A collection of fixes for RC1. Majority of changes are various
ASoC driver-specific small fixes and usual HD-audio quirks, while
there are a couple of core changes: a fix in ALSA core procfs code
to avoid deadlocks at disconnection and an ASoC core fix for DAPM
clock widgets.
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmVN9RwOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE9N6g/+OVspRs0DYTuUR4jjPKI9KKyhbRaWLHh2BWDw
CFEsvSMt38YqP9WXWXsioE01dw5++gdSiqrrID9Gk6ivwMjg8U3EGXaQxW4Z5MQJ
CNWaHZxTVlHNjj/mMpxsk/6c4/evHvuuAPp1k6rSnmPtzcu4nfwffyxEJggjFJmW
c8nPWYkXy1xnGpLVfb8D2FJYLacYQypyVn4vMSj/EU4jGXrz1mTJm7RcVJhCOuDq
wf+JmytYde+2WJwM7ILar9spB3C6+7S5cnttBlFA/t6ZsftI5HLlFMElXjFPugas
3j//GxJw4mjeEf4tfgd4U3AhQVcE0Jhc0t89VGeHs2vPrgXXKOe/Jdloq1OFLEnc
nG3VLEP0R5FUQEsbsEwGYXFqUBoOx6IeoKhksDnVPP1LiMS9Igu6rr8IbAYA6spl
wpGggpTULJ11fv9uGk8MA2I6V/AxJ8JhE1W0K7G9NZ0Z6hctYvP9Kr5ntnHCrJZa
K3rDzfKtAnH1FsKXa6ehRgvfTPRXCznGlNby7KQlwycL18OOzlPCLPuboe4IMT8T
SjfQt3sPhWI3+vdoo3qNoHG6l2Wt9bDO3FzGG9KxVqf0LU3vuLyWWry0uPUljAZq
8fs0vkOwrtobMgeqr38obIQJCHMaeYPHb23/kd1v7D8/oZrY4im/Y4N0+4XRGmsy
hmaNt4Q=
=6iW2
-----END PGP SIGNATURE-----
Merge tag 'sound-fix-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of fixes for rc1.
The majority of changes are various ASoC driver-specific small fixes
and usual HD-audio quirks, while there are a couple of core changes: a
fix in ALSA core procfs code to avoid deadlocks at disconnection and
an ASoC core fix for DAPM clock widgets"
* tag 'sound-fix-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
OSS: dmasound/paula: Convert to platform remove callback returning void
ALSA: hda: ASUS UM5302LA: Added quirks for cs35L41/10431A83 on i2c bus
ALSA: info: Fix potential deadlock at disconnection
ASoC: nau8540: Add self recovery to improve capture quility
ALSA: hda/realtek: Add support dual speaker for Dell
ALSA: hda: Add ASRock X670E Taichi to denylist
ALSA: hda/realtek: Add quirk for ASUS UX7602ZM
ASoC: SOF: sof-client: trivial: fix comment typo
ASoC: dapm: fix clock get name
ASoC: hdmi-codec: register hpd callback on component probe
ASoC: mediatek: mt8186_mt6366_rt1019_rt5682s: trivial: fix error messages
ASoC: da7219: Improve system suspend and resume handling
ASoC: codecs: Modify macro value error
ASoC: codecs: Modify the wrong judgment of re value
ASoC: codecs: Modify the maximum value of calib
ASoC: amd: acp: fix for i2s mode register field update
ASoC: codecs: aw88399: Fix -Wuninitialized in aw_dev_set_vcalb()
ASoC: rt712-sdca: fix speaker route missing issue
ASoC: rockchip: Fix unused rockchip_i2s_tdm_match warning for !CONFIG_OF
ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
As reported recently, ALSA core info helper may cause a deadlock at
the forced device disconnection during the procfs operation.
The proc_remove() (that is called from the snd_card_disconnect()
helper) has a synchronization of the pending procfs accesses via
wait_for_completion(). Meanwhile, ALSA procfs helper takes the global
mutex_lock(&info_mutex) at both the proc_open callback and
snd_card_info_disconnect() helper. Since the proc_open can't finish
due to the mutex lock, wait_for_completion() never returns, either,
hence it deadlocks.
