September 2023 - Alsa-devel - mailman.alsa-project.org

[PATCH] ALSA: usx2y: Annotate struct snd_usx2y_urb_seq with __counted_by
by Kees Cook 23 Sep '23

23 Sep '23

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct snd_usx2y_urb_seq. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted… Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: alsa-devel(a)alsa-project.org Signed-off-by: Kees Cook <keescook(a)chromium.org> --- sound/usb/usx2y/usbusx2y.h | 2 +- sound/usb/usx2y/usbusx2yaudio.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/usb/usx2y/usbusx2y.h b/sound/usb/usx2y/usbusx2y.h index 8d82f5cc2fe1..391fd7b4ed5e 100644 --- a/sound/usb/usx2y/usbusx2y.h +++ b/sound/usb/usx2y/usbusx2y.h @@ -18,7 +18,7 @@ struct snd_usx2y_async_seq { struct snd_usx2y_urb_seq { int submitted; int len; - struct urb *urb[]; + struct urb *urb[] __counted_by(len); }; #include "usx2yhwdeppcm.h" diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c index 5197599e7aa6..ca7888495a9f 100644 --- a/sound/usb/usx2y/usbusx2yaudio.c +++ b/sound/usb/usx2y/usbusx2yaudio.c @@ -681,6 +681,7 @@ static int usx2y_rate_set(struct usx2ydev *usx2y, int rate) err = -ENOMEM; goto cleanup; } + us->len = NOOF_SETRATE_URBS; usbdata = kmalloc_array(NOOF_SETRATE_URBS, sizeof(int), GFP_KERNEL); if (!usbdata) { @@ -702,7 +703,6 @@ static int usx2y_rate_set(struct usx2ydev *usx2y, int rate) if (err < 0) goto cleanup; us->submitted = 0; - us->len = NOOF_SETRATE_URBS; usx2y->us04 = us; wait_event_timeout(usx2y->in04_wait_queue, !us->len, HZ); usx2y->us04 = NULL; -- 2.34.1

3 2

[PATCH] ALSA: hda: Annotate struct hda_conn_list with __counted_by
by Kees Cook 23 Sep '23

23 Sep '23

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct hda_conn_list. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted… Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: Cezary Rojewski <cezary.rojewski(a)intel.com> Cc: alsa-devel(a)alsa-project.org Signed-off-by: Kees Cook <keescook(a)chromium.org> --- sound/pci/hda/hda_codec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 33af707a65ab..01718b1fc9a7 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -88,7 +88,7 @@ struct hda_conn_list { struct list_head list; int len; hda_nid_t nid; - hda_nid_t conns[]; + hda_nid_t conns[] __counted_by(len); }; /* look up the cached results */ -- 2.34.1

3 2

[PATCH] ASoC: loongson: Add error handling in loongson_pcm_open
by liuhaoran 23 Sep '23

23 Sep '23

This patch adds error-handling for the snd_pcm_hw_constraint_step() and snd_pcm_hw_constrain_integer() inside the img_prl_out_hw_params function in the loongson_dma.c file. Signed-off-by: liuhaoran <liuhaoran14(a)163.com> --- sound/soc/loongson/loongson_dma.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/soc/loongson/loongson_dma.c b/sound/soc/loongson/loongson_dma.c index 47d6551903fc..af9e6a881a2a 100644 --- a/sound/soc/loongson/loongson_dma.c +++ b/sound/soc/loongson/loongson_dma.c @@ -240,17 +240,17 @@ static int loongson_pcm_open(struct snd_soc_component *component, ret = snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 128); - if (ret<0) + if (ret < 0) return ret; - error = snd_pcm_hw_constraint_step(runtime, 0, + ret = snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_BYTES, 128); - if (ret<0) + if (ret < 0) return ret; - error = snd_pcm_hw_constraint_integer(substream->runtime, + ret = snd_pcm_hw_constraint_integer(substream->runtime, SNDRV_PCM_HW_PARAM_PERIODS); - if (ret<0) + if (ret < 0) return ret; snd_soc_set_runtime_hwparams(substream, &ls_pcm_hardware); -- 2.17.1

1 0

[PATCH] ASoC: img: Add error handling for clk_set_rate in img_prl_out_hw_params
by liuhaoran 23 Sep '23

23 Sep '23

This patch adds error-handling for the clk_set_rate() call inside the img_prl_out_hw_params function in the img-parallel-out.c file. Signed-off-by: liuhaoran <liuhaoran14(a)163.com> --- sound/soc/img/img-parallel-out.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c index 815e68a7048c..698e9e92ded9 100644 --- a/sound/soc/img/img-parallel-out.c +++ b/sound/soc/img/img-parallel-out.c @@ -137,7 +137,10 @@ static int img_prl_out_hw_params(struct snd_pcm_substream *substream, if (channels != 2) return -EINVAL; - clk_set_rate(prl->clk_ref, rate * 256); + int ret = clk_set_rate(prl->clk_ref, rate * 256); + + if (!ret) + return ret; reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL); reg = (reg & ~IMG_PRL_OUT_CTL_PACKH_MASK) | control_set; -- 2.17.1

