- Alsa-devel - mailman.alsa-project.org

A new null-ptr-deref Write bug in snd_pcm_format_set_silence
by butt3rflyh4ck 05 Sep '22

05 Sep '22

Hi, there is a new null-ptr-deref Write bug in snd_pcm_format_set_slience in sound/core/pcm_misc.c in the latest upstream kernel and can reproduce it. We call SNDCTL_DSP_SYNC and SNDCTL_DSP_SPEED in multiple threads to trigger the vulnerability. See the Call Trace: ================================================================== Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memset+0x20/0x40 mm/kasan/shadow.c:44 snd_pcm_format_set_silence sound/core/pcm_misc.c:441 [inline] snd_pcm_format_set_silence+0x215/0x350 sound/core/pcm_misc.c:424 snd_pcm_oss_sync+0x60e/0x800 sound/core/oss/pcm_oss.c:1690 snd_pcm_oss_ioctl+0x2087/0x3420 sound/core/oss/pcm_oss.c:2634 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ================================================================== We can see the function snd_pcm_format_set_silence code below: ``` int snd_pcm_format_set_silence(snd_pcm_format_t format, void *data, unsigned int samples) { int width; unsigned char *dst; const unsigned char *pat; if (!valid_format(format)) return -EINVAL; if (samples == 0) return 0; width = pcm_formats[(INT)format].phys; /* physical width */ pat = pcm_formats[(INT)format].silence; if (!width || !pat) return -EINVAL; /* signed or 1 byte data */ if (pcm_formats[(INT)format].signd == 1 || width <= 8) { unsigned int bytes = samples * width / 8; memset(data, *pat, bytes); ///// [1] ---------> data is NULL return 0; } ...... } ``` [1], the data pointer is NULL, we can know snd_pcm_format_set_silence called in line 1690 in sound/core/oss/pcm_oss.c from call stack trace. let we see code below: ``` static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) { int err = 0; unsigned int saved_f_flags; struct snd_pcm_substream *substream; struct snd_pcm_runtime *runtime; snd_pcm_format_t format; unsigned long width; size_t size; substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; if (substream != NULL) { runtime = substream->runtime; if (atomic_read(&substream->mmap_count)) goto __direct; err = snd_pcm_oss_make_ready(substream); if (err < 0) return err; atomic_inc(&runtime->oss.rw_ref); if (mutex_lock_interruptible(&runtime->oss.params_lock)) { atomic_dec(&runtime->oss.rw_ref); return -ERESTARTSYS; } format = snd_pcm_oss_format_from(runtime->oss.format); width = snd_pcm_format_physical_width(format); if (runtime->oss.buffer_used > 0) { #ifdef OSS_DEBUG pcm_dbg(substream->pcm, "sync: buffer_used\n"); #endif size = (8 * (runtime->oss.period_bytes - runtime->oss.buffer_used) + 7) / width; snd_pcm_format_set_silence(format, runtime->oss.buffer + runtime->oss.buffer_used, ///// [2] size); err = snd_pcm_oss_sync1(substream, runtime->oss.period_bytes); if (err < 0) goto unlock; } else if (runtime->oss.period_ptr > 0) { ``` [2] runtime->oss.buffer + runtime->oss.buffer_used is the data pointer, but runtime->oss.buffer is NULL here but it doesn't make sense. runtime->oss.buffter is allocated by kvzalloc, if runtime->oss_buffer is NULL, it would return an ENOMEM error. Maybe I think there is a race condition, the runtime->oss.buffer is freed and set to NULL but we can use runtime->oss.buffter via ioctl. ###reproduce it [ 167.258988][T25615] ================================================================== [ 167.265917][T25615] BUG: KASAN: null-ptr-deref in snd_pcm_format_set_silence+0x215/0x350 [ 167.266704][T25615] Write of size 16383 at addr 0000000000000001 by task snd_pcm_format_/25615 [ 167.267506][T25615] [ 167.267732][T25615] CPU: 0 PID: 25615 Comm: snd_pcm_format_ Not tainted 6.0.0-rc3-00299-gd895ec7938c4 #11 [ 167.268617][T25615] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 167.269410][T25615] Call Trace: [ 167.269697][T25615] <TASK> [ 167.269977][T25615] dump_stack_lvl+0xcd/0x134 [ 167.270428][T25615] ? snd_pcm_format_set_silence+0x215/0x350 [ 167.270985][T25615] kasan_report+0xb1/0x1e0 [ 167.271405][T25615] ? snd_pcm_format_set_silence+0x215/0x350 [ 167.271964][T25615] kasan_check_range+0x13d/0x180 [ 167.272440][T25615] memset+0x20/0x40 [ 167.272809][T25615] snd_pcm_format_set_silence+0x215/0x350 [ 167.273366][T25615] snd_pcm_oss_sync+0x60e/0x800 [ 167.273831][T25615] snd_pcm_oss_ioctl+0x2087/0x3420 [ 167.274320][T25615] ? snd_pcm_oss_release+0x300/0x300 [ 167.274817][T25615] ? __fget_files+0x26a/0x440 [ 167.275262][T25615] ? bpf_lsm_file_ioctl+0x5/0x10 [ 167.275731][T25615] ? snd_pcm_oss_release+0x300/0x300 [ 167.276222][T25615] __x64_sys_ioctl+0x193/0x200 [ 167.276677][T25615] do_syscall_64+0x35/0xb0 [ 167.277108][T25615] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 167.277679][T25615] RIP: 0033:0x44af9d [ 167.278058][T25615] Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff 8 [ 167.279792][T25615] RSP: 002b:00007f0cb636a178 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 167.280546][T25615] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044af9d [ 167.281285][T25615] RDX: 0000000000000000 RSI: 0000000000005001 RDI: 0000000000000003 [ 167.282001][T25615] RBP: 00007f0cb636a1a0 R08: 0000000000000000 R09: 0000000000000000 [ 167.282715][T25615] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcfea8e08e [ 167.283432][T25615] R13: 00007ffcfea8e08f R14: 0000000000000000 R15: 00007f0cb636a640 [ 167.284164][T25615] </TASK> [ 167.284453][T25615] ================================================================== If needed I would provide a reproduce. Regards, butt3rflyh4ck. -- Active Defense Lab of Venustech

