- Alsa-devel - mailman.alsa-project.org

[PATCH] ALSA: core: Fix double-free at snd_card_new()
by Takashi Iwai 19 Sep '22

19 Sep '22

During the code change to add the support for devres-managed card instance, we put an explicit kfree(card) call at the error path in snd_card_new(). This is needed for the early error path before the card is initialized with the device, but is rather superfluous and causes a double-free at the error path after the card instance is initialized, as the destructor of the card object already contains a kfree() call. This patch fixes the double-free situation by removing the superfluous kfree(). Meanwhile we need to call kfree() explicitly for the early error path, so it's added there instead. Fixes: e8ad415b7a55 ("ALSA: core: Add managed card creation") Reported-by: Rondreis <linhaoguo86(a)gmail.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/CAB7eexL1zBnB636hwS27d-LdPYZ_R1-5fJS_h=ZbCWYU=UPW… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/init.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/sound/core/init.c b/sound/core/init.c index 193dae361fac..5377f94eb211 100644 --- a/sound/core/init.c +++ b/sound/core/init.c @@ -178,10 +178,8 @@ int snd_card_new(struct device *parent, int idx, const char *xid, return -ENOMEM; err = snd_card_init(card, parent, idx, xid, module, extra_size); - if (err < 0) { - kfree(card); - return err; - } + if (err < 0) + return err; /* card is freed by error handler */ *card_ret = card; return 0; @@ -233,7 +231,7 @@ int snd_devm_card_new(struct device *parent, int idx, const char *xid, card->managed = true; err = snd_card_init(card, parent, idx, xid, module, extra_size); if (err < 0) { - devres_free(card); + devres_free(card); /* in managed mode, we need to free manually */ return err; } @@ -297,6 +295,8 @@ static int snd_card_init(struct snd_card *card, struct device *parent, mutex_unlock(&snd_card_mutex); dev_err(parent, "cannot find the slot for index %d (range 0-%i), error: %d\n", idx, snd_ecards_limit - 1, err); + if (!card->managed) + kfree(card); /* manually free here, as no destructor called */ return err; } set_bit(idx, snd_cards_lock); /* lock it */ -- 2.35.3

