September 2024 - Alsa-devel - mailman.alsa-project.org

[PATCH] ASoC: codecs: Use devm_clk_get_enabled() helpers
by ying zuxin 06 Sep '24

06 Sep '24

From: ying zuxin <11154159(a)vivo.com> The devm_clk_get_enabled() helpers: - call devm_clk_get() - call clk_prepare_enable() and register what is needed in order to call clk_disable_unprepare() when needed, as a managed resource. This simplifies the code and avoids the calls to clk_disable_unprepare(). Signed-off-by: ying zuxin <11154159(a)vivo.com> --- sound/soc/codecs/peb2466.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/sound/soc/codecs/peb2466.c b/sound/soc/codecs/peb2466.c index 76ee7e3f4d9b..b67cfad4fc32 100644 --- a/sound/soc/codecs/peb2466.c +++ b/sound/soc/codecs/peb2466.c @@ -1975,12 +1975,9 @@ static int peb2466_spi_probe(struct spi_device *spi) if (IS_ERR(peb2466->reset_gpio)) return PTR_ERR(peb2466->reset_gpio); - peb2466->mclk = devm_clk_get(&peb2466->spi->dev, "mclk"); + peb2466->mclk = devm_clk_get_enabled(&peb2466->spi->dev, "mclk"); if (IS_ERR(peb2466->mclk)) return PTR_ERR(peb2466->mclk); - ret = clk_prepare_enable(peb2466->mclk); - if (ret) - return ret; if (peb2466->reset_gpio) { gpiod_set_value_cansleep(peb2466->reset_gpio, 1); @@ -2031,17 +2028,9 @@ static int peb2466_spi_probe(struct spi_device *spi) return 0; failed: - clk_disable_unprepare(peb2466->mclk); return ret; } -static void peb2466_spi_remove(struct spi_device *spi) -{ - struct peb2466 *peb2466 = spi_get_drvdata(spi); - - clk_disable_unprepare(peb2466->mclk); -} - static const struct of_device_id peb2466_of_match[] = { { .compatible = "infineon,peb2466", }, { } @@ -2061,7 +2050,6 @@ static struct spi_driver peb2466_spi_driver = { }, .id_table = peb2466_id_table, .probe = peb2466_spi_probe, - .remove = peb2466_spi_remove, }; module_spi_driver(peb2466_spi_driver); -- 2.39.0

3 2

[PATCH] ASoC: makes rtd->initialized bit field
by Kuninori Morimoto 06 Sep '24

06 Sep '24

rtd->initialized is used to know whether soc_init_pcm_runtime() was correctly fined, and used to call snd_soc_link_exit(). We don't need to have it as bool, let's make it bit-field same as other flags. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Cc: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Cc: Cezary Rojewski <cezary.rojewski(a)intel.com> --- include/sound/soc.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/include/sound/soc.h b/include/sound/soc.h index 81ef380b2e06..e6e359c1a2ac 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h @@ -1207,8 +1207,7 @@ struct snd_soc_pcm_runtime { /* bit field */ unsigned int pop_wait:1; unsigned int fe_compr:1; /* for Dynamic PCM */ - - bool initialized; + unsigned int initialized:1; /* CPU/Codec/Platform */ int num_components; -- 2.43.0

2 1

[PATCH 1/2] pcm: dmix: Fix resume with multiple instances
by Takashi Iwai 06 Sep '24

