- Alsa-devel - mailman.alsa-project.org

Coverity: snd_usb_pcm_has_fixed_rate(): Null pointer dereferences
by coverity-bot 12 Jan '23

12 Jan '23

Hello! This is an experimental semi-automated report about issues detected by Coverity from a scan of next-20230111 as part of the linux-next scan project: https://scan.coverity.com/projects/linux-next-weekly-scan You're getting this email because you were associated with the identified lines of code (noted below) that were touched by commits: Mon Jan 9 16:05:21 2023 +0100 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Coverity reported the following: *** CID 1530547: Null pointer dereferences (REVERSE_INULL) sound/usb/pcm.c:166 in snd_usb_pcm_has_fixed_rate() 160 bool snd_usb_pcm_has_fixed_rate(struct snd_usb_substream *subs) 161 { 162 const struct audioformat *fp; 163 struct snd_usb_audio *chip = subs->stream->chip; 164 int rate = -1; 165 vvv CID 1530547: Null pointer dereferences (REVERSE_INULL) vvv Null-checking "subs" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 166 if (!subs) 167 return false; 168 if (!(chip->quirk_flags & QUIRK_FLAG_FIXED_RATE)) 169 return false; 170 list_for_each_entry(fp, &subs->fmt_list, list) { 171 if (fp->rates & SNDRV_PCM_RATE_CONTINUOUS) If this is a false positive, please let us know so we can mark it as such, or teach the Coverity rules to be smarter. If not, please make sure fixes get into linux-next. :) For patches fixing this, please include these lines (but double-check the "Fixes" first): Reported-by: coverity-bot <keescook+coverity-bot(a)chromium.org> Addresses-Coverity-ID: 1530547 ("Null pointer dereferences") Fixes: 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Thanks for your attention! -- Coverity-bot

