- Alsa-devel - mailman.alsa-project.org

[PATCH v5 0/9] Support Spi in i2c-multi-instantiate driver
by Stefan Binding 26 Jan '22

26 Jan '22

Add support for SPI bus in the i2c-multi-instantiate driver as upcoming laptops will need to multi instantiate SPI devices from a single device node, which has multiple SpiSerialBus entries at the ACPI table. With the new SPI support, i2c-multi-instantiate becomes bus-multi-instantiate and is moved to the ACPI folder. The intention is to support the SPI bus by re-using the current I2C multi instantiate, instead of creating a new SPI multi instantiate, to make it possible for peripherals that can be controlled by I2C or SPI to have the same HID at the ACPI table. The new driver (serial multi instantiate, smi) checks for the hard-coded bus type and returns -ENODEV in case of zero devices found for that bus. In the case of automatic bus detection, the driver will give preference to I2C. The expectation is for a device node in the ACPI table to have multiple I2cSerialBus only or multiple SpiSerialBus only, not a mix of both; and for the case where there are both entries in one device node, only the I2C ones would be probed. This new serial multi instantiate will be used in CS35L41 HDA new driver. Changes since V4: - renamed bus-multi-instantiate to serial-multi-instantiate - various minor fixes in serial-multi-instantiate - fix returns in serial-multi-instantiate - removed unnecessary stubs in spi.h - re-order SSIDs in patch_realtek.c Lucas Tanure (4): platform/x86: i2c-multi-instantiate: Rename it for a generic serial driver name platform/x86: serial-multi-instantiate: Reorganize I2C functions ALSA: hda/realtek: Add support for HP Laptops ACPI / scan: Create platform device for CS35L41 Stefan Binding (5): spi: Make spi_alloc_device and spi_add_device public again spi: Create helper API to lookup ACPI info for spi device spi: Support selection of the index of the ACPI Spi Resource before alloc spi: Add API to count spi acpi resources platform/x86: serial-multi-instantiate: Add SPI support MAINTAINERS | 4 +- drivers/acpi/scan.c | 16 +- drivers/platform/x86/Kconfig | 14 +- drivers/platform/x86/Makefile | 2 +- drivers/platform/x86/i2c-multi-instantiate.c | 174 --------- .../platform/x86/serial-multi-instantiate.c | 346 ++++++++++++++++++ drivers/spi/spi.c | 137 ++++++- include/linux/spi/spi.h | 20 + sound/pci/hda/patch_realtek.c | 43 ++- 9 files changed, 549 insertions(+), 207 deletions(-) delete mode 100644 drivers/platform/x86/i2c-multi-instantiate.c create mode 100644 drivers/platform/x86/serial-multi-instantiate.c -- 2.25.1

3 17

[PATCH v2] kselftest: alsa: Add test case for writing invalid values
by Mark Brown 26 Jan '22