06 Sep '24

The fix for PCM dmix suspend/resume checks spcm->info bit of SND_PCM_INFO_RESUME for applying a workaround for drivers with the full resume support. This assumed that scpm->info is exposed from the underlying slave PCM device. The above is true for the first opened instance, but for the second opened instance, it's a copy from the saved data in shmem. And, we dropped SND_PCM_INFO_RESUME bit there to assure not to expose the full resume capability to applications. This resulted in the inconsistencies, and when the second instance is resumed at first, it misses the snd_pcm_resume() call, hence the driver doesn't react properly any longer. For addressing it, we keep SND_PCM_INFO_RESUME bit in shmptr->s.info bits as is, while dropping the bit exposed to apps in snd_pcm_direct_hw_refine() and *_hw_params() callbacks. Fixes: 6d1d620eadf3 ("pcm: dmix: resume workaround for buggy driver") Reported-and-tested-by: Chancel Liu <chancel.liu(a)nxp.com> Closes: https://lore.kernel.org/DB9PR04MB94988752ED7C43B399E0BC00E3942@DB9PR04MB949… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- src/pcm/pcm_direct.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pcm/pcm_direct.c b/src/pcm/pcm_direct.c index e53e59238119..17e677f60b19 100644 --- a/src/pcm/pcm_direct.c +++ b/src/pcm/pcm_direct.c @@ -1018,6 +1018,7 @@ int snd_pcm_direct_hw_refine(snd_pcm_t *pcm, snd_pcm_hw_params_t *params) } dshare->timer_ticks = hw_param_interval(params, SND_PCM_HW_PARAM_PERIOD_SIZE)->max / dshare->slave_period_size; params->info = dshare->shmptr->s.info; + params->info &= ~SND_PCM_INFO_RESUME; #ifdef REFINE_DEBUG snd_output_puts(log, "DMIX REFINE (end):\n"); snd_pcm_hw_params_dump(params, log); @@ -1031,6 +1032,7 @@ int snd_pcm_direct_hw_params(snd_pcm_t *pcm, snd_pcm_hw_params_t * params) snd_pcm_direct_t *dmix = pcm->private_data; params->info = dmix->shmptr->s.info; + params->info &= ~SND_PCM_INFO_RESUME; params->rate_num = dmix->shmptr->s.rate; params->rate_den = 1; params->fifo_size = 0; @@ -1183,8 +1185,6 @@ static void save_slave_setting(snd_pcm_direct_t *dmix, snd_pcm_t *spcm) COPY_SLAVE(buffer_time); COPY_SLAVE(sample_bits); COPY_SLAVE(frame_bits); - - dmix->shmptr->s.info &= ~SND_PCM_INFO_RESUME; } #undef COPY_SLAVE -- 2.43.0

1 1

Suspend/resume Issue on pcm_dmix.c in alsa-lib
by Chancel Liu 06 Sep '24

06 Sep '24

Hi Takashi Iwai, Jaroslav Kysela We found an issue on dmix in alsa-lib when do suspend and resume. It can be easily reproduced by following steps: 1. Run two dmix clients in parallel. (Only one client doesn't has such issue) ~# aplay xxx1.wav & ~# aplay xxx2.wav & Here I attach the asound.conf we're using. ~# cat /etc/asound.conf defaults.pcm.rate_converter "linear" pcm.dmix_44100{ type dmix ipc_key 5678293 ipc_key_add_uid yes slave{ pcm "hw:0,0" period_time 40000 format S16_LE rate 44100 } } pcm.asymed{ type asym playback.pcm "dmix_44100" capture.pcm "dsnoop_44100" } pcm.!default{ type plug route_policy "average" slave.pcm "asymed" } 2. Let linux enter into suspend and then resume(Repeat this step if not reproduced) 3. After resume, aplay will get stuck in snd_pcm_wait(). The GDB shows: (gdb) bt #0 0x0000fffff7da9264 in __GI___poll (fds=fds@entry=0xfffffffff480, nfds=nfds@entry=1, timeout=timeout@entry=240) at /usr/src/debug/glibc/2.39+git/sysdeps/unix/sysv/linux/poll.c:41 #1 0x0000fffff7edf468 in poll (__timeout=240, __nfds=1, __fds=0xfffffffff480) #2 snd1_pcm_wait_nocheck (pcm=pcm@entry=0xaaaaaaad2cb0, timeout=240, timeout@entry=-10001) at pcm.c:2993 #3 0x0000fffff7ee54a0 in snd1_pcm_write_areas (pcm=pcm@entry=0xaaaaaaad2cb0, areas=areas@entry=0xfffffffff560, offset=<optimized out>, offset@entry=0, size=<optimized out>, size@entry=1768, func=func@entry=0xfffff7ef5190 <snd_pcm_plugin_write_areas>) at pcm.c:7699 #4 0x0000fffff7ef5020 in snd_pcm_plugin_writei (pcm=0xaaaaaaad2cb0, buffer=<optimized out>, size=1768) at pcm_plugin.c:354 It seems that sometimes after suspend and resume there's no available space for data written into buffer. Then aplay keeps stuck in snd_pcm_wait(). I checked the hw_ptr of dmix and found that hw_ptr is always 0 after resume. I don't have a solution now so I turn to you for help. The version of alsa-lib is v1.2.11. Could you please help check it? Regards, Chancel Liu