1 0

[syzbot] KASAN: use-after-free Read in snd_pcm_oss_poll
by syzbot 12 Jan '23

12 Jan '23

Hello, syzbot found the following issue on: HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=16d906ea480000 kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5 dashboard link: https://syzkaller.appspot.com/bug?extid=ee73befabe68e7907adf compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.… kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+ee73befabe68e7907adf(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849 Read of size 8 at addr ffff8880222ed980 by task syz-executor.0/13421 CPU: 0 PID: 13421 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report+0xc0/0xf0 mm/kasan/report.c:517 snd_pcm_oss_poll+0x91c/0xab0 sound/core/oss/pcm_oss.c:2849 vfs_poll include/linux/poll.h:88 [inline] io_poll_check_events io_uring/poll.c:279 [inline] io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327 handle_tw_list+0xa8/0x460 io_uring/io_uring.c:1169 tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1224 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fbb08c8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fbb099a6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007fbb08dabf88 RCX: 00007fbb08c8c0c9 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbb08dabf8c RBP: 00007fbb08dabf80 R08: 00007ffdf79a3080 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 00007fbb08dabf8c R13: 00007ffdf794d43f R14: 00007fbb099a6300 R15: 0000000000022000 </TASK> Allocated by task 13421: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:580 [inline] kzalloc include/linux/slab.h:720 [inline] snd_pcm_oss_open_file sound/core/oss/pcm_oss.c:2433 [inline] snd_pcm_oss_open.part.0+0x558/0x1330 sound/core/oss/pcm_oss.c:2535 snd_pcm_oss_open+0x44/0x60 sound/core/oss/pcm_oss.c:2499 soundcore_open+0x452/0x620 sound/sound_core.c:593 chrdev_open+0x26a/0x770 fs/char_dev.c:414 do_dentry_open+0x6cc/0x13f0 fs/open.c:883 do_open fs/namei.c:3558 [inline] path_openat+0x1bc1/0x2b40 fs/namei.c:3715 do_filp_open+0x1ba/0x410 fs/namei.c:3742 do_sys_openat2+0x16d/0x4c0 fs/open.c:1311 do_sys_open fs/open.c:1327 [inline] __do_sys_openat fs/open.c:1343 [inline] __se_sys_openat fs/open.c:1338 [inline] __x64_sys_openat+0x143/0x1f0 fs/open.c:1338 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 13421: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800 snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2415 [inline] snd_pcm_oss_release_file sound/core/oss/pcm_oss.c:2405 [inline] snd_pcm_oss_release+0x182/0x300 sound/core/oss/pcm_oss.c:2592 __fput+0x27c/0xa90 fs/file_table.c:321 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff8880222ed980 which belongs to the cache kmalloc-16 of size 16 The buggy address is located 0 bytes inside of 16-byte region [ffff8880222ed980, ffff8880222ed990) The buggy address belongs to the physical page: page:ffffea000088bb40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x222ed anon flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffff8880124413c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000800080 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5107, tgid 5107 (syz-executor.1), ts 750843463810, free_ts 748166918947 prep_new_page mm/page_alloc.c:2549 [inline] get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324 __alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590 __alloc_pages_node include/linux/gfp.h:237 [inline] alloc_slab_page mm/slub.c:1853 [inline] allocate_slab+0xa7/0x350 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292 __slab_alloc_node mm/slub.c:3345 [inline] slab_alloc_node mm/slub.c:3442 [inline] __kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc_node+0x4d/0xd0 mm/slab_common.c:974 kmalloc_node include/linux/slab.h:610 [inline] kvmalloc_node+0xa2/0x1a0 mm/util.c:603 xt_jumpstack_alloc net/netfilter/x_tables.c:1354 [inline] xt_replace_table+0x1a7/0x8c0 net/netfilter/x_tables.c:1393 __do_replace+0x1d7/0x8e0 net/ipv4/netfilter/ip_tables.c:1067 do_replace net/ipv4/netfilter/ip_tables.c:1140 [inline] do_ipt_set_ctl+0x89d/0xb10 net/ipv4/netfilter/ip_tables.c:1630 nf_setsockopt+0x87/0xe0 net/netfilter/nf_sockopt.c:101 ip_setsockopt+0xf2/0x110 net/ipv4/ip_sockglue.c:1445 tcp_setsockopt+0x9f/0x100 net/ipv4/tcp.c:3802 __sys_setsockopt+0x2c6/0x5b0 net/socket.c:2246 __do_sys_setsockopt net/socket.c:2257 [inline] __se_sys_setsockopt net/socket.c:2254 [inline] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2254 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1451 [inline] free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501 free_unref_page_prepare mm/page_alloc.c:3387 [inline] free_unref_page+0x1d/0x490 mm/page_alloc.c:3482 __unfreeze_partials+0x17c/0x1a0 mm/slub.c:2637 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x192/0x220 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook mm/slab.h:769 [inline] slab_alloc_node mm/slub.c:3452 [inline] slab_alloc mm/slub.c:3460 [inline] __kmem_cache_alloc_lru mm/slub.c:3467 [inline] kmem_cache_alloc+0x175/0x320 mm/slub.c:3476 kmem_cache_zalloc include/linux/slab.h:710 [inline] alloc_buffer_head+0x24/0x150 fs/buffer.c:2946 alloc_page_buffers+0x284/0x790 fs/buffer.c:871 create_empty_buffers+0x30/0xf30 fs/buffer.c:1585 ext4_block_write_begin+0x10a7/0x15f0 fs/ext4/inode.c:1080 ext4_da_write_begin+0x450/0xb70 fs/ext4/inode.c:3082 generic_perform_write+0x256/0x570 mm/filemap.c:3772 ext4_buffered_write_iter+0x15b/0x460 fs/ext4/file.c:285 ext4_file_write_iter+0x8bf/0x1710 fs/ext4/file.c:700 __kernel_write_iter+0x262/0x730 fs/read_write.c:517 Memory state around the buggy address: ffff8880222ed880: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc ffff8880222ed900: fa fb fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc >ffff8880222ed980: fa fb fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc ^ ffff8880222eda00: 00 00 fc fc 00 00 fc fc fa fb fc fc 00 00 fc fc ffff8880222eda80: fa fb fc fc 00 00 fc fc fa fb fc fc fa fb fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 1

Re: (subset) [PATCH v2 00/27] ARM: pxa: remove all unused boards&drivers
by Mark Brown 12 Jan '23