1 0

KASAN: invalid-free in snd_card_new
by Rondreis 19 Sep '22

19 Sep '22

Hello, When fuzzing the Linux kernel driver v6.0-rc4, the following crash was triggered. HEAD commit: 7e18e42e4b280c85b76967a9106a13ca61c16179 git tree: upstream kernel config: https://pastebin.com/raw/xtrgsXP3 C reproducer: https://pastebin.com/raw/w2sdQWYj console output: https://pastebin.com/raw/Yyf7zw2d Basically, in the c reproducer, we use the gadget module to emulate attaching a USB device(vendor id: 0x1bc7, product id: 0x1206, with the midi function) and executing some simple sequence of system calls. To reproduce this crash, we utilize a third-party library to emulate the attaching process: https://github.com/linux-usb-gadgets/libusbgx. Just clone this repository, install it, and compile the c reproducer with ``` gcc crash.c -lusbgx -lconfig -o crash ``` will do the trick. I would appreciate it if you have any idea how to solve this bug. The crash report is as follows: ================================================================== BUG: KASAN: double-free in snd_card_new+0xf9/0x130 sound/core/init.c:182 CPU: 1 PID: 7476 Comm: syz-executor.2 Not tainted 6.0.0-rc4+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0xe5/0x66d mm/kasan/report.c:433 kasan_report_invalid_free+0x5b/0x160 mm/kasan/report.c:462 ____kasan_slab_free mm/kasan/common.c:356 [inline] __kasan_slab_free+0x179/0x1b0 mm/kasan/common.c:375 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1754 [inline] slab_free_freelist_hook mm/slub.c:1780 [inline] slab_free mm/slub.c:3534 [inline] kfree+0xe9/0x650 mm/slub.c:4562 snd_card_new+0xf9/0x130 sound/core/init.c:182 snd_usb_audio_create sound/usb/card.c:621 [inline] usb_audio_probe+0x162a/0x2f10 sound/usb/card.c:797 usb_probe_interface+0x361/0x800 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xa90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 __device_attach_driver+0x1da/0x2d0 drivers/base/dd.c:936 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x283/0x480 drivers/base/dd.c:1008 proc_ioctl drivers/usb/core/devio.c:2356 [inline] proc_ioctl+0x5b4/0x6e0 drivers/usb/core/devio.c:2307 proc_ioctl_default drivers/usb/core/devio.c:2391 [inline] usbdev_do_ioctl drivers/usb/core/devio.c:2747 [inline] usbdev_ioctl+0x29a3/0x3340 drivers/usb/core/devio.c:2807 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f0dda8a80fd Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0ddaf63bf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f0dda99c340 RCX: 00007f0dda8a80fd RDX: 0000000020000900 RSI: 00000000c0105512 RDI: 0000000000000003 RBP: 00007f0ddaf63c50 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000d R13: 00007ffeb548e29f R14: 00007ffeb548e440 R15: 00007f0ddaf63d80 </TASK> Allocated by task 7476: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline] ____kasan_kmalloc mm/kasan/common.c:475 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525 kasan_kmalloc include/linux/kasan.h:234 [inline] __kmalloc+0x1da/0x3f0 mm/slub.c:4424 kmalloc include/linux/slab.h:605 [inline] kzalloc include/linux/slab.h:733 [inline] snd_card_new+0x78/0x130 sound/core/init.c:176 snd_usb_audio_create sound/usb/card.c:621 [inline] usb_audio_probe+0x162a/0x2f10 sound/usb/card.c:797 usb_probe_interface+0x361/0x800 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xa90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 __device_attach_driver+0x1da/0x2d0 drivers/base/dd.c:936 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x283/0x480 drivers/base/dd.c:1008 proc_ioctl drivers/usb/core/devio.c:2356 [inline] proc_ioctl+0x5b4/0x6e0 drivers/usb/core/devio.c:2307 proc_ioctl_default drivers/usb/core/devio.c:2391 [inline] usbdev_do_ioctl drivers/usb/core/devio.c:2747 [inline] usbdev_ioctl+0x29a3/0x3340 drivers/usb/core/devio.c:2807 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 7476: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:367 [inline] ____kasan_slab_free mm/kasan/common.c:329 [inline] __kasan_slab_free+0x11d/0x1b0 mm/kasan/common.c:375 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1754 [inline] slab_free_freelist_hook mm/slub.c:1780 [inline] slab_free mm/slub.c:3534 [inline] kfree+0xe9/0x650 mm/slub.c:4562 snd_card_do_free sound/core/init.c:605 [inline] release_card_device+0x1af/0x200 sound/core/init.c:145 device_release+0x9f/0x240 drivers/base/core.c:2330 kobject_cleanup lib/kobject.c:673 [inline] kobject_release lib/kobject.c:704 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1be/0x4c0 lib/kobject.c:721 put_device+0x1b/0x30 drivers/base/core.c:3624 snd_card_init+0x973/0xbd0 sound/core/init.c:367 snd_card_new+0xa1/0x130 sound/core/init.c:180 snd_usb_audio_create sound/usb/card.c:621 [inline] usb_audio_probe+0x162a/0x2f10 sound/usb/card.c:797 usb_probe_interface+0x361/0x800 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xa90 drivers/base/dd.c:639 __driver_probe_device+0x1df/0x4d0 drivers/base/dd.c:778 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:808 __device_attach_driver+0x1da/0x2d0 drivers/base/dd.c:936 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x283/0x480 drivers/base/dd.c:1008 proc_ioctl drivers/usb/core/devio.c:2356 [inline] proc_ioctl+0x5b4/0x6e0 drivers/usb/core/devio.c:2307 proc_ioctl_default drivers/usb/core/devio.c:2391 [inline] usbdev_do_ioctl drivers/usb/core/devio.c:2747 [inline] usbdev_ioctl+0x29a3/0x3340 drivers/usb/core/devio.c:2807 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff888041f54000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 0 bytes inside of 8192-byte region [ffff888041f54000, ffff888041f56000) The buggy address belongs to the physical page: page:ffffea000107d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x41f50 head:ffffea000107d400 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x4fff00000010200(slab|head|node=1|zone=1|lastcpupid=0x7ff) raw: 04fff00000010200 ffffea0001092200 dead000000000004 ffff888011c42280 raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 14941420612, free_ts 14728973666 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:2525 [inline] prep_new_page+0x2c6/0x350 mm/page_alloc.c:2532 get_page_from_freelist+0xae9/0x3a80 mm/page_alloc.c:4283 __alloc_pages+0x321/0x710 mm/page_alloc.c:5515 alloc_page_interleave+0x1e/0x250 mm/mempolicy.c:2103 alloc_pages+0x25f/0x2f0 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:1824 [inline] allocate_slab mm/slub.c:1969 [inline] new_slab+0x246/0x3a0 mm/slub.c:2029 ___slab_alloc+0xa50/0x1060 mm/slub.c:3031 __slab_alloc.isra.0+0x4d/0xa0 mm/slub.c:3118 slab_alloc_node mm/slub.c:3209 [inline] slab_alloc mm/slub.c:3251 [inline] __kmalloc+0x388/0x3f0 mm/slub.c:4420 kmalloc_array include/linux/slab.h:640 [inline] fb_show_logo_line drivers/video/fbdev/core/fbmem.c:491 [inline] fb_show_logo+0x1398/0x23c0 drivers/video/fbdev/core/fbmem.c:695 fbcon_switch+0xef7/0x12a0 drivers/video/fbdev/core/fbcon.c:2183 redraw_screen+0x2b9/0x740 drivers/tty/vt/vt.c:1021 con2fb_init_display drivers/video/fbdev/core/fbcon.c:806 [inline] set_con2fb_map+0x798/0xec0 drivers/video/fbdev/core/fbcon.c:865 do_fb_registered drivers/video/fbdev/core/fbcon.c:3012 [inline] fbcon_fb_registered+0x208/0x460 drivers/video/fbdev/core/fbcon.c:3028 do_register_framebuffer drivers/video/fbdev/core/fbmem.c:1696 [inline] register_framebuffer+0x545/0x910 drivers/video/fbdev/core/fbmem.c:1865 __drm_fb_helper_initial_config_and_unlock+0xdc6/0x1350 drivers/gpu/drm/drm_fb_helper.c:1910 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1449 [inline] free_pcp_prepare+0x5ab/0xd00 mm/page_alloc.c:1499 free_unref_page_prepare mm/page_alloc.c:3380 [inline] free_unref_page+0x19/0x410 mm/page_alloc.c:3476 __unfreeze_partials+0x3f3/0x410 mm/slub.c:2548 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x13d/0x180 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:447 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook+0x4d/0x4f0 mm/slab.h:727 slab_alloc_node mm/slub.c:3243 [inline] slab_alloc mm/slub.c:3251 [inline] __kmem_cache_alloc_lru mm/slub.c:3258 [inline] kmem_cache_alloc+0x151/0x360 mm/slub.c:3268 ptlock_alloc mm/memory.c:5774 [inline] ptlock_init include/linux/mm.h:2261 [inline] pmd_ptlock_init include/linux/mm.h:2347 [inline] pgtable_pmd_page_ctor include/linux/mm.h:2383 [inline] pmd_alloc_one include/asm-generic/pgalloc.h:129 [inline] __pmd_alloc+0xbf/0x5b0 mm/memory.c:5225 pmd_alloc include/linux/mm.h:2211 [inline] __handle_mm_fault+0x856/0x2e00 mm/memory.c:5013 handle_mm_fault+0x322/0xa80 mm/memory.c:5151 faultin_page mm/gup.c:990 [inline] __get_user_pages+0x5be/0x1250 mm/gup.c:1219 __get_user_pages_locked mm/gup.c:1423 [inline] __get_user_pages_remote mm/gup.c:2133 [inline] __get_user_pages_remote+0x196/0x810 mm/gup.c:2109 get_user_pages_remote+0x80/0xc0 mm/gup.c:2206 get_arg_page+0xe4/0x2a0 fs/exec.c:222 copy_string_kernel+0x16d/0x4f0 fs/exec.c:639 Memory state around the buggy address: ffff888041f53f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888041f53f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888041f54000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888041f54080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888041f54100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