3 12

[GIT PULL] ASoC fixes for v6.11-rc6
by Mark Brown 06 Sep '24

06 Sep '24

The following changes since commit bb4485562f5907708f1c218b5d70dce04165d1e1: ASoC: cs-amp-lib: Ignore empty UEFI calibration entries (2024-08-22 17:52:26 +0100) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git tags/asoc-fix-v6.11-rc6 for you to fetch changes up to 77212f300bfd6fb3edaabd1daf863cabb521854a: ASoC: codecs: lpass-va-macro: set the default codec version for sm8250 (2024-08-30 13:54:24 +0100) ---------------------------------------------------------------- ASoC: Fixes for v6.11 A larger set of fixes than I'd like at this point, but mainly due to people working on fixing module autoloading by adding missing exports of ID tables rather than anything particularly concerning. There are some other runtime fixes and quirks, and a tweak to the ABI definition for SOF which ensures that a struct layout doesn't vary depending on the architecture of the host. ---------------------------------------------------------------- Chen-Yu Tsai (1): ASoc: SOF: topology: Clear SOF link platform name upon unload Hans de Goede (2): ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict Laurentiu Mihalcea (1): ASoC: SOF: ipc: replace "enum sof_comp_type" field with "uint32_t" Liao Chen (4): ASoC: intel: fix module autoloading ASoC: google: fix module autoloading ASoC: tda7419: fix module autoloading ASoC: fix module autoloading Mark Brown (1): ASoC: fix module autoloading Markuss Broks (1): ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK) Matteo Martelli (1): ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode Mohan Kumar (1): ASoC: tegra: Fix CBB error during probe() Srinivas Kandagatla (1): ASoC: codecs: lpass-va-macro: set the default codec version for sm8250 Zhang Yi (1): ASoC: mediatek: mt8188-mt6359: Modify key robelin (1): ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object include/sound/sof/topology.h | 2 +- include/uapi/sound/sof/abi.h | 2 +- sound/soc/amd/yc/acp6x-mach.c | 7 ++ sound/soc/codecs/chv3-codec.c | 1 + sound/soc/codecs/lpass-va-macro.c | 11 +- sound/soc/codecs/tda7419.c | 1 + sound/soc/google/chv3-i2s.c | 1 + sound/soc/intel/boards/bxt_rt298.c | 2 +- sound/soc/intel/boards/bytcht_cx2072x.c | 2 +- sound/soc/intel/boards/bytcht_da7213.c | 2 +- sound/soc/intel/boards/bytcht_es8316.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 2 +- sound/soc/intel/boards/bytcr_rt5651.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5645.c | 2 +- sound/soc/intel/boards/cht_bsw_rt5672.c | 2 +- sound/soc/intel/common/soc-acpi-intel-cht-match.c | 1 - sound/soc/intel/keembay/kmb_platform.c | 1 + sound/soc/mediatek/mt8188/mt8188-mt6359.c | 17 ++- sound/soc/soc-dapm.c | 1 + sound/soc/sof/topology.c | 2 + sound/soc/sunxi/sun4i-i2s.c | 143 +++++++++++----------- sound/soc/tegra/tegra210_ahub.c | 10 +- 23 files changed, 127 insertions(+), 91 deletions(-)

2 1

[PATCH] ASoC: Intel: skl_hda_dsp_generic: convert comma to semicolon
by Chen Ni 05 Sep '24

05 Sep '24

Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> --- sound/soc/intel/boards/skl_hda_dsp_generic.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c index 225867bb3310..8e104874d58c 100644 --- a/sound/soc/intel/boards/skl_hda_dsp_generic.c +++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c @@ -217,14 +217,14 @@ static int skl_hda_audio_probe(struct platform_device *pdev) return -ENOMEM; card = &ctx->card; - card->name = "hda-dsp", - card->owner = THIS_MODULE, - card->dai_link = skl_hda_be_dai_links, - card->dapm_widgets = skl_hda_widgets, - card->dapm_routes = skl_hda_map, - card->add_dai_link = skl_hda_add_dai_link, - card->fully_routed = true, - card->late_probe = skl_hda_card_late_probe, + card->name = "hda-dsp"; + card->owner = THIS_MODULE; + card->dai_link = skl_hda_be_dai_links; + card->dapm_widgets = skl_hda_widgets; + card->dapm_routes = skl_hda_map; + card->add_dai_link = skl_hda_add_dai_link; + card->fully_routed = true; + card->late_probe = skl_hda_card_late_probe; snd_soc_card_set_drvdata(card, ctx); -- 2.25.1

