[ Upstream commit 7dd7f39fce0022b386ef1ea5ffef92ecc7dfc6af ]
hda_generic_machine_select() appends -idisp to the tplg filename by
allocating a new string with devm_kasprintf(), then stores the string
right back into the global variable snd_soc_acpi_intel_hda_machines.
When the module is unloaded, this memory is freed, resulting in a global
variable pointing to freed memory. Reloading the module then triggers
a use-after-free:
BUG: KFENCE: use-after-free read in string+0x48/0xe0
Use-after-free read at 0x00000000967e0109 (in kfence-#99):
string+0x48/0xe0
vsnprintf+0x329/0x6e0
devm_kvasprintf+0x54/0xb0
devm_kasprintf+0x58/0x80
hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
sof_probe_work+0x7f/0x600 [snd_sof]
process_one_work+0x17b/0x330
worker_thread+0x2ce/0x3f0
kthread+0xcf/0x100
ret_from_fork+0x31/0x50
ret_from_fork_asm+0x1a/0x30
kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64
allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
devm_kmalloc+0x52/0x120
devm_kvasprintf+0x66/0xb0
devm_kasprintf+0x58/0x80
hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
sof_probe_work+0x7f/0x600 [snd_sof]
process_one_work+0x17b/0x330
worker_thread+0x2ce/0x3f0
kthread+0xcf/0x100
ret_from_fork+0x31/0x50
ret_from_fork_asm+0x1a/0x30
freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
release_nodes+0x43/0xb0
devres_release_all+0x90/0xf0
device_unbind_cleanup+0xe/0x70
device_release_driver_internal+0x1c1/0x200
driver_detach+0x48/0x90
bus_remove_driver+0x6d/0xf0
pci_unregister_driver+0x42/0xb0
__do_sys_delete_module+0x1d1/0x310
do_syscall_64+0x82/0x190
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fix it by copying the match array with devm_kmemdup_array() before we
modify it.
Fixes: 5458411d75 ("ASoC: SOF: Intel: hda: refactoring topology name fixup for HDA mach")
Suggested-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Signed-off-by: Tavian Barnes <tavianator@tavianator.com>
Link: https://patch.msgid.link/570b15570b274520a0d9052f4e0f064a29c950ef.1747229716.git.tavianator@tavianator.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
After commit 0edb555a65 ("platform: Make platform_driver::remove()
return void") .remove() is (again) the right callback to implement for
platform drivers.
Convert all drivers below sound/soc to use .remove(), with the eventual
goal to drop struct platform_driver::remove_new(). As .remove() and
.remove_new() have the same prototypes, conversion is done by just
changing the structure member name in the driver initializer.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20240909151230.909818-2-u.kleine-koenig@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Add an new variable bt_link_mask to snd_soc_acpi_mach_params structure.
SSP port mask of BT offload found in NHLT table will be sent to
machine driver to setup BE dai link with correct SSP port number.
This patch only detects and enables the BT dailink. The functionality
will only be unlocked with a topology file that makes a reference to
that BT dailink. For backwards-compatibility reasons, this topology
will not be used by default. Chromebooks and Linux users willing to
experiment shall use the tplg_name kernel parameter to force the use
of an enhanced topology.
Signed-off-by: Brent Lu <brent.lu@intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20240827123215.258859-9-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Commit 8efcd48646 ("ASoC: Intel: sof_rt5682: use common module for
sof_card_private initialization") migrated the pin assignment in the
context struct up to soc-acpi-intel-ssp-common.c. This uses a lookup
table to see if a device has a amp/codec before assigning the pin. The
issue here arises when combination parts that serve both (with 2 ports)
are used.
sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:1f.3/adl_rt5682_def/SSP0-Codec'
CPU: 1 PID: 2079 Comm: udevd Tainted: G U 6.6.36-03391-g744739e00023 #1 3be1a2880a0970f65545a957db7d08ef4b3e2c0d
Hardware name: Google Anraggar/Anraggar, BIOS Google_Anraggar.15217.552.0 05/07/2024
Call Trace:
<TASK>
dump_stack_lvl+0x69/0xa0
sysfs_warn_dup+0x5b/0x70
sysfs_create_dir_ns+0xb0/0x100
kobject_add_internal+0x133/0x3c0
kobject_add+0x66/0xb0
? device_add+0x65/0x780
device_add+0x164/0x780
snd_soc_add_pcm_runtimes+0x2fa/0x800
snd_soc_bind_card+0x35e/0xc20
devm_snd_soc_register_card+0x48/0x90
platform_probe+0x7b/0xb0
really_probe+0xf7/0x2a0
...
kobject: kobject_add_internal failed for SSP0-Codec with -EEXIST, don't try to register things with the same name in the same directory.
The issue is that the ALC5650 was only defined in the codec table and
not the amp table which left the pin unassigned but the dai link was
still created by the machine driver.
Also patch the suffix filename code for the topology to prevent double
suffix names as a result of this change.