26 Jan '22

Attempt to write various invalid values for control types we know about and check that something sensible happens. The ABI isn't quite as clearly defined as one might like, rather than generating an error when an invalid value is written many devices will silently rewrite the value into one that is valid for the control. The exact value chosen is not predictable so in the case the write succeeds we just check that the value we read back is one that is valid for the control. Reviewed-by: Shuah Khan <skhan(a)linuxfoundation.org> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- v2: - Fix a couple of _integer()/_integer64() confusions. tools/testing/selftests/alsa/mixer-test.c | 222 +++++++++++++++++++++- 1 file changed, 221 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c index 17f158d7a767..0e88f4f3d802 100644 --- a/tools/testing/selftests/alsa/mixer-test.c +++ b/tools/testing/selftests/alsa/mixer-test.c @@ -13,6 +13,7 @@ #include <stdio.h> #include <stdlib.h> #include <stdbool.h> +#include <limits.h> #include <string.h> #include <getopt.h> #include <stdarg.h> @@ -26,7 +27,7 @@ #include "../kselftest.h" -#define TESTS_PER_CONTROL 3 +#define TESTS_PER_CONTROL 4 struct card_data { snd_ctl_t *handle; @@ -679,6 +680,224 @@ void test_ctl_write_valid(struct ctl_data *ctl) ctl->card->card, ctl->elem); } +bool test_ctl_write_invalid_value(struct ctl_data *ctl, + snd_ctl_elem_value_t *val) +{ + int err; + long val_read; + + /* Ideally this will fail... */ + err = snd_ctl_elem_write(ctl->card->handle, val); + if (err < 0) + return false; + + /* ...but some devices will clamp to an in range value */ + err = snd_ctl_elem_read(ctl->card->handle, val); + if (err < 0) { + ksft_print_msg("%s failed to read: %s\n", + ctl->name, snd_strerror(err)); + return true; + } + + return !ctl_value_valid(ctl, val); +} + +bool test_ctl_write_invalid_boolean(struct ctl_data *ctl) +{ + int err, i; + long val_read; + bool fail = false; + snd_ctl_elem_value_t *val; + snd_ctl_elem_value_alloca(&val); + + for (i = 0; i < snd_ctl_elem_info_get_count(ctl->info); i++) { + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_boolean(val, i, 2); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + + return !fail; +} + +bool test_ctl_write_invalid_integer(struct ctl_data *ctl) +{ + int i; + bool fail = false; + snd_ctl_elem_value_t *val; + snd_ctl_elem_value_alloca(&val); + + for (i = 0; i < snd_ctl_elem_info_get_count(ctl->info); i++) { + if (snd_ctl_elem_info_get_min(ctl->info) != LONG_MIN) { + /* Just under range */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, + snd_ctl_elem_info_get_min(ctl->info) - 1); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Minimum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, LONG_MIN); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + + if (snd_ctl_elem_info_get_max(ctl->info) != LONG_MAX) { + /* Just over range */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, + snd_ctl_elem_info_get_max(ctl->info) + 1); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Maximum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, LONG_MAX); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + } + + return !fail; +} + +bool test_ctl_write_invalid_integer64(struct ctl_data *ctl) +{ + int i; + bool fail = false; + snd_ctl_elem_value_t *val; + snd_ctl_elem_value_alloca(&val); + + for (i = 0; i < snd_ctl_elem_info_get_count(ctl->info); i++) { + if (snd_ctl_elem_info_get_min64(ctl->info) != LLONG_MIN) { + /* Just under range */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer64(val, i, + snd_ctl_elem_info_get_min64(ctl->info) - 1); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Minimum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer64(val, i, LLONG_MIN); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + + if (snd_ctl_elem_info_get_max64(ctl->info) != LLONG_MAX) { + /* Just over range */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer64(val, i, + snd_ctl_elem_info_get_max64(ctl->info) + 1); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Maximum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer64(val, i, LLONG_MAX); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + } + + return !fail; +} + +bool test_ctl_write_invalid_enumerated(struct ctl_data *ctl) +{ + int err, i; + unsigned int val_read; + bool fail = false; + snd_ctl_elem_value_t *val; + snd_ctl_elem_value_alloca(&val); + + snd_ctl_elem_value_set_id(val, ctl->id); + + for (i = 0; i < snd_ctl_elem_info_get_count(ctl->info); i++) { + /* One beyond maximum */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_enumerated(val, i, + snd_ctl_elem_info_get_items(ctl->info)); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Maximum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_enumerated(val, i, UINT_MAX); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + } + + return !fail; +} + + +void test_ctl_write_invalid(struct ctl_data *ctl) +{ + bool pass; + int err; + + /* If the control is turned off let's be polite */ + if (snd_ctl_elem_info_is_inactive(ctl->info)) { + ksft_print_msg("%s is inactive\n", ctl->name); + ksft_test_result_skip("write_invalid.%d.%d\n", + ctl->card->card, ctl->elem); + return; + } + + if (!snd_ctl_elem_info_is_writable(ctl->info)) { + ksft_print_msg("%s is not writeable\n", ctl->name); + ksft_test_result_skip("write_invalid.%d.%d\n", + ctl->card->card, ctl->elem); + return; + } + + switch (snd_ctl_elem_info_get_type(ctl->info)) { + case SND_CTL_ELEM_TYPE_BOOLEAN: + pass = test_ctl_write_invalid_boolean(ctl); + break; + + case SND_CTL_ELEM_TYPE_INTEGER: + pass = test_ctl_write_invalid_integer(ctl); + break; + + case SND_CTL_ELEM_TYPE_INTEGER64: + pass = test_ctl_write_invalid_integer64(ctl); + break; + + case SND_CTL_ELEM_TYPE_ENUMERATED: + pass = test_ctl_write_invalid_enumerated(ctl); + break; + + default: + /* No tests for this yet */ + ksft_test_result_skip("write_invalid.%d.%d\n", + ctl->card->card, ctl->elem); + return; + } + + /* Restore the default value to minimise disruption */ + err = write_and_verify(ctl, ctl->def_val, NULL); + if (err < 0) + pass = false; + + ksft_test_result(pass, "write_invalid.%d.%d\n", + ctl->card->card, ctl->elem); +} + int main(void) { struct ctl_data *ctl; @@ -697,6 +916,7 @@ int main(void) test_ctl_get_value(ctl); test_ctl_write_default(ctl); test_ctl_write_valid(ctl); + test_ctl_write_invalid(ctl); } ksft_exit_pass(); -- 2.30.2