12 Jan '23

On Thu, 05 Jan 2023 14:45:55 +0100, Arnd Bergmann wrote: > Most of the legacy PXA board files were marked as unused in linux-5.19 and > can get removed in linux-6.3. There is support for pxa250/pxa270/pxa300 > using devicetree already, which supports a number of boards, but progress > on converting the remaining ones has stalled over the past few years. > > The two boards that are left in the tree for now are the three 'sharpsl' > variants (spitz/akita/borzoi) and the 'gumstix' family of machines. > Both of these are supported by qemu, which can be helpful for completing > the DT conversion. > > [...] Applied to https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next Thanks! [14/27] ASoC: PXA: make SND_PXA2XX_SOC_AC97 user-selectable commit: 5eab9265759e2fb042aa452931c3d06ab7ab8dae [15/27] ASoC: pxa: remove unused board support (no commit info) All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark

1 0

[PATCH v2 0/5] ASoC: Intel: Balance ACPI device refcount
by Andy Shevchenko 12 Jan '23

12 Jan '23

While looking for the open coded put_device(&adev->dev) cases, where adev stands for ACPI device, I noticed that in a few ASoC Intel driver, among others, the refcount is not balanced properly in some cases. This series fixes that issue and converts to use acpi_dev_put(). Changelog v2: - split Intel drivers out from others (Pierre) - sent with cover letter (Mark) Andy Shevchenko (5): ASoC: Intel: bytcht_es8316: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use ASoC: Intel: bytcr_rt5640: Drop reference count of ACPI device after use ASoC: Intel: bytcr_wm5102: Drop reference count of ACPI device after use ASoC: Intel: sof_es8336: Drop reference count of ACPI device after use sound/soc/intel/boards/bytcht_es8316.c | 20 ++++++++++++-------- sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++------ sound/soc/intel/boards/bytcr_rt5651.c | 2 +- sound/soc/intel/boards/bytcr_wm5102.c | 2 +- sound/soc/intel/boards/sof_es8336.c | 14 ++++++++------ 5 files changed, 28 insertions(+), 22 deletions(-) -- 2.39.0

3 7

[PATCH] ASoC: soc-pcm.c: Introduce a count to record the times of setting DAIs parameters
by Chancel Liu 12 Jan '23

