[PATCH AUTOSEL 6.18-6.1] ASoC: qcom: q6apm: return error code to consumers on failures

[Sasha Levin <sashal@kernel.org>]

From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>

[ Upstream commit 3075ae5abbc370d2a9a01bd6d554a412d406f5bd ]

Return errors from audioreach_set_media_format() to ensure callers are
notified when media format setup fails.

This could hide failures while programming media format parameters for
individual modules and allow graph setup to continue with incomplete
configuration.

Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20260528185806.6316-3-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: ASoC: qcom: q6apm: return error code to
consumers on failures

**Local tree:** Linux **6.18.44** (`git describe HEAD` → `v6.18.44`)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Parse the Subject Line
**Record:** `[ASoC: qcom: q6apm]` `[return]` — propagate error codes
from `audioreach_set_media_format()` to callers of
`q6apm_graph_media_format_shmem()` and `q6apm_graph_media_format_pcm()`.

### Step 1.2: Parse All Commit Message Tags
**Record:**
- **Signed-off-by:** Srinivas Kandagatla
  `<srinivas.kandagatla@oss.qualcomm.com>` (author)
- **Link:** https://patch.msgid.link/20260528185806.6316-3-
  srinivas.kandagatla@oss.qualcomm.com
- **Signed-off-by:** Mark Brown `<broonie@kernel.org>` (ASoC maintainer)
- **No** Fixes:, Reported-by:, Tested-by:, Reviewed-by:, Acked-by:, Cc:
  stable@vger.kernel.org
- **Notable:** No user or fuzzer reports; maintainer-reviewed and merged
  by Mark Brown. Absence of Cc: stable is expected per review pipeline
  rules.

### Step 1.3: Analyze Commit Body
**Record:**
- **Bug:** `q6apm_graph_media_format_shmem()` and
  `q6apm_graph_media_format_pcm()` discard return values from
  `audioreach_set_media_format()` and always return 0.
- **Symptom:** DSP media-format programming failures are hidden; audio
  graph setup continues with incomplete module configuration.
- **Root cause:** Wrapper functions ignore errors from underlying DSP
  IPC (`audioreach_graph_send_cmd_sync()` and related helpers).
- **Version info:** None stated in commit message.

### Step 1.4: Detect Hidden Bug Fixes
**Record:** Yes — despite not using "fix" in the subject, this is a real
error-handling bug. Callers are written to check return codes, but
wrappers always report success even when DSP commands fail.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory the Changes
**Record:**
- **File:** `sound/soc/qcom/qdsp6/q6apm.c` — 5 insertions, 5 deletions
  (net 0 lines)
- **Functions modified:** `q6apm_graph_media_format_shmem()`,
  `q6apm_graph_media_format_pcm()`
- **Scope:** Single-file surgical fix

### Step 2.2: Code Flow Change
**Record:**
- **Hunk 1 (`q6apm_graph_media_format_shmem`):** Before: call
  `audioreach_set_media_format()`, return 0. After: `return
  audioreach_set_media_format(...)`.
- **Hunk 2 (`q6apm_graph_media_format_pcm`):** Before: loop over
  modules, call `audioreach_set_media_format()` without checking return.
  After: capture `ret`, return immediately on first failure.
- **Paths affected:** PCM/compress prepare and LPASS DAI setup — all
  paths that configure DSP media format.

### Step 2.3: Bug Mechanism
**Record:** **Category:** Logic/correctness — swallowed error codes.
- `audioreach_set_media_format()` returns errors from DSP IPC
  (`audioreach_graph_send_cmd_sync()` at line 1213 of `audioreach.c`)
  and allocation failures (`-ENOMEM`, `-EINVAL`).
- Wrappers discarded these; callers checking `ret < 0` could never
  detect failures.

### Step 2.4: Fix Quality
**Record:** Obviously correct — standard error propagation. Minimal
change, no API changes, no new symbols. Regression risk very low; only
changes behavior when underlying call already failed.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame the Changed Lines
**Record:** Both functions introduced in `25ab80db6b133c` (Oct 2021,
"ASoC: qdsp6: audioreach: add module configuration command helpers").
Bug present since introduction. Code exists in this 6.18.44 tree.

