- Apr 09, 2018
-
-
Takashi Iwai authored
snd_pcm_hw_params() (more exactly snd_pcm_hw_params_choose()) contains a check of the return error from snd_pcm_hw_param_first() and _last() with snd_BUG_ON() -- i.e. it may trigger WARN_ON() depending on the kconfig. This was a valid check in the past, as these functions shouldn't return any error if the parameters have been already refined via snd_pcm_hw_refine() beforehand. However, the recent rewrite introduced a kmalloc() in snd_pcm_hw_refine() for removing VLA, and this brought a possibility to trigger an error. As a result, syzbot caught lots of superfluous kernel WARN_ON() and paniced via fault injection. As the WARN_ON() is no longer valid with the introduction of kmalloc(), let's drop snd_BUG_ON() check, in order to make the world peaceful place again. Reported-by:
<syzbot+803e0047ac3a3096bb4f@syzkaller.appspotmail.com> Fixes: 5730f9f7 ("ALSA: pcm: Remove VLA usage") Signed-off-by:
Takashi Iwai <tiwai@suse.de>
-
- Apr 07, 2018
-
-
Takashi Iwai authored
The commit 02a5d692 ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write") split the PCM preparation code to a locked version, and it added a sanity check of runtime->oss.prepare flag along with the change. This leaded to an endless loop when the stream gets XRUN: namely, snd_pcm_oss_write3() and co call snd_pcm_oss_prepare() without setting runtime->oss.prepare flag and the loop continues until the PCM state reaches to another one. As the function is supposed to execute the preparation unconditionally, drop the invalid state check there. The bug was triggered by syzkaller. Fixes: 02a5d692 ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write") Reported-by:
<syzbot+150189c103427d31a053@syzkaller.appspotmail.com> Reported-by:
<syzbot+7e3f31a52646f939c052@syzkaller.appspotmail.com> Reported-by:
<syzbot+4f2016cf5185da7759dc@syzkaller.appspotmail.com> Cc: <stable@vger.kernel.org> Signed-off-by:
-
Takashi Iwai authored
The UAC3 clock parser codes lack of the sanity checks for malformed descriptors like UAC2 parser does. Without it, the driver may lead to a potential crash. Fixes: 9a2fe9b8 ("ALSA: usb: initial USB Audio Device Class 3.0 support") Tested-by:
Ruslan Bilovol <ruslan.bilovol@gmail.com> Reviewed-by:
-
Takashi Iwai authored
The sanity checks introduced for malformed descriptors loosely check the given descriptor size, although the size greater than the defined description is invalid. It was due to a concern of any funky firmware in the actual products. But this doesn't look hitting, and any sane products must have the defined descriptors. So in this patch, we make the validators more strict, allowing only with the defined descriptor sizes. The value in clock selector validator is corrected from 5 to 7 to count the two unlisted fields after baCSourceID[]. Suggested-by:
-
Takashi Iwai authored
There are lots of open-coded functions to find a clock source, selector and multiplier. Now there are both v2 and v3, so six variants. This patch refactors the code to use a common helper for the main loop, and define each validator function for each target. There is no functional change. Fixes: 9a2fe9b8 ("ALSA: usb: initial USB Audio Device Class 3.0 support") Reviewed-by:
-
- Apr 03, 2018
-
-
Takashi Iwai authored
The PCM runtime object is created and freed dynamically at PCM stream open / close time. This is tracked via substream->runtime, and it's cleared at snd_pcm_detach_substream(). The runtime object assignment is protected by PCM open_mutex, so for all PCM operations, it's safely handled. However, each PCM substream provides also an ALSA timer interface, and user-space can access to this while closing a PCM substream. This may eventually lead to a UAF, as snd_pcm_timer_resolution() tries to access the runtime while clearing it in other side. Fortunately, it's the only concurrent access from the PCM timer, and it merely reads runtime->timer_resolution field. So, we can avoid the race by reordering kfree() and wrapping the substream->runtime clearance with the corresponding timer lock. Reported-by:
<syzbot+8e62ff4e07aa2ce87826@syzkaller.appspotmail.com> Cc: <stable@vger.kernel.org> Signed-off-by:
-
- Mar 29, 2018
-
-
Lukas Wunner authored
