summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2018-05-01ASoC: mediatek: avoid using snd_soc_platformKai Chieh Chuang1-1/+1
avoid using snd_soc_platform, which is removed after 4.18 Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-30ALSA: aloop: Add missing cable lock to ctl API callbacksTakashi Iwai1-2/+15
Some control API callbacks in aloop driver are too lazy to take the loopback->cable_lock and it results in possible races of cable access while it's being freed. It eventually lead to a UAF, as reported by fuzzer recently. This patch covers such control API callbacks and add the proper mutex locks. Reported-by: DaeRyong Jeong <threeearcat@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-29ALSA: dice: fix kernel NULL pointer dereference due to invalid calculation ↵Takashi Sakamoto1-2/+3
for array index At a commit f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls'), maximum size of payload for tx isochronous packet is cached to reduce the number of function calls. This cache was programmed to updated at a first callback of ohci1394 IR context. However, the maximum size is required to queueing packets before starting the isochronous context. As a result, the cached value is reused to queue packets in next time to starting the isochronous context. Then the cache is updated in a first callback of the isochronous context. This can cause kernel NULL pointer dereference in a below call graph: (sound/firewire/amdtp-stream.c) amdtp_stream_start() ->queue_in_packet() ->queue_packet() (drivers/firewire/core-iso.c) ->fw_iso_context_queue() ->struct fw_card_driver.queue_iso() (drivers/firewire/ohci.c) = ohci_queue_iso() ->queue_iso_packet_per_buffer() buffer->pages[page] The issued dereference occurs in a case that: - target unit supports different stream formats for sampling transmission frequency. - maximum length of payload for tx stream in a first trial is bigger than the length in a second trial. In this case, correct number of pages are allocated for DMA and the 'pages' array has enough elements, while index of the element is wrongly calculated according to the old value of length of payload in a call of 'queue_in_packet()'. Then it causes the issue. This commit fixes the critical bug. This affects all of drivers in ALSA firewire stack in Linux kernel v4.12 or later. [12665.302360] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [12665.302415] IP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.302439] PGD 0 [12665.302440] P4D 0 [12665.302450] [12665.302470] Oops: 0000 [#1] SMP PTI [12665.302487] Modules linked in: ... [12665.303096] CPU: 1 PID: 12760 Comm: jackd Tainted: P OE 4.13.0-38-generic #43-Ubuntu [12665.303154] Hardware name: /DH77DF, BIOS KCH7710H.86A.0069.2012.0224.1825 02/24/2012 [12665.303215] task: ffff9ce87da2ae80 task.stack: ffffb5b8823d0000 [12665.303258] RIP: 0010:ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.303301] RSP: 0018:ffffb5b8823d3ab8 EFLAGS: 00010086 [12665.303337] RAX: ffff9ce4f4876930 RBX: 0000000000000008 RCX: ffff9ce88a3955e0 [12665.303384] RDX: 0000000000000000 RSI: 0000000034877f00 RDI: 0000000000000000 [12665.303427] RBP: ffffb5b8823d3b68 R08: ffff9ce8ccb390a0 R09: ffff9ce877639ab0 [12665.303475] R10: 0000000000000108 R11: 0000000000000000 R12: 0000000000000003 [12665.303513] R13: 0000000000000000 R14: ffff9ce4f4876950 R15: 0000000000000000 [12665.303554] FS: 00007f2ec467f8c0(0000) GS:ffff9ce8df280000(0000) knlGS:0000000000000000 [12665.303600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12665.303633] CR2: 0000000000000030 CR3: 00000002dcf90004 CR4: 00000000000606e0 [12665.303674] Call Trace: [12665.303698] fw_iso_context_queue+0x18/0x20 [firewire_core] [12665.303735] queue_packet+0x88/0xe0 [snd_firewire_lib] [12665.303770] amdtp_stream_start+0x19b/0x270 [snd_firewire_lib] [12665.303811] start_streams+0x276/0x3c0 [snd_dice] [12665.303840] snd_dice_stream_start_duplex+0x1bf/0x480 [snd_dice] [12665.303882] ? vma_gap_callbacks_rotate+0x1e/0x30 [12665.303914] ? __rb_insert_augmented+0xab/0x240 [12665.303936] capture_prepare+0x3c/0x70 [snd_dice] [12665.303961] snd_pcm_do_prepare+0x1d/0x30 [snd_pcm] [12665.303985] snd_pcm_action_single+0x3b/0x90 [snd_pcm] [12665.304009] snd_pcm_action_nonatomic+0x68/0x70 [snd_pcm] [12665.304035] snd_pcm_prepare+0x68/0x90 [snd_pcm] [12665.304058] snd_pcm_common_ioctl1+0x4c0/0x940 [snd_pcm] [12665.304083] snd_pcm_capture_ioctl1+0x19b/0x250 [snd_pcm] [12665.304108] snd_pcm_capture_ioctl+0x27/0x40 [snd_pcm] [12665.304131] do_vfs_ioctl+0xa8/0x630 [12665.304148] ? entry_SYSCALL_64_after_hwframe+0xe9/0x139 [12665.304172] ? entry_SYSCALL_64_after_hwframe+0xe2/0x139 [12665.304195] ? entry_SYSCALL_64_after_hwframe+0xdb/0x139 [12665.304218] ? entry_SYSCALL_64_after_hwframe+0xd4/0x139 [12665.304242] ? entry_SYSCALL_64_after_hwframe+0xcd/0x139 [12665.304265] ? entry_SYSCALL_64_after_hwframe+0xc6/0x139 [12665.304288] ? entry_SYSCALL_64_after_hwframe+0xbf/0x139 [12665.304312] ? entry_SYSCALL_64_after_hwframe+0xb8/0x139 [12665.304335] ? entry_SYSCALL_64_after_hwframe+0xb1/0x139 [12665.304358] SyS_ioctl+0x79/0x90 [12665.304374] ? entry_SYSCALL_64_after_hwframe+0x72/0x139 [12665.304397] entry_SYSCALL_64_fastpath+0x24/0xab [12665.304417] RIP: 0033:0x7f2ec3750ef7 [12665.304433] RSP: 002b:00007fff99e31388 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [12665.304465] RAX: ffffffffffffffda RBX: 00007fff99e312f0 RCX: 00007f2ec3750ef7 [12665.304494] RDX: 0000000000000000 RSI: 0000000000004140 RDI: 0000000000000007 [12665.304522] RBP: 0000556ebc63fd60 R08: 0000556ebc640560 R09: 0000000000000000 [12665.304553] R10: 0000000000000001 R11: 0000000000000246 R12: 0000556ebc63fcf0 [12665.304584] R13: 0000000000000000 R14: 0000000000000007 R15: 0000000000000000 [12665.304612] Code: 01 00 00 44 89 eb 45 31 ed 45 31 db 66 41 89 1e 66 41 89 5e 0c 66 45 89 5e 0e 49 8b 49 08 49 63 d4 4d 85 c0 49 63 ff 48 8b 14 d1 <48> 8b 72 30 41 8d 14 37 41 89 56 04 48 63 d3 0f 84 ce 00 00 00 [12665.304713] RIP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] RSP: ffffb5b8823d3ab8 [12665.304743] CR2: 0000000000000030 [12665.317701] ---[ end trace 9d55b056dd52a19f ]--- Fixes: f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls') Cc: <stable@vger.kernel.org> # v4.12+ Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-27ALSA: cs46xx: fix spelling mistake: "amplifer" -> "amplifier"Colin Ian King1-1/+1
Trivial fix to spelling mistake in module parameter description text Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-27ASoC: tas6424: Add support for the mute pinJean-Jacques Hiblot2-1/+37
mute can be connected to GPIO. In that case we have to drive it to the correct value Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: tas6424: Add support for the standby pinJean-Jacques Hiblot2-0/+23
The standby pin can be connected to a GPIO. In that case we have to drive it to the correct values for the TAS6424 to operate properly. Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: core: Allow codec_conf DT lookups to match parent of_nodeCharles Keepax1-1/+6
For devices implemented as a MFD it is common to only have a single node in devicetree representing the whole device. As such when looking up codec_conf mappings we should match against both the devices of_node and the devices parent's of_node, as is already done for DAIs and platform components. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()Takashi Iwai1-2/+2
The sequencer virmidi code has an open race at its output trigger callback: namely, virmidi keeps only one event packet for processing while it doesn't protect for concurrent output trigger calls. snd_virmidi_output_trigger() tries to process the previously unfinished event before starting encoding the given MIDI stream, but this is done without any lock. Meanwhile, if another rawmidi stream starts the output trigger, this proceeds further, and overwrites the event package that is being processed in another thread. This eventually corrupts and may lead to the invalid memory access if the event type is like SYSEX. The fix is just to move the spinlock to cover both the pending event and the new stream. The bug was spotted by a new fuzzer, RaceFuzzer. BugLink: http://lkml.kernel.org/r/20180426045223.GA15307@dragonet.kaist.ac.kr Reported-by: DaeRyong Jeong <threeearcat@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-27ALSA: hda - Fix incorrect usage of IS_REACHABLE()Takashi Iwai1-1/+1