### Step 3.2: Follow Fixes: Tag
**Record:** N/A — no Fixes: tag in commit message.

### Step 3.3: File History for Related Changes
**Record:** Recent stable-tree q6apm fixes include NULL deref
(`ca028334343a1`), remove ordering, queue ptr reset. On master, this fix
(`3075ae5abbc37`) is patch 2/6 of "add push/pull module support" series,
but the diff is self-contained and does not depend on push/pull code.
Related master-only commits (push/pull, watermark) are separate
features.

### Step 3.4: Author's Other Commits
**Record:** Srinivas Kandagatla is primary Qualcomm QDSP6 contributor.
Recent stable backports from same author include `90983f841dfa9` (q6asm-
dai error handling) and `ca028334343a1` (q6apm NULL deref).

### Step 3.5: Prerequisites
**Record:** No dependencies. `audioreach_set_media_format()` already
returns `int` in this tree. `git apply --check` on commit
`3075ae5abbc37` against HEAD succeeds cleanly.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original Patch Discussion
**Record:**
- **b4 dig URL:** https://patch.msgid.link/20260528185806.6316-3-
  srinivas.kandagatla@oss.qualcomm.com
- **Series:** v1 (2026-05-19) and v2 (2026-05-28); committed version
  matches v2 patch 2/6
- **Lore fetch:** Blocked by Anubis bot protection — could not read
  thread content
- **UNVERIFIED:** Reviewer stable nominations, NAKs, or specific review
  comments

### Step 4.2: Reviewers
**Record:** b4 dig -w shows CC to Mark Brown (maintainer), Liam
Girdwood, Takashi Iwai, Krzysztof Kozlowski, linux-sound@, linux-arm-
msm@. Appropriate subsystem coverage.

### Step 4.3: Bug Report
**Record:** N/A — no Reported-by or bugzilla/syzbot links.

### Step 4.4: Related Patches
**Record:** Part of 6-patch push/pull series on master; this specific
patch is standalone error propagation with no push/pull code changes.

### Step 4.5: Stable Mailing List
**Record:** Not searched (lore blocked). Commit lacks Cc: stable; not
used as negative signal per instructions.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key Functions
**Record:** `q6apm_graph_media_format_shmem()`,
`q6apm_graph_media_format_pcm()`, callee
`audioreach_set_media_format()`.

### Step 5.2: Callers
**Record:**
| Caller | File | Error handling |
|--------|------|----------------|
| `q6apm_dai_prepare()` | `q6apm-dai.c:246-254` | Returns on shmem
failure; logs pcm failure but **does not return** (pre-existing caller
gap) |
| `q6apm_dai_compr_set_params()` | `q6apm-dai.c:683-689` | Returns on
both failures |
| LPASS DAI hw_params | `q6apm-lpass-dais.c:195-199` | Returns and goes
to `err` |

### Step 5.3: Callees
**Record:** `audioreach_set_media_format()` dispatches to module-
specific setters, ultimately calling `audioreach_graph_send_cmd_sync()`
for DSP IPC. Returns negative errno on failure.

### Step 5.4: Call Chain / Reachability
**Record:** Reachable from userspace audio operations (PCM prepare,
compressed offload, LPASS DAI hw_params) on Qualcomm Snapdragon
platforms with `CONFIG_SND_SOC_QDSP6`. Common audio playback/capture
path for those devices.

### Step 5.5: Similar Patterns
**Record:** Precedent in this tree: `ba6474f19fd1b` "ASoC: qcom: qdsp6:
Set error code in q6usb_hw_params()" — same class of fix (don't return
success on failure), backported by Greg Kroah-Hartman to stable.

---

## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE

### Step 6.1: Does Buggy Code Exist?
**Record:** **Yes.** Current `q6apm.c` lines 206-208 and 385-390 ignore
`audioreach_set_media_format()` return values. Bug since 2021; present
in 6.18.44.

### Step 6.2: Backport Complications
**Record:** Clean apply verified (`git apply --check` passed). No
conflicting refactors in this file between stable and master for these
functions.