The system sleep PM ops azx_suspend() and azx_resume() were previously called by vga_switcheroo, but commit 07f4f97d ("vga_switcheroo: Use device link for HDA controller") removed their invocation. Unfortunately the commit neglected to update the #ifdef surrounding the two functions, so if CONFIG_PM_SLEEP is *not* enabled but all three of CONFIG_PM, CONFIG_VGA_SWITCHEROO and CONFIG_SND_HDA_CODEC_HDMI *are* enabled, the compiler now emits the following warning: sound/pci/hda/hda_intel.c:1024:12: warning: 'azx_resume' defined but not used [-Wunused-function] static int azx_resume(struct device *dev) ^~~~~~~~~~ sound/pci/hda/hda_intel.c:989:12: warning: 'azx_suspend' defined but not used [-Wunused-function] static int azx_suspend(struct device *dev) ^~~~~~~~~~~ Silence by updating the #ifdef. Because the #ifdef block now uses the same condition as the one immediately succeeding it, the two blocks can be collapsed together, shaving off another two lines. Fixes: 07f4f97d ("vga_switcheroo: Use device link for HDA controller") Reviewed-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
Lukas Wunner <lukas@wunner.de> Link: https://patchwork.kernel.org/patch/10313441/ Link: https://patchwork.freedesktop.org/patch/msgid/b8e70e34a9acbd4f0a1a6c7673cea96888ae9503.1522323444.git.lukas@wunner.de
-
Dan Carpenter authored
We recently made "format" a u64 variable so now static checkers complain that this shift will wrap around if format is more than 31. I don't think it makes a difference for runtime, but it's simple to silence the warning. Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
-
- Mar 28, 2018
-
-
Alexei Starovoitov authored
- fix trace_hfi1_ctxt_info() to pass large struct by reference instead of by value - convert 'type array[]' tracepoint arguments into 'type *array', since compiler will warn that sizeof('type array[]') == sizeof('type *array') and later should be used instead The CAST_TO_U64 macro in the later patch will enforce that tracepoint arguments can only be integers, pointers, or less than 8 byte structures. Larger structures should be passed by reference. Signed-off-by:Alexei Starovoitov <ast@kernel.org> Signed-off-by:
Daniel Borkmann <daniel@iogearbox.net>
-
Fabio Estevam authored
Structure i2c_driver does not need to set the owner field, as this will be populated by the driver core. Generated by scripts/coccinelle/api/platform_no_drv_owner.cocci. Signed-off-by:
Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by:
Mark Brown <broonie@kernel.org>
-
Kuninori Morimoto authored
Now we can replace Codec to Component. Let's do it. Note: xxx_codec_xxx() -> xxx_component_xxx() .idle_bias_off = 0 -> .idle_bias_on = 1 .ignore_pmdown_time = 0 -> .use_pmdown_time = 1 - -> .endianness = 1 - -> .non_legacy_dai_naming = 1 Signed-off-by:
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by:
-
Kuninori Morimoto authored
commit aeec6cc0 ("ASoC: Intel: bytcr_rt5651: Configure PLL1 before using it") is using codec->dev, but codec is replaced to component. Let's use component Fixes: aeec6cc0 ("ASoC: Intel: bytcr_rt5651: Configure PLL1 before using it") Signed-off-by:
-
Kuninori Morimoto authored
commit c88d3115 ("ASoC: amd: Enable da7219 master clock using common clock framework") is using rtd->codec, but codec is replaced to component. Let's use component Fixes: c88d3115 ("ASoC: amd: Enable da7219 master clock using common clock framework") Signed-off-by:
-
- Mar 27, 2018
-
-
Colin Ian King authored
With the current exit return path of the ctl_info allocation failure cval is not being freed resulting in a memory leak. Fix this by kfree'ing it on the return. Detected by CoverityScan, CID#1466878 ("Resource Leak") Fixes: 21e9b3e9 ("ALSA: usb-audio: fix uac control query argument") Signed-off-by:Colin Ian King <colin.king@canonical.com> Signed-off-by:
-
Takashi Iwai authored
The previous fix 40cab6e8 ("ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams") introduced some mutex unbalance; the check of runtime->oss.rw_ref was inserted in a wrong place after the mutex lock. This patch fixes the inconsistency by rewriting with the helper functions to lock/unlock parameters with the stream check. Fixes: 40cab6e8 ("ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams") Reported-by:
-
Dan Carpenter authored
Smatch complains that "tmp" can be uninitialized if we do a zero size write. Fixes: 02a5d692 ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write") Signed-off-by:
-
Liam Girdwood authored
Fix the topology kcontrol string handling so that string pointer references are strdup()ed instead of being copied. This fixes issues with kcontrol templates on the stack or ones that are freed. Remember and free the strings too when topology is unloaded. Signed-off-by:
Liam Girdwood <liam.r.girdwood@linux.intel.com> Signed-off-by:
-
Robert Rosengren authored