2 1

[PATCH] ALSA: hda: Fix UAF of leds class devs at unbinding
by Takashi Iwai 26 Jan '22

26 Jan '22

The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-audio codec device. Unfortunately, it turned out that the devres release doesn't work for this case; namely, since the codec resource release happens before the devm call chain, it triggers a NULL dereference or a UAF for a stale set_brightness_delay callback. For fixing the bug, this patch changes the LED class device register and unregister in a manual manner without devres, keeping the instances in hda_gen_spec. Reported-by: Alexander Sergeyev <sergeev917(a)gmail.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220111195229.a77wrpjclqwrx4bx@localhost.localdo… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/pci/hda/hda_generic.c | 17 +++++++++++++++-- sound/pci/hda/hda_generic.h | 3 +++ 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c index 3bf5e3410703..fc114e522480 100644 --- a/sound/pci/hda/hda_generic.c +++ b/sound/pci/hda/hda_generic.c @@ -91,6 +91,12 @@ static void snd_hda_gen_spec_free(struct hda_gen_spec *spec) free_kctls(spec); snd_array_free(&spec->paths); snd_array_free(&spec->loopback_list); +#ifdef CONFIG_SND_HDA_GENERIC_LEDS + if (spec->led_cdevs[LED_AUDIO_MUTE]) + led_classdev_unregister(spec->led_cdevs[LED_AUDIO_MUTE]); + if (spec->led_cdevs[LED_AUDIO_MICMUTE]) + led_classdev_unregister(spec->led_cdevs[LED_AUDIO_MICMUTE]); +#endif } /* @@ -3922,7 +3928,10 @@ static int create_mute_led_cdev(struct hda_codec *codec, enum led_brightness), bool micmute) { + struct hda_gen_spec *spec = codec->spec; struct led_classdev *cdev; + int idx = micmute ? LED_AUDIO_MICMUTE : LED_AUDIO_MUTE; + int err; cdev = devm_kzalloc(&codec->core.dev, sizeof(*cdev), GFP_KERNEL); if (!cdev) @@ -3932,10 +3941,14 @@ static int create_mute_led_cdev(struct hda_codec *codec, cdev->max_brightness = 1; cdev->default_trigger = micmute ? "audio-micmute" : "audio-mute"; cdev->brightness_set_blocking = callback; - cdev->brightness = ledtrig_audio_get(micmute ? LED_AUDIO_MICMUTE : LED_AUDIO_MUTE); + cdev->brightness = ledtrig_audio_get(idx); cdev->flags = LED_CORE_SUSPENDRESUME; - return devm_led_classdev_register(&codec->core.dev, cdev); + err = led_classdev_register(&codec->core.dev, cdev); + if (err < 0) + return err; + spec->led_cdevs[idx] = cdev; + return 0; } /** diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h index 8e1bc8ea74fc..34eba40cc6e6 100644 --- a/sound/pci/hda/hda_generic.h +++ b/sound/pci/hda/hda_generic.h @@ -294,6 +294,9 @@ struct hda_gen_spec { struct hda_jack_callback *cb); void (*mic_autoswitch_hook)(struct hda_codec *codec, struct hda_jack_callback *cb); + + /* leds */ + struct led_classdev *led_cdevs[NUM_AUDIO_LEDS]; }; /* values for add_stereo_mix_input flag */ -- 2.31.1