TASK#1 TASK#2
proc_reg_open()
takes use_pde()
snd_info_text_entry_open()
snd_card_disconnect()
snd_info_card_disconnect()
takes mutex_lock(&info_mutex)
proc_remove()
wait_for_completion(unused_pde)
... waiting task#1 closes
mutex_lock(&info_mutex)
=> DEADLOCK
This patch is a workaround for avoiding the deadlock scenario above.
The basic strategy is to move proc_remove() call outside the mutex
lock. proc_remove() can work gracefully without extra locking, and it
can delete the tree recursively alone. So, we call proc_remove() at
snd_info_card_disconnection() at first, then delete the rest resources
recursively within the info_mutex lock.
After the change, the function snd_info_disconnect() doesn't do
disconnection by itself any longer, but it merely clears the procfs
pointer. So rename the function to snd_info_clear_entries() for
avoiding confusion.
The similar change is applied to snd_info_free_entry(), too. Since
the proc_remove() is called only conditionally with the non-NULL
entry->p, it's skipped after the snd_info_clear_entries() call.
Reported-by: Shinhyung Kang <s47.kang@samsung.com>
Closes: https://lore.kernel.org/r/664457955.21699345385931.JavaMail.epsvc@epcpadp4
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20231109141954.4283-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Most of changes at this time are for ASoC, spread over ASoC core and
drivers due to the API prefix standardization. Other than that, there
have little change wrt API, rather lots of driver-specific updates and
fixes. Some highlight below:
ASoC:
- Standardization of API prefix
- GPIO API usage improvements
- Support for HDA patches
- Lots of work on SOF, including crash dump support
- Fixes for noise when stopping some Sounwire CODECs
- Support for AMD platforms with es83xx, AMD ACP 6.3 and 7.0, Awinc
AT87390 and AW88399, many Intel platforms, many Mediatek platforms,
Qualcomm SM6115 and SC7180 platforms, Richtek RTQ9128 and Texas
Instruments TAS575x
HD-audio and USB-audio:
- Deferred probe support of audio component binding
- More fixes and enhancements for Cirrus subcodecs
- USB Scarlett2 mixer and McIntosh DSD quirk
Others:
- More enhancement of snd-aloop driver
- Update MAINTAINERS entry for linux-sound mailing list
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmVDqXcOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE+PbhAAsmiOxjXpCNVGbhy9tR+UB9p6gCIzFv5RQQIc
0DzqnqssbJt86jtFMrv0VC6BNfnwcyBVzKxWinKz861xXiM9SRU5vTirUES3Cil/
sZaQYC9ppTrZm3q2EGF4eGC349oZGzuLzk1EkEVPfNHiELwcO4R1NZbtgWKIc8LE
bNz8RT3FyxHAv+5juW5suGs0Bq4Mwa9z+eM8xEPwxPL3gpIAb5EapIesHEgaa893
w3jYwKRHCDq0ADtXIY9xI3ypqenfbeTge4nuBnw354sPRVdZInrRfCNkTJojb+tp
5Pc2gpFmTUGy6T2wG6QP23VgeV14BJHrQD3Z1Wh2aQ8V+ARa92XvY1Xeg4vJ+NE0
yhvlh028GjKrMIvhl7mmepV9mia2zA1TluqlzKEla3B5lIj0E1zvMA+vCzNAz3Ro
lV2Q0dpJ3ENQ9ahGF/d37u3glrqXxISlG9uTGdY0UcF7U9Iyxb0jEnhQYl05b+zR
Oaw/HApuvIUj4cdJWEYf0AnTTqeE8KSZ3wUlPPyuQAdAusCaQFMciWeO0EeLqEId
KR/rbnSgVKS3zHLdNw5A67Sv36E9OG/E+EiJ6Tet15a69yq2Oyv4pwMMwbqsvBG5
8kNbtBFGxOHnCrZgM6VV2/g3BP/IwyIFd5kkS2q13FXBTYRpY01dQDjHlmspasNK
hYH69AA=
=2/dI
-----END PGP SIGNATURE-----
Merge tag 'sound-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound updates from Takashi Iwai:
"Most of changes at this time are for ASoC, spread over ASoC core and
drivers due to the API prefix standardization.
Other than that, there have little change wrt API, rather lots of
driver-specific updates and fixes.