2 3

[PATCH] ALSA: usb-audio: Register card at the last interface
by Takashi Iwai 04 Sep '22

04 Sep '22

The USB-audio driver matches per interface, and as default, it registers the card instance at the very first instance. This can be a problem for the devices that have multiple interfaces to be probed, as the udev rule isn't applied properly for the later appearing interfaces. Although we introduced the delayed_register option and the quirks for covering those shortcomings, it's nothing but a workaround for specific devices. This patch is an another attempt to fix the problem in a more generic way. Now the driver checks the whole USB device descriptor at the very first time when an interface is attached to a sound card. It looks at each matching interface in the descriptor and remembers the last matching one. The snd_card_register() is invoked only when this last interface is probed. After this change, the quirks for the delayed registration become superfluous, hence they are removed along with the patch. OTOH, the delayed_register option is still kept, as it might be useful for some corner cases (e.g. a special driver overtakes the interface probe from the standard driver, and the last interface probe may miss). Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/usb/card.c | 32 +++++++++++++++++++++++++------- sound/usb/quirks.c | 42 ------------------------------------------ sound/usb/quirks.h | 2 -- sound/usb/usbaudio.h | 1 + 4 files changed, 26 insertions(+), 51 deletions(-) diff --git a/sound/usb/card.c b/sound/usb/card.c index 706d249a9ad6..3aea241435fb 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -690,7 +690,7 @@ static bool get_alias_id(struct usb_device *dev, unsigned int *id) return false; } -static bool check_delayed_register_option(struct snd_usb_audio *chip, int iface) +static int check_delayed_register_option(struct snd_usb_audio *chip) { int i; unsigned int id, inum; @@ -699,14 +699,31 @@ static bool check_delayed_register_option(struct snd_usb_audio *chip, int iface) if (delayed_register[i] && sscanf(delayed_register[i], "%x:%x", &id, &inum) == 2 && id == chip->usb_id) - return iface < inum; + return inum; } - return false; + return -1; } static const struct usb_device_id usb_audio_ids[]; /* defined below */ +/* look for the last interface that matches with our ids and remember it */ +static void find_last_interface(struct snd_usb_audio *chip) +{ + struct usb_host_config *config = chip->dev->actconfig; + struct usb_interface *intf; + int i; + + if (!config) + return; + for (i = 0; i < config->desc.bNumInterfaces; i++) { + intf = config->interface[i]; + if (usb_match_id(intf, usb_audio_ids)) + chip->last_iface = intf->altsetting[0].desc.bInterfaceNumber; + } + usb_audio_dbg(chip, "Found last interface = %d\n", chip->last_iface); +} + /* look for the corresponding quirk */ static const struct snd_usb_audio_quirk * get_alias_quirk(struct usb_device *dev, unsigned int id) @@ -813,6 +830,7 @@ static int usb_audio_probe(struct usb_interface *intf, err = -ENODEV; goto __error; } + find_last_interface(chip); } if (chip->num_interfaces >= MAX_CARD_INTERFACES) { @@ -862,11 +880,11 @@ static int usb_audio_probe(struct usb_interface *intf, chip->need_delayed_register = false; /* clear again */ } - /* we are allowed to call snd_card_register() many times, but first - * check to see if a device needs to skip it or do anything special + /* register card if we reach to the last interface or to the specified + * one given via option */ - if (!snd_usb_registration_quirk(chip, ifnum) && - !check_delayed_register_option(chip, ifnum)) { + if (check_delayed_register_option(chip) == ifnum || + chip->last_iface == ifnum) { err = snd_card_register(chip->card); if (err < 0) goto __error; diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index 5b4d8f5eade2..8c3b0be909eb 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -1728,48 +1728,6 @@ void snd_usb_audioformat_attributes_quirk(struct snd_usb_audio *chip, } } -/* - * registration quirk: - * the registration is skipped if a device matches with the given ID, - * unless the interface reaches to the defined one. This is for delaying - * the registration until the last known interface, so that the card and - * devices appear at the same time. - */ - -struct registration_quirk { - unsigned int usb_id; /* composed via USB_ID() */ - unsigned int interface; /* the interface to trigger register */ -}; - -#define REG_QUIRK_ENTRY(vendor, product, iface) \ - { .usb_id = USB_ID(vendor, product), .interface = (iface) } - -static const struct registration_quirk registration_quirks[] = { - REG_QUIRK_ENTRY(0x0951, 0x16d8, 2), /* Kingston HyperX AMP */ - REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */ - REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ - REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ - REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */ - REG_QUIRK_ENTRY(0x0ecb, 0x1f4c, 2), /* JBL Quantum 400 */ - REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ - REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ - REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ - { 0 } /* terminator */ -}; - -/* return true if skipping registration */ -bool snd_usb_registration_quirk(struct snd_usb_audio *chip, int iface) -{ - const struct registration_quirk *q; - - for (q = registration_quirks; q->usb_id; q++) - if (chip->usb_id == q->usb_id) - return iface < q->interface; - - /* Register as normal */ - return false; -} - /* * driver behavior quirk flags */ diff --git a/sound/usb/quirks.h b/sound/usb/quirks.h index 31abb7cb01a5..f9bfd5ac7bab 100644 --- a/sound/usb/quirks.h +++ b/sound/usb/quirks.h @@ -48,8 +48,6 @@ void snd_usb_audioformat_attributes_quirk(struct snd_usb_audio *chip, struct audioformat *fp, int stream); -bool snd_usb_registration_quirk(struct snd_usb_audio *chip, int iface); - void snd_usb_init_quirk_flags(struct snd_usb_audio *chip); #endif /* __USBAUDIO_QUIRKS_H */ diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h index ffbb4b0d09a0..2c6575029b1c 100644 --- a/sound/usb/usbaudio.h +++ b/sound/usb/usbaudio.h @@ -37,6 +37,7 @@ struct snd_usb_audio { unsigned int quirk_flags; unsigned int need_delayed_register:1; /* warn for delayed registration */ int num_interfaces; + int last_iface; int num_suspended_intf; int sample_rate_read_error; -- 2.35.3

1 0

[PATCH v5 0/2] lib/string_helpers: Introduce parse_int_array_user()
by Cezary Rojewski 04 Sep '22