The commit c469652bb5e8 ("ALSA: hda - Use IS_REACHABLE() for dependency on input") simplified the dependencies with IS_REACHABLE() macro, but it broke due to its incorrect usage: it should have been IS_REACHABLE(CONFIG_INPUT) instead of IS_REACHABLE(INPUT). Fixes: c469652bb5e8 ("ALSA: hda - Use IS_REACHABLE() for dependency on input") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-27ASoC: mediatek: preallocate pages use platform deviceKai Chieh Chuang1-2/+2
preallocate pages should use platform device, since we set dma mask for platform device. Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2018-04-27ASoC: mediatek: preallocate pages use platform deviceKai Chieh Chuang1-2/+2
preallocate pages should use platform device, since we set dma mask for platform device. Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: omap: Remove OMAP_MUX dependency from Nokia N810 audio supportJarkko Nikula1-1/+0
Commit e9f5f1e45608 ("ARM: OMAP2+: Remove legacy mux code") removed CONFIG_OMAP_MUX making impossible to build Nokia N810 audio support. Remove this dependency so we can do at least build tests. Fixes: e9f5f1e45608 ("ARM: OMAP2+: Remove legacy mux code") Signed-off-by: Jarkko Nikula <jarkko.nikula@bitmer.com> Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: omap: n810: HS mic is not working, add a widget for it with commentPeter Ujfalusi1-2/+9
The bias for the analog HS microphone is coming from Retu/Vilma chip and we do not have control over it, yet. For clarity, add a new DAPM_MIC widget for the HS mic and document the current state. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27Merge branch 'asoc-4.17' into asoc-4.18 n810 dependenciesMark Brown1-5/+5
2018-04-27ASoC: omap: n810: Correct the cpu_dai, platform and codec namePeter Ujfalusi1-3/+3
The non DT boot is no longer supported and when booting with DT the device names are different. Fix them up for now, but the n810.c should be updated to support probing via DT with proper bindings. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: omap: n810: Correct the card level dapm_routePeter Ujfalusi1-2/+2
Fix the capture DAPM route due to core changes regarding to mic bias. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: mt6797: switch to SPDX license tagKai Chieh Chuang8-94/+24
Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: mt6797: add structure define and clock control function for 6797Kai Chieh Chuang5-0/+1101
Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: add mt6797-mt6351 driver and config optionKai Chieh Chuang4-0/+226
Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: mt6351 switch to SPDX license tagKai Chieh Chuang1-6/+5
Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-27ASoC: uniphier: remove boilerplate from lisence commentKatsuhiro Suzuki7-91/+0
This patch removes boilerplate of GPLv2, use only SPDX identifier as same as other recently ASoC DAI drivers. Signed-off-by: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: fsl_ssi: Use u32 variable type when using regmap_read()Fabio Estevam1-2/+1
Convert the sisr and sisr2 variable types to u32 to avoid the following sparse warnings: sound/soc/fsl/fsl_ssi.c:391:42: warning: incorrect type in argument 3 (different base types) sound/soc/fsl/fsl_ssi.c:391:42: expected unsigned int *val sound/soc/fsl/fsl_ssi.c:391:42: got restricted __be32 *<noident> sound/soc/fsl/fsl_ssi.c:393:17: warning: restricted __be32 degrades to integer sound/soc/fsl/fsl_ssi.c:393:15: warning: incorrect type in assignment (different base types) sound/soc/fsl/fsl_ssi.c:393:15: expected restricted __be32 [usertype] sisr2 sound/soc/fsl/fsl_ssi.c:393:15: got unsigned int sound/soc/fsl/fsl_ssi.c:396:50: warning: incorrect type in argument 3 (different base types) sound/soc/fsl/fsl_ssi.c:396:50: expected unsigned int [unsigned] val sound/soc/fsl/fsl_ssi.c:396:50: got restricted __be32 [usertype] sisr2 sound/soc/fsl/fsl_ssi.c:398:42: warning: incorrect type in argument 2 (different base types) sound/soc/fsl/fsl_ssi.c:398:42: expected unsigned int [unsigned] [usertype] sisr sound/soc/fsl/fsl_ssi.c:398:42: got restricted __be32 [addressable] [usertype] sisr In other places where regmap_read() is used a u32 variable is passed to store the register read value, so do the same here as well. regmap API already takes care of endianness, so the usage of u32 is safe. Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: amd: rename audio_substream_data variableMukunda, Vijendar1-9/+9