1 0

Re: No sound on gpd pocket 3
by Pierre-Louis Bossart 26 Jan '22

26 Jan '22

On 1/24/22 12:35, anthony tonitch wrote: > HO, I'm really sorry, I did this alsa-info from my main computer over > ssh and I might have typed the command on the wrong terminal :'( > here it is http://alsa-project.org/db/?f=8ec2e745ceafb1a659d71eff99ad3a9eda3eb62d ah, now it's starting to make sense. I am afraid you have the ES8316 codec, or one of its variants. /sys/bus/acpi/devices/ESSX8326:00/status 15 so no you don't want to use options snd-intel-dspcfg dsp_driver=1 but options snd-intel-dspcfg dsp_driver=3 The auto-detection don't work because we use a different codec HID for the driver selection { .flags = FLAG_SOF, .device = 0x5a98, .codec_hid = "ESSX8336", }, as well as the machine driver selection { .id = "ESSX8336", .drv_name = "sof-essx8336", .sof_tplg_filename = "sof-glk-es8336.tplg", }, This is really a problematic set of devices, where absolutely all possible I2S links have been used, along with GPIO settings and DMICs. Please file a bug on https://github.com/thesofproject/linux/issues so that we can keep track of this and suggest solution. Thanks! > Le lun. 24 janv. 2022 à 18:11, Pierre-Louis Bossart > <pierre-louis.bossart(a)linux.intel.com> a écrit : >> >> >> >> On 1/24/22 10:52, anthony tonitch wrote: >>> Hello, >>> >>> I have a problem I guess related to sof... I already asked on the irc >>> #alsa(a)libera.chat and gnarface advised me to come and ask on this >>> mailing list! >> >> using "options snd-intel-dspcfg dsp_driver=1" to avoid using SOF isn't >> very helpful on an AMD platform :-) >> >> 08:00.1 Audio device [0403]: NVIDIA Corporation GP104 High Definition >> Audio Controller [10de:10f0] (rev a1) >> Subsystem: PNY Device [196e:11a0] >> 0a:00.3 Audio device [0403]: Advanced Micro Devices, Inc. [AMD] Family >> 17h (Models 00h-0fh) HD Audio Controller [1022:1457] >> Subsystem: ASUSTeK Computer Inc. Device [1043:86c7] >> >> Best of luck! >> >>> >>> I am struggling to make the sound of my gpd pocket 3 to work on linux >>> (archlinux to be precise)! In fact, the sound is not supposed to work >>> out of the box as other users tested it before me! but they all had >>> the solution to set the dsp_driver and this didn't worked for me! >>> I checked several times to see if the module was loaded properly and >>> yes it is (as you can also check in the alsa-info at the end of the mail)! >>> >>> If I do aplay -l I get a bunch of hdmi connection that is not working >>> at all! I'm really lost here and I don't even know what to look for >>> anymore >>> >>> The sound works great on windows so This doens't seems to be hardware problem ?! >>> and I tried to plug an usb headset which give me sound so I doesn't >>> seems to be config related either ?! (tho the jack doesn't work) >>> >>> I asked on several places already. I post the different links here in >>> case you want to check but I don't have any response to any post >>> unfortunately! >>> >>> - Post on Archlinux BBS: https://bbs.archlinux.org/viewtopic.php?id=273044 >>> - Post on subreddit GPDPocket: >>> https://www.reddit.com/r/GPDPocket/comments/s31qi8/gpd_p3_no_sound_linux/ >>> >>> - Screenshot and bios picture of maybe relevant informations: >>> - https://imgur.com/a/DouSB3m >>> - https://imgur.com/a/K232PLJ >>> >>> I hope there is enough informations to help me debug this but if you >>> need anything I can provide it! this is a small pc and I'm usualy >>> quarrying it around! >>> I know this is better to send mail but if you need me to chat for any >>> reason (it would be easier for instance) I'm usually hanging on the >>> libera.chat irc as tonitch you can pm or tag me on #alsa >>> >>> Here is the alsa-info.sh : >>> http://alsa-project.org/db/?f=6ddb669a19086cebdb121c97c25bbdccb98e856d >>> >>> Thanks a lot for your help! >>> >>> PS: Ubuntu mate have released their official pocket 3 distribution and >>> I tried it but the sound didn't worked either, here is the alsa-info >>> In case this help ?! : >>> http://alsa-project.org/db/?f=df4c183fd00cec224006ec8caa228705399ad873

2 4

[PATCH] ASoC: Intel: atom: Remove redundant check to simplify the code
by Tang Bin 25 Jan '22