1 0

[PATCH 1/2 4.19.y] ALSA: usb-audio: Sanity checks for each pipe and EP types
by Takashi Iwai 05 Sep '24

05 Sep '24

[ Upstream commit 801ebf1043ae7b182588554cc9b9ad3c14bc2ab5 ] The recent USB core code performs sanity checks for the given pipe and EP types, and it can be hit by manipulated USB descriptors by syzbot. For making syzbot happier, this patch introduces a local helper for a sanity check in the driver side and calls it at each place before the message handling, so that we can avoid the WARNING splats. Reported-by: syzbot+d952e5e28f5fb7718d23(a)syzkaller.appspotmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> --- sound/usb/helper.c | 17 +++++++++++++++++ sound/usb/helper.h | 1 + sound/usb/quirks.c | 14 +++++++++++--- 3 files changed, 29 insertions(+), 3 deletions(-) diff --git a/sound/usb/helper.c b/sound/usb/helper.c index 7712e2b84183..b1cc9499c57e 100644 --- a/sound/usb/helper.c +++ b/sound/usb/helper.c @@ -76,6 +76,20 @@ void *snd_usb_find_csint_desc(void *buffer, int buflen, void *after, u8 dsubtype return NULL; } +/* check the validity of pipe and EP types */ +int snd_usb_pipe_sanity_check(struct usb_device *dev, unsigned int pipe) +{ + static const int pipetypes[4] = { + PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT + }; + struct usb_host_endpoint *ep; + + ep = usb_pipe_endpoint(dev, pipe); + if (usb_pipetype(pipe) != pipetypes[usb_endpoint_type(&ep->desc)]) + return -EINVAL; + return 0; +} + /* * Wrapper for usb_control_msg(). * Allocates a temp buffer to prevent dmaing from/to the stack. @@ -88,6 +102,9 @@ int snd_usb_ctl_msg(struct usb_device *dev, unsigned int pipe, __u8 request, void *buf = NULL; int timeout; + if (snd_usb_pipe_sanity_check(dev, pipe)) + return -EINVAL; + if (size > 0) { buf = kmemdup(data, size, GFP_KERNEL); if (!buf) diff --git a/sound/usb/helper.h b/sound/usb/helper.h index f5b4c6647e4d..5e8a18b4e7b9 100644 --- a/sound/usb/helper.h +++ b/sound/usb/helper.h @@ -7,6 +7,7 @@ unsigned int snd_usb_combine_bytes(unsigned char *bytes, int size); void *snd_usb_find_desc(void *descstart, int desclen, void *after, u8 dtype); void *snd_usb_find_csint_desc(void *descstart, int desclen, void *after, u8 dsubtype); +int snd_usb_pipe_sanity_check(struct usb_device *dev, unsigned int pipe); int snd_usb_ctl_msg(struct usb_device *dev, unsigned int pipe, __u8 request, __u8 requesttype, __u16 value, __u16 index, void *data, __u16 size); diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index 43cbaaff163f..087eef5e249d 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -743,11 +743,13 @@ static int snd_usb_novation_boot_quirk(struct usb_device *dev) static int snd_usb_accessmusic_boot_quirk(struct usb_device *dev) { int err, actual_length; - /* "midi send" enable */ static const u8 seq[] = { 0x4e, 0x73, 0x52, 0x01 }; + void *buf; - void *buf = kmemdup(seq, ARRAY_SIZE(seq), GFP_KERNEL); + if (snd_usb_pipe_sanity_check(dev, usb_sndintpipe(dev, 0x05))) + return -EINVAL; + buf = kmemdup(seq, ARRAY_SIZE(seq), GFP_KERNEL); if (!buf) return -ENOMEM; err = usb_interrupt_msg(dev, usb_sndintpipe(dev, 0x05), buf, @@ -772,7 +774,11 @@ static int snd_usb_accessmusic_boot_quirk(struct usb_device *dev) static int snd_usb_nativeinstruments_boot_quirk(struct usb_device *dev) { - int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), + int ret; + + if (snd_usb_pipe_sanity_check(dev, usb_sndctrlpipe(dev, 0))) + return -EINVAL; + ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), 0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE, 1, 0, NULL, 0, 1000); @@ -879,6 +885,8 @@ static int snd_usb_axefx3_boot_quirk(struct usb_device *dev) dev_dbg(&dev->dev, "Waiting for Axe-Fx III to boot up...\n"); + if (snd_usb_pipe_sanity_check(dev, usb_sndctrlpipe(dev, 0))) + return -EINVAL; /* If the Axe-Fx III has not fully booted, it will timeout when trying * to enable the audio streaming interface. A more generous timeout is * used here to detect when the Axe-Fx III has finished booting as the -- 2.45.2

