- Alsa-devel - mailman.alsa-project.org

[PATCH v2] ALSA: control led: fix memory leak in snd_ctl_led_register
by Dongliang Mu 02 Jun '21

02 Jun '21

The snd_ctl_led_sysfs_add and snd_ctl_led_sysfs_remove should contain the refcount operations in pair. However, snd_ctl_led_sysfs_remove fails to decrease the refcount to zero, which causes device_release never to be invoked. This leads to memory leak to some resources, like struct device_private. In addition, we also free some other similar memory leaks in snd_ctl_led_init/snd_ctl_led_exit. Fix this by replacing device_del to device_unregister in snd_ctl_led_sysfs_remove/snd_ctl_led_init/snd_ctl_led_exit. Note that, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device will call kobject_release and delay the release of kobject, which will cause use-after-free when the memory backing the kobject is freed at once. Reported-by: syzbot+08a7d8b51ea048a74ffb(a)syzkaller.appspotmail.com Fixes: a135dfb5de1 ("ALSA: led control - add sysfs kcontrol LED marking layer") Signed-off-by: Dongliang Mu <mudongliangabcd(a)gmail.com> --- v1->v2: fix other similar memory leaks; move kfree(led_card) to a release function. sound/core/control_led.c | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) diff --git a/sound/core/control_led.c b/sound/core/control_led.c index 25f57c14f294..a90e31dbde61 100644 --- a/sound/core/control_led.c +++ b/sound/core/control_led.c @@ -17,6 +17,9 @@ MODULE_LICENSE("GPL"); #define MAX_LED (((SNDRV_CTL_ELEM_ACCESS_MIC_LED - SNDRV_CTL_ELEM_ACCESS_SPK_LED) \ >> SNDRV_CTL_ELEM_ACCESS_LED_SHIFT) + 1) +#define to_led_card_dev(_dev) \ + container_of(_dev, struct snd_ctl_led_card, dev) + enum snd_ctl_led_mode { MODE_FOLLOW_MUTE = 0, MODE_FOLLOW_ROUTE, @@ -371,6 +374,21 @@ static void snd_ctl_led_disconnect(struct snd_card *card) snd_ctl_led_refresh(); } +static void snd_ctl_led_card_release(struct device *dev) +{ + struct snd_ctl_led_card *led_card = to_led_card_dev(dev); + + kfree(led_card); +} + +static void snd_ctl_led_release(struct device *dev) +{ +} + +static void snd_ctl_led_dev_release(struct device *dev) +{ +} + /* * sysfs */ @@ -663,6 +681,7 @@ static void snd_ctl_led_sysfs_add(struct snd_card *card) led_card->number = card->number; led_card->led = led; device_initialize(&led_card->dev); + led_card->dev.release = snd_ctl_led_card_release; if (dev_set_name(&led_card->dev, "card%d", card->number) < 0) goto cerr; led_card->dev.parent = &led->dev; @@ -681,7 +700,6 @@ static void snd_ctl_led_sysfs_add(struct snd_card *card) put_device(&led_card->dev); cerr2: printk(KERN_ERR "snd_ctl_led: unable to add card%d", card->number); - kfree(led_card); } } @@ -700,8 +718,7 @@ static void snd_ctl_led_sysfs_remove(struct snd_card *card) snprintf(link_name, sizeof(link_name), "led-%s", led->name); sysfs_remove_link(&card->ctl_dev.kobj, link_name); sysfs_remove_link(&led_card->dev.kobj, "card"); - device_del(&led_card->dev); - kfree(led_card); + device_unregister(&led_card->dev); led->cards[card->number] = NULL; } } @@ -723,6 +740,7 @@ static int __init snd_ctl_led_init(void) device_initialize(&snd_ctl_led_dev); snd_ctl_led_dev.class = sound_class; + snd_ctl_led_dev.release = snd_ctl_led_dev_release; dev_set_name(&snd_ctl_led_dev, "ctl-led"); if (device_add(&snd_ctl_led_dev)) { put_device(&snd_ctl_led_dev); @@ -733,15 +751,16 @@ static int __init snd_ctl_led_init(void) INIT_LIST_HEAD(&led->controls); device_initialize(&led->dev); led->dev.parent = &snd_ctl_led_dev; + led->dev.release = snd_ctl_led_release; led->dev.groups = snd_ctl_led_dev_attr_groups; dev_set_name(&led->dev, led->name); if (device_add(&led->dev)) { put_device(&led->dev); for (; group > 0; group--) { led = &snd_ctl_leds[group - 1]; - device_del(&led->dev); + device_unregister(&led->dev); } - device_del(&snd_ctl_led_dev); + device_unregister(&snd_ctl_led_dev); return -ENOMEM; } } @@ -767,9 +786,9 @@ static void __exit snd_ctl_led_exit(void) } for (group = 0; group < MAX_LED; group++) { led = &snd_ctl_leds[group]; - device_del(&led->dev); + device_unregister(&led->dev); } - device_del(&snd_ctl_led_dev); + device_unregister(&snd_ctl_led_dev); snd_ctl_led_clean(NULL); } -- 2.25.1