Show paused ALSA aloop device as inactive, i.e. the control "PCM Slave Active" set as false. Notification sent upon state change. This makes it possible for client capturing from aloop device to know if data is expected. Without it the client expects data even if playback is paused. Signed-off-by:
Robert Rosengren <robert.rosengren@axis.com> Signed-off-by:
-
- Mar 26, 2018
-
-
Stefan Roese authored
When trying to use the driver (e.g. aplay *.wav), the 4MiB DMA buffer will get mmapp'ed in 16KiB chunks. But this fails with the 2nd 16KiB area, as the page offset is outside of the VMA range (size), which is currently used as size parameter in snd_pcm_lib_default_mmap(). By using the DMA buffer size (dma_bytes) instead, the complete DMA buffer can be mmapp'ed and the issue is fixed. This issue was detected on an ARM platform (TI AM57xx) using the RME HDSP MADI PCIe soundcard. Fixes: 657b1989 ("ALSA: pcm - Use dma_mmap_coherent() if available") Signed-off-by:
Stefan Roese <sr@denx.de> Cc: <stable@vger.kernel.org> Signed-off-by:
-
Joe Perches authored
Some functions definitions have either the initial open brace and/or the closing brace outside of column 1. Move those braces to column 1. This allows various function analyzers like gnu complexity to work properly for these modified functions. Signed-off-by:
Joe Perches <joe@perches.com> Acked-by:
Andy Shevchenko <andy.shevchenko@gmail.com> Acked-by:
Paul Moore <paul@paul-moore.com> Acked-by:
Alex Deucher <alexander.deucher@amd.com> Acked-by:
Dave Chinner <dchinner@redhat.com> Reviewed-by:
Darrick J. Wong <darrick.wong@oracle.com> Acked-by:
Alexandre Belloni <alexandre.belloni@free-electrons.com> Acked-by:
Martin K. Petersen <martin.petersen@oracle.com> Acked-by:
Mauro Carvalho Chehab <mchehab@s-opensource.com> Acked-by:
Rafael J. Wysocki <rafael.j.wysocki@intel.com> Acked-by:
Nicolin Chen <nicoleotsuka@gmail.com> Acked-by:
Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by:
Jiri Kosina <jkosina@suse.cz>
-
- Mar 24, 2018
-
-
Andrew Chant authored
Make the "clock valid" control a global control instead of a mixer so that it doesn't appear in mixer applications. Additionally, remove the check for writeability prohibited by spec, and Use common code to read the control value. Tested with a UAC2 Audio device that presents a clock validity control. The control still shows up in /proc usbmixer but not in alsamixer. Signed-off-by:
Andrew Chant <achant@google.com> Signed-off-by:
-
Andrew Chant authored
This implements UAC2 jack detection support, presenting jack status as a boolean read-only mono mixer. The presence of any channel in the UAC2_TE_CONNECTOR control for a terminal will result in the mixer saying the jack is connected. Mixer naming follows the convention in sound/core/ctljack.c, terminating the mixer with " Jack". For additional clues as to which jack is being presented, the name is prefixed with " - Input Jack" or " - Output Jack" depending on if it's an input or output terminal. This is required because terminal names are ambiguous between inputs and outputs and often duplicated - Bidirectional terminal types (0x400 -> 0x4FF) "... may be used separately for input only or output only. These types require two Terminal descriptors. Both have the same type." (quote from "USB Device Class Definition for Terminal Types") Since bidirectional terminal types are common for headphone adapters, this distinguishes between two otherwise identically-named jack controls. Tested with a UAC2 audio device with connector control capability. Signed-off-by:
-
- Mar 23, 2018
-
-
Takashi Iwai authored
OSS PCM stream management isn't modal but it allows ioctls issued at any time for changing the parameters. In the previous hardening patch ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write"), we covered these races and prevent the corruption by protecting the concurrent accesses via params_lock mutex. However, this means that some ioctls that try to change the stream parameter (e.g. channels or format) would be blocked until the read/write finishes, and it may take really long. Basically changing the parameter while reading/writing is an invalid operation, hence it's even more user-friendly from the API POV if it returns -EBUSY in such a situation. This patch adds such checks in the relevant ioctls with the addition of read/write access refcount. Cc: <stable@vger.kernel.org> Signed-off-by: -
Takashi Iwai authored