4 4

[PATCH] ASoC: atmel: mchp-i2s-mcc: Improve maxburst calculation for better performance
by Andrei Simion 05 Sep '24

05 Sep '24

From: Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com> The period size represents the size of the DMA descriptor. To ensure all DMA descriptors start from a well-aligned address, the period size must be divided by (sample size * maxburst), not just by maxburst. This adjustment allows for computing a higher maxburst value, thereby increasing the performance of the DMA transfer. Previously, snd_pcm_lib_period_bytes() returned 0 because the runtime HW parameters are computed after the hw_params() callbacks are used. To address this, we now use params_*() functions to compute the period size accurately. This change optimizes the DMA transfer performance by ensuring proper alignment and efficient use of maxburst values. Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com> [andrei.simion(a)microchip.com: Reword commit message and commit title. Add macros with values for maximum DMA chunk size allowed. Add DMA_BURST_ALIGNED preprocessor function to check the alignment of the DMA burst] Signed-off-by: Andrei Simion <andrei.simion(a)microchip.com> --- sound/soc/atmel/mchp-i2s-mcc.c | 38 +++++++++++++++++++++++++++++----- 1 file changed, 33 insertions(+), 5 deletions(-) diff --git a/sound/soc/atmel/mchp-i2s-mcc.c b/sound/soc/atmel/mchp-i2s-mcc.c index 193dd7acceb0..35a56b266b8d 100644 --- a/sound/soc/atmel/mchp-i2s-mcc.c +++ b/sound/soc/atmel/mchp-i2s-mcc.c @@ -221,6 +221,15 @@ #define MCHP_I2SMCC_MAX_CHANNELS 8 #define MCHP_I2MCC_TDM_SLOT_WIDTH 32 +/* + * ---- DMA chunk size allowed ---- + */ +#define MCHP_I2SMCC_DMA_8_WORD_CHUNK 8 +#define MCHP_I2SMCC_DMA_4_WORD_CHUNK 4 +#define MCHP_I2SMCC_DMA_2_WORD_CHUNK 2 +#define MCHP_I2SMCC_DMA_1_WORD_CHUNK 1 +#define DMA_BURST_ALIGNED(_p, _s, _w) !(_p % (_s * _w)) + static const struct regmap_config mchp_i2s_mcc_regmap_config = { .reg_bits = 32, .reg_stride = 4, @@ -504,12 +513,30 @@ static int mchp_i2s_mcc_is_running(struct mchp_i2s_mcc_dev *dev) return !!(sr & (MCHP_I2SMCC_SR_TXEN | MCHP_I2SMCC_SR_RXEN)); } +static inline int mchp_i2s_mcc_period_to_maxburst(int period_size, int sample_size) +{ + int p_size = period_size; + int s_size = sample_size; + + if (DMA_BURST_ALIGNED(p_size, s_size, MCHP_I2SMCC_DMA_8_WORD_CHUNK)) + return MCHP_I2SMCC_DMA_8_WORD_CHUNK; + if (DMA_BURST_ALIGNED(p_size, s_size, MCHP_I2SMCC_DMA_4_WORD_CHUNK)) + return MCHP_I2SMCC_DMA_4_WORD_CHUNK; + if (DMA_BURST_ALIGNED(p_size, s_size, MCHP_I2SMCC_DMA_2_WORD_CHUNK)) + return MCHP_I2SMCC_DMA_2_WORD_CHUNK; + return MCHP_I2SMCC_DMA_1_WORD_CHUNK; +} + static int mchp_i2s_mcc_hw_params(struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params, struct snd_soc_dai *dai) { unsigned long rate = 0; struct mchp_i2s_mcc_dev *dev = snd_soc_dai_get_drvdata(dai); + int sample_bytes = params_physical_width(params) / 8; + int period_bytes = params_period_size(params) * + params_channels(params) * sample_bytes; + int maxburst; u32 mra = 0; u32 mrb = 0; unsigned int channels = params_channels(params); @@ -519,9 +546,9 @@ static int mchp_i2s_mcc_hw_params(struct snd_pcm_substream *substream, int ret; bool is_playback = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK); - dev_dbg(dev->dev, "%s() rate=%u format=%#x width=%u channels=%u\n", + dev_dbg(dev->dev, "%s() rate=%u format=%#x width=%u channels=%u period_bytes=%d\n", __func__, params_rate(params), params_format(params), - params_width(params), params_channels(params)); + params_width(params), params_channels(params), period_bytes); switch (dev->fmt & SND_SOC_DAIFMT_FORMAT_MASK) { case SND_SOC_DAIFMT_I2S: @@ -630,11 +657,12 @@ static int mchp_i2s_mcc_hw_params(struct snd_pcm_substream *substream, * We must have the same burst size configured * in the DMA transfer and in out IP */ - mrb |= MCHP_I2SMCC_MRB_DMACHUNK(channels); + maxburst = mchp_i2s_mcc_period_to_maxburst(period_bytes, sample_bytes); + mrb |= MCHP_I2SMCC_MRB_DMACHUNK(maxburst); if (is_playback) - dev->playback.maxburst = 1 << (fls(channels) - 1); + dev->playback.maxburst = maxburst; else - dev->capture.maxburst = 1 << (fls(channels) - 1); + dev->capture.maxburst = maxburst; switch (params_format(params)) { case SNDRV_PCM_FORMAT_S8: base-commit: fdadd93817f124fd0ea6ef251d4a1068b7feceba -- 2.34.1