In order to make audio_substream_data structure variable consistent throughout the code, changed the name from audio_config to rtd wherever applicable. Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: mediatek: switch to SPDX license tagRyder Lee21-190/+22
Add SPDX identifiers to all remaining files in sound/soc/mediatek/ Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: mediatek: add MT7622 AFE compatible in documentationRyder Lee1-1/+3
Add support for MT7622 AFE which shares the same binding with MT2701. Cc: devicetree@vger.kernel.org Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: mediatek: add MT7622 AFE supportRyder Lee4-15/+48
This patch adds support for the MT7622 AFE which reuses MT2701 driver. We also introduce the 'struct mt2701_soc_variants' to differentiate between the SoC generations as there might be other (existing or future) chips that use the same binding and driver, then being a little more abstract could help in the long run. Cc: Jia Zeng <jia.zeng@mediatek.com> Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Reviewed-by: Garlic Tseng <garlic.tseng@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: mediatek: Add MTK_STREAM_NUM to mtk-base-afe.hRyder Lee4-71/+30
Add MTK_STREAM_NUM to common header and modify related stuff so that the other SoCs can reuse it. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Reviewed-by: Garlic Tseng <garlic.tseng@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: mediatek: simplify the control logic of MT2701 I2SRyder Lee3-100/+66
This patch adjusts the mt2701_afe_i2s_ops to simplify the control logic of the I2S path. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Reviewed-by: Garlic Tseng <garlic.tseng@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ALSA: dice: fix error path to destroy initialized stream dataTakashi Sakamoto1-1/+1
In error path of snd_dice_stream_init_duplex(), stream data for incoming packet can be left to be initialized. This commit fixes it. Fixes: 436b5abe2224 ('ALSA: dice: handle whole available isochronous streams') Cc: <stable@vger.kernel.org> # v4.6+ Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-26ASoC: add mt6351 codec driverKai Chieh Chuang5-0/+1633
This patch adds the MediaTek MT6351 codec driver. MT6351 communicate with SoC through MediaTek PMIC wrapper. MT6351 use MediaTek proprietary audio interface. Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: compress: Add helper functions for component open/freeCharles Keepax1-79/+62
There are 2 loops calling open and 4 loops calling free for all the components on a DAI link. Factor out these loops into helper functions to make the code a little clearer. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Acked-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: Remove platform code now everything is componentisedCharles Keepax6-707/+12
As all drivers have been moved over to the new generic component code remove the now unused platform specific code. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Acked-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26Merge branch 'asoc-4.17' into asoc-4.18 for compress dependenciesMark Brown6-31/+44
2018-04-26ASoC: compress: Only call free for components which have been openedCharles Keepax1-24/+28
The core should only call free on a component if said component has already had open called on it. This is not presently the case and most compressed drivers in the kernel assume it will be. This causes null pointer dereferences in the drivers as they attempt clean up for stuff that was never put in place. This is fixed by aborting calling open callbacks once a failure is encountered and then during clean up only iterating through the component list to that point. This is a fairly quick fix to the issue, to allow backporting. There is more refactoring to follow to tidy the code up a little. Fixes: 9e7e3738ab0e ("ASoC: snd_soc_component_driver has snd_compr_ops") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Acked-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-26ASoC: Update email address for VinodVinod Koul2-1/+4
