Skip to content
  1. Dec 10, 2018
  2. Dec 09, 2018
  3. Dec 07, 2018
  4. Dec 05, 2018
  5. Dec 03, 2018
    • Hui Peng's avatar
      ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c · 5f8cf712
      Hui Peng authored
      If a USB sound card reports 0 interfaces, an error condition is triggered
      and the function usb_audio_probe errors out. In the error path, there was a
      use-after-free vulnerability where the memory object of the card was first
      freed, followed by a decrement of the number of active chips. Moving the
      decrement above the atomic_dec fixes the UAF.
      
      [ The original problem was introduced in 3.1 kernel, while it was
        developed in a different form.  The Fixes tag below indicates the
        original commit but it doesn't mean that the patch is applicable
        cleanly. -- tiwai ]
      
      Fixes: 362e4e49
      
       ("ALSA: usb-audio - clear chip->probing on error exit")
      Reported-by: default avatarHui Peng <benquike@gmail.com>
      Reported-by: default avatarMathias Payer <mathias.payer@nebelwelt.net>
      Signed-off-by: default avatarHui Peng <benquike@gmail.com>
      Signed-off-by: default avatarMathias Payer <mathias.payer@nebelwelt.net>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      5f8cf712
    • Takashi Iwai's avatar
      ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570 · 54947cd6
      Takashi Iwai authored
      We've got a regression report for some Thinkpad models (at least
      T570s) which shows the too low speaker output volume.  The bisection
      leaded to the commit 61fcf8ec ("ALSA: hda/realtek - Enable Thinkpad
      Dock device for ALC298 platform"), and it's basically adding the two
      pin configurations for the dock, and looks harmless.
      
      The real culprit seems, though, that the DAC assignment for the
      speaker pin is implicitly assumed on these devices, i.e. pin NID 0x14
      to be coupled with DAC NID 0x03.  When more pins are configured by the
      commit above, the auto-parser changes the DAC assignment, and this
      resulted in the regression.
      
      As a workaround, just provide the fixed pin / DAC mapping table for
      this Thinkpad fixup function.  It's no generic solution, but the
      problem itself is pretty much device-specific, so must be good
      enough.
      
      Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1554304
      Fixes: 61fcf8ec
      
       ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform")
      Cc: <stable@vger.kernel.org>
      Reported-and-tested-by: default avatarJeremy Cline <jcline@redhat.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      54947cd6
  6. Nov 29, 2018
    • Takashi Iwai's avatar
      ALSA: pcm: Fix interval evaluation with openmin/max · 5363857b
      Takashi Iwai authored
      As addressed in alsa-lib (commit b420056604f0), we need to fix the
      case where the evaluation of PCM interval "(x x+1]" leading to
      -EINVAL.  After applying rules, such an interval may be translated as
      "(x x+1)".
      
      Fixes: ff2d6acd
      
       ("ALSA: pcm: Fix snd_interval_refine first/last with open min/max")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      5363857b
    • Kai-Heng Feng's avatar
      ALSA: hda: Add support for AMD Stoney Ridge · 3deef52c
      Kai-Heng Feng authored
      
      
      It's similar to other AMD audio devices, it also supports D3, which can
      save some power drain.
      
      Signed-off-by: default avatarKai-Heng Feng <kai.heng.feng@canonical.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      3deef52c
    • Tony Das's avatar
      ALSA: usb-audio: Add SMSL D1 to quirks for native DSD support · 44ff57e6
      Tony Das authored
      
      
      This patch adds quirk VID/PID IDs for the SMSL D1 in order to enable
      Native DSD support.
      
      [ Moved the added entry in numerical order -- tiwai ]
      
      Signed-off-by: default avatarTony Das <tdas444@gmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      44ff57e6
    • Chanho Min's avatar
      ALSA: pcm: Fix starvation on down_write_nonblock() · b888a5f7
      Chanho Min authored
      Commit 67ec1072 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM
      stream") fixes deadlock for non-atomic PCM stream. But, This patch
      causes antother stuck.
      If writer is RT thread and reader is a normal thread, the reader
      thread will be difficult to get scheduled. It may not give chance to
      release readlocks and writer gets stuck for a long time if they are
      pinned to single cpu.
      
      The deadlock described in the previous commit is because the linux
      rwsem queues like a FIFO. So, we might need non-FIFO writelock, not
      non-block one.
      