Fixes: 8efcd48646 ("ASoC: Intel: sof_rt5682: use common module for sof_card_private initialization")
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://patch.msgid.link/20240716084012.299257-1-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Pull soundwire updates from Vinod Koul:
- cleanup and conversion for soundwire sysfs groups
- intel support for ace2x bits, auxdevice pm improvements
- qcom multi link device support
* tag 'soundwire-6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: (33 commits)
soundwire: intel_ace2.x: add support for DOAISE property
soundwire: intel_ace2.x: add support for DODSE property
soundwire: intel_ace2x: use DOAIS and DODS settings from firmware
soundwire: intel_ace2x: cleanup DOAIS/DODS settings
soundwire: intel_ace2x: simplify check_wake()
soundwire: intel_ace2x: fix wakeup handling
soundwire: intel_init: resume all devices on exit.
soundwire: intel: export intel_resume_child_device
soundwire: intel_auxdevice: use pm_runtime_resume() instead of pm_request_resume()
ASoC: SOF: Intel: hda: disable SoundWire interrupt later
soundwire: qcom: allow multi-link on newer devices
soundwire: intel_ace2x: use legacy formula for intel_alh_id
soundwire: reconcile dp0_prop and dpn_prop
soundwire: intel_ace2x: set the clock source
soundwire: intel_ace2.x: power-up first before setting SYNCPRD
soundwire: intel_ace2x: move and extend clock selection
soundwire: intel: add support for MeteorLake additional clocks
soundwire: intel: add more values for SYNCPRD
soundwire: bus: extend base clock checks to 96 MHz
soundwire: cadence: show the bus frequency and frame shape
...
ASoC: Updates for v6.10
This is a very big update, in large part due to extensive work the Intel
people have been doing in their drivers though it's also been busy
elsewhere. There's also a big overhaul of the DAPM documentation from
Luca Ceresoli arising from the work he did putting together his recent
ELC talk, and he also contributed a new tool for visualising the DAPM
state.
- A new tool dapm-graph for visualising the DAPM state.
- Substantial fixes and clarifications for the DAPM documentation.
- Very large updates throughout the Intel audio drivers.
- Cleanups of accessors for driver data, module labelling, and for
constification.
- Modernsation and cleanup work in the Mediatek drivers.
- Several fixes and features for the DaVinci I2S driver.
- New drivers for several AMD and Intel platforms, Nuvoton NAU8325,
Rockchip RK3308 and Texas Instruments PCM6240.
*-objs suffix is reserved rather for (user-space) host programs while
usually *-y suffix is used for kernel drivers (although *-objs works
for that purpose for now).
Let's correct the old usages of *-objs in Makefiles.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20240507155540.24815-25-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Merge series from Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>:
This patchset does not change any functionality. It only clarifies the
Copyright information in ASoC/HDAudio contributions, where an "All
rights reserved" notice was mistakenly added in a number of files over
the years, likely due to copy/paste. The Intel template never included
this statement.
Merge series from Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>:
The SoundWire BPT support will rely on the HDaudio DMA. This exposes a
circular dependency module dependency which has to be resolved by
splitting common parts used by HDaudio and SoundWire parts, and
'generic' parts used by HDaudio only.
This patchset does not change any functionality, it just moves code
around, exposes symbols that are used in the new module. The code has
been in use for more than one kernel cycle already so it really
shouldn't break any existing platforms.
The main issue with such code moves is that it makes backports or
fixes more complicated. That's the main reason why we held back these
patches until we were reasonably confident on the maturity of MTL and
LNL drivers.
The existing code relies on the 'HDA_COMMON' module and namespace. We
need to start splitting top-level parts from the low-level ones,
otherwise we will not be able to reuse the low-level parts DMA support
for SoundWire/BPT.
In the end the dependencies will be:
+----------------------------------------------+
| |
| v
sof-pci-intel-xxx --> sof-intel-hda ------------> sof-hda-common
| ^
| |
+-> soundwire_intel --> sof_hda_sdw_bpt
This patch adds the initial split between the sof-pci-intel-xxx
modules and the common parts, in a follow-up patch we will further
split the HDA_COMMON parts
Since the PCI modules are not all independent, i.e. the CNL parts are
also used in JSL and TGL, additional Kconfig and namespace modules
were added.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Link: https://lore.kernel.org/r/20240503135221.229202-4-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Merge series from Krzysztof Kozlowski <krzk@kernel.org>:
The core code does not modify the 'struct snd_sof_dsp_ops' passed via
pointer in various places, so this can be made pointer to const in few
places. This in turn allows few drivers to have the local (usually
static) 'struct snd_sof_dsp_ops' as const which increased code safety,
as it is now part of rodata.
Not all drivers can be made safer that way. Intel and AMD rely on
customizing that 'struct snd_sof_dsp_ops' before passing to SOF, so they
won't benefit. They don't lose anything., either.
Peter Ujfalusi
Tavian Barnes
Bard Liao
Terry Cheong
Ranjani Sridharan
Kai Vehmanen
Brent Lu
Uwe Kleine-König
Pierre-Louis Bossart
Fred Oh
Kuninori Morimoto
Curtis Malainey
Mark Brown
Linus Torvalds
Takashi Iwai
Krzysztof Kozlowski