4 3

bytcr-rt5640 initiializes but has wrong settings
by GitHub issues - opened 02 Jun '21

02 Jun '21

alsa-project/alsa-ucm-conf issue #96 was opened from AnterCreeper: My device is Elitepad 1000 G2. The headphone and the mic inside cannot work. However, The speaker works properly. The mic IN1 is the headphone mic insted of the mic inside. I think that it may be because the audio was ported to the wrong place. Sorry for my bad English :D Issue URL : https://github.com/alsa-project/alsa-ucm-conf/issues/96 Repository URL: https://github.com/alsa-project/alsa-ucm-conf

1 0

[syzbot] UBSAN: shift-out-of-bounds in snd_timer_user_ccallback
by syzbot 02 Jun '21

02 Jun '21

Hello, syzbot found the following issue on: HEAD commit: 5ff2756a Merge tag 'nfs-for-5.13-2' of git://git.linux-nfs.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=17872d5bd00000 kernel config: https://syzkaller.appspot.com/x/.config?x=770708ea7cfd4916 dashboard link: https://syzkaller.appspot.com/bug?extid=d102fa5b35335a7e544e Unfortunately, I don't have any reproducer for this issue yet. IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+d102fa5b35335a7e544e(a)syzkaller.appspotmail.com ================================================================================ UBSAN: shift-out-of-bounds in sound/core/timer.c:1376:23 shift exponent 105 is too large for 32-bit type 'int' CPU: 1 PID: 10368 Comm: syz-executor.1 Not tainted 5.13.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 snd_timer_user_ccallback.cold+0x19/0x1e sound/core/timer.c:1376 snd_timer_notify1+0x243/0x3b0 sound/core/timer.c:525 snd_timer_stop1+0x641/0x890 sound/core/timer.c:656 snd_timer_pause+0x6e/0x90 sound/core/timer.c:738 seq_timer_stop sound/core/seq/seq_timer.c:331 [inline] snd_seq_timer_stop+0x93/0xd0 sound/core/seq/seq_timer.c:341 queue_delete+0x42/0xa0 sound/core/seq/seq_queue.c:133 snd_seq_queue_client_leave+0x37/0x1a0 sound/core/seq/seq_queue.c:552 seq_free_client1.part.0+0x10a/0x260 sound/core/seq/seq_clientmgr.c:280 seq_free_client1 sound/core/seq/seq_clientmgr.c:273 [inline] seq_free_client+0x7b/0xf0 sound/core/seq/seq_clientmgr.c:301 snd_seq_release+0x4d/0xe0 sound/core/seq/seq_clientmgr.c:382 __fput+0x288/0x920 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:174 [inline] exit_to_user_mode_prepare+0x272/0x280 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:301 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:57 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4193eb Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:0000000000a9fb80 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00000000004193eb RDX: 0000000000571b58 RSI: ffffffff89166efe RDI: 0000000000000004 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2ea280a8 R10: 00000000000001d1 R11: 0000000000000293 R12: 000000000014d248 R13: 00000000000003e8 R14: 000000000056bf80 R15: 000000000014d1dd ================================================================================ --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0