2 4

[PATCH] ALSA: hda/realtek: Add a quirk for HP OMEN 16 (8902) mute LED
by Daniel Houldsworth 19 Sep '22

19 Sep '22

Similair to the HP OMEN 15, the HP OMEN 16 also needs ALC285_FIXUP_HP_MUTE_LED for the mute LED to work. Signed-off-by: Daniel Houldsworth <dhould3(a)gmail.com> --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 38930cf5a..c7d07d6df 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -9265,6 +9265,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { SND_PCI_QUIRK(0x103c, 0x8786, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED), SND_PCI_QUIRK(0x103c, 0x8787, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED), SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED), SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x87e7, "HP ProBook 450 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), -- 2.37.3

2 1

[PATCH v2 0/3] sound: realtek: add quirks for ASUS G513, G533Z, GA503R
by Luke D. Jones 19 Sep '22

19 Sep '22

This series adds quirks to fix pincfg for the ASUS ROG G513 and G533Z laptops, and adds a mapping for the ASUS ROG GA503R to use the previous G15/G14 quirks which fix the DAC mapping. Changelog: V2: - Use smallcaps in hex string - Chain the G533Z quirk with the G513 quirk as they use the same base pincfg - Add the quirk for GA503R series to use GA401 quirk Luke D. Jones (3): sound: realtek: Add pincfg for ASUS G513 HP jack sound: realtek: Add pincfg for ASUS G533Z HP jack sound: realtek: Add quirk for ASUS GA503R laptop sound/pci/hda/patch_realtek.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) -- 2.37.3