04 Sep '22

Continuation of recent upstream discussion [1] regarding user string tokenization. First, parse_int_array_user() is introduced to allow for splitting specified user string into a sequence of integers. Makes use of get_options() internally so the parsing logic is not duplicated. With that done, redundant parts of the sound driver are removed. Originally similar functionality was added for the SOF sound driver. As more users are on the horizon, it is desirable to update existing string_helpers code and provide a unified solution. Changes in v5: - fixed kernel doc for parse_int_array_user() Changes in v4: - renamed the function to parse_int_array_user() - at the name several local variable names have been reworded to match the above Changes in v3: - relocated tokenize_user_input() implementation to string_helpers as requested by Matthew Changes in v2: - reused get_options() so no parsing logic is duplicated - simplified __user variant with help of memdup_user_nul() Both suggested by Andy, thanks for thorough review [1]: https://lore.kernel.org/alsa-devel/20220707091301.1282291-1-cezary.rojewski… Cezary Rojewski (2): lib/string_helpers: Introduce parse_int_array_user() ASoC: SOF: Remove strsplit_u32() and tokenize_input() include/linux/string_helpers.h | 2 + lib/string_helpers.c | 44 +++++++++++++ sound/soc/sof/sof-client-probes.c | 104 ++++++------------------------ 3 files changed, 64 insertions(+), 86 deletions(-) -- 2.25.1

2 6

[PATCH] ALSA: hda/sigmatel: Keep power up while beep is enabled
by Takashi Iwai 04 Sep '22

04 Sep '22

It seems that the beep playback doesn't work well on IDT codec devices when the codec auto-pm is enabled. Keep the power on while the beep switch is enabled. Link: https://bugzilla.suse.com/show_bug.cgi?id=1200544 Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/pci/hda/patch_sigmatel.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c index 61df4d33c48f..066bfccd2587 100644 --- a/sound/pci/hda/patch_sigmatel.c +++ b/sound/pci/hda/patch_sigmatel.c @@ -209,6 +209,7 @@ struct sigmatel_spec { /* beep widgets */ hda_nid_t anabeep_nid; + bool beep_power_on; /* SPDIF-out mux */ const char * const *spdif_labels; @@ -4443,6 +4444,26 @@ static int stac_suspend(struct hda_codec *codec) return 0; } + +static int stac_check_power_status(struct hda_codec *codec, hda_nid_t nid) +{ + struct sigmatel_spec *spec = codec->spec; + int ret = snd_hda_gen_check_power_status(codec, nid); + +#ifdef CONFIG_SND_HDA_INPUT_BEEP + if (nid == spec->gen.beep_nid && codec->beep) { + if (codec->beep->enabled != spec->beep_power_on) { + spec->beep_power_on = codec->beep->enabled; + if (spec->beep_power_on) + snd_hda_power_up_pm(codec); + else + snd_hda_power_down_pm(codec); + } + ret |= spec->beep_power_on; + } +#endif + return ret; +} #else #define stac_suspend NULL #endif /* CONFIG_PM */ @@ -4455,6 +4476,7 @@ static const struct hda_codec_ops stac_patch_ops = { .unsol_event = snd_hda_jack_unsol_event, #ifdef CONFIG_PM .suspend = stac_suspend, + .check_power_status = stac_check_power_status, #endif }; -- 2.35.3

1 0

[PATCH v2] ASoC: rsnd: Add check for rsnd_mod_power_on
by Jiasheng Jiang 02 Sep '22