1 0

[PATCH 2/2 4.19.y] ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check
by Hillf Danton 05 Sep '24

05 Sep '24

[ Upstream commit 5d78e1c2b7f4be00bbe62141603a631dc7812f35 ] syzbot found the following crash on: general protection fault: 0000 [#1] SMP KASAN RIP: 0010:snd_usb_pipe_sanity_check+0x80/0x130 sound/usb/helper.c:75 Call Trace: snd_usb_motu_microbookii_communicate.constprop.0+0xa0/0x2fb sound/usb/quirks.c:1007 snd_usb_motu_microbookii_boot_quirk sound/usb/quirks.c:1051 [inline] snd_usb_apply_boot_quirk.cold+0x163/0x370 sound/usb/quirks.c:1280 usb_audio_probe+0x2ec/0x2010 sound/usb/card.c:576 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 really_probe+0x281/0x650 drivers/base/dd.c:548 .... It was introduced in commit 801ebf1043ae for checking pipe and endpoint types. It is fixed by adding a check of the ep pointer in question. BugLink: https://syzkaller.appspot.com/bug?extid=d59c4387bfb6eced94e2 Reported-by: syzbot <syzbot+d59c4387bfb6eced94e2(a)syzkaller.appspotmail.com> Fixes: 801ebf1043ae ("ALSA: usb-audio: Sanity checks for each pipe and EP types") Cc: Andrey Konovalov <andreyknvl(a)google.com> Signed-off-by: Hillf Danton <hdanton(a)sina.com> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> --- sound/usb/helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/helper.c b/sound/usb/helper.c index b1cc9499c57e..029489b490ca 100644 --- a/sound/usb/helper.c +++ b/sound/usb/helper.c @@ -85,7 +85,7 @@ int snd_usb_pipe_sanity_check(struct usb_device *dev, unsigned int pipe) struct usb_host_endpoint *ep; ep = usb_pipe_endpoint(dev, pipe); - if (usb_pipetype(pipe) != pipetypes[usb_endpoint_type(&ep->desc)]) + if (!ep || usb_pipetype(pipe) != pipetypes[usb_endpoint_type(&ep->desc)]) return -EINVAL; return 0; } -- 2.45.2

1 0

[PATCH 0/2 4.19.y] ALSA: usb-audio: sanity checks for pipes
by Dan Carpenter 05 Sep '24

05 Sep '24

Backporting the sanity checks on pipes seems like a good idea. These are basically the same as Takashi Iwai's patches upstream. The difference is that upstream added two sanity checks to code that doesn't exist in 4.19. I had talked about backporting fcc2cc1f3561 ("USB: move snd_usb_pipe_sanity_check into the USB core") but that's just a refactor and not a bug fix. Hillf Danton (1): ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check Takashi Iwai (1): ALSA: usb-audio: Sanity checks for each pipe and EP types sound/usb/helper.c | 17 +++++++++++++++++ sound/usb/helper.h | 1 + sound/usb/quirks.c | 14 +++++++++++--- 3 files changed, 29 insertions(+), 3 deletions(-) -- 2.45.2

1 0