12 Jan '23

The commit 1da681e52853 ("ASoC: soc-pcm.c: Clear DAIs parameters after stream_active is updated") tries to make sure DAIs parameters can be cleared properly through moving the cleanup to the place where stream_active is updated. However, it will cause the cleanup only happening in soc_pcm_close(). Suppose a case: aplay -Dhw:0 44100.wav 48000.wav. The case calls soc_pcm_open()->soc_pcm_hw_params()->soc_pcm_hw_free()-> soc_pcm_hw_params()->soc_pcm_hw_free()->soc_pcm_close() in order. The parameters would be remained in the system even if the playback of 44100.wav is finished. The case requires us clearing parameters in phase of soc_pcm_hw_free(). We shouldn't use stream_active to decide if we must do the cleanup since it is finally updated in soc_pcm_close(). This patch introduces a usage count called hw_params_count in snd_soc_dai structure. It records the times of setting parameters to this DAI then decreases each time soc_pcm_hw_free() is called. If the count decreases to 0, it means this DAI is not used now and we should clear the parameters. Fixes: 1da681e52853 ("ASoC: soc-pcm.c: Clear DAIs parameters after stream_active is updated") Signed-off-by: Chancel Liu <chancel.liu(a)nxp.com> --- include/sound/soc-dai.h | 3 +++ sound/soc/soc-pcm.c | 16 +++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h index ea7509672086..a7e589a0fe72 100644 --- a/include/sound/soc-dai.h +++ b/include/sound/soc-dai.h @@ -451,6 +451,9 @@ struct snd_soc_dai { unsigned int channels; unsigned int sample_bits; + /* Count of setting DAI parameters */ + unsigned int hw_params_count; + /* parent platform/codec */ struct snd_soc_component *component; diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 579a44d81d9a..2c2a5dcf9e06 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -711,14 +711,10 @@ static int soc_pcm_clean(struct snd_soc_pcm_runtime *rtd, if (!rollback) { snd_soc_runtime_deactivate(rtd, substream->stream); - /* clear the corresponding DAIs parameters when going to be inactive */ - for_each_rtd_dais(rtd, i, dai) { - if (snd_soc_dai_active(dai) == 0) - soc_pcm_set_dai_params(dai, NULL); + for_each_rtd_dais(rtd, i, dai) if (snd_soc_dai_stream_active(dai, substream->stream) == 0) snd_soc_dai_digital_mute(dai, 1, substream->stream); - } } for_each_rtd_dais(rtd, i, dai) @@ -949,6 +945,14 @@ static int soc_pcm_hw_clean(struct snd_soc_pcm_runtime *rtd, snd_soc_dpcm_mutex_assert_held(rtd); + /* clear the corresponding DAIs parameters when hw_params_count decreases to 0 */ + for_each_rtd_dais(rtd, i, dai) + if (snd_soc_dai_stream_valid(dai, substream->stream)) { + dai->hw_params_count--; + if (dai->hw_params_count == 0) + soc_pcm_set_dai_params(dai, NULL); + } + /* run the stream event */ snd_soc_dapm_stream_stop(rtd, substream->stream); @@ -1051,6 +1055,7 @@ static int __soc_pcm_hw_params(struct snd_soc_pcm_runtime *rtd, soc_pcm_set_dai_params(codec_dai, &codec_params); snd_soc_dapm_update_dai(substream, &codec_params, codec_dai); + codec_dai->hw_params_count++; } for_each_rtd_cpu_dais(rtd, i, cpu_dai) { @@ -1068,6 +1073,7 @@ static int __soc_pcm_hw_params(struct snd_soc_pcm_runtime *rtd, /* store the parameters for each DAI */ soc_pcm_set_dai_params(cpu_dai, params); snd_soc_dapm_update_dai(substream, params, cpu_dai); + cpu_dai->hw_params_count++; } ret = snd_soc_pcm_component_hw_params(substream, params); -- 2.25.1