### Step 6.3: Related Fixes Already Present?
**Record:** Fix `3075ae5abbc37` is **not** in 6.18.44 (`git log --grep`
on HEAD returns empty). Bug remains unfixed in this tree.

---

## PHASE 7: SUBSYSTEM AND MAINTAINER CONTEXT

### Step 7.1: Subsystem Criticality
**Record:** **ASoC / Qualcomm QDSP6 audio driver** — **PERIPHERAL**
(platform-specific: Snapdragon/MSM devices). Critical for audio on those
platforms; not universal.

### Step 7.2: Subsystem Activity
**Record:** Actively maintained in 6.18.y — multiple recent q6apm/q6asm
stable backports from same author/maintainer chain.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who Is Affected
**Record:** Users of `CONFIG_SND_SOC_QDSP6` on Qualcomm platforms
(phones, tablets, embedded). Not universal kernel users.

### Step 8.2: Trigger Conditions
**Record:** Triggered when DSP media-format IPC fails during graph setup
(DSP not ready, invalid params, allocation failure, IPC timeout).
Unprivileged users can trigger via normal audio open/prepare. Not a race
— deterministic on DSP command failure.

### Step 8.3: Failure Mode Severity
**Record:** Without fix: silent failure, graph continues with incomplete
DSP configuration → no audio, broken audio, or unpredictable DSP
behavior. **Severity: MEDIUM** — functional correctness bug, not
demonstrated kernel crash/oops/deadlock. Could theoretically stress DSP
firmware, but that is unverified.

### Step 8.4: Risk-Benefit
**Record:**
- **Benefit:** MEDIUM — restores broken API contract; enables proper
  failure detection in 3 of 4 call sites (shmem in prepare, compress
  offload, LPASS DAI)
- **Risk:** VERY LOW — 10-line change, only affects already-failing
  paths
- **Ratio:** Favorable — trivial fix for long-standing bug in actively
  maintained subsystem with direct stable precedent

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence Summary

**FOR backport:**
- Real, verified bug: error codes swallowed since 2021
- Callers written to handle errors but cannot detect failures today
- Trivial, obviously correct fix; applies cleanly to 6.18.44
- Same subsystem/author as recent stable backports (`90983f841dfa9`,
  `ca028334343a1`)
- Direct precedent: `ba6474f19fd1b` (error propagation in qdsp6)
  backported to stable
- Prevents continuing DSP graph setup after failed format programming
- Maintainer-reviewed (Mark Brown)

**AGAINST backport:**
- No user reports, syzbot, or CVE
- Failure mode is functional (broken audio), not demonstrated
  crash/corruption/deadlock
- Platform-specific peripheral driver
- One caller (`q6apm_dai_prepare` pcm path) still doesn't abort on pcm
  format failure — fix is partially undermined there (pre-existing
  separate issue)
- Part of larger feature series on master (though patch itself is
  standalone)

**UNRESOLVED:**
- Lore review thread content (Anubis blocked)
- Whether DSP firmware can crash from incomplete configuration

### Step 9.2: Stable Rules Checklist
1. Obviously correct and tested? **PASS** — trivial error propagation;
   maintainer merged, no Tested-by
2. Fixes real bug affecting users? **PASS** — broken error reporting on
   Qualcomm audio platforms
3. Important issue? **PASS (borderline)** — not crash/security, but
   prevents silent continuation with failed DSP setup; same class as
   prior stable backport `ba6474f19fd1b`
4. Small and contained? **PASS** — 1 file, ~10 lines
5. No new features/APIs? **PASS**
6. Can apply to local tree? **PASS** — verified clean apply; buggy code
   present

### Step 9.3: Exception Categories
**Record:** N/A — not device ID, quirk, DT, build, or docs fix. Standard
error-handling bug fix.

### Step 9.4: Decision Rationale

This commit fixes a long-standing error-swallowing bug in Qualcomm QDSP6
audio graph setup. While the failure mode is primarily functional rather
than a kernel crash, the fix is trivially correct, applies cleanly to
6.18.44, restores a broken API contract that callers already depend on,
and matches a directly analogous fix (`ba6474f19fd1b`) already
backported to this stable tree. The risk is negligible and the subsystem
is actively receiving similar stable fixes from the same maintainer
chain.