Some highlight below:
ASoC:
- Standardization of API prefix
- GPIO API usage improvements
- Support for HDA patches
- Lots of work on SOF, including crash dump support
- Fixes for noise when stopping some Sounwire CODECs
- Support for AMD platforms with es83xx, AMD ACP 6.3 and 7.0, Awinc
AT87390 and AW88399, many Intel platforms, many Mediatek platforms,
Qualcomm SM6115 and SC7180 platforms, Richtek RTQ9128 and Texas
Instruments TAS575x
HD-audio and USB-audio:
- Deferred probe support of audio component binding
- More fixes and enhancements for Cirrus subcodecs
- USB Scarlett2 mixer and McIntosh DSD quirk
Others:
- More enhancement of snd-aloop driver
- Update MAINTAINERS entry for linux-sound mailing list"
* tag 'sound-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (485 commits)
ALSA: hda: cs35l41: Fix missing error code in cs35l41_smart_amp()
ALSA: hda: cs35l41: mark cs35l41_verify_id() static
ASoC: codecs: wsa883x: make use of new mute_unmute_on_trigger flag
ASoC: soc-dai: add flag to mute and unmute stream during trigger
ASoC: ams-delta.c: use component after check
ASoC: amd: acp: select SND_SOC_AMD_ACP_LEGACY_COMMON for ACP63
ASoC: codecs: aw88399: fix typo in Kconfig select
ASoC: amd: acp: add ACPI dependency
ASoC: Intel: avs: Add rt5514 machine board
ASoC: Intel: avs: Add rt5514 machine board
ALSA: scarlett2: Add missing check with firmware version control
ALSA: virtio: use ack callback
ALSA: scarlett2: Remap Level Meter values
ALSA: scarlett2: Allow passing any output to line_out_remap()
ALSA: scarlett2: Add support for reading firmware version
ALSA: scarlett2: Rename Gen 3 config sets
ALSA: scarlett2: Rename scarlett_gen2 to scarlett2
ASoC: cs35l41: Detect CSPL errors when sending CSPL commands
ALSA: hda: cs35l41: Check CSPL state after loading firmware
ALSA: hda: cs35l41: Do not unload firmware before reset in system suspend
...
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCZTppQwAKCRCRxhvAZXjc
om2kAP4u+eLsrhJHfUPUttGUEkSkZE+5/s/f1A/1GcV51usLSgEAu8urxAnP49GW
INaDABXaFfKx8/KI/H2YFZPKGwlNEwY=
=PDDE
-----END PGP SIGNATURE-----
Merge tag 'vfs-6.7.iov_iter' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs
Pull iov_iter updates from Christian Brauner:
"This contain's David's iov_iter cleanup work to convert the iov_iter
iteration macros to inline functions:
- Remove last_offset from iov_iter as it was only used by ITER_PIPE
- Add a __user tag on copy_mc_to_user()'s dst argument on x86 to
match that on powerpc and get rid of a sparse warning
- Convert iter->user_backed to user_backed_iter() in the sound PCM
driver
- Convert iter->user_backed to user_backed_iter() in a couple of
infiniband drivers
- Renumber the type enum so that the ITER_* constants match the order
in iterate_and_advance*()
- Since the preceding patch puts UBUF and IOVEC at 0 and 1, change
user_backed_iter() to just use the type value and get rid of the
extra flag
- Convert the iov_iter iteration macros to always-inline functions to
make the code easier to follow. It uses function pointers, but they
get optimised away
- Move the check for ->copy_mc to _copy_from_iter() and
copy_page_from_iter_atomic() rather than in memcpy_from_iter_mc()
where it gets repeated for every segment. Instead, we check once
and invoke a side function that can use iterate_bvec() rather than
iterate_and_advance() and supply a different step function
- Move the copy-and-csum code to net/ where it can be in proximity
with the code that uses it
- Fold memcpy_and_csum() in to its two users
- Move csum_and_copy_from_iter_full() out of line and merge in
csum_and_copy_from_iter() since the former is the only caller of
the latter
- Move hash_and_copy_to_iter() to net/ where it can be with its only
caller"
* tag 'vfs-6.7.iov_iter' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs:
iov_iter, net: Move hash_and_copy_to_iter() to net/
iov_iter, net: Merge csum_and_copy_from_iter{,_full}() together
iov_iter, net: Fold in csum_and_memcpy()
iov_iter, net: Move csum_and_copy_to/from_iter() to net/
iov_iter: Don't deal with iter->copy_mc in memcpy_from_iter_mc()
iov_iter: Convert iterate*() to inline funcs
iov_iter: Derive user-backedness from the iterator type
iov_iter: Renumber ITER_* constants
infiniband: Use user_backed_iter() to see if iterator is UBUF/IOVEC
sound: Fix snd_pcm_readv()/writev() to use iov access functions
iov_iter, x86: Be consistent about the __user tag on copy_mc_to_user()
iov_iter: Remove last_offset from iov_iter as it was for ITER_PIPE
The compile warnings with -Wformat-truncation appearing at
snd_seq_midisynth_probe() in seq_midi.c are false-positive; those must
fit within the given string size.