25 Jan '22

In the function sst_platform_get_resources(), if platform_get_irq() failed, the return should not be zero, as the example in platform.c is * int irq = platform_get_irq(pdev, 0) * if (irq < 0) * return irq; So remove the redundant check to simplify the code. Signed-off-by: Tang Bin <tangbin(a)cmss.chinamobile.com> --- sound/soc/intel/atom/sst/sst_acpi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/intel/atom/sst/sst_acpi.c b/sound/soc/intel/atom/sst/sst_acpi.c index 3be64430c..696d547c5 100644 --- a/sound/soc/intel/atom/sst/sst_acpi.c +++ b/sound/soc/intel/atom/sst/sst_acpi.c @@ -226,8 +226,8 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx) /* Find the IRQ */ ctx->irq_num = platform_get_irq(pdev, ctx->pdata->res_info->acpi_ipc_irq_index); - if (ctx->irq_num <= 0) - return ctx->irq_num < 0 ? ctx->irq_num : -EIO; + if (ctx->irq_num < 0) + return ctx->irq_num; return 0; } -- 2.20.1.windows.1

5 7

[PATCH 0/3] ASoC: sh: rz-ssi: Trivial changes
by Lad Prabhakar 25 Jan '22

25 Jan '22

Hi All, This patch series has trivial changes for rz-ssi driver. Patches 1 (partial) & 2 are from series [3]. patch 1/3 is just a cosmetic change which was part of patch [0] where it uses a do-while instead of while-do. Patch 2/3 is from series [1] where a helper function is added and patch 3/3 is a new patch which removes duplicate macros. All the patches apply to [2] (sound -next) [0] https://patchwork.kernel.org/project/alsa-devel/patch/ 20220115012303.29651-2-prabhakar.mahadev-lad.rj(a)bp.renesas.com/ [1] https://patchwork.kernel.org/project/alsa-devel/patch/ 20220115012303.29651-6-prabhakar.mahadev-lad.rj(a)bp.renesas.com/ [2] https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git/log/ [3] https://patchwork.kernel.org/project/alsa-devel/list/?series=605672 Cheers, Prabhakar Lad Prabhakar (3): ASoC: sh: rz-ssi: Use a do-while loop in rz_ssi_pio_recv() ASoC: sh: rz-ssi: Add rz_ssi_set_substream() helper function ASoC: sh: rz-ssi: Remove duplicate macros sound/soc/sh/rz-ssi.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) -- 2.17.1

3 5

[PATCH v1 0/3] ASoC: Add bounds checking for written values
by Mark Brown 25 Jan '22

25 Jan '22

This series adds verification that values written to registers are in bounds for controls since the core doesn't validate for us. Mark Brown (3): ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() sound/soc/soc-ops.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) base-commit: e783362eb54cd99b2cac8b3a9aeac942e6f6ac07 -- 2.30.2

3 10

Re: [PATCH 5/5] spi: make remove callback a void function
by Jérôme Pouiller 25 Jan '22

25 Jan '22

On Sunday 23 January 2022 18:52:01 CET Uwe Kleine-König wrote: > > The value returned by an spi driver's remove function is mostly ignored. > (Only an error message is printed if the value is non-zero that the > error is ignored.) > > So change the prototype of the remove function to return no value. This > way driver authors are not tempted to assume that passing an error to > the upper layer is a good idea. All drivers are adapted accordingly. > There is no intended change of behaviour, all callbacks were prepared to > return 0 before. > > Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> [...] > diff --git a/drivers/staging/wfx/bus_spi.c b/drivers/staging/wfx/bus_spi.c > index 55ffcd7c42e2..fa0ff66a457d 100644 > --- a/drivers/staging/wfx/bus_spi.c > +++ b/drivers/staging/wfx/bus_spi.c > @@ -232,12 +232,11 @@ static int wfx_spi_probe(struct spi_device *func) > return wfx_probe(bus->core); > } > > -static int wfx_spi_remove(struct spi_device *func) > +static void wfx_spi_remove(struct spi_device *func) > { > struct wfx_spi_priv *bus = spi_get_drvdata(func); > > wfx_release(bus->core); > - return 0; > } > > /* For dynamic driver binding, kernel does not use OF to match driver. It only For the wfx driver: Acked-by: Jérôme Pouiller <jerome.pouiller(a)silabs.com> -- Jérôme Pouiller