4 3

[syzbot] KASAN: use-after-free Read in snd_rawmidi_poll
by syzbot 12 Jan '23

12 Jan '23

Hello, syzbot found the following issue on: HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112 git tree: linux-next console output: https://syzkaller.appspot.com/x/log.txt?x=1748baa1480000 kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5 dashboard link: https://syzkaller.appspot.com/bug?extid=e3ec01fd2d18c9264c3b compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.… kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e3ec01fd2d18c9264c3b(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in snd_rawmidi_poll+0x559/0x680 sound/core/rawmidi.c:1655 Read of size 8 at addr ffff8881479ea708 by task syz-executor.0/7629 CPU: 1 PID: 7629 Comm: syz-executor.0 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report+0xc0/0xf0 mm/kasan/report.c:517 snd_rawmidi_poll+0x559/0x680 sound/core/rawmidi.c:1655 vfs_poll include/linux/poll.h:88 [inline] io_poll_check_events io_uring/poll.c:279 [inline] io_poll_task_func+0x3a6/0x1220 io_uring/poll.c:327 handle_tw_list+0xa8/0x460 io_uring/io_uring.c:1169 tctx_task_work+0x12e/0x530 io_uring/io_uring.c:1224 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f66cbc8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f66cc936168 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 RAX: fffffffffffffe00 RBX: 00007f66cbdabf80 RCX: 00007f66cbc8c0c9 RDX: 0000000000000001 RSI: 0000000020000800 RDI: 0000000000000006 RBP: 00007f66cbce7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe231decef R14: 00007f66cc936300 R15: 0000000000022000 </TASK> Allocated by task 7629: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:580 [inline] snd_rawmidi_open+0x39a/0xb70 sound/core/rawmidi.c:482 snd_open+0x223/0x460 sound/core/sound.c:169 chrdev_open+0x26a/0x770 fs/char_dev.c:414 do_dentry_open+0x6cc/0x13f0 fs/open.c:883 do_open fs/namei.c:3558 [inline] path_openat+0x1bc1/0x2b40 fs/namei.c:3715 do_filp_open+0x1ba/0x410 fs/namei.c:3742 do_sys_openat2+0x16d/0x4c0 fs/open.c:1311 do_sys_open fs/open.c:1327 [inline] __do_sys_openat fs/open.c:1343 [inline] __se_sys_openat fs/open.c:1338 [inline] __x64_sys_openat+0x143/0x1f0 fs/open.c:1338 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 7629: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0xaf/0x2d0 mm/slub.c:3800 snd_rawmidi_release+0x6a/0xf0 sound/core/rawmidi.c:619 __fput+0x27c/0xa90 fs/file_table.c:321 task_work_run+0x16f/0x270 kernel/task_work.c:179 get_signal+0x1c7/0x24f0 kernel/signal.c:2635 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff8881479ea700 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 8 bytes inside of 32-byte region [ffff8881479ea700, ffff8881479ea720) The buggy address belongs to the physical page: page:ffffea00051e7a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1479ea flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff) raw: 057ff00000000200 ffff888012441500 ffffea0001debd00 dead000000000004 raw: 0000000000000000 0000000000400040 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, tgid 1 (swapper/0), ts 9844741481, free_ts 0 prep_new_page mm/page_alloc.c:2549 [inline] get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324 __alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590 alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2114 alloc_pages+0x233/0x270 mm/mempolicy.c:2276 alloc_slab_page mm/slub.c:1851 [inline] allocate_slab+0x25f/0x350 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292 __slab_alloc_node mm/slub.c:3345 [inline] slab_alloc_node mm/slub.c:3442 [inline] __kmem_cache_alloc_node+0x136/0x330 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:966 [inline] __kmalloc+0x4a/0xd0 mm/slab_common.c:980 kmalloc include/linux/slab.h:584 [inline] usb_get_configuration+0x381/0x3b60 drivers/usb/core/config.c:919 usb_enumerate_device drivers/usb/core/hub.c:2405 [inline] usb_new_device+0x56a/0x7b0 drivers/usb/core/hub.c:2543 register_root_hub+0x421/0x573 drivers/usb/core/hcd.c:1017 usb_add_hcd.cold+0x100c/0x13a1 drivers/usb/core/hcd.c:2991 vhci_hcd_probe+0x14f/0x3a0 drivers/usb/usbip/vhci_hcd.c:1362 platform_probe+0x100/0x1f0 drivers/base/platform.c:1400 call_driver_probe drivers/base/dd.c:560 [inline] really_probe+0x249/0xb90 drivers/base/dd.c:639 page_owner free stack trace missing Memory state around the buggy address: ffff8881479ea600: 00 00 00 00 fc fc fc fc 00 00 00 07 fc fc fc fc ffff8881479ea680: fa fb fb fb fc fc fc fc 00 00 00 07 fc fc fc fc >ffff8881479ea700: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc ^ ffff8881479ea780: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc ffff8881479ea800: 00 00 00 01 fc fc fc fc 00 00 00 00 fc fc fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 1

[PATCH 0/5] Add tdm support in acp machine driver
by Venkata Prasad Potturu 12 Jan '23

12 Jan '23

This patch set is to add new cpu dai, refactor dai format implementation and add tdm support in acp machine driver. Venkata Prasad Potturu (5): ASoC: amd: acp: Refactor i2s bclk calculation ASoC: amd: acp: Add new cpu dai's in machine driver ASoC: amd: acp: Refactor dai format implementation ASoC: amd: acp: Add tdm support in machine driver ASoC: amd: acp: Enable tdm support for skyrim platforms sound/soc/amd/acp/acp-legacy-mach.c | 13 ++ sound/soc/amd/acp/acp-mach-common.c | 275 +++++++++++++++++++++++----- sound/soc/amd/acp/acp-mach.h | 4 + sound/soc/amd/acp/acp-sof-mach.c | 14 ++ 4 files changed, 256 insertions(+), 50 deletions(-) -- 2.25.1

2 7

[PATCH] ASoC: SOF: sof-audio: Check snd_sof_widget pointer not NULL
by AngeloGioacchino Del Regno 12 Jan '23