[PATCH 0/4] ASoC: rsnd: adjust disabled module for R-Car D3
by Kuninori Morimoto 01 Jun '21

01 Jun '21

Hi Mark, Geert Renesas Sound driver is assuming that all SSI/SRC are connected. But some SSI/SRC are not connected on Some Renesas SoC. ex) H2 E2 SRC0 <= SRC1 SRC1 SRC2 SRC2 ... ... We accepted it by using "status = disabled" on DT before. ex) rcar_sound,src { src-0 { => status = "disabled"; }; src1: src-1 { ... }; ... But R-Car D3 have many disabled modules (It has SSI3/SSI4, SRC5/SRC6), and Renesas SoC maintainer don't want above style on DT. ex) rcar_sound,src { => src0: src-0 { status = "disabled"; }; => src1: src-1 { status = "disabled"; }; => src2: src-2 { status = "disabled"; }; => src3: src-3 { status = "disabled"; }; => src4: src-4 { status = "disabled"; }; src5: src-5 { ... }; ... This patch-set adjust to this situation, and enables to intuitive DT settings. rcar_sound,src { src5: src-5 { ... }; src6: src-6 { ... }; }; Kuninori Morimoto (4): ASoC: rsnd: tidyup rsnd_parse_connect_common() ASoC: rsnd: tidyup rsnd_dma_request_channel() ASoC: rsnd: tidyup rsnd_parse_connect_xxx() ASoC: rsnd: adjust disabled module sound/soc/sh/rcar/core.c | 58 ++++++++++++++++++++++++++++++++++++++-- sound/soc/sh/rcar/dma.c | 8 +++--- sound/soc/sh/rcar/dvc.c | 2 +- sound/soc/sh/rcar/rsnd.h | 16 ++++++----- sound/soc/sh/rcar/src.c | 6 +++-- sound/soc/sh/rcar/ssi.c | 12 ++++++--- sound/soc/sh/rcar/ssiu.c | 10 ++++--- 7 files changed, 91 insertions(+), 21 deletions(-) -- 2.25.1

2 5

[PATCH 1/2] ASoC: SOF: Intel: hda: clean up hda_dsp_dump()
by Kai Vehmanen 01 Jun '21

01 Jun '21

From: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Clean up the hda_dsp_dump() function to avoid duplicating the ROM status and error. Signed-off-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Reviewed-by: Bard Liao <bard.liao(a)intel.com> Signed-off-by: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> --- sound/soc/sof/intel/hda.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c index 126232a76a10..e1e368ff2b12 100644 --- a/sound/soc/sof/intel/hda.c +++ b/sound/soc/sof/intel/hda.c @@ -394,28 +394,21 @@ void hda_dsp_dump(struct snd_sof_dev *sdev, u32 flags) struct sof_ipc_dsp_oops_xtensa xoops; struct sof_ipc_panic_info panic_info; u32 stack[HDA_DSP_STACK_DUMP_SIZE]; - u32 status, panic; - /* try APL specific status message types first */ + /* print ROM/FW status */ hda_dsp_get_status(sdev); - /* now try generic SOF status messages */ - status = snd_sof_dsp_read(sdev, HDA_DSP_BAR, - HDA_DSP_SRAM_REG_FW_STATUS); - panic = snd_sof_dsp_read(sdev, HDA_DSP_BAR, HDA_DSP_SRAM_REG_FW_TRACEP); - + /* print panic info if FW boot is complete. Otherwise, print the extended ROM status */ if (sdev->fw_state == SOF_FW_BOOT_COMPLETE) { + u32 status = snd_sof_dsp_read(sdev, HDA_DSP_BAR, HDA_DSP_SRAM_REG_FW_STATUS); + u32 panic = snd_sof_dsp_read(sdev, HDA_DSP_BAR, HDA_DSP_SRAM_REG_FW_TRACEP); + hda_dsp_get_registers(sdev, &xoops, &panic_info, stack, HDA_DSP_STACK_DUMP_SIZE); snd_sof_get_status(sdev, status, panic, &xoops, &panic_info, stack, HDA_DSP_STACK_DUMP_SIZE); } else { - sof_dev_dbg_or_err(sdev->dev, flags & SOF_DBG_DUMP_FORCE_ERR_LEVEL, - "status = 0x%8.8x panic = 0x%8.8x\n", - status, panic); - hda_dsp_dump_ext_rom_status(sdev, flags); - hda_dsp_get_status(sdev); } } base-commit: 058efb40641845432c52777443b3372dbc97c032 -- 2.31.1