Although we apply the params_lock mutex to the whole read and write operations as well as snd_pcm_oss_change_params(), we may still face some races. First off, the params_lock is taken inside the read and write loop. This is intentional for avoiding the too long locking, but it allows the in-between parameter change, which might lead to invalid pointers. We check the readiness of the stream and set up via snd_pcm_oss_make_ready() at the beginning of read and write, but it's called only once, by assuming that it remains ready in the rest. Second, many ioctls that may change the actual parameters (i.e. setting runtime->oss.params=1) aren't protected, hence they can be processed in a half-baked state. This patch is an attempt to plug these holes. The stream readiness check is moved inside the read/write inner loop, so that the stream is always set up in a proper state before further processing. Also, each ioctl that may change the parameter is wrapped with the params_lock for avoiding the races. The issues were triggered by syzkaller in a few different scenarios, particularly the one below appearing as GPF in loopback_pos_update. Reported-by:
<syzbot+c4227aec125487ec3efa@syzkaller.appspotmail.com> Cc: <stable@vger.kernel.org> Signed-off-by:
-
Nobutaka Okabe authored
Integrate the native DSD support quirk codes of "ITF-USB DSD" based DACs. Now, "is_itf_usb_dsd_2alts_dac()" and "is_itf_usb_dsd_3alts_dac()" is integrated into one function "is_itf_usb_dsd_dac()". So, remove the logic to distinguish UD-501 and UD-501V2 by the "Product Name". The integration is possible by changing the following two functions. - snd_usb_select_mode_quirk(): Change the determination condition of the DSD mode switch command, from the altset number being used, to the audio format being played. Actually, this operation is same as playback using ASIO driver in Windows environment. - snd_usb_interface_dsd_format_quirk(): To which altset supports native DSD is determined by the number of altsets. Previously, it's a constant "2" or "3". Signed-off-by:
Nobutaka Okabe <nob77413@gmail.com> Signed-off-by:
-
Nobutaka Okabe authored
There are two versions of TEAC UD-501, the normal version and the vendor updated version(UD-501V2). They have the same VID/PID, but the num of the altsetting is different, UD-501 has 2 altsets for stream, and UD-501V2 has 3. So, add the logic to distinguish them by the Product Name, not by the PID. Signed-off-by:
-
Nobutaka Okabe authored
Add native DSD support quirk for Luxman DA-06 DAC, by adding the PID/VID 1852:5065. Rename "is_marantz_denon_dac()" function to "is_itf_usb_dsd_2alts_dac()" to cover broader device family sharing the same USB audio implementation(*). For the same reason, rename "is_teac_dsd_dac()" function to "is_itf_usb_dsd_3alts_dac()". (*) These devices have the same USB controller "ITF-USB DSD", supplied by INTERFACE Co., Ltd. "ITF-USB DSD" USB controller has two patterns, Pattern 1. (2 altsets version) - Altset 0: for control - Altset 1: for stream (S32) - Altset 2: for stream (S32, DSD_U32) Pattern 2. (3 altsets version) - Altset 0: for control - Altset 1: for stream (S16) - Altset 2: for stream (S32) - Altset 3: for stream (S32, DSD_U32) "is_itf_usb_dsd_2alts_dac()" returns true, if the DAC has "Pattern 1" USB controller, and "is_itf_usb_dsd_3alts_dac()" returns true, if "Pattern2". Signed-off-by:
-
Nobutaka Okabe authored
Add native DSD support quirk for TEAC UD-301 DAC, by adding the PID/VID 0644:804a. Signed-off-by:
-
Andrew Chant authored
This patch fixes code readability and should have no functional change. Correct uac control query functions to account for the 1-based indexing of USB Audio Class control identifiers. The function parameter, u8 control, should be the constant defined in audio-v2.h to identify the control to be checked for readability or writeability. This patch fixes all callers that had adjusted, and makes explicit the mapping between audio_feature_info[] array index and the associated control identifier. Signed-off-by:
-
- Mar 22, 2018
-
-
Takashi Iwai authored
In loopback_open() and loopback_close(), we assign and release the substream object to the corresponding cable in a racy way. It's neither locked nor done in the right position. The open callback assigns the substream before its preparation finishes, hence the other side of the cable may pick it up, which may lead to the invalid memory access. This patch addresses these: move the assignment to the end of the open callback, and wrap with cable->lock for avoiding concurrent accesses. Cc: <stable@vger.kernel.org> Signed-off-by: -
Takashi Iwai authored
