linux-kernel - [PATCH] ASoC: soc-dai: Do not call snd_soc_link_be_hw_params

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221104160252.166114-1-rf@opensource.cirrus.com>
Date:   Fri, 4 Nov 2022 16:02:52 +0000
From:   Richard Fitzgerald <rf@...nsource.cirrus.com>
To:     <broonie@...nel.org>, <lgirdwood@...il.com>
CC:     <alsa-devel@...a-project.org>, <linux-kernel@...r.kernel.org>,
        <patches@...nsource.cirrus.com>,
        Richard Fitzgerald <rf@...nsource.cirrus.com>
Subject: [PATCH] ASoC: soc-dai: Do not call snd_soc_link_be_hw_params_fixup() twice

For a BE link snd_soc_link_be_hw_params_fixup() is called by
dpcm_be_dai_hw_params() to initialize the params before it passes them
to __soc_pcm_hw_params(). Then __soc_pcm_hw_params() refines params to
match the BE codec and passes that to snd_soc_dai_hw_params().

The second call of snd_soc_link_be_hw_params_fixup() within
snd_soc_dai_hw_params() was overwriting the refined params with the
original BE CPU DAI params. This would then lead to various problems,
for example passing an invalid number of channels to the codec driver
hw_params(), or enabling more AIF widgets on the codec than are actually
mapped by TDM slots.

These errors may not be noticed on a simple 1:1 link between one CPU DAI
and one codec DAI, because most likely they have the same DAI config
(though this is not necessarily true, for example if the CPU end has dummy
TDM slots to achieve a desirable BCLK).

For 1:N mappings there are likely to be multiple codecs using different
subsets of the TDM slots and this overwriting of the refined params
can cause incorrect configuration of each codec on the link.

The erroneous extra call to the BE fixup function() was introduced
by:
commit a655de808cbd ("ASoC: core: Allow topology to override machine
driver FE DAI link config.")

at that time, the call to the BE fixup was already done by
dpcm_be_dai_hw_params(), which was introduced several years earlier
by:
commit 01d7584cd2e5 ("ASoC: dpcm: Add Dynamic PCM core operations.")

The erroneous code has changed and moved to a different source file
since the patch that introduced it, so this fix patch won't directly
apply as a fix on top of code older than:
commit 8b4ba1d31771 ("ASoC: soc-dai: fix up hw params only if it is
needed")

though it can be applied with some minor adjustment to code before
that patch but after:
commit aa6166c2ac28 ("ASoC: soc-dai: mv soc_dai_hw_params() to soc-dai")

On any tree older than that the code is in soc-pcm.c.

Signed-off-by: Richard Fitzgerald <rf@...nsource.cirrus.com>
---
 sound/soc/soc-dai.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c
index 49752af0e205..29a75fdf90e0 100644
--- a/sound/soc/soc-dai.c
+++ b/sound/soc/soc-dai.c
@@ -386,23 +386,16 @@ int snd_soc_dai_hw_params(struct snd_soc_dai *dai,
 			  struct snd_pcm_substream *substream,
 			  struct snd_pcm_hw_params *params)
 {
-	struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream);
 	int ret = 0;

 	if (dai->driver->ops &&
-	    dai->driver->ops->hw_params) {
-		/* perform any topology hw_params fixups before DAI  */
-		ret = snd_soc_link_be_hw_params_fixup(rtd, params);
-		if (ret < 0)
-			goto end;
-
+	    dai->driver->ops->hw_params)
 		ret = dai->driver->ops->hw_params(substream, params, dai);
-	}

 	/* mark substream if succeeded */
 	if (ret == 0)
 		soc_dai_mark_push(dai, substream, hw_params);
-end:
+
 	return soc_dai_ret(dai, ret);
 }

-- 
2.30.2