2 2

[PATCH] ASoC: SOF: Intel: pci-tgl: add ADL-M support
by Kai Vehmanen 01 Jun '21

01 Jun '21

Add PCI DID for Intel AlderLake-M. Signed-off-by: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi(a)intel.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> --- sound/soc/sof/intel/pci-tgl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/sof/intel/pci-tgl.c b/sound/soc/sof/intel/pci-tgl.c index 88c3bf404dd7..a00262184efa 100644 --- a/sound/soc/sof/intel/pci-tgl.c +++ b/sound/soc/sof/intel/pci-tgl.c @@ -116,6 +116,8 @@ static const struct pci_device_id sof_pci_ids[] = { .driver_data = (unsigned long)&adls_desc}, { PCI_DEVICE(0x8086, 0x51c8), /* ADL-P */ .driver_data = (unsigned long)&adl_desc}, + { PCI_DEVICE(0x8086, 0x51cc), /* ADL-M */ + .driver_data = (unsigned long)&adl_desc}, { 0, } }; MODULE_DEVICE_TABLE(pci, sof_pci_ids); base-commit: 058efb40641845432c52777443b3372dbc97c032 -- 2.31.1

3 2

[PATCH] ASoC: fsl-asoc-card: Set .owner attribute when registering card.
by Nicolas Cavallari 01 Jun '21

01 Jun '21

Otherwise, when compiled as module, a WARN_ON is triggered: WARNING: CPU: 0 PID: 5 at sound/core/init.c:208 snd_card_new+0x310/0x39c [snd] [...] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.10.39 #1 Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) Workqueue: events deferred_probe_work_func [<c0111988>] (unwind_backtrace) from [<c010c8ac>] (show_stack+0x10/0x14) [<c010c8ac>] (show_stack) from [<c092784c>] (dump_stack+0xdc/0x104) [<c092784c>] (dump_stack) from [<c0129710>] (__warn+0xd8/0x114) [<c0129710>] (__warn) from [<c0922a48>] (warn_slowpath_fmt+0x5c/0xc4) [<c0922a48>] (warn_slowpath_fmt) from [<bf0496f8>] (snd_card_new+0x310/0x39c [snd]) [<bf0496f8>] (snd_card_new [snd]) from [<bf1d7df8>] (snd_soc_bind_card+0x334/0x9c4 [snd_soc_core]) [<bf1d7df8>] (snd_soc_bind_card [snd_soc_core]) from [<bf1e9cd8>] (devm_snd_soc_register_card+0x30/0x6c [snd_soc_core]) [<bf1e9cd8>] (devm_snd_soc_register_card [snd_soc_core]) from [<bf22d964>] (fsl_asoc_card_probe+0x550/0xcc8 [snd_soc_fsl_asoc_card]) [<bf22d964>] (fsl_asoc_card_probe [snd_soc_fsl_asoc_card]) from [<c060c930>] (platform_drv_probe+0x48/0x98) [...] Signed-off-by: Nicolas Cavallari <nicolas.cavallari(a)green-communications.fr> --- sound/soc/fsl/fsl-asoc-card.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c index c62bfd1c3ac7..4f55b316cf0f 100644 --- a/sound/soc/fsl/fsl-asoc-card.c +++ b/sound/soc/fsl/fsl-asoc-card.c @@ -744,6 +744,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) /* Initialize sound card */ priv->pdev = pdev; priv->card.dev = &pdev->dev; + priv->card.owner = THIS_MODULE; ret = snd_soc_of_parse_card_name(&priv->card, "model"); if (ret) { snprintf(priv->name, sizeof(priv->name), "%s-audio", -- 2.32.0.rc0