1 0

[PATCH] kselftest: alsa: Add test case for writing invalid values
by Mark Brown 25 Jan '22

25 Jan '22

Attempt to write various invalid values for control types we know about and check that something sensible happens. The ABI isn't quite as clearly defined as one might like, rather than generating an error when an invalid value is written many devices will silently rewrite the value into one that is valid for the control. The exact value chosen is not predictable so in the case the write succeeds we just check that the value we read back is one that is valid for the control. Signed-off-by: Mark Brown <broonie(a)kernel.org> --- tools/testing/selftests/alsa/mixer-test.c | 222 +++++++++++++++++++++- 1 file changed, 221 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c index 17f158d7a767..15e05b241468 100644 --- a/tools/testing/selftests/alsa/mixer-test.c +++ b/tools/testing/selftests/alsa/mixer-test.c @@ -13,6 +13,7 @@ #include <stdio.h> #include <stdlib.h> #include <stdbool.h> +#include <limits.h> #include <string.h> #include <getopt.h> #include <stdarg.h> @@ -26,7 +27,7 @@ #include "../kselftest.h" -#define TESTS_PER_CONTROL 3 +#define TESTS_PER_CONTROL 4 struct card_data { snd_ctl_t *handle; @@ -679,6 +680,224 @@ void test_ctl_write_valid(struct ctl_data *ctl) ctl->card->card, ctl->elem); } +bool test_ctl_write_invalid_value(struct ctl_data *ctl, + snd_ctl_elem_value_t *val) +{ + int err; + long val_read; + + /* Ideally this will fail... */ + err = snd_ctl_elem_write(ctl->card->handle, val); + if (err < 0) + return false; + + /* ...but some devices will clamp to an in range value */ + err = snd_ctl_elem_read(ctl->card->handle, val); + if (err < 0) { + ksft_print_msg("%s failed to read: %s\n", + ctl->name, snd_strerror(err)); + return true; + } + + return !ctl_value_valid(ctl, val); +} + +bool test_ctl_write_invalid_boolean(struct ctl_data *ctl) +{ + int err, i; + long val_read; + bool fail = false; + snd_ctl_elem_value_t *val; + snd_ctl_elem_value_alloca(&val); + + for (i = 0; i < snd_ctl_elem_info_get_count(ctl->info); i++) { + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_boolean(val, i, 2); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + + return !fail; +} + +bool test_ctl_write_invalid_integer(struct ctl_data *ctl) +{ + int i; + bool fail = false; + snd_ctl_elem_value_t *val; + snd_ctl_elem_value_alloca(&val); + + for (i = 0; i < snd_ctl_elem_info_get_count(ctl->info); i++) { + if (snd_ctl_elem_info_get_min(ctl->info) != LONG_MIN) { + /* Just under range */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, + snd_ctl_elem_info_get_min(ctl->info) - 1); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Minimum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, LONG_MIN); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + + if (snd_ctl_elem_info_get_max(ctl->info) != LONG_MAX) { + /* Just over range */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, + snd_ctl_elem_info_get_max(ctl->info) + 1); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Maximum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, LONG_MAX); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + } + + return !fail; +} + +bool test_ctl_write_invalid_integer64(struct ctl_data *ctl) +{ + int i; + bool fail = false; + snd_ctl_elem_value_t *val; + snd_ctl_elem_value_alloca(&val); + + for (i = 0; i < snd_ctl_elem_info_get_count(ctl->info); i++) { + if (snd_ctl_elem_info_get_min64(ctl->info) != LLONG_MIN) { + /* Just under range */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer64(val, i, + snd_ctl_elem_info_get_min64(ctl->info) - 1); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Minimum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, LLONG_MIN); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + + if (snd_ctl_elem_info_get_max64(ctl->info) != LLONG_MAX) { + /* Just over range */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer64(val, i, + snd_ctl_elem_info_get_max64(ctl->info) + 1); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Maximum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_integer(val, i, LLONG_MAX); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + } + } + + return !fail; +} + +bool test_ctl_write_invalid_enumerated(struct ctl_data *ctl) +{ + int err, i; + unsigned int val_read; + bool fail = false; + snd_ctl_elem_value_t *val; + snd_ctl_elem_value_alloca(&val); + + snd_ctl_elem_value_set_id(val, ctl->id); + + for (i = 0; i < snd_ctl_elem_info_get_count(ctl->info); i++) { + /* One beyond maximum */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_enumerated(val, i, + snd_ctl_elem_info_get_items(ctl->info)); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + /* Maximum representable value */ + snd_ctl_elem_value_copy(val, ctl->def_val); + snd_ctl_elem_value_set_enumerated(val, i, UINT_MAX); + + if (test_ctl_write_invalid_value(ctl, val)) + fail = true; + + } + + return !fail; +} + + +void test_ctl_write_invalid(struct ctl_data *ctl) +{ + bool pass; + int err; + + /* If the control is turned off let's be polite */ + if (snd_ctl_elem_info_is_inactive(ctl->info)) { + ksft_print_msg("%s is inactive\n", ctl->name); + ksft_test_result_skip("write_invalid.%d.%d\n", + ctl->card->card, ctl->elem); + return; + } + + if (!snd_ctl_elem_info_is_writable(ctl->info)) { + ksft_print_msg("%s is not writeable\n", ctl->name); + ksft_test_result_skip("write_invalid.%d.%d\n", + ctl->card->card, ctl->elem); + return; + } + + switch (snd_ctl_elem_info_get_type(ctl->info)) { + case SND_CTL_ELEM_TYPE_BOOLEAN: + pass = test_ctl_write_invalid_boolean(ctl); + break; + + case SND_CTL_ELEM_TYPE_INTEGER: + pass = test_ctl_write_invalid_integer(ctl); + break; + + case SND_CTL_ELEM_TYPE_INTEGER64: + pass = test_ctl_write_invalid_integer64(ctl); + break; + + case SND_CTL_ELEM_TYPE_ENUMERATED: + pass = test_ctl_write_invalid_enumerated(ctl); + break; + + default: + /* No tests for this yet */ + ksft_test_result_skip("write_invalid.%d.%d\n", + ctl->card->card, ctl->elem); + return; + } + + /* Restore the default value to minimise disruption */ + err = write_and_verify(ctl, ctl->def_val, NULL); + if (err < 0) + pass = false; + + ksft_test_result(pass, "write_invalid.%d.%d\n", + ctl->card->card, ctl->elem); +} + int main(void) { struct ctl_data *ctl; @@ -697,6 +916,7 @@ int main(void) test_ctl_get_value(ctl); test_ctl_write_default(ctl); test_ctl_write_valid(ctl); + test_ctl_write_invalid(ctl); } ksft_exit_pass(); -- 2.30.2