For suppressing the warning, replace snprintf() with scnprintf().
As stated in the above, truncation doesn't matter.
Link: https://lore.kernel.org/r/20230915082802.28684-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The filling of a port name string got a warning with W=1 due to the
potentially too long group name. Add the string precision to limit
the size.
Fixes: 81fd444aa3 ("ALSA: seq: Bind UMP device")
Link: https://lore.kernel.org/r/20230915082802.28684-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
There is no need to use temporary string for the debugfs directory name as
we can use the device name of the card.
This change will also fixes the following compiler warning/error (W=1):
sound/core/init.c: In function ‘snd_card_init’:
sound/core/init.c:367:28: error: ‘%d’ directive writing between 1 and 10 bytes into a region of size 4 [-Werror=format-overflow=]
367 | sprintf(name, "card%d", idx);
| ^~
sound/core/init.c:367:23: note: directive argument in the range [0, 2147483646]
367 | sprintf(name, "card%d", idx);
| ^~~~~~~~
sound/core/init.c:367:9: note: ‘sprintf’ output between 6 and 15 bytes into a destination of size 8
367 | sprintf(name, "card%d", idx);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
The idx is guarantied to be less than SNDRV_CARDS (max 256 or 8) by the
code in snd_card_init(), however the compiler does not see that.
The warnings got brought to light by a recent patch upstream:
commit 6d4ab2e97d ("extrawarn: enable format and stringop overflow warnings in W=1")
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://lore.kernel.org/r/20230912110113.3166-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
ALSA sequencer core still delivers events to the disabled UMP Group,
leaving this handling to the device. But it's rather risky and it's
easy to imagine that such an unexpected event may screw up the device
firmware.
This patch avoids the superfluous event deliveries by setting the
group_filter of the UMP client as default, and evaluate the
group_filter properly at delivery from non-UMP clients.
The grouop_filter is updated upon the dynamic UMP Function Block
updates, so that it follows the change of the disabled UMP Groups,
too.
Fixes: d2b7060777 ("ALSA: seq: Add UMP group filter")
Link: https://lore.kernel.org/r/20230912085144.32534-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The update of rate_num/den and msbits were factored out to
fixup_unreferenced_params() function to be called explicitly after the
hw_refine or hw_params procedure. It's called from
snd_pcm_hw_refine_user(), but it's forgotten in the PCM compat ioctl.
This ended up with the incomplete rate_num/den and msbits parameters
when 32bit compat ioctl is used.
This patch adds the missing call in snd_pcm_ioctl_hw_params_compat().
Reported-by: Meng_Cai@novatek.com.cn
Fixes: f9a076bff0 ("ALSA: pcm: calculate non-mask/non-interval parameters always when possible")
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230829134344.31588-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Filling the rawmidi name and substream name can be truncated, and this
leads to spurious compiler warnings due to -Wformat-truncation.
Although the truncation is the expected behavior, it'd be better to
truncate the string within "(...)"
This patch puts the precision specifies to each %s for fitting the
words within the size-limited strings.
Fixes: 5f11dd938f ("ALSA: usb-audio: Attach legacy rawmidi after probing all UMP EPs")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202308251844.1FuQYsql-lkp@intel.com/
Link: https://lore.kernel.org/r/20230826072151.23408-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When the UMP Endpoint is declared as "static", that is, no dynamic
reassignment of UMP Groups, it makes little sense to expose always all
16 groups with 16 substreams. Many of those substreams are disabled
groups, hence they are useless, but applications don't know it and try
to open / access all those substreams unnecessarily.