3 6

USB-Audio: Motu M4: no duplex profile
by GitHub issues - opened 19 Sep '22

19 Sep '22

alsa-project/alsa-ucm-conf issue #214 was opened from pisquaredover6: I have compiled alsa-ucm-conf v1.2.7.2 with the patches [3a6acaa5090a0c5a0d29c8a4906b6a60378774e2](https://github.com/alsa-project/a… and [ad1618cdd33f5c78ee1a0a9d3db362ffcb9f2596](https://github.com/alsa-project/a…. With this, I have simplex audio, but no duplex profiles any more. Is there any chance we can add a duplex profile, as it used to be the case before alsa-ucm-conf introduced the M4? Issue URL : https://github.com/alsa-project/alsa-ucm-conf/issues/214 Repository URL: https://github.com/alsa-project/alsa-ucm-conf

1 0

[PATCH] ASoC: amd: yc: Add ASUS UM5302TA into DMI table
by Xiaoyan Li 17 Sep '22

17 Sep '22

ASUS Zenbook S 13 OLED (UM5302TA) needs this quirk to get the built-in microphone working properly. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216270 Signed-off-by: Xiaoyan Li <lxy.lixiaoyan(a)gmail.com> --- sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c index e0b24e1daef3..5eab3baf3573 100644 --- a/sound/soc/amd/yc/acp6x-mach.c +++ b/sound/soc/amd/yc/acp6x-mach.c @@ -171,6 +171,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "21J6"), } }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "UM5302TA"), + } + }, {} }; -- 2.37.3

2 1

[PATCH -next 1/2] ALSA: mts64: Switch to use list_for_each_entry() helper
by Yang Yingliang 17 Sep '22

17 Sep '22

Use list_for_each_entry() helper instead of list_for_each() and list_entry() to simplify code a bit. No functional change. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- sound/drivers/mts64.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c index d3bc9e8c407d..746ac25a319e 100644 --- a/sound/drivers/mts64.c +++ b/sound/drivers/mts64.c @@ -752,7 +752,6 @@ static int snd_mts64_rawmidi_create(struct snd_card *card) struct mts64 *mts = card->private_data; struct snd_rawmidi *rmidi; struct snd_rawmidi_substream *substream; - struct list_head *list; int err; err = snd_rawmidi_new(card, CARD_NAME, 0, @@ -778,16 +777,16 @@ static int snd_mts64_rawmidi_create(struct snd_card *card) /* name substreams */ /* output */ - list_for_each(list, - &rmidi->streams[SNDRV_RAWMIDI_STREAM_OUTPUT].substreams) { - substream = list_entry(list, struct snd_rawmidi_substream, list); + list_for_each_entry(substream, + &rmidi->streams[SNDRV_RAWMIDI_STREAM_OUTPUT].substreams, + list) { sprintf(substream->name, "Miditerminal %d", substream->number+1); } /* input */ - list_for_each(list, - &rmidi->streams[SNDRV_RAWMIDI_STREAM_INPUT].substreams) { - substream = list_entry(list, struct snd_rawmidi_substream, list); + list_for_each_entry(substream, + &rmidi->streams[SNDRV_RAWMIDI_STREAM_INPUT].substreams, + list) { mts->midi_input_substream[substream->number] = substream; switch(substream->number) { case MTS64_SMPTE_SUBSTREAM: -- 2.25.1

1 1

[PATCH -next] ALSA: ppc: Switch to use for_each_child_of_node() macro
by Yang Yingliang 17 Sep '22

17 Sep '22

Use for_each_child_of_node() macro instead of open coding it. No functional change. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- sound/ppc/tumbler.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c index c65e74d7cd0a..f3f8ad7c3df8 100644 --- a/sound/ppc/tumbler.c +++ b/sound/ppc/tumbler.c @@ -1060,8 +1060,7 @@ static struct device_node *find_audio_device(const char *name) if (! gpiop) return NULL; - for (np = of_get_next_child(gpiop, NULL); np; - np = of_get_next_child(gpiop, np)) { + for_each_child_of_node(gpiop, np) { const char *property = of_get_property(np, "audio-gpio", NULL); if (property && strcmp(property, name) == 0) break; @@ -1080,8 +1079,7 @@ static struct device_node *find_compatible_audio_device(const char *name) if (!gpiop) return NULL; - for (np = of_get_next_child(gpiop, NULL); np; - np = of_get_next_child(gpiop, np)) { + for_each_child_of_node(gpiop, np) { if (of_device_is_compatible(np, name)) break; } -- 2.25.1