12 Jan '23

In function sof_unprepare_widgets_in_path(), check if swidget is actually not NULL, as the widget may not have been initialized at all. This commit solves the following kernel panic seen on MediaTek MT8195: [ 18.025215] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000014 [ 18.034266] Mem abort info: [ 18.037314] ESR = 0x0000000096000004 [ 18.041314] EC = 0x25: DABT (current EL), IL = 32 bits [ 18.046876] SET = 0, FnV = 0 [ 18.050180] EA = 0, S1PTW = 0 [ 18.053572] FSC = 0x04: level 0 translation fault [ 18.058700] Data abort info: [ 18.061832] ISV = 0, ISS = 0x00000004 [ 18.065919] CM = 0, WnR = 0 [ 18.069137] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000115495000 [ 18.075826] [0000000000000014] pgd=0000000000000000, p4d=0000000000000000 [ 18.082867] Internal error: Oops: 0000000096000004 [#1] SMP [ 18.088688] Modules linked in: af_alg qrtr btusb btrtl btintel btmtk btbcm bluetooth 8021q garp uvcvideo mrp stp ecdh_generic llc ecc videobuf2_vmalloc mt7921e mt7921_common mt76_connac_lib mt76 mac80211 snd_sof_ipc_msg_injector snd_sof_ipc_flood_test cfg80211 snd_sof_mt8195 mtk_adsp_common snd_sof_xtensa_dsp snd_sof_of panfrost rfkill snd_sof crct10dif_ce cros_ec_sensors cros_ec_lid_angle gpu_sched sbs_battery cros_usbpd_logger cros_ec_sensors_core hid_multitouch snd_sof_utils fuse ipv6 [ 18.132109] CPU: 5 PID: 657 Comm: wireplumber Tainted: G W 6.2.0-rc3-next-20230111+ #230 [ 18.141834] Hardware name: Acer Tomato (rev2) board (DT) [ 18.147392] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 18.154600] pc : sof_unprepare_widgets_in_path.isra.0+0x28/0x10c [snd_sof] [ 18.161735] lr : sof_walk_widgets_in_order+0x198/0x1d0 [snd_sof] [ 18.167996] sp : ffff80000eb0b870 [ 18.171558] x29: ffff80000eb0b870 x28: 0000000000000001 x27: ffff5d8e178c4c00 [ 18.178939] x26: ffffbd50140fd758 x25: ffffbd50140fd760 x24: 0000000000000000 [ 18.186321] x23: 0000000000000000 x22: ffff5d8e109dd080 x21: ffff5d8e0a429280 [ 18.193702] x20: 0000000000000000 x19: ffff5d8e11fe4800 x18: 0000000000000000 [ 18.201083] x17: 0000000000000000 x16: ffffbd5073deabb0 x15: 0000000000000000 [ 18.208464] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 18.215846] x11: 0000000000000000 x10: 0000000000002780 x9 : ffffbd50140eb4bc [ 18.223228] x8 : ffff5d8e1b5327e0 x7 : 0000000000000000 x6 : ffff5d8e1b530000 [ 18.230610] x5 : 0000000000000003 x4 : 0000000000000001 x3 : 0000000000000000 [ 18.237991] x2 : 0000000000000000 x1 : ffff5d8e11fe4800 x0 : ffff5d8e0a429280 [ 18.245372] Call trace: [ 18.248066] sof_unprepare_widgets_in_path.isra.0+0x28/0x10c [snd_sof] [ 18.254847] sof_walk_widgets_in_order+0x198/0x1d0 [snd_sof] [ 18.260760] sof_widget_list_free+0x7c/0xbc [snd_sof] [ 18.266066] sof_pcm_hw_free+0x10c/0x1c0 [snd_sof] [ 18.271110] snd_soc_pcm_component_hw_free+0x8c/0xe0 [ 18.276327] soc_pcm_hw_clean+0x60/0x11c [ 18.280498] dpcm_fe_dai_hw_free+0x98/0x110 [ 18.284930] snd_pcm_common_ioctl+0xc48/0x1a2c [ 18.289624] snd_pcm_ioctl+0x38/0x50 [ 18.293448] __arm64_sys_ioctl+0xb0/0xf4 [ 18.297620] invoke_syscall+0x50/0x120 [ 18.301618] el0_svc_common.constprop.0+0x17c/0x1b0 [ 18.306744] do_el0_svc+0x40/0xc4 [ 18.310307] el0_svc+0x48/0xf0 [ 18.313611] el0t_64_sync_handler+0xb8/0xc0 [ 18.318041] el0t_64_sync+0x1a0/0x1a4 [ 18.321953] Code: aa0103f3 f90013f5 aa0003f5 f9406834 (39405280) [ 18.328293] ---[ end trace 0000000000000000 ]--- Fixes: 9862dcf70245 ("ASoC: SOF: don't unprepare widget used other pipelines") Fixes: ce59804d2643 ("ASoC: SOF: clear prepare state when widget is unprepared") Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> --- sound/soc/sof/sof-audio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/sof/sof-audio.c b/sound/soc/sof/sof-audio.c index e1ab8380e7d8..1988717762b3 100644 --- a/sound/soc/sof/sof-audio.c +++ b/sound/soc/sof/sof-audio.c @@ -274,7 +274,7 @@ sof_unprepare_widgets_in_path(struct snd_sof_dev *sdev, struct snd_soc_dapm_widg struct snd_soc_dapm_path *p; /* return if the widget is in use or if it is already unprepared */ - if (!swidget->prepared || swidget->use_count > 1) + if (!swidget || !swidget->prepared || swidget->use_count > 1) return; widget_ops = tplg_ops ? tplg_ops->widget : NULL; -- 2.39.0

