Skip to content
Snippets Groups Projects
  1. Nov 14, 2016
    • Takashi Iwai's avatar
      ALSA: usb-audio: Fix use-after-free of usb_device at disconnect · 6ff1a253
      Takashi Iwai authored
      
      The usb-audio driver implements the deferred device disconnection for
      the device in use.  In this mode, the disconnection callback returns
      immediately while the actual ALSA card object removal happens later
      when all files get closed.  As Shuah reported, this code flow,
      however, leads to a use-after-free, detected by KASAN:
      
       BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
       Write of size 8 by task pulseaudio/2244
       Call Trace:
        [<ffffffff81b31473>] dump_stack+0x67/0x94
        [<ffffffff81564ef1>] kasan_object_err+0x21/0x70
        [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
        [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
        [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
        [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
        [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
        [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
        [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
        [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
        [<ffffffff8242cae4>] release_card_device+0x34/0x130
        [<ffffffff81ef1846>] device_release+0x76/0x1e0
        [<ffffffff81b37ad7>] kobject_release+0x107/0x370
        .....
       Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
       Allocated:
        [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
        [<ffffffff81564296>] save_stack+0x46/0xd0
        [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
        [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
        [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
        [<ffffffff8216349d>] hub_event+0xf1d/0x35f0
        ....
       Freed:
        [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
        [<ffffffff81564296>] save_stack+0x46/0xd0
        [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
        [<ffffffff81560929>] kfree+0xd9/0x280
        [<ffffffff8214de6e>] usb_release_dev+0xde/0x110
        [<ffffffff81ef1846>] device_release+0x76/0x1e0
        ....
      
      It's the code trying to clear drvdata of the assigned usb_device where
      the usb_device itself was already released in usb_release_dev() after
      the disconnect callback.
      
      This patch fixes it by checking whether the code path is via the
      disconnect callback, i.e. chip->shutdown flag is set.
      
      Fixes: 79289e24 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
      Reported-and-tested-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
      Cc: <stable@vger.kernel.org> # v4.6+
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      6ff1a253
    • Linus Torvalds's avatar
      ASoC: lpass-platform: fix uninitialized variable · ee2bd216
      Linus Torvalds authored
      
      In commit 022d00ee ("ASoC: lpass-platform: Fix broken pcm data
      usage") the stream specific information initialization was broken, with
      the dma channel information not being initialized if there was no
      alloc_dma_channel() helper function.
      
      Before that, the DMA channel number was implicitly initialized to zero
      because the backing store was allocated with devm_kzalloc().  When the
      init code was rewritten, that implicit initialization was lost, and gcc
      rightfully complains about an uninitialized variable being used.
      
      Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
      Cc: Mark Brown <broonie@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ee2bd216
  2. Nov 11, 2016
    • Takashi Iwai's avatar
      ALSA: hda - Fix mic regression by ASRock mobo fixup · 9a254191
      Takashi Iwai authored
      
      The commit [1a3f0991: ALSA: hda - Fix surround output pins for
      ASRock B150M mobo] introduced a fixup of pin configs for ASRock
      mobos to fix the surround outputs.  However, this overrides the pin
      configs of the mic pins as if they are outputs-only, effectively
      disabling the mic inputs.  Of course, it's a regression wrt mic
      functionality.
      
      Actually the pins 0x18 and 0x1a don't need to be changed; we just need
      to disable the bogus pins 0x14 and 0x15.  Then the auto-parser will
      pick up mic pins as switchable and assign the surround outputs there.
      
      This patch removes the incorrect pin overrides of NID 0x18 and 0x1a
      from the ASRock fixup.
      
      Fixes: 1a3f0991 ('ALSA: hda - Fix surround output pins for ASRock...')
      Reported-and-tested-by: default avatarVitor Antunes <vitor.hda@gmail.com>
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=187431
      
      
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      9a254191
  3. Nov 10, 2016
  4. Nov 08, 2016
    • Takashi Iwai's avatar
      ALSA: info: Return error for invalid read/write · 6809cd68
      Takashi Iwai authored
      
      Currently the ALSA proc handler allows read or write even if the proc
      file were write-only or read-only.  It's mostly harmless, does thing
      but allocating memory and ignores the input/output.  But it doesn't
      tell user about the invalid use, and it's confusing and inconsistent
      in comparison with other proc files.
      
      This patch adds some sanity checks and let the proc handler returning
      an -EIO error when the invalid read/write is performed.
      