This patch limits the number of UMP legacy rawmidi substreams only to
the active groups. The behavior is changed only for the static
endpoint (i.e. devices without UMP v1.1 feature implemented or with
the static block flag is set).
Fixes: 0b5288f5fe ("ALSA: ump: Add legacy raw MIDI support")
Link: https://lore.kernel.org/r/20230824075108.29958-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
To make it clearer which legacy substream corresponds to which UMP
group, fill the subname field of each substream object with the group
number and the endpoint name, e.g. "Group 1 (My Device)".
Ideally speaking, we should have some better link information to the
derived UMP, but it's another feature extension.
Fixes: 0b5288f5fe ("ALSA: ump: Add legacy raw MIDI support")
Link: https://lore.kernel.org/r/20230824075108.29958-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The legacy rawmidi devices are the shadows of the main UMP devices,
hence it's better to initialize them after all UMP Endpoints are
parsed. Then, at the moment the legacy rawmidi is created, we already
know the static flag or the proper EP name string, and we can fill
those information at UMP core side instead of fiddling the attributes
at a later point.
Fixes: ec362b63c4 ("ALSA: usb-audio: Enable the legacy raw MIDI support")
Link: https://lore.kernel.org/r/20230824075108.29958-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add two more helpers for copying memory between iov_iter and iomem,
which will be used by the new PCM copy ops in a few drivers.
The existing helpers became wrappers of those now.
Note that copy_from/to_iter() returns the copied bytes, hence the
error condition is adjusted accordingly.
Link: https://lore.kernel.org/r/20230815190136.8987-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
iov_iter is a universal interface to copy the data chunk from/to
user-space and kernel in a unified manner. This API can fit for ALSA
PCM copy ops, too; we had to split to copy_user and copy_kernel in the
past, and those can be unified to a single ops with iov_iter.
This patch adds a new PCM copy ops that passes iov_iter for copying
both kernel and user-space in the same way. This patch touches only
the ALSA PCM core part, and the actual users will be replaced in the
following patches.
The expansion of iov_iter is done in the PCM core right before calling
each copy callback. It's a bit suboptimal, but I took this now as
it's the most straightforward replacement. The more conversion to
iov_iter in the caller side is a TODO for future.
As of now, the old copy_user and copy_kernel ops are still kept.
Once after all users are converted, we'll drop the old copy_user and
copy_kernel ops, too.
Link: https://lore.kernel.org/r/20230815190136.8987-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Now all users of snd_device_intialize() are gone, let's drop it.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20230816160252.23396-10-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Align with the other components, and use snd_device_alloc() for the
new sound device for sequencer, too. No functional changes.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20230816160252.23396-9-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Align with the other components, and use snd_device_alloc() for the
new sound device for timer, too. No functional changes.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20230816160252.23396-8-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Embedding the struct device to snd_compr object may result in UAF when
the delayed kobj release is used. Like other devices, let's detach
the struct device from the snd_compr by allocating dynamically via
snd_device_alloc().
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20230816160252.23396-7-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch detaches the struct device from the snd_rawmidi object by
allocating via snd_device_alloc(), just like done for other devices.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20230816160252.23396-6-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Like control and PCM devices, it's better to avoid the embedded struct
device for hwdep (although it's more or less well working), too.
Change it to allocate via snd_device_alloc(), and free the memory at
the common snd_hwdep_free().
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20230816160252.23396-5-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
So far we use the embedded struct device for each PCM substreams in
struct snd_pcm. This may result in UAF when the delayed kobj release
is used; each corresponding struct device is still accessed at the
(delayed) device release, while the snd_pcm object may be already
gone.
As a workaround, detach the struct device from the snd_pcm object by
allocating via the new snd_device_alloc() helper.
A caveat is that we store the PCM substream pointer to drvdata since
the device resume and others require the access to it.
This patch is based on the fix Curtis posted initially. In this
patch, the changes are split and use the new helper function instead.
