1. 23 Feb, 2024 1 commit
    • Richard Fitzgerald's avatar
      ASoC: soc-card: Fix missing locking in snd_soc_card_get_kcontrol() · eba2eb24
      Richard Fitzgerald authored
      snd_soc_card_get_kcontrol() must be holding a read lock on
      card->controls_rwsem while walking the controls list.
      
      Compare with snd_ctl_find_numid().
      
      The existing function is renamed snd_soc_card_get_kcontrol_locked()
      so that it can be called from contexts that are already holding
      card->controls_rwsem (for example, control get/put functions).
      
      There are few direct or indirect callers of
      snd_soc_card_get_kcontrol(), and most are safe. Three require
      changes, which have been included in this patch:
      
      codecs/cs35l45.c:
        cs35l45_activate_ctl() is called from a control put() function so
        is changed to call snd_soc_card_get_kcontrol_locked().
      
      codecs/cs35l56.c:
        cs35l56_sync_asp1_mixer_widgets_with_firmware() is called from
        control get()/put() functions so is changed to call
        snd_soc_card_get_kcontrol_locked().
      
      fsl/fsl_xcvr.c:
        fsl_xcvr_activate_ctl() is called from three places, one of which
        already holds card->controls_rwsem:
        1. fsl_xcvr_mode_put(), a control put function, which will
           already be holding card->controls_rwsem.
        2. fsl_xcvr_startup(), a DAI startup function.
        3. fsl_xcvr_shutdown(), a DAI shutdown function.
      
        To fix this, fsl_xcvr_activate_ctl() has been changed to call
        snd_soc_card_get_kcontrol_locked() so that it is safe to call
        directly from fsl_xcvr_mode_put().
        The fsl_xcvr_startup() and fsl_xcvr_shutdown() functions have been
        changed to take a read lock on card->controls_rsem() around calls
        to fsl_xcvr_activate_ctl(). While this is not very elegant, it
        keeps the change small, to avoid this patch creating a large
        collateral churn in fsl/fsl_xcvr.c.
      
      Analysis of other callers of snd_soc_card_get_kcontrol() is that
      they do not need any changes, they are not holding card->controls_rwsem
      when they call snd_soc_card_get_kcontrol().
      
      Direct callers of snd_soc_card_get_kcontrol():
        fsl/fsl_spdif.c: fsl_spdif_dai_probe() - DAI probe function
        fsl/fsl_micfil.c: voice_detected_fn() - IRQ handler
      
      Indirect callers via soc_component_notify_control():
        codecs/cs42l43: cs42l43_mic_shutter() - IRQ handler
        codecs/cs42l43: cs42l43_spk_shutter() - IRQ handler
        codecs/ak4118.c: ak4118_irq_handler() - IRQ handler
        codecs/wm_adsp.c: wm_adsp_write_ctl() - not currently used
      
      Indirect callers via snd_soc_limit_volume():
        qcom/sc8280xp.c: sc8280xp_snd_init() - DAIlink init function
        ti/rx51.c: rx51_aic34_init() - DAI init function
      
      I don't have hardware to test the fsl/*, qcom/sc828xp.c, ti/rx51.c
      and ak4118.c changes.
      
      Backport note:
      The fsl/, qcom/, cs35l45, cs35l56 and cs42l43 callers were added
      since the Fixes commit so won't all be present on older kernels.
      Signed-off-by: default avatarRichard Fitzgerald <rf@opensource.cirrus.com>
      Fixes: 209c6cdf ("ASoC: soc-card: move snd_soc_card_get_kcontrol() to soc-card")
      Link: https://lore.kernel.org/r/20240221123710.690224-1-rf@opensource.cirrus.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      eba2eb24
  2. 21 Feb, 2024 1 commit
    • Colin Ian King's avatar
      ASoC: qcom: Fix uninitialized pointer dmactl · 1382d8b5
      Colin Ian King authored
      In the case where __lpass_get_dmactl_handle is called and the driver
      id dai_id is invalid the pointer dmactl is not being assigned a value,
      and dmactl contains a garbage value since it has not been initialized
      and so the null check may not work. Fix this to initialize dmactl to
      NULL. One could argue that modern compilers will set this to zero, but
      it is useful to keep this initialized as per the same way in functions
      __lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.
      
      Cleans up clang scan build warning:
      sound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition
      evaluates to a garbage value [core.uninitialized.Branch]
      
      Fixes: b81af585 ("ASoC: qcom: Add lpass CPU driver for codec dma control")
      Signed-off-by: default avatarColin Ian King <colin.i.king@gmail.com>
      Link: https://msgid.link/r/20240221134804.3475989-1-colin.i.king@gmail.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      1382d8b5
  3. 19 Feb, 2024 1 commit
  4. 13 Feb, 2024 7 commits
  5. 12 Feb, 2024 4 commits
  6. 11 Feb, 2024 4 commits
    • Cristian Ciocaltea's avatar
      ASoC: SOF: amd: Fix locking in ACP IRQ handler · c4b603c6
      Cristian Ciocaltea authored
      A recent change in acp_irq_thread() was meant to address a potential race
      condition while trying to acquire the hardware semaphore responsible for
      the synchronization between firmware and host IPC interrupts.
      
      This resulted in an improper use of the IPC spinlock, causing normal
      kernel memory allocations (which may sleep) inside atomic contexts:
      
      1707255557.133976 kernel: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:315
      
      ...
      