2 3

[PATCH v2 1/1] ASoC: amd: acp-es8336: Drop reference count of ACPI device after use
by Andy Shevchenko 12 Jan '23

12 Jan '23

Theoretically the device might gone if its reference count drops to 0. This might be the case when we try to find the first physical node of the ACPI device. We need to keep reference to it until we get a result of the above mentioned call. Refactor the code to drop the reference count at the correct place. While at it, move to acpi_dev_put() as symmetrical call to the acpi_dev_get_first_match_dev(). Fixes: 02527c3f2300 ("ASoC: amd: add Machine driver for Jadeite platform") Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Acked-by: Vijendar Mukunda <Vijendar.Mukunda(a)amd.com> --- v2: split from big series (Pierre), added tag (Vijendar) sound/soc/amd/acp-es8336.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sound/soc/amd/acp-es8336.c b/sound/soc/amd/acp-es8336.c index 2fe8df86053a..89499542c803 100644 --- a/sound/soc/amd/acp-es8336.c +++ b/sound/soc/amd/acp-es8336.c @@ -198,9 +198,11 @@ static int st_es8336_late_probe(struct snd_soc_card *card) int ret; adev = acpi_dev_get_first_match_dev("ESSX8336", NULL, -1); - if (adev) - put_device(&adev->dev); + if (!adev) + return -ENODEV; + codec_dev = acpi_get_first_physical_node(adev); + acpi_dev_put(adev); if (!codec_dev) dev_err(card->dev, "can not find codec dev\n"); -- 2.39.0