02 Sep '22

As rsnd_mod_power_on() can return negative numbers, it should be better to check the return value and deal with the exception. Fixes: e7d850dd10f4 ("ASoC: rsnd: use mod base common method on SSI-parent") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> --- Changelog: v1 -> v2: 1. Add check for rsnd_mod_power_on in other files. --- sound/soc/sh/rcar/ctu.c | 6 +++++- sound/soc/sh/rcar/dvc.c | 6 +++++- sound/soc/sh/rcar/mix.c | 6 +++++- sound/soc/sh/rcar/src.c | 5 ++++- sound/soc/sh/rcar/ssi.c | 4 +++- 5 files changed, 22 insertions(+), 5 deletions(-) diff --git a/sound/soc/sh/rcar/ctu.c b/sound/soc/sh/rcar/ctu.c index 6156445bcb69..e39eb2ac7e95 100644 --- a/sound/soc/sh/rcar/ctu.c +++ b/sound/soc/sh/rcar/ctu.c @@ -171,7 +171,11 @@ static int rsnd_ctu_init(struct rsnd_mod *mod, struct rsnd_dai_stream *io, struct rsnd_priv *priv) { - rsnd_mod_power_on(mod); + int ret; + + ret = rsnd_mod_power_on(mod); + if (ret < 0) + return ret; rsnd_ctu_activation(mod); diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c index 5137e03a9d7c..16befcbc312c 100644 --- a/sound/soc/sh/rcar/dvc.c +++ b/sound/soc/sh/rcar/dvc.c @@ -186,7 +186,11 @@ static int rsnd_dvc_init(struct rsnd_mod *mod, struct rsnd_dai_stream *io, struct rsnd_priv *priv) { - rsnd_mod_power_on(mod); + int ret; + + ret = rsnd_mod_power_on(mod); + if (ret < 0) + return ret; rsnd_dvc_activation(mod); diff --git a/sound/soc/sh/rcar/mix.c b/sound/soc/sh/rcar/mix.c index 3572c2c5686c..1de0e085804c 100644 --- a/sound/soc/sh/rcar/mix.c +++ b/sound/soc/sh/rcar/mix.c @@ -146,7 +146,11 @@ static int rsnd_mix_init(struct rsnd_mod *mod, struct rsnd_dai_stream *io, struct rsnd_priv *priv) { - rsnd_mod_power_on(mod); + int ret; + + ret = rsnd_mod_power_on(mod); + if (ret < 0) + return ret; rsnd_mix_activation(mod); diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c index 0ea84ae57c6a..f832165e46bc 100644 --- a/sound/soc/sh/rcar/src.c +++ b/sound/soc/sh/rcar/src.c @@ -463,11 +463,14 @@ static int rsnd_src_init(struct rsnd_mod *mod, struct rsnd_priv *priv) { struct rsnd_src *src = rsnd_mod_to_src(mod); + int ret; /* reset sync convert_rate */ src->sync.val = 0; - rsnd_mod_power_on(mod); + ret = rsnd_mod_power_on(mod); + if (ret < 0) + return ret; rsnd_src_activation(mod); diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c index 43c5e27dc5c8..7ade6c5ed96f 100644 --- a/sound/soc/sh/rcar/ssi.c +++ b/sound/soc/sh/rcar/ssi.c @@ -480,7 +480,9 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, ssi->usrcnt++; - rsnd_mod_power_on(mod); + ret = rsnd_mod_power_on(mod); + if (ret < 0) + return ret; rsnd_ssi_config_init(mod, io); -- 2.25.1

3 2

[PATCH v4 0/2] lib/string_helpers: Introduce parse_int_array_user()
by Cezary Rojewski 02 Sep '22

02 Sep '22

Continuation of recent upstream discussion [1] regarding user string tokenization. First, parse_int_array_user() is introduced to allow for splitting specified user string into a sequence of integers. Makes use of get_options() internally so the parsing logic is not duplicated. With that done, redundant parts of the sound driver are removed. Originally similar functionality was added for the SOF sound driver. As more users are on the horizon, it is desirable to update existing string_helpers code and provide a unified solution. Changes in v4: - renamed the function to parse_int_array_user() - at the name several local variable names have been reworded to match the above Changes in v3: - relocated tokenize_user_input() implementation to string_helpers as requested by Matthew Changes in v2: - reused get_options() so no parsing logic is duplicated - simplified __user variant with help of memdup_user_nul() Both suggested by Andy, thanks for thourough review [1]: https://lore.kernel.org/alsa-devel/20220707091301.1282291-1-cezary.rojewski… Cezary Rojewski (2): lib/string_helpers: Introduce parse_int_array_user() ASoC: SOF: Remove strsplit_u32() and tokenize_input() include/linux/string_helpers.h | 2 + lib/string_helpers.c | 45 +++++++++++++ sound/soc/sof/sof-client-probes.c | 104 ++++++------------------------ 3 files changed, 65 insertions(+), 86 deletions(-) -- 2.25.1

2 4

[PATCH v3 0/2] lib/string_helpers: Introduce tokenize_user_input()
by Cezary Rojewski 02 Sep '22