---

## Verification

- **[Phase 1]** Parsed commit message and tags from `git show
  3075ae5abbc37`
- **[Phase 1]** Confirmed no Reported-by, Fixes:, or Cc: stable tags
- **[Phase 2]** Read diff: 1 file, 2 functions, error propagation only
- **[Phase 2]** Read `audioreach_set_media_format()` at
  `audioreach.c:1281-1335` — returns `rc` from DSP IPC
- **[Phase 2]** Read `audioreach_pcm_set_media_format()` at
  `audioreach.c:1213-1217` — returns `audioreach_graph_send_cmd_sync()`
  result
- **[Phase 3]** `git describe HEAD` → v6.18.44
- **[Phase 3]** `git blame` → buggy code from `25ab80db6b133c`
  (2021-10-26)
- **[Phase 3]** `git log --oneline -20 -- sound/soc/qcom/qdsp6/q6apm.c`
  — subsystem history
- **[Phase 3]** `git apply --check` on `3075ae5abbc37` against HEAD —
  clean apply
- **[Phase 3]** `git log HEAD..master -- q6apm.c` — fix on master, not
  in stable
- **[Phase 4]** `b4 dig -c 3075ae5abbc37` — found lore URL, v1/v2 series
- **[Phase 4]** `b4 dig -c 3075ae5abbc37 -w` — Mark Brown, linux-sound@
  CC'd
- **[Phase 4]** WebFetch lore URL — blocked by Anubis (UNVERIFIED review
  discussion)
- **[Phase 5]** `grep q6apm_graph_media_format` — 4 call sites in q6apm-
  dai.c and q6apm-lpass-dais.c
- **[Phase 5]** Read caller error handling in q6apm-dai.c:246-254,
  683-689 and q6apm-lpass-dais.c:195-199
- **[Phase 6]** Confirmed buggy code at q6apm.c:206-208 and 385-390 in
  current tree
- **[Phase 6]** Confirmed fix not present: `git log --grep="return error
  code" HEAD` empty
- **[Phase 7]** Kconfig confirms `CONFIG_SND_SOC_QDSP6` platform-
  specific driver
- **[Phase 8]** Precedent: `git show ba6474f19fd1b` — similar error
  propagation backported to stable
- **[Phase 8]** Precedent: `git show 90983f841dfa9` — q6asm-dai error
  handling backported to 6.18.y
- **UNVERIFIED:** DSP firmware crash from incomplete configuration
- **UNVERIFIED:** Lore review thread stable nominations

**YES**

 sound/soc/qcom/qdsp6/q6apm.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/sound/soc/qcom/qdsp6/q6apm.c b/sound/soc/qcom/qdsp6/q6apm.c
index 6326649ba31b4..73c5dc0e5cc55 100644
--- a/sound/soc/qcom/qdsp6/q6apm.c
+++ b/sound/soc/qcom/qdsp6/q6apm.c
@@ -203,10 +203,7 @@ int q6apm_graph_media_format_shmem(struct q6apm_graph *graph,
 	if (!module)
 		return -ENODEV;
 
-	audioreach_set_media_format(graph, module, cfg);
-
-	return 0;
-
+	return audioreach_set_media_format(graph, module, cfg);
 }
 EXPORT_SYMBOL_GPL(q6apm_graph_media_format_shmem);
 
@@ -374,6 +371,7 @@ int q6apm_graph_media_format_pcm(struct q6apm_graph *graph, struct audioreach_mo
 	struct audioreach_sub_graph *sgs;
 	struct audioreach_container *container;
 	struct audioreach_module *module;
+	int ret;
 
 	list_for_each_entry(sgs, &info->sg_list, node) {
 		list_for_each_entry(container, &sgs->container_list, node) {
@@ -382,7 +380,9 @@ int q6apm_graph_media_format_pcm(struct q6apm_graph *graph, struct audioreach_mo
 					(module->module_id == MODULE_ID_RD_SHARED_MEM_EP))
 					continue;
 
-				audioreach_set_media_format(graph, module, cfg);
+				ret = audioreach_set_media_format(graph, module, cfg);
+				if (ret)
+					return ret;
 			}
 		}
 	}
-- 
2.53.0