      Cc: <stable@vger.kernel.org> # v4.2+
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      6809cd68
    • Takashi Iwai's avatar
      ALSA: info: Limit the proc text input size · 027a9fe6
      Takashi Iwai authored
      
      The ALSA proc handler allows currently the write in the unlimited size
      until kmalloc() fails.  But basically the write is supposed to be only
      for small inputs, mostly for one line inputs, and we don't have to
      handle too large sizes at all.  Since the kmalloc error results in the
      kernel warning, it's better to limit the size beforehand.
      
      This patch adds the limit of 16kB, which must be large enough for the
      currently existing code.
      
      Cc: stable@vger.kernel.org # v4.2+
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      027a9fe6
  5. Nov 02, 2016
  6. Nov 01, 2016
    • Chen-Yu Tsai's avatar
      ASoC: sun4i-codec: Enable bus clock after getting GPIO · 3716a891
      Chen-Yu Tsai authored
      
      In the current probe function the GPIO is acquired after the codec's
      bus clock is enabled. However if it fails to acquire the GPIO due to
      a deferred probe, it does not disable the bus clock before bailing out.
      This would result in the clock being enabled multiple times.
      
      Move the code that enables the bus clock after the part that gets the
      GPIO, maintaining a separation between resource acquisition and device
      enablement in the probe function.
      
      Signed-off-by: default avatarChen-Yu Tsai <wens@csie.org>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      3716a891
  7. Oct 31, 2016
  8. Oct 28, 2016
  9. Oct 27, 2016
  10. Oct 26, 2016
  11. Oct 25, 2016
  12. Oct 24, 2016
  13. Oct 20, 2016
  14. Oct 18, 2016
  15. Oct 13, 2016
  16. Oct 12, 2016
  17. Oct 11, 2016
    • Masahiro Yamada's avatar
      treewide: remove redundant #include <linux/kconfig.h> · 97139d4a
      Masahiro Yamada authored
      Kernel source files need not include <linux/kconfig.h> explicitly
      because the top Makefile forces to include it with:
      
        -include $(srctree)/include/linux/kconfig.h
      
      This commit removes explicit includes except the following:
      
        * arch/s390/include/asm/facilities_src.h
        * tools/testing/radix-tree/linux/kernel.h
      
      These two are used for host programs.
      
      Link: http://lkml.kernel.org/r/1473656164-11929-1-git-send-email-yamada.masahiro@socionext.com
      
      
      Signed-off-by: default avatarMasahiro Yamada <yamada.masahiro@socionext.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      97139d4a
    • Petr Mladek's avatar
      kthread: kthread worker API cleanup · 3989144f
      Petr Mladek authored
      A good practice is to prefix the names of functions by the name
      of the subsystem.
      
      The kthread worker API is a mix of classic kthreads and workqueues.  Each
      worker has a dedicated kthread.  It runs a generic function that process
      queued works.  It is implemented as part of the kthread subsystem.
      
      This patch renames the existing kthread worker API to use
      the corresponding name from the workqueues API prefixed by
      kthread_:
      
      __init_kthread_worker()		-> __kthread_init_worker()
      init_kthread_worker()		-> kthread_init_worker()
      init_kthread_work()		-> kthread_init_work()
      insert_kthread_work()		-> kthread_insert_work()
      queue_kthread_work()		-> kthread_queue_work()
      flush_kthread_work()		-> kthread_flush_work()
      flush_kthread_worker()		-> kthread_flush_worker()
      
      Note that the names of DEFINE_KTHREAD_WORK*() macros stay
      as they are. It is common that the "DEFINE_" prefix has
      precedence over the subsystem names.
      
      Note that INIT() macros and init() functions use different
      naming scheme. There is no good solution. There are several
      reasons for this solution:
      
        + "init" in the function names stands for the verb "initialize"
          aka "initialize worker". While "INIT" in the macro names
          stands for the noun "INITIALIZER" aka "worker initializer".
      
        + INIT() macros are used only in DEFINE() macros
      
        + init() functions are used close to the other kthread()
          functions. It looks much better if all the functions
          use the same scheme.
      
        + There will be also kthread_destroy_worker() that will
          be used close to kthread_cancel_work(). It is related
          to the init() function. Again it looks better if all
          functions use the same naming scheme.
      
        + there are several precedents for such init() function
          names, e.g. amd_iommu_init_device(), free_area_init_node(),
          jump_label_init_type(),  regmap_init_mmio_clk(),
      
        + It is not an argument but it was inconsistent even before.
      