Link: https://lore.kernel.org/r/20230801171928.1460120-1-cujomalainey@chromium.org
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20230816160252.23396-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Embedding the ctl_dev in the snd_card object may result in UAF when
the delayed kobj release is used; at the delayed kobj release, it
still accesses the struct device itself while the card memory (that
embeds the struct device) may be already gone.
As a workaround, detach the struct device from the card object by
allocating via the new snd_device_alloc() helper. The rest are just
replacing ctl_dev access to the pointer.
This is based on the fix Curtis posted initially. In this patch, the
changes are split and use the new helper function instead.
Link: https://lore.kernel.org/r/20230801171928.1460120-1-cujomalainey@chromium.org
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20230816160252.23396-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Introduce a new helper, snd_device_alloc(), for allocating a struct
device that is bound with the sound class. It's a replacement of
snd_device_initialize().
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Curtis Malainey <cujomalainey@chromium.org>
Link: https://lore.kernel.org/r/20230816160252.23396-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Here's an initial batch of updates for ASoC for this release cycle.
We've got a bunch of new drivers in here, a bit of core work from
Morimoto-san and quite a lot of janitorial work. There's several
updates that pull in changes from other subsystems in order to build
on them:
- An adaptor to allow use of IIO DACs and ADCs in ASoC which pulls in
some IIO changes.
- Create a library function for intlog10() and use it in the NAU8825
driver.
- Include the ASoC tests, including the topology tests, in the default
KUnit full test coverage. This also involves enabling UML builds of
ALSA since that's the default KUnit test environment which pulls in
the addition of some stubs to the driver.
- More factoring out from Morimoto-san.
- Convert a lot of drivers to use the more modern maple tree register
cache.
- Support for AMD machines with MAX98388 and NAU8821, Cirrus Logic
CS35L36, Intel AVS machines with ES8336 and RT5663 and NXP i.MX93.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmS/t9MACgkQJNaLcl1U
h9Dg4wf+Njvy5zphgUJlSJ7vNj7GtzgldnWwfQrb+19BOtv5HHIYg4e/Yr4eWdgc
rg5DGIGvr8sxYQ44TCA59sXdTuakkNF/ejDoj8AwNsr/J3sD6S+FTkV8qLFcgQ3r
+0ElZ26I2kd6gfvDlwHfa5rJVPCa7vrg3o6EHccqRX9CSyPJRlwRqRRj+w8ftZtV
rZ7Gapz3E4A3mBo7VIO/kEgI1uSmaShM8d4HoVmxJEKJ6lbyX8SIXMBzZVq5z/iX
DcnRaMPAMhgzytmdDJ7SjJuxL0EOd6p8Lnk0jILvO6U30Z7aTunzMuK/o0GHqFkm
eHveoHIU4gbt3YqDFgPosPlxi4OCgw==
=KJZq
-----END PGP SIGNATURE-----
Merge tag 'asoc-v6.6-early' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next
ASoC: Updates for v6.6
Here's an initial batch of updates for ASoC for this release cycle.
We've got a bunch of new drivers in here, a bit of core work from
Morimoto-san and quite a lot of janitorial work. There's several
updates that pull in changes from other subsystems in order to build
on them:
- An adaptor to allow use of IIO DACs and ADCs in ASoC which pulls in
some IIO changes.
- Create a library function for intlog10() and use it in the NAU8825
driver.
- Include the ASoC tests, including the topology tests, in the default
KUnit full test coverage. This also involves enabling UML builds of
ALSA since that's the default KUnit test environment which pulls in
the addition of some stubs to the driver.
- More factoring out from Morimoto-san.
- Convert a lot of drivers to use the more modern maple tree register
cache.
- Support for AMD machines with MAX98388 and NAU8821, Cirrus Logic
CS35L36, Intel AVS machines with ES8336 and RT5663 and NXP i.MX93.
Add a new helper to add multiple vmaster followers in a shot. The
same function was open-coded in various places, and this helper
replaces them.
Link: https://lore.kernel.org/r/20230721071643.3631-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Now all needed callers have been replaced with *_locked() versions,
let's turn on the locking in snd_ctl_find_id() and
snd_ctl_find_numid().
This patch also adds the lockdep assertions for debugging, too.