1 0

[PATCH] ASoC: soc-generic-dmaengine-pcm: Fix function name in comment
by Miquel Raynal 22 Sep '23

22 Sep '23

While browsing/grepping in the sound core, I found that snd_dmaengine_set_config_from_dai_data() did not exist, in favor of snd_dmaengine_pcm_set_config_from_dai_data(). Fix the typo. Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> --- sound/soc/soc-generic-dmaengine-pcm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c index d0653d775c87..cad222eb9a29 100644 --- a/sound/soc/soc-generic-dmaengine-pcm.c +++ b/sound/soc/soc-generic-dmaengine-pcm.c @@ -44,8 +44,8 @@ static struct device *dmaengine_dma_dev(struct dmaengine_pcm *pcm, * platforms which make use of the snd_dmaengine_dai_dma_data struct for their * DAI DMA data. Internally the function will first call * snd_hwparams_to_dma_slave_config to fill in the slave config based on the - * hw_params, followed by snd_dmaengine_set_config_from_dai_data to fill in the - * remaining fields based on the DAI DMA data. + * hw_params, followed by snd_dmaengine_pcm_set_config_from_dai_data to fill in + * the remaining fields based on the DAI DMA data. */ int snd_dmaengine_pcm_prepare_slave_config(struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params, struct dma_slave_config *slave_config) -- 2.34.1

2 1

[PATCH v2] ASoC: dt-bindings: tfa9879: Convert to dtschema
by Bragatheswaran Manickavel 22 Sep '23

22 Sep '23

Convert the tfa9879 audio CODEC bindings to DT schema No error/warning seen when running make dt_binding_check Signed-off-by: Bragatheswaran Manickavel <bragathemanick0908(a)gmail.com> Changes: V1 -> V2: Fixed DT syntax errors and doc warning --- .../bindings/sound/nxp,tfa9879.yaml | 44 +++++++++++++++++++ .../devicetree/bindings/sound/tfa9879.txt | 23 ---------- MAINTAINERS | 2 +- 3 files changed, 45 insertions(+), 24 deletions(-) create mode 100644 Documentation/devicetree/bindings/sound/nxp,tfa9879.yaml delete mode 100644 Documentation/devicetree/bindings/sound/tfa9879.txt diff --git a/Documentation/devicetree/bindings/sound/nxp,tfa9879.yaml b/Documentation/devicetree/bindings/sound/nxp,tfa9879.yaml new file mode 100644 index 000000000000..df26248573ad --- /dev/null +++ b/Documentation/devicetree/bindings/sound/nxp,tfa9879.yaml @@ -0,0 +1,44 @@ +# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/sound/nxp,tfa9879.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: NXP TFA9879 class-D audio amplifier + +maintainers: + - Peter Rosin <peda(a)axentia.se> + +allOf: + - $ref: dai-common.yaml# + +properties: + compatible: + const: nxp,tfa9879 + + reg: + maxItems: 1 + + "#sound-dai-cells": + const: 0 + +required: + - compatible + - reg + - '#sound-dai-cells' + +unevaluatedProperties: false + +examples: + - | + i2c1 { + #address-cells = <1>; + #size-cells = <0>; + amplifier@6c { + compatible = "nxp,tfa9879"; + reg = <0x6c>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c1>; + #sound-dai-cells = <0>; + }; + }; diff --git a/Documentation/devicetree/bindings/sound/tfa9879.txt b/Documentation/devicetree/bindings/sound/tfa9879.txt deleted file mode 100644 index 1620e6848436..000000000000 --- a/Documentation/devicetree/bindings/sound/tfa9879.txt +++ /dev/null @@ -1,23 +0,0 @@ -NXP TFA9879 class-D audio amplifier - -Required properties: - -- compatible : "nxp,tfa9879" - -- reg : the I2C address of the device - -- #sound-dai-cells : must be 0. - -Example: - -&i2c1 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_i2c1>; - - amp: amp@6c { - #sound-dai-cells = <0>; - compatible = "nxp,tfa9879"; - reg = <0x6c>; - }; -}; - diff --git a/MAINTAINERS b/MAINTAINERS index a4c30221eb30..569303daf9b4 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -15476,7 +15476,7 @@ NXP TFA9879 DRIVER M: Peter Rosin <peda(a)axentia.se> L: alsa-devel(a)alsa-project.org (moderated for non-subscribers) S: Maintained -F: Documentation/devicetree/bindings/sound/tfa9879.txt +F: Documentation/devicetree/bindings/sound/nxp,tfa9879.yaml F: sound/soc/codecs/tfa9879* NXP-NCI NFC DRIVER -- 2.34.1