3 2

[PATCH] ASoC: SOF: reset enabled_cores state at suspend
by Kai Vehmanen 01 Jun '21

01 Jun '21

The recent changes to use common code to power up/down DSP cores also removed the reset of the core state at suspend. It turns out this is still needed. When the firmware state is reset to SOF_FW_BOOT_NOT_STARTED, also enabled_cores should be reset, and existing DSP drivers depend on this. BugLink: https://github.com/thesofproject/linux/issues/2824 Fixes: 42077f08b3 ("ASoC: SOF: update dsp core power status in common APIs") Signed-off-by: Kai Vehmanen <kai.vehmanen(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Reviewed-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com> --- sound/soc/sof/pm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/sof/pm.c b/sound/soc/sof/pm.c index fd265803f7bc..c83fb6255961 100644 --- a/sound/soc/sof/pm.c +++ b/sound/soc/sof/pm.c @@ -256,6 +256,7 @@ static int sof_suspend(struct device *dev, bool runtime_suspend) /* reset FW state */ sdev->fw_state = SOF_FW_BOOT_NOT_STARTED; + sdev->enabled_cores_mask = 0; return ret; } base-commit: 058efb40641845432c52777443b3372dbc97c032 -- 2.31.1

2 1

[PATCH] ASoC: topology: Fix spelling mistake "vesion" -> "version"
by Colin King 01 Jun '21

01 Jun '21

From: Colin Ian King <colin.king(a)canonical.com> There are spelling mistakes in comments. Fix them. Signed-off-by: Colin Ian King <colin.king(a)canonical.com> --- sound/soc/soc-topology.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index 5e65b72910e9..0a24d0d409d2 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -1881,7 +1881,7 @@ static void stream_caps_new_ver(struct snd_soc_tplg_stream_caps *dest, * @src: older version of pcm as a source * @pcm: latest version of pcm created from the source * - * Support from vesion 4. User should free the returned pcm manually. + * Support from version 4. User should free the returned pcm manually. */ static int pcm_new_ver(struct soc_tplg *tplg, struct snd_soc_tplg_pcm *src, @@ -2069,7 +2069,7 @@ static void set_link_hw_format(struct snd_soc_dai_link *link, * @src: old version of phyical link config as a source * @link: latest version of physical link config created from the source * - * Support from vesion 4. User need free the returned link config manually. + * Support from version 4. User need free the returned link config manually. */ static int link_new_ver(struct soc_tplg *tplg, struct snd_soc_tplg_link_config *src, @@ -2380,7 +2380,7 @@ static int soc_tplg_dai_elems_load(struct soc_tplg *tplg, * @src: old version of manifest as a source * @manifest: latest version of manifest created from the source * - * Support from vesion 4. Users need free the returned manifest manually. + * Support from version 4. Users need free the returned manifest manually. */ static int manifest_new_ver(struct soc_tplg *tplg, struct snd_soc_tplg_manifest *src, -- 2.31.1

2 1

[PATCH -next] ASoC: ti: omap-mcbsp: use DEVICE_ATTR_RW macro
by YueHaibing 01 Jun '21

01 Jun '21

Use DEVICE_ATTR_RW() helper instead of plain DEVICE_ATTR(), which makes the code a bit shorter and easier to read. Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> --- sound/soc/ti/omap-mcbsp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/ti/omap-mcbsp.c b/sound/soc/ti/omap-mcbsp.c index db47981768c5..4479d74f0a45 100644 --- a/sound/soc/ti/omap-mcbsp.c +++ b/sound/soc/ti/omap-mcbsp.c @@ -539,7 +539,7 @@ static ssize_t prop##_store(struct device *dev, \ return size; \ } \ \ -static DEVICE_ATTR(prop, 0644, prop##_show, prop##_store) +static DEVICE_ATTR_RW(prop) THRESHOLD_PROP_BUILDER(max_tx_thres); THRESHOLD_PROP_BUILDER(max_rx_thres); -- 2.17.1

4 3