      My suggestion is that the writer gives reader a chance to be scheduled
      by using the minimum msleep() instaed of spinning without blocking by
      writer. Also, The *_nonblock may be changed to *_nonfifo appropriately
      to this concept.
      In terms of performance, when trylock is failed, this minimum periodic
      msleep will have the same performance as the tick-based
      schedule()/wake_up_q().
      
      [ Although this has a fairly high performance penalty, the relevant
        code path became already rare due to the previous commit ("ALSA:
        pcm: Call snd_pcm_unlink() conditionally at closing").  That is, now
        this unconditional msleep appears only when using linked streams,
        and this must be a rare case.  So we accept this as a quick
        workaround until finding a more suitable one -- tiwai ]
      
      Fixes: 67ec1072
      
       ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream")
      Suggested-by: default avatarWonmin Jung <wonmin.jung@lge.com>
      Signed-off-by: default avatarChanho Min <chanho.min@lge.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      b888a5f7
    • Takashi Iwai's avatar
      ALSA: pcm: Call snd_pcm_unlink() conditionally at closing · b51abed8
      Takashi Iwai authored
      
      
      Currently the PCM core calls snd_pcm_unlink() always unconditionally
      at closing a stream.  However, since snd_pcm_unlink() invokes the
      global rwsem down, the lock can be easily contended.  More badly, when
      a thread runs in a high priority RT-FIFO, it may stall at spinning.
      
      Basically the call of snd_pcm_unlink() is required only for the linked
      streams that are already rare occasion.  For normal use cases, this
      code path is fairly superfluous.
      
      As an optimization (and also as a workaround for the RT problem
      above in normal situations without linked streams), this patch adds a
      check before calling snd_pcm_unlink() and calls it only when needed.
      
      Reported-by: default avatarChanho Min <chanho.min@lge.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      b51abed8
  7. Nov 28, 2018
  8. Nov 27, 2018
  9. Nov 26, 2018
  10. Nov 25, 2018
    • Takashi Iwai's avatar
      ALSA: control: Fix race between adding and removing a user element · e1a7bfe3
      Takashi Iwai authored
      
      
      The procedure for adding a user control element has some window opened
      for race against the concurrent removal of a user element.  This was
      caught by syzkaller, hitting a KASAN use-after-free error.
      
      This patch addresses the bug by wrapping the whole procedure to add a
      user control element with the card->controls_rwsem, instead of only
      around the increment of card->user_ctl_count.
      
      This required a slight code refactoring, too.  The function
      snd_ctl_add() is split to two parts: a core function to add the
      control element and a part calling it.  The former is called from the
      function for adding a user control element inside the controls_rwsem.
      
      One change to be noted is that snd_ctl_notify() for adding a control
      element gets called inside the controls_rwsem as well while it was
      called outside the rwsem.  But this should be OK, as snd_ctl_notify()
      takes another (finer) rwlock instead of rwsem, and the call of
      snd_ctl_notify() inside rwsem is already done in another code path.
      
      Reported-by: default avatar <syzbot+dc09047bce3820621ba2@syzkaller.appspotmail.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      e1a7bfe3
    • Takashi Iwai's avatar
      ALSA: sparc: Fix invalid snd_free_pages() at error path · 9a20332a
      Takashi Iwai authored
      
      
      Some spurious calls of snd_free_pages() have been overlooked and
      remain in the error paths of sparc cs4231 driver code.  Since
      runtime->dma_area is managed by the PCM core helper, we shouldn't
      release manually.
      
      Drop the superfluous calls.
      
      Reviewed-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      9a20332a
    • Takashi Iwai's avatar
      ALSA: wss: Fix invalid snd_free_pages() at error path · 7b691541
      Takashi Iwai authored
      
      
      Some spurious calls of snd_free_pages() have been overlooked and
      remain in the error paths of wss driver code.  Since runtime->dma_area
      is managed by the PCM core helper, we shouldn't release manually.
      
      Drop the superfluous calls.
      