      1707255557.134757 kernel:  sof_ipc3_rx_msg+0x70/0x130 [snd_sof]
      1707255557.134793 kernel:  acp_sof_ipc_irq_thread+0x1e0/0x550 [snd_sof_amd_acp]
      1707255557.134855 kernel:  acp_irq_thread+0xa3/0x130 [snd_sof_amd_acp]
      1707255557.134904 kernel:  ? irq_thread+0xb5/0x1e0
      1707255557.134947 kernel:  ? __pfx_irq_thread_fn+0x10/0x10
      1707255557.134985 kernel:  irq_thread_fn+0x23/0x60
      
      Moreover, there are attempts to lock a mutex from the same atomic
      context:
      
      1707255557.136357 kernel: =============================
      1707255557.136393 kernel: [ BUG: Invalid wait context ]
      1707255557.136413 kernel: 6.8.0-rc3-next-20240206-audio-next #9 Tainted: G        W
      1707255557.136432 kernel: -----------------------------
      1707255557.136451 kernel: irq/66-AudioDSP/502 is trying to lock:
      1707255557.136470 kernel: ffff965152f26af8 (&sb->s_type->i_mutex_key#2){+.+.}-{3:3}, at: start_creating.part.0+0x5f/0x180
      
      ...
      
      1707255557.137429 kernel:  start_creating.part.0+0x5f/0x180
      1707255557.137457 kernel:  __debugfs_create_file+0x61/0x210
      1707255557.137475 kernel:  snd_sof_debugfs_io_item+0x75/0xc0 [snd_sof]
      1707255557.137494 kernel:  sof_ipc3_do_rx_work+0x7cf/0x9f0 [snd_sof]
      1707255557.137513 kernel:  sof_ipc3_rx_msg+0xb3/0x130 [snd_sof]
      1707255557.137532 kernel:  acp_sof_ipc_irq_thread+0x1e0/0x550 [snd_sof_amd_acp]
      1707255557.137551 kernel:  acp_irq_thread+0xa3/0x130 [snd_sof_amd_acp]
      
      Fix the issues by reducing the lock scope in acp_irq_thread(), so that
      it guards only the hardware semaphore acquiring attempt.  Additionally,
      restore the initial locking in acp_sof_ipc_irq_thread() to synchronize
      the handling of immediate replies from DSP core.
      
      Fixes: 802134c8 ("ASoC: SOF: amd: Refactor spinlock_irq(&sdev->ipc_lock) sequence in irq_handler")
      Signed-off-by: default avatarCristian Ciocaltea <cristian.ciocaltea@collabora.com>
      Link: https://lore.kernel.org/r/20240208234315.2182048-1-cristian.ciocaltea@collabora.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      c4b603c6
    • Alexey Khoroshilov's avatar
      ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() · 6ef5d5b9
      Alexey Khoroshilov authored
      There is a path in rt5645_jack_detect_work(), where rt5645->jd_mutex
      is left locked forever. That may lead to deadlock
      when rt5645_jack_detect_work() is called for the second time.
      
      Found by Linux Verification Center (linuxtesting.org) with SVACE.
      
      Fixes: cdba4301 ("ASoC: rt5650: add mutex to avoid the jack detection failure")
      Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Link: https://lore.kernel.org/r/1707645514-21196-1-git-send-email-khoroshilov@ispras.ruSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      6ef5d5b9
    • Hans de Goede's avatar
      ASoC: Intel: cht_bsw_rt5645: Cleanup codec_name handling · 930375d3
      Hans de Goede authored
      4 fixes / cleanups to the rt5645 mc driver's codec_name handling:
      
      1. In the for loop looking for the dai_index for the codec, replace
      card->dai_link[i] with cht_dailink[i]. The for loop already uses
      ARRAY_SIZE(cht_dailink) as bound and card->dai_link is just a pointer to
      cht_dailink using card->dai_link only obfuscates that cht_dailink is being
      modified directly rather then say a copy of cht_dailink. Using
      cht_dailink[i] also makes the code consistent with other machine drivers.
      
      2. Don't set cht_dailink[dai_index].codecs->name in the for loop,
      this immediately gets overridden using acpi_dev_name(adev) directly
      below the loop.
      
      3. Add a missing break to the loop.
      
      4. Remove the now no longer used (only set, never read) codec_name field
      from struct cht_mc_private.
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Link: https://lore.kernel.org/r/20240210134400.24913-3-hdegoede@redhat.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      930375d3
    • Hans de Goede's avatar
      ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards · 7d99a70b
      Hans de Goede authored
      Since commit 13f58267 ("ASoC: soc.h: don't create dummy Component
      via COMP_DUMMY()") dummy snd_soc_dai_link.codecs entries no longer
      have a name set.
      
      This means that when looking for the codec dai_link the machine
      driver can no longer unconditionally run strcmp() on
      snd_soc_dai_link.codecs[0].name since this may now be NULL.
      
      Add a check for snd_soc_dai_link.codecs[0].name being NULL to all
      BYT/CHT machine drivers to avoid NULL pointer dereferences in
      their probe() methods.
      
      Fixes: 13f58267 ("ASoC: soc.h: don't create dummy Component via COMP_DUMMY()")
      Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Link: https://lore.kernel.org/r/20240210134400.24913-2-hdegoede@redhat.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      7d99a70b
  7. 09 Feb, 2024 1 commit
  8. 08 Feb, 2024 2 commits
  9. 07 Feb, 2024 3 commits
  10. 06 Feb, 2024 1 commit
  11. 05 Feb, 2024 4 commits
  12. 01 Feb, 2024 11 commits