Update the email address for compressed audio maintainer Also update .mailmap. Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-25ASoC: mediatek: use snd_soc_dai_get_drvdata() to get the private dataRyder Lee3-88/+46
Reduce the boilerplate code to retrieve the private data. No functional change intended. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Reviewed-by: Garlic Tseng <garlic.tseng@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-25ASoC: mediatek: add documents for mt6797Kai Chieh Chuang2-0/+56
Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-25ASoC: mt6797: add mt6797 platform driverKai Chieh Chuang1-0/+1241
Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-25Merge branch 'for-linus' into for-nextTakashi Iwai357-2606/+5895
Back-merge 4.17-rc3 fixes for further development. This will bump the base to 4.17-rc2, too. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25ALSA: hda - Skip jack and others for non-existing PCM streamsTakashi Iwai1-1/+8
When CONFIG_SND_DYNAMIC_MINORS isn't set, there are only limited number of devices available, and HD-audio, especially with HDMI/DP codec, will fail to create more than two devices. The driver warns about the lack of such devices and skips the PCM device creations, but the HDMI driver still tries to create the corresponding JACK, SPDIF and ELD controls even for the non-existing PCM substreams. This results in confusion on user-space, and even may break the operation. Similarly, Intel HDMI/DP codec builds the ELD notification from i915 graphics driver, and this may be broken if a notification is sent for the non-existing PCM stream. This patch adds the check of the existence of the assigned PCM substream in the both scenarios above, and skips the further operation if the PCM substream is not assigned. Fixes: 9152085defb6 ("ALSA: hda - add DP MST audio support") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25Merge tag 'asoc-fix-4.17-rc2' of ↵Takashi Iwai11-33/+85
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v4.17 A small batch of fixes collected since the merge window, none of which are particularly large or remarkable. They've all been cooking in -next for a while.
2018-04-25ALSA: hda/realtek - change the location for one of two front micsKailang Yang1-0/+1
On this Lenovo ThinkCentre machine. There are two front mics, we change the location for one of them. Relation: f33f79f3d0e5 ("ALSA: hda/realtek - change the location for one of two front microphones") Signed-off-by: Kailang Yang <kailang@realtek.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25ALSA: rme9652: Hardening for potential Spectre v1Takashi Iwai1-2/+4
As recently Smatch suggested, one place in RME9652 driver may expand the array directly from the user-space value with speculation: sound/pci/rme9652/rme9652.c:2074 snd_rme9652_channel_info() warn: potential spectre issue 'rme9652->channel_map' (local cap) This patch puts array_index_nospec() for hardening against it. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25ALSA: hdspm: Hardening for potential Spectre v1Takashi Iwai1-10/+14
As recently Smatch suggested, a couple of places in HDSP MADI driver may expand the array directly from the user-space value with speculation: sound/pci/rme9652/hdspm.c:5717 snd_hdspm_channel_info() warn: potential spectre issue 'hdspm->channel_map_out' (local cap) sound/pci/rme9652/hdspm.c:5734 snd_hdspm_channel_info() warn: potential spectre issue 'hdspm->channel_map_in' (local cap) This patch puts array_index_nospec() for hardening against them. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25ALSA: asihpi: Hardening for potential Spectre v1Takashi Iwai2-5/+12
As recently Smatch suggested, a couple of places in ASIHPI driver may expand the array directly from the user-space value with speculation: sound/pci/asihpi/hpimsginit.c:70 hpi_init_response() warn: potential spectre issue 'res_size' (local cap) sound/pci/asihpi/hpioctl.c:189 asihpi_hpi_ioctl() warn: potential spectre issue 'adapters' This patch puts array_index_nospec() for hardening against them. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25ALSA: opl3: Hardening for potential Spectre v1Takashi Iwai1-2/+5