Link: https://lore.kernel.org/r/20230718141304.1032-11-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
For reducing the unnecessary use of controls_rwsem in the drivers,
this patch adds a new variant for snd_ctl_find_*() helpers:
snd_ctl_find_id_locked() and snd_ctl_find_numid_locked() look for a
kctl element inside the card->controls_rwsem -- that is, doing the
very same as what snd_ctl_find_id() and snd_ctl_find_numid() did until
now. snd_ctl_find_id() and snd_ctl_find_numid() remain same,
i.e. still unlocked version, but they will be switched to locked
version once after all callers are replaced.
The patch also replaces the calls of snd_ctl_find_id() and
snd_ctl_find_numid() in a few places; all of those are places where we
know that the functions are called properly with controls_rwsem held.
All others are without rwsem (although they should have been).
After this patch, we'll turn on the locking in snd_ctl_find_id() and
snd_ctl_find_numid() to be more race-free.
Link: https://lore.kernel.org/r/20230718141304.1032-10-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
To assure the proper locking, add the lockdep check to
__snd_ctl_remove(), __snd_ctl_add_replace() and other internal
functions to handle user controls.
Link: https://lore.kernel.org/r/20230718141304.1032-6-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
So far, snd_ctl_remove() requires its caller to take
card->controls_rwsem manually before the call for avoiding possible
races. However, many callers don't care and miss the locking.
Basically it's cumbersome and error-prone to enforce it to each
caller. Moreover, card->controls_rwsem is a field that should be used
only by internal or proper helpers, and it's not to be touched at
random external places.
This patch is an attempt to make those calls more consistent: now
snd_ctl_remove() takes the card->controls_rwsem internally, just like
other API functions for kctls. Since a few callers already take the
controls_rwsem locks, the patch removes those locks at the same time,
too.
Link: https://lore.kernel.org/r/20230718141304.1032-5-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
snd_ctl_rename() expects that card->controls_rwsem is held in the
caller side for avoiding possible races, but actually no one really
did that. It's likely because this operation is done usually only at
the device initialization where no race can happen. But, it's still
safer to take a lock, so we just take the lock inside snd_ctl_rename()
like most of other API functions do.
Link: https://lore.kernel.org/r/20230718141304.1032-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
snd_jack_report() is supposed to be callable from an IRQ context, too,
and it's indeed used in that way from virtsnd driver. The fix for
input_dev race in commit 1b6a6fc528 ("ALSA: jack: Access input_dev
under mutex"), however, introduced a mutex lock in snd_jack_report(),
and this resulted in a potential sleep-in-atomic.
For addressing that problem, this patch changes the relevant code to
use the object get/put and removes the mutex usage. That is,
snd_jack_report(), it takes input_get_device() and leaves with
input_put_device() for assuring the input_dev being assigned.
Although the whole mutex could be reduced, we keep it because it can
be still a protection for potential races between creation and
deletion.
Fixes: 1b6a6fc528 ("ALSA: jack: Access input_dev under mutex")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/cf95f7fe-a748-4990-8378-000491b40329@moroto.mountain
Tested-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230706155357.3470-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The PCM memory allocation helpers have a sanity check against too many
buffer allocations. However, the check is performed without a proper
lock and the allocation isn't serialized; this allows user to allocate
more memories than predefined max size.
Practically seen, this isn't really a big problem, as it's more or
less some "soft limit" as a sanity check, and it's not possible to
allocate unlimitedly. But it's still better to address this for more
consistent behavior.
The patch covers the size check in do_alloc_pages() with the
card->memory_mutex, and increases the allocated size there for
preventing the further overflow. When the actual allocation fails,
the size is decreased accordingly.
Reported-by: BassCheck <bass@buaa.edu.cn>
Reported-by: Tuo Li <islituo@gmail.com>
Link: https://lore.kernel.org/r/CADm8Tek6t0WedK+3Y6rbE5YEt19tML8BUL45N2ji4ZAz1KcN_A@mail.gmail.com
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230703112430.30634-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A wrong size for UMP_SYSTEM_STATUS_MIDI_TIME_CODE and case
UMP_SYSTEM_STATUS_SONG_SELECT was reported at converting to the legacy
MIDI 1.0 stream. This patch corrects the value.
Fixes: 0b5288f5fe ("ALSA: ump: Add legacy raw MIDI support")
Link: https://lore.kernel.org/r/20230628094352.15754-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Jason Zhang