3 3

[PATCH v1 0/2] ALSA: cs35l41: prevent old firmwares using unsupported commands
by Stefan Binding 22 Sep '23

22 Sep '23

Some systems use older firmware which does not support newer commands which are used to enable external boost. For those systems, we can workaround this by writing the registers directly. We can use the firmware version, stored inside cs_dsp, to determine whether or not the command is supported. To achieve this, it requires a cleanup in the api, to pass the cs_dsp struct into the function. We can also remove the redundant boolean firmware_running from the HDA driver, and use the equivalent state inside cs_dsp. This chain is based on Mark's branch, since the api change was made to the function in sound/soc/codecs/cs35l41-lib.c. Stefan Binding (2): ALSA: hda: cs35l41: Remove unnecessary boolean state variable firmware_running ALSA: cs35l41: Fix for old systems which do not support command include/sound/cs35l41.h | 2 +- sound/pci/hda/cs35l41_hda.c | 28 ++++++++++++---------------- sound/pci/hda/cs35l41_hda.h | 1 - sound/soc/codecs/cs35l41-lib.c | 6 ++++-- sound/soc/codecs/cs35l41.c | 4 ++-- 5 files changed, 19 insertions(+), 22 deletions(-) -- 2.34.1

3 9

[PATCH v6 03/13] sound: Fix snd_pcm_readv()/writev() to use iov access functions
by David Howells 22 Sep '23

22 Sep '23

Fix snd_pcm_readv()/writev() to use iov access functions rather than poking at the iov_iter internals directly. Signed-off-by: David Howells <dhowells(a)redhat.com> Reviewed-by: Jaroslav Kysela <perex(a)perex.cz> Reviewed-by: Takashi Iwai <tiwai(a)suse.de> cc: Oswald Buddenhagen <oswald.buddenhagen(a)gmx.de> cc: Jens Axboe <axboe(a)kernel.dk> cc: Suren Baghdasaryan <surenb(a)google.com> cc: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> cc: alsa-devel(a)alsa-project.org --- sound/core/pcm_native.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index bd9ddf412b46..9a69236fa207 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -3527,7 +3527,7 @@ static ssize_t snd_pcm_readv(struct kiocb *iocb, struct iov_iter *to) if (runtime->state == SNDRV_PCM_STATE_OPEN || runtime->state == SNDRV_PCM_STATE_DISCONNECTED) return -EBADFD; - if (!to->user_backed) + if (!user_backed_iter(to)) return -EINVAL; if (to->nr_segs > 1024 || to->nr_segs != runtime->channels) return -EINVAL; @@ -3567,7 +3567,7 @@ static ssize_t snd_pcm_writev(struct kiocb *iocb, struct iov_iter *from) if (runtime->state == SNDRV_PCM_STATE_OPEN || runtime->state == SNDRV_PCM_STATE_DISCONNECTED) return -EBADFD; - if (!from->user_backed) + if (!user_backed_iter(from)) return -EINVAL; if (from->nr_segs > 128 || from->nr_segs != runtime->channels || !frame_aligned(runtime, iov->iov_len))

1 0

[RFC PATCH v4 00/11] Add audio support in v4l2 framework
by Shengjiu Wang 22 Sep '23