As recently Smatch suggested, one place in OPL3 driver may expand the array directly from the user-space value with speculation: sound/drivers/opl3/opl3_synth.c:476 snd_opl3_set_voice() warn: potential spectre issue 'snd_opl3_regmap' This patch puts array_index_nospec() for hardening against it. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25ALSA: hda: Hardening for potential Spectre v1Takashi Iwai1-1/+11
As recently Smatch suggested, one place in HD-audio hwdep ioctl codes may expand the array directly from the user-space value with speculation: sound/pci/hda/hda_local.h:467 get_wcaps() warn: potential spectre issue 'codec->wcaps' As get_wcaps() itself is a fairly frequently called inline function, and there is only one single call with a user-space value, we replace only the latter one to open-code locally with array_index_nospec() hardening in this patch. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25ALSA: control: Hardening for potential Spectre v1Takashi Iwai1-2/+5
As recently Smatch suggested, a few places in ALSA control core codes may expand the array directly from the user-space value with speculation: sound/core/control.c:1003 snd_ctl_elem_lock() warn: potential spectre issue 'kctl->vd' sound/core/control.c:1031 snd_ctl_elem_unlock() warn: potential spectre issue 'kctl->vd' sound/core/control.c:844 snd_ctl_elem_info() warn: potential spectre issue 'kctl->vd' sound/core/control.c:891 snd_ctl_elem_read() warn: potential spectre issue 'kctl->vd' sound/core/control.c:939 snd_ctl_elem_write() warn: potential spectre issue 'kctl->vd' Although all these seem doing only the first load without further reference, we may want to stay in a safer side, so hardening with array_index_nospec() would still make sense. In this patch, we put array_index_nospec() to the common snd_ctl_get_ioff*() helpers instead of each caller. These helpers are also referred from some drivers, too, and basically all usages are to calculate the array index from the user-space value, hence it's better to cover there. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25ALSA: seq: oss: Hardening for potential Spectre v1Takashi Iwai4-40/+55
As Smatch recently suggested, a few places in OSS sequencer codes may expand the array directly from the user-space value with speculation, namely there are a significant amount of references to either info->ch[] or dp->synths[] array: sound/core/seq/oss/seq_oss_event.c:315 note_on_event() warn: potential spectre issue 'info->ch' (local cap) sound/core/seq/oss/seq_oss_event.c:362 note_off_event() warn: potential spectre issue 'info->ch' (local cap) sound/core/seq/oss/seq_oss_synth.c:470 snd_seq_oss_synth_load_patch() warn: potential spectre issue 'dp->synths' (local cap) sound/core/seq/oss/seq_oss_event.c:293 note_on_event() warn: potential spectre issue 'dp->synths' sound/core/seq/oss/seq_oss_event.c:353 note_off_event() warn: potential spectre issue 'dp->synths' sound/core/seq/oss/seq_oss_synth.c:506 snd_seq_oss_synth_sysex() warn: potential spectre issue 'dp->synths' sound/core/seq/oss/seq_oss_synth.c:580 snd_seq_oss_synth_ioctl() warn: potential spectre issue 'dp->synths' Although all these seem doing only the first load without further reference, we may want to stay in a safer side, so hardening with array_index_nospec() would still make sense. We may put array_index_nospec() at each place, but here we take a different approach: - For dp->synths[], change the helpers to retrieve seq_oss_synthinfo pointer directly instead of the array expansion at each place - For info->ch[], harden in a normal way, as there are only a couple of places As a result, the existing helper, snd_seq_oss_synth_is_valid() is replaced with snd_seq_oss_synth_info(). Also, we cover MIDI device where a similar array expansion is done, too, although it wasn't reported by Smatch. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-25ALSA: seq: oss: Fix unbalanced use lock for synth MIDI deviceTakashi Iwai1-4/+8
When get_synthdev() is called for a MIDI device, it returns the fixed midi_synth_dev without the use refcounting. OTOH, the caller is supposed to unreference unconditionally after the usage, so this would lead to unbalanced refcount. This patch corrects the behavior and keep up the refcount balance also for the MIDI synth device. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
generated by cgit v1.2.3 (git 2.39.0) at 2025-10-02 23:39:58 +0300