02 Sep '22

Continuation of recent upstream discussion [1] regarding user string tokenization. First, tokenize_user_input() is introduced to allow for splitting specified user string into a sequence of integers. Makes use of get_options() internally so the parsing logic is not duplicated. With that done, redundant parts of the sound driver are removed. Originally similar functionality was added for the SOF sound driver. As more users are on the horizon, it is desirable to update existing string_helpers code and provide a unified solution. Changes in v3: - relocated tokenize_user_input() implementation to string_helpers as requested by Matthew Changes in v2: - reused get_options() so no parsing logic is duplicated - simplified __user variant with help of memdup_user_nul() Both suggested by Andy, thanks for thourough review [1]: https://lore.kernel.org/alsa-devel/20220707091301.1282291-1-cezary.rojewski… Cezary Rojewski (2): lib/string_helpers: Introduce tokenize_user_input() ASoC: SOF: Remove strsplit_u32() and tokenize_input() include/linux/string_helpers.h | 2 + lib/string_helpers.c | 45 +++++++++++++++ sound/soc/sof/sof-client-probes.c | 93 ++++--------------------------- 3 files changed, 59 insertions(+), 81 deletions(-) -- 2.25.1

2 7

[PATCH v2 0/2] Introduce sof_of_machine_select
by Chunxu Li 02 Sep '22

02 Sep '22

From: "chunxu.li" <chunxu.li(a)mediatek.com> Change since v1: - remove the callback of_machine_select defined in sof-priv.h - move sof_of_machine_select to common code, and called in sof_machine_check - rename .board field to .compatible in structure snd_sof_of_mach In these patches, we introduce function sof_of_machine_select for SOF Chunxu Li (2): ASoC: SOF: Introduce function sof_of_machine_select ASoC: SOF: mediatek: Add sof_mt8186_machs for mt8186 include/sound/sof.h | 2 ++ sound/soc/sof/mediatek/mt8186/mt8186.c | 9 ++++++++ sound/soc/sof/pcm.c | 8 ++++++- sound/soc/sof/sof-audio.c | 30 ++++++++++++++++++++++++++ sound/soc/sof/sof-of-dev.h | 7 ++++++ 5 files changed, 55 insertions(+), 1 deletion(-) -- 2.25.1

3 5

[PATCH] ALSA: aloop: Fix random zeros in capture data when using jiffies timer
by Pattara Teerapong 02 Sep '22

02 Sep '22

In loopback_jiffies_timer_pos_update(), we are getting jiffies twice. First time for playback, second time for capture. Jiffies can be updated between these two calls and if the capture jiffies is larger, extra zeros will be filled in the capture buffer. Change to get jiffies once and use it for both playback and capture. Signed-off-by: Pattara Teerapong <pteerapong(a)chromium.org> --- sound/drivers/aloop.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c index 9b4a7cdb103a..12f12a294df5 100644 --- a/sound/drivers/aloop.c +++ b/sound/drivers/aloop.c @@ -605,17 +605,18 @@ static unsigned int loopback_jiffies_timer_pos_update cable->streams[SNDRV_PCM_STREAM_PLAYBACK]; struct loopback_pcm *dpcm_capt = cable->streams[SNDRV_PCM_STREAM_CAPTURE]; - unsigned long delta_play = 0, delta_capt = 0; + unsigned long delta_play = 0, delta_capt = 0, cur_jiffies; unsigned int running, count1, count2; + cur_jiffies = jiffies; running = cable->running ^ cable->pause; if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) { - delta_play = jiffies - dpcm_play->last_jiffies; + delta_play = cur_jiffies - dpcm_play->last_jiffies; dpcm_play->last_jiffies += delta_play; } if (running & (1 << SNDRV_PCM_STREAM_CAPTURE)) { - delta_capt = jiffies - dpcm_capt->last_jiffies; + delta_capt = cur_jiffies - dpcm_capt->last_jiffies; dpcm_capt->last_jiffies += delta_capt; } -- 2.37.2.789.g6183377224-goog

