lib [3]. Flow of changes: The very first patch adds MSBITS subformat options to allow for granular 20/32, 24/32 and 32/32 format selection. The next three make sure subformat is actually honored during runtime. Most of that code is based on format-related API. Follow up is upgrade to the hda stream-format interface - several functions are added to make the granular format selection simple in the HDAudio world. Core of the implementation is based on the existing snd_hdac_calc_stream_format(). The next ten patches are straightforward switch from one interface to another with cleanup of now-unsed function as a finishing touch. Last but not least - the avs-driver, on which the problem analyzed and debugged, is updated to no longer acknowledge S24_LE as a valid format option. Results with skylake-driver and snd_hda_intel show status quo on our RVPs. PR filed on SOF github shows promising results too [4]. Changes in v3: - merged the first two patches as suggested by Jaroslav - re-authored patch 01 to Jaroslav, added my Co-developed-by. - added Jaroslav' Co-developed-by to patch 02. - 'subformats' field now S32_LE-specific. Given the fact that it is the only format currently requiring subformat-intervention, functionality is narrowed to reduce amount of memory allocations and cleanup. Suggested by Jaroslav. - note to the above: the hdaudio part converted 1:1 as requested, patch 02/16 - note #2: alsa part converted to S32_LE-specific yet without addition of the chicken bit. Instead, struct snd_pcm_hardware is updated with u32 subformat mask to do the job. - ALSA-core additions in form of snd_pcm_subformat_width() and snd_pcm_hw_params_bps() relocated from 01/16 to the user, patch 05. Changes in v2: - patch 01/17, introduced struct snd_pcm_subformat which task is to represent subformat-mask on per format basis. Expectation is that manipulated arrays of subformats always end with a sentinel entry - patch 01/17, added snd_pcm_hw_copy() as the copying snd_pcm_hardware becomes non-trivial - patch 02/17, added hw_rule that produces final subformat mask based on provided formats as suggested by Jaroslav - patch 04/17, soc_pcm_hw_update_subformat() refactored as the subformat intersection becomes non-trivial - relevant functions releasing resources occupied by hda_pcm and snd_pcm_runtime updated to also kfree() subformats - except for 16/17, no changes to patches past 04/17, retaining acks for these Changes in v1: - fixed UBSAN due to missing snd_pcm_subformat_names[] entries for new subformats - as HDMI stream capabilities are assigned on PCM open, patch 16/17 has been updated to ignore such codecs for now. A separate patchset will take care of this case - params_bps() reworded to snd_pcm_hw_params_bps() - fixed compilation issues in sof-driver, patch 13/17 [1]: https://lore.kernel.org/alsa-devel/20190905053302.9262-1-pawel.harlozinski@… [2]: https://github.com/alsa-project/alsa-utils/pull/228 [3]: https://github.com/alsa-project/alsa-lib/pull/342 [4]: https://github.com/thesofproject/linux/pull/4539 Cezary Rojewski (15): ALSA: hda: Honor subformat when querying PCMs ASoC: pcm: Honor subformat when configuring runtime ALSA: hda: Upgrade stream-format infrastructure ALSA: hda: Switch to new stream-format interface ALSA: hda/hdmi: Switch to new stream-format interface ALSA: hda/ca0132: Switch to new stream-format interface ASoC: codecs: hda: Switch to new stream-format interface ASoC: codecs: hdac_hda: Switch to new stream-format interface ASoC: codecs: hdac_hdmi: Switch to new stream-format interface ASoC: Intel Skylake: Switch to new stream-format interface ASoC: SOF: Intel: Switch to new stream-format interface ASoC: Intel: avs: Switch to new stream-format interface ALSA: hda: Drop snd_hdac_calc_stream_format() ASoC: Intel: avs: Kill S24_LE format ASoC: Intel: avs: Unhardcode HDAudio BE DAI drivers description Jaroslav Kysela (1): ALSA: pcm: Introduce MSBITS subformat interface include/sound/hda_codec.h | 5 +- include/sound/hdaudio.h | 13 +-- include/sound/pcm.h | 8 ++ include/sound/pcm_params.h | 2 + include/sound/soc.h | 1 + include/uapi/sound/asound.h | 7 +- sound/core/pcm.c | 3 + sound/core/pcm_lib.c | 28 ++++++ sound/core/pcm_misc.c | 22 +++++ sound/core/pcm_native.c | 55 ++++++++++- sound/hda/hdac_device.c | 156 +++++++++++++++++++++--------- sound/pci/hda/hda_codec.c | 2 + sound/pci/hda/hda_controller.c | 10 +- sound/pci/hda/patch_ca0132.c | 3 +- sound/pci/hda/patch_hdmi.c | 6 +- sound/soc/codecs/hda-dai.c | 6 +- sound/soc/codecs/hda.c | 2 + sound/soc/codecs/hdac_hda.c | 8 +- sound/soc/codecs/hdac_hdmi.c | 10 +- sound/soc/intel/avs/loader.c | 4 +- sound/soc/intel/avs/path.c | 2 +- sound/soc/intel/avs/pcm.c | 58 +++++++++-- sound/soc/intel/avs/probes.c | 3 +- sound/soc/intel/avs/topology.c | 13 ++- sound/soc/intel/skylake/skl-pcm.c | 11 ++- sound/soc/soc-pcm.c | 10 ++ sound/soc/sof/intel/hda-dai-ops.c | 5 +- tools/include/uapi/sound/asound.h | 7 +- 28 files changed, 358 insertions(+), 102 deletions(-) -- 2.25.1