2 1

[bug report] ASoC: rockchip: i2s: use regmap_read_poll_timeout to poll I2S_CLR
by Dan Carpenter 16 Sep '22

16 Sep '22

Hello Judy Hsiao, The patch fbb0ec656ee5: "ASoC: rockchip: i2s: use regmap_read_poll_timeout to poll I2S_CLR" from Sep 14, 2022, leads to the following Smatch static checker warning: sound/soc/rockchip/rockchip_i2s.c:165 rockchip_snd_txctrl() warn: sleeping in atomic context sound/soc/rockchip/rockchip_i2s.c 126 static int rockchip_snd_txctrl(struct rk_i2s_dev *i2s, int on) 127 { 128 unsigned int val = 0; 129 int ret = 0; 130 131 spin_lock(&i2s->lock); ^^^^^^^^^^^^^^^^^^^^^ Holding a spin lock. 132 if (on) { 133 ret = regmap_update_bits(i2s->regmap, I2S_DMACR, 134 I2S_DMACR_TDE_ENABLE, 135 I2S_DMACR_TDE_ENABLE); 136 if (ret < 0) 137 goto end; 138 ret = regmap_update_bits(i2s->regmap, I2S_XFER, 139 I2S_XFER_TXS_START | I2S_XFER_RXS_START, 140 I2S_XFER_TXS_START | I2S_XFER_RXS_START); 141 if (ret < 0) 142 goto end; 143 i2s->tx_start = true; 144 } else { 145 i2s->tx_start = false; 146 147 ret = regmap_update_bits(i2s->regmap, I2S_DMACR, 148 I2S_DMACR_TDE_ENABLE, 149 I2S_DMACR_TDE_DISABLE); 150 if (ret < 0) 151 goto end; 152 153 if (!i2s->rx_start) { 154 ret = regmap_update_bits(i2s->regmap, I2S_XFER, 155 I2S_XFER_TXS_START | I2S_XFER_RXS_START, 156 I2S_XFER_TXS_STOP | I2S_XFER_RXS_STOP); 157 if (ret < 0) 158 goto end; 159 udelay(150); 160 ret = regmap_update_bits(i2s->regmap, I2S_CLR, 161 I2S_CLR_TXC | I2S_CLR_RXC, 162 I2S_CLR_TXC | I2S_CLR_RXC); 163 if (ret < 0) 164 goto end; --> 165 ret = regmap_read_poll_timeout(i2s->regmap, 166 I2S_CLR, 167 val, 168 val != 0, 169 20, ^^ 170 200); ^^^ If the sleep_us or timeout_us values are non-zero then it can sleep so it's a sleeping in atomic bug. 171 if (ret < 0) 172 dev_warn(i2s->dev, "fail to clear: %d\n", ret); 173 } 174 } 175 end: 176 spin_unlock(&i2s->lock); 177 if (ret < 0) 178 dev_err(i2s->dev, "lrclk update failed\n"); 179 180 return ret; 181 } regards, dan carpenter

1 1

[PATCH] soundwire: qcom: update status from device id 1
by Srinivas Kandagatla 16 Sep '22

16 Sep '22

By default autoenumeration is enabled on QCom SoundWire controller which means the core should not be dealing with device 0 w.r.t enumeration. Currently device 0 status is also shared with SoundWire core which confuses the core sometimes and we endup adding 0:0:0:0 slave device. Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> --- drivers/soundwire/qcom.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c index e21a3306bf01..871e4d8b32c7 100644 --- a/drivers/soundwire/qcom.c +++ b/drivers/soundwire/qcom.c @@ -428,7 +428,7 @@ static int qcom_swrm_get_alert_slave_dev_num(struct qcom_swrm_ctrl *ctrl) ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val); - for (dev_num = 0; dev_num <= SDW_MAX_DEVICES; dev_num++) { + for (dev_num = 1; dev_num <= SDW_MAX_DEVICES; dev_num++) { status = (val >> (dev_num * SWRM_MCP_SLV_STATUS_SZ)); if ((status & SWRM_MCP_SLV_STATUS_MASK) == SDW_SLAVE_ALERT) { @@ -448,7 +448,7 @@ static void qcom_swrm_get_device_status(struct qcom_swrm_ctrl *ctrl) ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &val); ctrl->slave_status = val; - for (i = 0; i <= SDW_MAX_DEVICES; i++) { + for (i = 1; i <= SDW_MAX_DEVICES; i++) { u32 s; s = (val >> (i * 2)); -- 2.21.0

2 5