2 1

retire_capture_urb: Corrected urb data len
by Sean Anderson 02 Sep '22

02 Sep '22

Hi all, I have a "FiiO DigiHug USB Audio" sound card (1852:7022) [3]. I have had no problems with the audio, but I did notice a large number of message like retire_capture_urb: 4992 callbacks suppressed in my dmesg [1]. This is caused by the "Corrected urb data len." warning. The patch adding this warning [2] makes it seem like this warning should be an uncommon occurance. However, based on the number of suppressed callbacks, this seems to be happening at a rate of around 500 Hz. Is this buggy hardware? Or is this a bug in the driver? Does there need to be a quirk? Or perhaps the warning above should be a debug instead? I'm using 5.15.0-46-generic. I know, I know; this is a vendor kernel. However, I went through the commits for sound/usb/pcm.c and didn't see any major differences. I also previously saw this issue on 5.4, so this probably isn't a regression. --Sean [1] I would have liked to post the actual message, but I was unable to figure out how to disable ratelimiting. I tried setting /proc/sys/kernel/printk_ratelimit to 0, /proc/sys/kernel/printk_ratelimit_burst to 5000, and /proc/sys/kernel/printk to 8. However, nothing seemed to have any effect (except that the callbacks suppressed messages were disabled). I find this very strange, given that the callbacks suppressed message uses KERN_WARN, and so does dev_warn_ratelimited. [2] https://lore.kernel.org/all/4B28A659.6070303@ladisch.de/T/ [3] Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 1.10 bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 8 idVendor 0x1852 GYROCOM C&C Co., LTD idProduct 0x7022 bcdDevice 0.01 iManufacturer 1 FiiO iProduct 2 DigiHug USB Audio iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x0182 bNumInterfaces 4 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 3 Human Interface Device bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 HID Device Descriptor: bLength 9 bDescriptorType 33 bcdHID 1.00 bCountryCode 0 Not supported bNumDescriptors 1 bDescriptorType 34 Report wDescriptorLength 58 Report Descriptors: ** UNAVAILABLE ** Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0012 1x 18 bytes bInterval 32 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 1 Audio bInterfaceSubClass 1 Control Device bInterfaceProtocol 0 iInterface 3 FiiO USB DAC-E10 AudioControl Interface Descriptor: bLength 10 bDescriptorType 36 bDescriptorSubtype 1 (HEADER) bcdADC 1.00 wTotalLength 0x003e bInCollection 2 baInterfaceNr(0) 2 baInterfaceNr(1) 3 AudioControl Interface Descriptor: bLength 12 bDescriptorType 36 bDescriptorSubtype 2 (INPUT_TERMINAL) bTerminalID 5 wTerminalType 0x0605 SPDIF interface bAssocTerminal 0 bNrChannels 2 wChannelConfig 0x0003 Left Front (L) Right Front (R) iChannelNames 0 iTerminal 0 AudioControl Interface Descriptor: bLength 12 bDescriptorType 36 bDescriptorSubtype 2 (INPUT_TERMINAL) bTerminalID 9 wTerminalType 0x0101 USB Streaming bAssocTerminal 0 bNrChannels 2 wChannelConfig 0x0003 Left Front (L) Right Front (R) iChannelNames 0 iTerminal 0 AudioControl Interface Descriptor: bLength 9 bDescriptorType 36 bDescriptorSubtype 3 (OUTPUT_TERMINAL) bTerminalID 3 wTerminalType 0x0605 SPDIF interface bAssocTerminal 0 bSourceID 16 iTerminal 0 AudioControl Interface Descriptor: bLength 9 bDescriptorType 36 bDescriptorSubtype 3 (OUTPUT_TERMINAL) bTerminalID 7 wTerminalType 0x0101 USB Streaming bAssocTerminal 0 bSourceID 5 iTerminal 0 AudioControl Interface Descriptor: bLength 10 bDescriptorType 36 bDescriptorSubtype 6 (FEATURE_UNIT) bUnitID 16 bSourceID 9 bControlSize 1 bmaControls(0) 0x01 Mute Control bmaControls(1) 0x02 Volume Control bmaControls(2) 0x02 Volume Control iFeature 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 2 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 2 bAlternateSetting 1 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 