3 4

[PATCH v2][next] ALSA: usb-audio: scarlett2: Use struct_size() helper in scarlett2_usb()
by Gustavo A. R. Silva 25 Jan '22

25 Jan '22

Make use of the struct_size() helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worst scenario, could lead to heap overflows. Also, address the following sparse warnings: sound/usb/mixer_scarlett_gen2.c:1064:28: warning: using sizeof on a flexible structure sound/usb/mixer_scarlett_gen2.c:1065:29: warning: using sizeof on a flexible structure Link: https://github.com/KSPP/linux/issues/174 Signed-off-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> --- Changes in v2: - Use correct format specifier %zu for type size_t argument. sound/usb/mixer_scarlett_gen2.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c index 53ebabf42472..7ff8a4817c67 100644 --- a/sound/usb/mixer_scarlett_gen2.c +++ b/sound/usb/mixer_scarlett_gen2.c @@ -1061,9 +1061,9 @@ static int scarlett2_usb( { struct scarlett2_data *private = mixer->private_data; struct usb_device *dev = mixer->chip->dev; - u16 req_buf_size = sizeof(struct scarlett2_usb_packet) + req_size; - u16 resp_buf_size = sizeof(struct scarlett2_usb_packet) + resp_size; struct scarlett2_usb_packet *req, *resp = NULL; + size_t req_buf_size = struct_size(req, data, req_size); + size_t resp_buf_size = struct_size(resp, data, resp_size); int err; req = kmalloc(req_buf_size, GFP_KERNEL); @@ -1111,7 +1111,7 @@ static int scarlett2_usb( usb_audio_err( mixer->chip, "Scarlett Gen 2/3 USB response result cmd %x was %d " - "expected %d\n", + "expected %zu\n", cmd, err, resp_buf_size); err = -EINVAL; goto unlock; -- 2.27.0

3 2