The aloop driver tries to stop the pending timer via timer_del() in the trigger callback and in the close callback. The former is correct, as it's an atomic operation, while the latter expects that the timer gets really removed and proceeds the resource releases after that. But timer_del() doesn't synchronize, hence the running timer may still access the released resources. A similar situation can be also seen in the prepare callback after trigger(STOP) where the prepare tries to re-initialize the things while a timer is still running. The problems like the above are seen indirectly in some syzkaller reports (although it's not 100% clear whether this is the only cause, as the race condition is quite narrow and not always easy to trigger). For addressing these issues, this patch adds the explicit alls of timer_del_sync() in some places, so that the pending timer is properly killed / synced. Cc: <stable@vger.kernel.org> Signed-off-by: -
Kailang Yang authored
It will have a chance speaker no sound after system resume. To toggle NID 0x53 index 0x2 bit 15 will solve this issue. This usage will also suitable with ALC256. Fixes: 4a219ef8 ("ALSA: hda/realtek - Add ALC256 HP depop function") Signed-off-by:
Kailang Yang <kailang@realtek.com> Cc: <stable@vger.kernel.org> Signed-off-by:
-
Kailang Yang authored
This platform was hardware fixed type for CTIA type for headset port. Assigned 0x19 verb will fix can't record issue. Signed-off-by:
-
John Hsu authored
User reports an issue in Ubuntu about the device switch upon playback. We find the FLL will disalbe when switching headphone to speaker. The pulseaudio will stop the headphone and close its power. Then, it just opens the speaker and turn on its power. Therefore, the supply of system clock does the OFF event and disables FLL. But the FLL doesn't enable again when the speaker powers on. The patch adds the recovery of system clock to enable FLL again for this case. And it covers the case that system clock from MCLK. Signed-off-by:
John Hsu <KCHSU0@nuvoton.com> Signed-off-by:
-
- Mar 21, 2018
-
-
Ruslan Bilovol authored
Recently released USB Audio Class 3.0 specification introduces many significant changes comparing to previous versions, like - new Power Domains, support for LPM/L1 - new Cluster descriptor - changed layout of all class-specific descriptors - new High Capability descriptors - New class-specific String descriptors - new and removed units - additional sources for interrupts - removed Type II Audio Data Formats - ... and many other things (check spec) It also provides backward compatibility through multiple configurations, as well as requires mandatory support for BADD (Basic Audio Device Definition) on each ADC3.0 compliant device This patch adds initial support of UAC3 specification that is enough for Generic I/O Profile (BAOF, BAIF) device support from BADD document. Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
-
Takashi Iwai authored
We've observed too long probe time with Coffee Lake (CFL) machines, and the likely cause is some communication problem between the HD-audio controller and the codec chips. While the controller expects an IRQ wakeup for each codec response, it seems sometimes missing, and it takes one second for the controller driver to time out and read the response in the polling mode. Although we aren't sure about the real culprit yet, in this patch, we put a workaround by forcing the polling mode as default for CFL machines; the polling mode itself isn't too heavy, and much better than other workarounds initially suggested (e.g. disabling power-save), at least. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199007 Fixes: e79b0006 ("ALSA: hda - Add Coffelake PCI ID") Reported-and-tested-by:
Hui Wang <hui.wang@canonical.com> Cc: <stable@vger.kernel.org> Signed-off-by:
-
Ezequiel Garcia authored
The driver does not select all the codec drivers that needs. Fix it by selecting the analog and HDMI codecs. Cc: Sjoerd Simons <sjoerd.simons@collabora.co.uk> Signed-off-by:
Ezequiel Garcia <ezequiel@collabora.co.uk> Signed-off-by:
-
Ezequiel Garcia authored
Commit 24069b58 ("ASoC: hdmi-codec: remove multi detection support") changed the dai_name for the HDMI Codec, breaking the rk3288_hdmi_analog driver, which fails to register with a: rk3288-snd-hdmi-analog sound: ASoC: CODEC DAI hdmi-hifi.0 not registered This commit fixes the dai_name, fixing the issue. Fixes: 24069b58 ("ASoC: hdmi-codec: remove multi detection support") Signed-off-by:
-
Masanari Iida authored
This patch fixes a spelling typo in printk Signed-off-by:
Masanari Iida <standby24x7@gmail.com> Signed-off-by:
-
Nikita Yushchenko authored
Use SET_SYSTEM_SLEEP_PM_OPS() macro instead of direct assignment to .suspend and .resume fields. This makes driver working after restore from hibernation. Signed-off-by:
Nikita Yushchenko <nikita.yoush@cogentembedded.com> Signed-off-by:
-