7 bDelay 0 frames wFormatTag 0x0001 PCM AudioStreaming Interface Descriptor: bLength 26 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 1 (FORMAT_TYPE_I) bNrChannels 2 bSubframeSize 2 bBitResolution 16 bSamFreqType 6 Discrete tSamFreq[ 0] 8000 tSamFreq[ 1] 16000 tSamFreq[ 2] 32000 tSamFreq[ 3] 44100 tSamFreq[ 4] 48000 tSamFreq[ 5] 96000 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 9 Transfer Type Isochronous Synch Type Adaptive Usage Type Data wMaxPacketSize 0x0184 1x 388 bytes bInterval 1 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 2 Decoded PCM samples wLockDelay 0x0002 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 2 bAlternateSetting 2 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 7 bDelay 0 frames wFormatTag 0x0001 PCM AudioStreaming Interface Descriptor: bLength 26 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 1 (FORMAT_TYPE_I) bNrChannels 2 bSubframeSize 3 bBitResolution 24 bSamFreqType 6 Discrete tSamFreq[ 0] 8000 tSamFreq[ 1] 16000 tSamFreq[ 2] 32000 tSamFreq[ 3] 44100 tSamFreq[ 4] 48000 tSamFreq[ 5] 96000 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 9 Transfer Type Isochronous Synch Type Adaptive Usage Type Data wMaxPacketSize 0x0246 1x 582 bytes bInterval 1 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 2 Decoded PCM samples wLockDelay 0x0002 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 0 bNumEndpoints 0 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 1 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 9 bDelay 0 frames wFormatTag 0x0001 PCM AudioStreaming Interface Descriptor: bLength 20 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 1 (FORMAT_TYPE_I) bNrChannels 2 bSubframeSize 2 bBitResolution 16 bSamFreqType 4 Discrete tSamFreq[ 0] 32000 tSamFreq[ 1] 44100 tSamFreq[ 2] 48000 tSamFreq[ 3] 96000 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x03 EP 3 OUT bmAttributes 9 Transfer Type Isochronous Synch Type Adaptive Usage Type Data wMaxPacketSize 0x0184 1x 388 bytes bInterval 1 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 2 Decoded PCM samples wLockDelay 0x0002 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 2 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 9 bDelay 0 frames wFormatTag 0x0001 PCM AudioStreaming Interface Descriptor: bLength 20 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 1 (FORMAT_TYPE_I) bNrChannels 2 bSubframeSize 3 bBitResolution 24 bSamFreqType 4 Discrete tSamFreq[ 0] 32000 tSamFreq[ 1] 44100 tSamFreq[ 2] 48000 tSamFreq[ 3] 96000 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x03 EP 3 OUT bmAttributes 9 Transfer Type Isochronous Synch Type Adaptive Usage Type Data wMaxPacketSize 0x0246 1x 582 bytes bInterval 1 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 2 Decoded PCM samples wLockDelay 0x0002 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 3 bAlternateSetting 3 bNumEndpoints 1 bInterfaceClass 1 Audio bInterfaceSubClass 2 Streaming bInterfaceProtocol 0 iInterface 0 AudioStreaming Interface Descriptor: bLength 7 bDescriptorType 36 bDescriptorSubtype 1 (AS_GENERAL) bTerminalLink 9 bDelay 0 frames wFormatTag 0x2001 IEC1937_AC-3 AudioStreaming Interface Descriptor: bLength 11 bDescriptorType 36 bDescriptorSubtype 2 (FORMAT_TYPE) bFormatType 3 (FORMAT_TYPE_III) bNrChannels 2 bSubframeSize 2 bBitResolution 16 bSamFreqType 1 Discrete tSamFreq[ 0] 48000 Endpoint Descriptor: bLength 9 bDescriptorType 5 bEndpointAddress 0x03 EP 3 OUT bmAttributes 9 Transfer Type Isochronous Synch Type Adaptive Usage Type Data wMaxPacketSize 0x00c0 1x 192 bytes bInterval 1 bRefresh 0 bSynchAddress 0 AudioStreaming Endpoint Descriptor: bLength 7 bDescriptorType 37 bDescriptorSubtype 1 (EP_GENERAL) bmAttributes 0x01 Sampling Frequency bLockDelayUnits 2 Decoded PCM samples wLockDelay 0x0002 can't get debug descriptor: Resource temporarily unavailable Device Status: 0x0000 (Bus Powered)

2 5