22 Sep '23

Audio signal processing also has the requirement for memory to memory similar as Video. This asrc memory to memory (memory ->asrc->memory) case is a non real time use case. User fills the input buffer to the asrc module, after conversion, then asrc sends back the output buffer to user. So it is not a traditional ALSA playback and capture case. It is a specific use case, there is no reference in current kernel. v4l2 memory to memory is the closed implementation, v4l2 current support video, image, radio, tuner, touch devices, so it is not complicated to add support for this specific audio case. Because we had implemented the "memory -> asrc ->i2s device-> codec" use case in ALSA. Now the "memory->asrc->memory" needs to reuse the code in asrc driver, so the first 3 patches is for refining the code to make it can be shared by the "memory->asrc->memory" driver. The main change is in the v4l2 side, A /dev/vl4-audioX will be created, user applications only use the ioctl of v4l2 framework. Other change is to add memory to memory support for two kinds of i.MX ASRC module. changes in v4: - update document style - separate V4L2_AUDIO_FMT_LPCM and V4L2_CAP_AUDIO_M2M in separate commit changes in v3: - Modify documents for adding audio m2m support - Add audio virtual m2m driver - Defined V4L2_AUDIO_FMT_LPCM format type for audio. - Defined V4L2_CAP_AUDIO_M2M capability type for audio m2m case. - with modification in v4l-utils, pass v4l2-compliance test. changes in v2: - decouple the implementation in v4l2 and ALSA - implement the memory to memory driver as a platfrom driver and move it to driver/media - move fsl_asrc_common.h to include/sound folder Shengjiu Wang (11): ASoC: fsl_asrc: define functions for memory to memory usage ASoC: fsl_easrc: define functions for memory to memory usage ASoC: fsl_asrc: move fsl_asrc_common.h to include/sound ASoC: fsl_asrc: register m2m platform device ASoC: fsl_easrc: register m2m platform device media: uapi: Add V4L2_CAP_AUDIO_M2M capability flag media: uapi: Add V4L2_AUDIO_FMT_LPCM fourcc format media: v4l2: Add audio capture and output support media: uapi: Add V4L2_CID_USER_IMX_ASRC_RATIO_MOD control media: audm2m: add virtual driver for audio memory to memory media: imx-asrc: Add memory to memory driver .../userspace-api/media/v4l/audio-formats.rst | 15 + .../userspace-api/media/v4l/buffer.rst | 6 + .../userspace-api/media/v4l/control.rst | 5 + .../userspace-api/media/v4l/dev-audio.rst | 63 + .../userspace-api/media/v4l/devices.rst | 1 + .../media/v4l/pixfmt-aud-lpcm.rst | 61 + .../userspace-api/media/v4l/pixfmt.rst | 1 + .../media/v4l/vidioc-enum-fmt.rst | 2 + .../userspace-api/media/v4l/vidioc-g-fmt.rst | 4 + .../media/v4l/vidioc-querycap.rst | 3 + .../media/videodev2.h.rst.exceptions | 3 + .../media/common/videobuf2/videobuf2-v4l2.c | 4 + drivers/media/platform/nxp/Kconfig | 12 + drivers/media/platform/nxp/Makefile | 1 + drivers/media/platform/nxp/imx-asrc.c | 1058 +++++++++++++++++ drivers/media/test-drivers/Kconfig | 9 + drivers/media/test-drivers/Makefile | 1 + drivers/media/test-drivers/audm2m.c | 767 ++++++++++++ drivers/media/v4l2-core/v4l2-ctrls-defs.c | 1 + drivers/media/v4l2-core/v4l2-dev.c | 17 + drivers/media/v4l2-core/v4l2-ioctl.c | 53 + include/media/v4l2-dev.h | 2 + include/media/v4l2-ioctl.h | 34 + .../fsl => include/sound}/fsl_asrc_common.h | 54 + include/uapi/linux/v4l2-controls.h | 1 + include/uapi/linux/videodev2.h | 25 + sound/soc/fsl/fsl_asrc.c | 162 +++ sound/soc/fsl/fsl_asrc.h | 4 +- sound/soc/fsl/fsl_asrc_dma.c | 2 +- sound/soc/fsl/fsl_easrc.c | 239 ++++ sound/soc/fsl/fsl_easrc.h | 8 +- 31 files changed, 2615 insertions(+), 3 deletions(-) create mode 100644 Documentation/userspace-api/media/v4l/audio-formats.rst create mode 100644 Documentation/userspace-api/media/v4l/dev-audio.rst create mode 100644 Documentation/userspace-api/media/v4l/pixfmt-aud-lpcm.rst create mode 100644 drivers/media/platform/nxp/imx-asrc.c create mode 100644 drivers/media/test-drivers/audm2m.c rename {sound/soc/fsl => include/sound}/fsl_asrc_common.h (60%) -- 2.34.1

4 22

[PATCH] sound: usb: increase snd_card alloc size
by Ricardo B. Marliere 22 Sep '23

22 Sep '23

Syzbot reports a slab-out-of-bounds read of a snd_card object. When snd_usb_audio_create calls snd_card_new, it passes sizeof(*chip) as the extra_size argument, which is not enough in this case. Relevant logs below: BUG: KASAN: slab-out-of-bounds in imon_probe+0x2983/0x3910 Read of size 1 at addr ffff8880436a2c71 by task kworker/1:2/777 (...) The buggy address belongs to the object at ffff8880436a2000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 1 bytes to the right of allocated 3184-byte region [ffff8880436a2000, ffff8880436a2c70) Reported-by: syzbot+59875ffef5cb9c9b29e9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a838aa0603cc74d6@google.com/ Signed-off-by: Ricardo B. Marliere <ricardo(a)marliere.net> --- sound/usb/card.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/card.c b/sound/usb/card.c index 1b2edc0fd2e9..6578326d33e8 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -619,7 +619,7 @@ static int snd_usb_audio_create(struct usb_interface *intf, } err = snd_card_new(&intf->dev, index[idx], id[idx], THIS_MODULE, - sizeof(*chip), &card); + sizeof(*chip) + 2, &card); if (err < 0) { dev_err(&dev->dev, "cannot create card instance %d\n", idx); return err; -- 2.40.1

2 4