2 1

[GIT PULL] ASoC fixes for v6.2-rc3
by Mark Brown 12 Jan '23

12 Jan '23

The following changes since commit 1b929c02afd37871d5afb9d498426f83432e71c2: Linux 6.2-rc1 (2022-12-25 13:41:39 -0800) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git tags/asoc-fix-v6.2-rc3 for you to fetch changes up to 242fc66ae6e1e2b8519daacc7590a73cd0e8a6e4: ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets (2023-01-10 12:45:22 +0000) ---------------------------------------------------------------- ASoC: Fixes for v6.2 There's quite a few fixes here, mostly board specific apart from the SOF power management ones. We also have some new quirks and Kconfig tweaks to enable existing code on new platforms, and a one liner which exposes the SOF firmware state in debugfs to aid with debugging. There's also a SPI fix that I mistakenly put in the wrong queue and did some merges on top of before I noticed, it seemed more trouble than it was worth to unpick things. A copy of the same patch is also in the spi tree. ---------------------------------------------------------------- Ajye Huang (1): ASoC: Intel: sof_nau8825: add variant with nau8318 amplifier. Allen-KH Cheng (1): ASoC: mediatek: mt8186: Add machine support for max98357a Aniol Martí (1): ASoC: amd: yc: Add ASUS M5402RA into DMI table Arnd Bergmann (2): ASoC: Intel: fix sof-nau8825 link failure ASoC: Intel: sof-nau8825: fix module alias overflow Brian Norris (1): ASoC: qcom: lpass-cpu: Fix fallback SD line index handling Chancel Liu (1): ASoC: fsl_micfil: Correct the number of steps on SX controls ChiYuan Huang (1): ASoC: rt9120: Make dev PM runtime bind AsoC component PM Curtis Malainey (1): ASoC: SOF: Add FW state to debugfs Emanuele Ghidoli (1): ASoC: wm8904: fix wrong outputs volume after power reactivation Gongjun Song (2): ASoC: Intel: soc-acpi: add configuration for variant of 0C40 product ASoC: Intel: soc-acpi: add configuration for variant of 0C11 product Krzysztof Kozlowski (2): ASoC: dt-bindings: qcom,lpass-wsa-macro: correct clocks on SM8250 ASoC: dt-bindings: qcom,lpass-tx-macro: correct clocks on SC7280 Mark Brown (4): ASoC: SOF: Fixes for suspend after firmware crash Add new AMP MAX98360A for RT5682S ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets Mars Chen (1): ASoC: support machine driver with max98360 Ranjani Sridharan (2): ASoC: SOF: pm: Set target state earlier ASoC: SOF: pm: Always tear down pipelines before DSP suspend Ricardo Ribalda (1): spi: mediatek: Enable irq before the spi registration Stephan Gerhold (1): ASoC: qcom: Fix building APQ8016 machine driver without SOUNDWIRE Wim Van Boven (1): ASoC: amd: yc: Add Razer Blade 14 2022 into DMI table tongjian (2): ASoC: mediatek: mt8186: support rt5682s_max98360 ASoC: dt-bindings: mt8186-mt6366: add new compatible for max98360a .../sound/mt8186-mt6366-rt1019-rt5682s.yaml | 1 + .../bindings/sound/qcom,lpass-tx-macro.yaml | 4 +- .../bindings/sound/qcom,lpass-wsa-macro.yaml | 58 ++++++++-- drivers/spi/spi-mt65xx.c | 12 +- sound/soc/amd/yc/acp6x-mach.c | 14 +++ sound/soc/codecs/rt9120.c | 12 ++ sound/soc/codecs/wm8904.c | 7 ++ sound/soc/fsl/fsl-asoc-card.c | 8 +- sound/soc/fsl/fsl_micfil.c | 16 +-- sound/soc/fsl/fsl_ssi.c | 4 +- sound/soc/intel/boards/Kconfig | 2 + sound/soc/intel/boards/sof_nau8825.c | 31 +++++- sound/soc/intel/common/soc-acpi-intel-adl-match.c | 20 +++- sound/soc/intel/common/soc-acpi-intel-rpl-match.c | 50 +++++++++ sound/soc/mediatek/Kconfig | 4 +- .../mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c | 22 +++- sound/soc/qcom/Kconfig | 21 ++-- sound/soc/qcom/Makefile | 2 + sound/soc/qcom/common.c | 114 ------------------- sound/soc/qcom/common.h | 10 -- sound/soc/qcom/lpass-cpu.c | 5 +- sound/soc/qcom/sc8280xp.c | 1 + sound/soc/qcom/sdw.c | 123 +++++++++++++++++++++ sound/soc/qcom/sdw.h | 18 +++ sound/soc/qcom/sm8250.c | 1 + sound/soc/sof/debug.c | 4 +- sound/soc/sof/pm.c | 9 +- 27 files changed, 389 insertions(+), 184 deletions(-) create mode 100644 sound/soc/qcom/sdw.c create mode 100644 sound/soc/qcom/sdw.h

2 1