3 19

[PATCH] soundwire: amd: add an error code check in amd_sdw_clock_stop_exit
by Su Hui 16 Nov '23

16 Nov '23

Clang static analyzer complains that value stored to 'ret' is never read. Add an error code check and print an error message if 'readl_poll_timeout' failed. Signed-off-by: Su Hui <suhui(a)nfschina.com> --- drivers/soundwire/amd_manager.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c index 3a99f6dcdfaf..f391b541f4b7 100644 --- a/drivers/soundwire/amd_manager.c +++ b/drivers/soundwire/amd_manager.c @@ -1029,6 +1029,10 @@ static int amd_sdw_clock_stop_exit(struct amd_sdw_manager *amd_manager) ret = readl_poll_timeout(amd_manager->mmio + ACP_SW_CLK_RESUME_CTRL, val, (val & AMD_SDW_CLK_RESUME_DONE), ACP_DELAY_US, AMD_SDW_TIMEOUT); + if (ret) + dev_err(amd_manager->dev, "%s: timed out: %pe\n", __func__, + ERR_PTR(ret)); + if (val & AMD_SDW_CLK_RESUME_DONE) { writel(0, amd_manager->mmio + ACP_SW_CLK_RESUME_CTRL); ret = sdw_bus_exit_clk_stop(&amd_manager->bus); -- 2.30.2

3 4

Potential arbitrary code execution via dlopen
by GitHub issues - opened 16 Nov '23

16 Nov '23

alsa-project/alsa-lib issue #365 was opened from szsam: The value of the first argument of dlopen() may come from getenv. Using externally controlled strings in a process operation can allow an attacker to execute malicious commands. https://github.com/alsa-project/alsa-lib/blob/ed6b07084bfea4155bbc98bcf3850… https://github.com/alsa-project/alsa-lib/blob/ed6b07084bfea4155bbc98bcf3850… Issue URL : https://github.com/alsa-project/alsa-lib/issues/365 Repository URL: https://github.com/alsa-project/alsa-lib

1 0

aserver: fix buffer overwriting
by GitHub pull_request - opened 16 Nov '23

16 Nov '23

alsa-project/alsa-lib pull request #364 was opened from szsam: name array should allocate space for the null terminator. Also, need to check if client->name has enough space for strcpy. I suggest assigning a CVE for this buffer overflow vulnerability. Request URL : https://github.com/alsa-project/alsa-lib/pull/364 Patch URL : https://github.com/alsa-project/alsa-lib/pull/364.patch Repository URL: https://github.com/alsa-project/alsa-lib

1 0

pcm: fix stack allocation inside a loop
by GitHub pull_request - opened 15 Nov '23

15 Nov '23

alsa-project/alsa-lib pull request #363 was opened from szsam: Using alloca in a loop can lead to a stack overflow. Fix by using malloc and free. Request URL : https://github.com/alsa-project/alsa-lib/pull/363 Patch URL : https://github.com/alsa-project/alsa-lib/pull/363.patch Repository URL: https://github.com/alsa-project/alsa-lib

1 0