Skip to content

Conversation

@drok
Copy link
Owner

@drok drok commented Sep 5, 2022

From: Takashi Iwai tiwai@suse.de
Original Request: [GIT PULL] sound fixes for 5.18-rc6

Linus,

please pull sound fixes for v5.18-rc6 from:

  git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git tags/sound-5.18-rc6

The topmost commit is ac02e3cd5ab9407dcf926df2a1085c13881ccf7a

----------------------------------------------------------------

sound fixes for 5.18-rc6

It became slightly larger as I've been off in the last weeks.
The majority of changes at this PR is about ASoC, the fixes for
dmaengine and for for addressing issues reported by CI, as well as
other device-specific small fixes.  Also, the fixes for FireWire
core stack and the usual HD-audio quirks are included.

----------------------------------------------------------------

Ajit Kumar Pandey (1):
      ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback

Andy Chi (1):
      ALSA: hda/realtek: Enable mute/micmute LEDs support for HP Laptops

Chengfeng Ye (1):
      firewire: fix potential uaf in outbound_phy_packet_callback()

ChiYuan Huang (1):
      ASoC: rt9120: Correct the reg 0x09 size to one byte

Codrin Ciubotariu (2):
      ASoC: atmel: mchp-pdmc: set prepare_slave_config
      ASoC: dmaengine: Restore NULL prepare_slave_config() callback

Hui Wang (1):
      ALSA: hda/realtek: Fix mute led issue on thinkpad with cs35l41 s-codec

Jakob Koschel (1):
      firewire: remove check of list iterator against head past the loop body

Mark Brown (8):
      ASoC: wm8958: Fix change notifications for DSP controls
      ASoC: da7219: Fix change notifications for tone generator frequency
      ASoC: meson: Fix event generation for AUI ACODEC mux
      ASoC: meson: Fix event generation for AUI CODEC mux
      ASoC: meson: Fix event generation for G12A tohdmi mux
      ASoC: max98090: Reject invalid values in custom control put()
      ASoC: max98090: Generate notifications on changes for custom control
      ASoC: ops: Validate input values in snd_soc_put_volsw_range()

Neil Armstrong (2):
      ASoC: meson: axg-tdm-interface: Fix formatters in trigger"
      ASoC: meson: axg-card: Fix nonatomic links

Niels Dossche (1):
      firewire: core: extend card->lock in fw_core_handle_bus_reset

Olivier Moysan (1):
      ASoC: simple-card-utils: fix sysclk shutdown

Pierre-Louis Bossart (1):
      ASoC: soc-ops: fix error handling

Takashi Sakamoto (1):
      ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes

Zihao Wang (1):
      ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers

---
 drivers/firewire/core-card.c               |  3 +++
 drivers/firewire/core-cdev.c               |  4 +++-
 drivers/firewire/core-topology.c           |  9 +++------
 drivers/firewire/core-transaction.c        | 30 ++++++++++++++++--------------
 drivers/firewire/sbp2.c                    | 13 +++++++------
 sound/firewire/fireworks/fireworks_hwdep.c |  1 +
 sound/pci/hda/patch_realtek.c              | 15 +++++++++------
 sound/soc/atmel/mchp-pdmc.c                |  1 +
 sound/soc/codecs/da7219.c                  | 14 ++++++++++----
 sound/soc/codecs/max98090.c                |  5 ++++-
 sound/soc/codecs/rt9120.c                  |  1 -
 sound/soc/codecs/wm8958-dsp2.c             |  8 ++++----
 sound/soc/generic/simple-card-utils.c      |  2 +-
 sound/soc/meson/aiu-acodec-ctrl.c          |  2 +-
 sound/soc/meson/aiu-codec-ctrl.c           |  2 +-
 sound/soc/meson/axg-card.c                 |  1 -
 sound/soc/meson/axg-tdm-interface.c        | 26 +++++---------------------
 sound/soc/meson/g12a-tohdmitx.c            |  2 +-
 sound/soc/soc-generic-dmaengine-pcm.c      |  6 +++---
 sound/soc/soc-ops.c                        | 20 ++++++++++++++++++--
 sound/soc/sof/sof-pci-dev.c                |  5 +++++
 21 files changed, 96 insertions(+), 74 deletions(-)


```

broonie and others added 25 commits April 19, 2022 12:07
The WM8958 DSP controls all return 0 on successful write, not a boolean
value indicating if the write changed the value of the control. Fix this
by returning 1 after a change, there is already a check at the start of
each put() that skips the function in the case that there is no change.

Signed-off-by: Mark Brown <broonie@kernel.org>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20220416125408.197440-1-broonie@kernel.org
Cc: stable@vger.kernel.org
In asoc_simple_shutdown() the snd_soc_dai_set_sysclk() function
is called twice with input direction SND_SOC_CLOCK_IN.
Restore one call with output direction SND_SOC_CLOCK_OUT.

Fixes: 5ca2ab4 ("ASoC: simple-card-utils: Add new system-clock-fixed flag")

Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Link: https://lore.kernel.org/r/20220412111658.11015-1-olivier.moysan@foss.st.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The tone generator frequency control just returns 0 on successful write,
not a boolean value indicating if there was a change or not.  Compare
what was written with the value that was there previously so that
notifications are generated appropriately when the value changes.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220420133437.569229-1-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
The AIU ACODEC has a custom put() operation which returns 0 when the value
of the mux changes, meaning that events are not generated for userspace.
Change to return 1 in this case, the function returns early in the case
where there is no change.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20220421123803.292063-2-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
The AIU CODEC has a custom put() operation which returns 0 when the value
of the mux changes, meaning that events are not generated for userspace.
Change to return 1 in this case, the function returns early in the case
where there is no change.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20220421123803.292063-3-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
The G12A tohdmi has a custom put() operation which returns 0 when the value
of the mux changes, meaning that events are not generated for userspace.
Change to return 1 in this case, the function returns early in the case
where there is no change.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20220421123803.292063-4-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
cppcheck throws the following warning:

sound/soc/soc-ops.c:461:8: style: Variable 'ret' is assigned a value
that is never used. [unreadVariable]
   ret = err;
       ^

This seems to be a missing change in the return value.

Fixes: 7f3d90a ("ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_sx()")
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://lore.kernel.org/r/20220421162328.302017-1-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This reverts commit bf5e488 because
the following and required commit e138233
causes the following system crash when using audio:
 BUG: sleeping function called from invalid context at kernel/locking/mutex.c:282

Fixes: bf5e488 ("ASoC: meson: axg-tdm-interface: manage formatters in trigger")
Reported-by: Dmitry Shmidt <dimitrysh@google.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Acked-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20220421155725.2589089-1-narmstrong@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit e138233 causes the
following system crash when using audio on G12A/G12B & SM1 systems:

 BUG: sleeping function called from invalid context at kernel/locking/mutex.c:282
  in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/0
 preempt_count: 10001, expected: 0
 RCU nest depth: 0, expected: 0
 Preemption disabled at:
 schedule_preempt_disabled+0x20/0x2c

 mutex_lock+0x24/0x60
 _snd_pcm_stream_lock_irqsave+0x20/0x3c
 snd_pcm_period_elapsed+0x24/0xa4
 axg_fifo_pcm_irq_block+0x64/0xdc
 __handle_irq_event_percpu+0x104/0x264
 handle_irq_event+0x48/0xb4
 ...
 start_kernel+0x3f0/0x484
 __primary_switched+0xc0/0xc8

Revert this commit until the crash is fixed.