      Reviewed-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      7b691541
  11. Nov 24, 2018
  12. Nov 23, 2018
  13. Nov 21, 2018
  14. Nov 19, 2018
  15. Nov 16, 2018
  16. Nov 15, 2018
    • Tzung-Bi Shih's avatar
      ASoC: dapm: Recalculate audio map forcely when card instantiated · 882eab6c
      Tzung-Bi Shih authored
      
      
      Audio map are possible in wrong state before card->instantiated has
      been set to true.  Imaging the following examples:
      
      time 1: at the beginning
      
        in:-1    in:-1    in:-1    in:-1
       out:-1   out:-1   out:-1   out:-1
       SIGGEN        A        B      Spk
      
      time 2: after someone called snd_soc_dapm_new_widgets()
      (e.g. create_fill_widget_route_map() in sound/soc/codecs/hdac_hdmi.c)
      
         in:1     in:0     in:0     in:0
        out:0    out:0    out:0    out:1
       SIGGEN        A        B      Spk
      
      time 3: routes added
      
         in:1     in:0     in:0     in:0
        out:0    out:0    out:0    out:1
       SIGGEN -----> A -----> B ---> Spk
      
      In the end, the path should be powered on but it did not.  At time 3,
      "in" of SIGGEN and "out" of Spk did not propagate to their neighbors
      because snd_soc_dapm_add_path() will not invalidate the paths if
      the card has not instantiated (i.e. card->instantiated is false).
      To correct the state of audio map, recalculate the whole map forcely.
      
      Signed-off-by: default avatarTzung-Bi Shih <tzungbi@google.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      882eab6c
    • Peter Ujfalusi's avatar
      ASoC: omap-abe-twl6040: Fix missing audio card caused by deferred probing · 76836fd3
      Peter Ujfalusi authored
      
      
      The machine driver fails to probe in next-20181113 with:
      
      [    2.539093] omap-abe-twl6040 sound: ASoC: CODEC DAI twl6040-legacy not registered
      [    2.546630] omap-abe-twl6040 sound: devm_snd_soc_register_card() failed: -517
      ...
      [    3.693206] omap-abe-twl6040 sound: ASoC: Both platform name/of_node are set for TWL6040
      [    3.701446] omap-abe-twl6040 sound: ASoC: failed to init link TWL6040
      [    3.708007] omap-abe-twl6040 sound: devm_snd_soc_register_card() failed: -22
      [    3.715148] omap-abe-twl6040: probe of sound failed with error -22
      
      Bisect pointed to a merge commit:
      first bad commit: [0f688ab20a540aafa984c5dbd68a71debebf4d7f] Merge remote-tracking branch 'net-next/master'
      
      and a diff between a working kernel does not reveal anything which would
      explain the change in behavior.
      
      Further investigation showed that on the second try of loading fails
      because the dai_link->platform is no longer NULL and it might be pointing
      to uninitialized memory.
      
      The fix is to move the snd_soc_dai_link and snd_soc_card inside of the
      abe_twl6040 struct, which is dynamically allocated every time the driver
      probes.
      
      Signed-off-by: default avatarPeter Ujfalusi <peter.ujfalusi@ti.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      76836fd3
  17. Nov 14, 2018
    • Kirill Marinushkin's avatar
      ASoC: pcm3060: Rename output widgets · 933a9549
      Kirill Marinushkin authored
      In the initial commit [1], I added differential output of the codec as
      separate `+` and `-` widgets:
      
      OUTL+
      OUTR+
      OUTL-
      OUTR-
      
      Later, in the commit [2], I added a device tree property to configure the
      output as single-ended or differential. Having this property, the `+` and
      `-` separation in widgets seems for me confusing. There are no functional
      benefits in such separation, so I find reasonable to get rid of it:
      
      OUTL
      OUTR
      
      The new naming is more friendly for sound cards, and is better aligned with
      other codec drivers in kernel.
      
      Renaming the output widgets now should not be a problem from the backwards-
      compatibility perspective, as the driver for PCM3060 is added into the
      mainline very recently, and did not yet appear in any releases.
      
      [1] commit 6ee47d4a
      
       ("ASoC: pcm3060: Add codec driver")
      [2] commit a78c62de00d5 ("ASoC: pcm3060: Add DT property for single-ended
          output")
      
      Signed-off-by: default avatarKirill Marinushkin <kmarinushkin@birdec.tech>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      933a9549
    • Rohit kumar's avatar
      ASoC: qcom: Set dai_link id to each dai_link · 67fd1437
      Rohit kumar authored
      
      
      Frontend dai_link id is used for closing ADM sessions.
      During concurrent usecase when one session is closed,
      it closes other ADM session associated with other usecase
      too. Dai_link->id should always point to Frontend dai id.
      Set cpu_dai id as dai_link id to fix the issue.
      
      Signed-off-by: default avatarRohit kumar <rohitkr@codeaurora.org>
      Acked-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      67fd1437