Fixes: e138233 ("ASoC: meson: axg-card: make links nonatomic")
Reported-by: Dmitry Shmidt <dimitrysh@google.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Acked-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20220421155725.2589089-2-narmstrong@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The quirk ALC287_FIXUP_CS35L41_I2C_2 needs to chain the quirk
ALC269_FIXUP_THINKPAD_ACPI, otherwise the mute led will not work if a
thinkpad machine applies that quirk.

And it will be safe if non-thinkpad machines apply that quirk since
hda_fixup_thinkpad_acpi() will check and return in this case.

Fixes: ae7abe3 ("ALSA: hda/realtek: Add CS35L41 support for Thinkpad laptops")
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20220422073937.10073-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
On HP Laptops, requires the same ALC285_FIXUP_HP_GPIO_LED quirk to
make its audio LEDs work.

So apply the quirk, and make it the last one since it's an LED quirk.

Signed-off-by: Andy Chi <andy.chi@canonical.com>
Fixes: 07bcab9 ("ALSA: hda/realtek: Add support for HP Laptops")
Link: https://lore.kernel.org/r/20220422090845.230071-1-andy.chi@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Correct the reg 0x09 size to one byte.

Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1650608810-3829-1-git-send-email-u0084500@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
&e->event and e point to the same address, and &e->event could
be freed in queue_event. So there is a potential uaf issue if
we dereference e after calling queue_event(). Fix this by adding
a temporary variable to maintain e->client in advance, this can
avoid the potential uaf issue.

Cc: <stable@vger.kernel.org>
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220409041243.603210-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When list_for_each_entry() completes the iteration over the whole list
without breaking the loop, the iterator value will be a bogus pointer
computed based on the head element.

While it is safe to use the pointer to determine if it was computed
based on the head element, either with list_entry_is_head() or
&pos->member == head, using the iterator variable after the loop should
be avoided.

In preparation to limit the scope of a list iterator to the list
traversal loop, use a dedicated pointer to point to the found element [1].

Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
Cc: <stable@vger.kernel.org>
Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220409041243.603210-3-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
card->local_node and card->bm_retries are both always accessed under
card->lock.
fw_core_handle_bus_reset has a check whose condition depends on
card->local_node and whose body writes to card->bm_retries.
Both of these accesses are not under card->lock. Move the lock acquiring
of card->lock to before this check such that these accesses do happen
when card->lock is held.
fw_destroy_nodes is called inside the check.
Since fw_destroy_nodes already acquires card->lock inside its function
body, move this out to the callsites of fw_destroy_nodes.
Also add a comment to indicate which locking is necessary when calling
fw_destroy_nodes.

Cc: <stable@vger.kernel.org>
Signed-off-by: Niels Dossche <dossche.niels@gmail.com>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220409041243.603210-4-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Pull FireWire fixes

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Lenovo Yoga Duet 7 13ITL6 has Realtek ALC287 and built-in
speakers do not work out of the box. The fix developed for
Yoga 7i 14ITL5 also enables speaker output for this model.

Signed-off-by: Zihao Wang <wzhd@ustc.edu>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220424084120.74125-1-wzhd@ustc.edu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
ALSA fireworks driver has a bug in its initial state to return count
shorter than expected by 4 bytes to userspace applications when handling
response frame for Echo Audio Fireworks transaction. It's due to missing
addition of the size for the type of event in ALSA firewire stack.

Fixes: 555e8a8 ("ALSA: fireworks: Add command/response functionality into hwdep interface")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20220424102428.21109-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The max98090 driver has a custom put function for some controls which can
only be updated in certain circumstances which makes no effort to validate
that input is suitable for the control, allowing out of spec values to be
written to the hardware and presented to userspace. Fix this by returning
an error when invalid values are written.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20220420193454.2647908-1-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
The max98090 driver has some custom controls which share a put() function
which returns 0 unconditionally, meaning that events are not generated
when the value changes. Fix that.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20220420193454.2647908-2-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Since a pointer to struct snd_dmaengine_pcm_config is passed,
snd_dmaengine_pcm_prepare_slave_config() is no longer called unless it's
explicitly set in prepare_slave_config.

Fixes: 5029165 ("ASoC: atmel: mchp-pdmc: add PDMC driver")
Suggested-by: Sascha Hauer <sha@pengutronix.de>
Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Link: https://lore.kernel.org/r/20220421125403.2180824-2-codrin.ciubotariu@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
As pointed out by Sascha Hauer, this patch changes:
if (pmc->config && !pcm->config->prepare_slave_config)
        <do nothing>
to:
if (pmc->config && !pcm->config->prepare_slave_config)
        snd_dmaengine_pcm_prepare_slave_config()

This breaks the drivers that do not need a call to
dmaengine_slave_config(). Drivers that still need to call
snd_dmaengine_pcm_prepare_slave_config(), but have a NULL
pcm->config->prepare_slave_config should use
snd_dmaengine_pcm_prepare_slave_config() as their prepare_slave_config
callback.

Fixes: 9a1e134 ("ASoC: dmaengine: do not use a NULL prepare_slave_config() callback")
Reported-by: Sascha Hauer <sha@pengutronix.de>
Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Link: https://lore.kernel.org/r/20220421125403.2180824-1-codrin.ciubotariu@microchip.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Check that values written via snd_soc_put_volsw_range() are
within the range advertised by the control, ensuring that we
don't write out of spec values to the hardware.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20220423131239.3375261-1-broonie@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
We are accessing "desc->ops" in sof_pci_probe without checking "desc"
pointer. This results in NULL pointer exception if pci_id->driver_data
i.e desc pointer isn't defined in sof device probe:

BUG: kernel NULL pointer dereference, address: 0000000000000060
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
RIP: 0010:sof_pci_probe+0x1e/0x17f [snd_sof_pci]
Code: Unable to access opcode bytes at RIP 0xffffffffc043dff4.
RSP: 0018:ffffac4b03b9b8d8 EFLAGS: 00010246

Add NULL pointer check for sof_dev_desc pointer to avoid such exception.

Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Ajit Kumar Pandey <AjitKumar.Pandey@amd.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220426183357.102155-1-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
…x/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v5.18

A larger collection of fixes than I'd like, mainly because mixer-test
is making it's way into the CI systems and turning up issues on a wider
range of systems.  The most substantial thing though is a revert and an
alternative fix for a dmaengine issue where the fix caused disruption
for some other configurations, the core fix is backed out an a driver
specific thing done instead.
Copy link

@mergesium mergesium bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Proposed merge summary

Backports (2)

Merge Graph

%%{init: { 'theme': 'neutral', 'gitGraph': {'rotateCommitLabel': true},'themeVariables': { 'git3': '#990000', 'gitBranchLabel3': '#ffffff' }} }%%
gitGraph
 commit id: " "
 branch your-branch order: 3
 checkout main
 commit id: "..0a566d43c8c"
 checkout your-branch
 commit id: "52517d9c0c0 (V1)"
 checkout main
 merge your-branch
 checkout your-branch
 checkout main
 commit id: "..2848551bc65"
 checkout your-branch
 commit id: "..c22a8086b38 (V2)"
 checkout main
 merge your-branch
 checkout your-branch
 checkout main
 commit id: "..8d670948f4d"
 checkout your-branch
 commit id: "..0aa6b294b31 (V3)"
 checkout main
 merge your-branch
 checkout your-branch
 checkout main
 commit id: "..40037e4f8b2"
 checkout your-branch
 commit id: "..ef248d9bd61 (V4)"
 checkout main
 merge your-branch
 checkout your-branch
 checkout main
 commit id: "..d0d642a5d36"
 checkout your-branch
 commit id: "..bc55cfd5718 (V5)"
 checkout main
 merge your-branch
 checkout your-branch
 checkout main
 commit id: "..31231092841"
 branch adapted-backport-2 order: 1
 checkout main
 branch adapted-backport-2 order: 1
 checkout main
 commit id: "..b9b4c79e583"
 checkout your-branch
 commit id: "..24d0c9f0e7d (V6)"
 checkout main
 merge your-branch
 checkout your-branch
 checkout main
 commit id: "..2d230968ad0"
 checkout your-branch
 commit id: "..86222af07ab (V7)"
 checkout main
 merge your-branch
 checkout your-branch
 checkout adapted-backport-2
 commit id: "31231092841..b4b7f2a65ce"
 checkout your-branch
 commit id: "..b4b7f2a65ce"
 merge adapted-backport-2
 checkout adapted-backport-2
 commit id: "31231092841..ac02e3cd5ab"
 checkout your-branch
 commit id: "..ac02e3cd5ab"
 merge adapted-backport-2
 checkout main
 commit id: "..30c8e80f793"
 merge your-branch tag: "This PR"
 checkout your-branch
Loading

@drok
Copy link
Owner Author

drok commented Sep 13, 2022

Proposed merge summary

Backports (2)

  • m1-3-g8142 c22a808 Merge tag 'm2' into branch1
  • m1-5-gdbe0 Merge tag 'm3' into branch1

Merge Graph

%%{init: { 'theme': 'neutral', 'gitGraph': {'rotateCommitLabel': true, 'mainBranchName': 'myhead'},'themeVariables': { 'git3': '#990000', 'gitBranchLabel3': '#ffffff' }} }%%
gitGraph
 commit id: " " tag: "m1"
 branch branch1 order: 3
 checkout myhead
 commit id: "m2"
 branch trivial-backport-1 order: 1
 checkout trivial-backport-1
 commit id: "m2..m1-3-g8142"
 checkout branch1
 commit id: "m1-3-g8142"
 merge trivial-backport-1
 checkout myhead
 commit id: "m3"
 branch trivial-backport-2 order: 1
 checkout trivial-backport-2
 commit id: "m3..m1-5-gdbe0"
 checkout branch1
 commit id: "..m1-5-gdbe0"
 merge trivial-backport-2
 commit id: "m1-6-gb477 (V1)"
 checkout myhead
 commit id: "..m5"
 merge branch1 tag: "This PR"
 checkout branch1
Loading

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.