      [arnd@arndb.de: fix linux-next merge conflict]
       Link: http://lkml.kernel.org/r/20160908135724.1311726-1-arnd@arndb.de
      Link: http://lkml.kernel.org/r/1470754545-17632-3-git-send-email-pmladek@suse.com
      
      
      Suggested-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarPetr Mladek <pmladek@suse.com>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
      Cc: Josh Triplett <josh@joshtriplett.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Jiri Kosina <jkosina@suse.cz>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Michal Hocko <mhocko@suse.cz>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3989144f
    • murray foster's avatar
      ASoC: cs4270: fix DAPM stream name mismatch · aa5f9209
      murray foster authored
      
      Mismatching stream names in DAPM route and widget definitions are
      causing compilation errors. Fixing these names allows the cs4270
      driver to compile and function.
      
      [Errors must be at probe time not compile time -- broonie]
      
      Signed-off-by: default avatarMurray Foster <mrafoster@gmail.com>
      Acked-by: default avatarPaul Handrigan <Paul.Handrigan@cirrus.com>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      Cc: stable@vger.kernel.org
      aa5f9209
    • Arnd Bergmann's avatar
      ASoC: Intel: haswell depends on sst-firmware · c3474e21
      Arnd Bergmann authored
      
      The Intel Haswell audio support fails to link if
      CONFIG_SND_SOC_INTEL_SST_FIRMWARE is disabled:
      
      sst-haswell-dsp.c: undefined reference to `sst_mem_block_register'
      sst-haswell-dsp.c: undefined reference to `sst_mem_block_unregister_all'
      sst-haswell-dsp.c: undefined reference to `sst_module_alloc_blocks'
      sst-haswell-dsp.c: undefined reference to `sst_module_free'
      sst-haswell-dsp.c: undefined reference to `sst_module_new'
      sst-haswell-pcm.c: undefined reference to `sst_module_get_from_id'
      sst-haswell-pcm.c: undefined reference to `sst_module_runtime_restore'
      sst-haswell-pcm.c: undefined reference to `sst_module_runtime_save'
      ERROR: "sst_block_alloc_scratch" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_block_free_scratch" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_dsp_dma_copyfrom" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_dsp_dma_copyto" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_dsp_dma_get_channel" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_dsp_dma_put_channel" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_dsp_free" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_dsp_get_offset" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_dsp_new" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_fw_free_all" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_fw_new" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_fw_reload" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_fw_unload" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_module_runtime_alloc_blocks" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_module_runtime_get_from_id" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      ERROR: "sst_module_runtime_new" [sound/soc/intel/haswell/snd-soc-sst-haswell-pcm.ko] undefined!
      
      This moves the 'select' statement from two of the three haswell based users
      into the line that is used by all of them, so make it harder to get wrong
      and to fix the existing randconfig regressions.
      
      Fixes: 2d995e5d ("ASoC: Intel: boards: Add bdw-rt5677 machine driver")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      c3474e21
  18. Oct 10, 2016
  19. Oct 06, 2016
  20. Oct 04, 2016
    • Petr Kulhavy's avatar
      ASoC: tas571x: remove improper PDN signal usage in set_bias_level · 8b0678dc
      Petr Kulhavy authored
      
      The set_bias_level toggles the PDN signal when entering
      SND_SOC_BIAS_STANDBY and SND_SOC_BIAS_OFF. However this has no effect and
      actually breaks things down (tested with TAS5717) due to the following
      reasons:
      
      1) holding down PDN does not save power but holding down RST does
      2) now hard mute via register 0x5 is implemented and therefore it is no
         longer needed to toggle PDN to enter all channel shut down
      3) in order to leave PDN it is required to toggle the RST signal (see
         TAS5721 datasheet), which was not implemented
      4) toggling PDN as implemented actually mutes PWMs and there is no audio
         output (tested on TAS5717)
      
      For these reasons remove the PDN signal toggling and just initialize it to
      inactive in probe().
      
      Signed-off-by: default avatarPetr Kulhavy <brain@jikos.cz>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      8b0678dc
    • Petr Kulhavy's avatar
      ASoC: tas571x: extend the t_i2c time to comply with TAS5721 · e54de7f5
      Petr Kulhavy authored
      
      TAS5721 datasheet recommends to wait at least 13.5ms after deasserting the
      RESET signal. For TAS5717 this time is only 12ms, which was the original
      value in the code.
      
      Extend the wait time after deasserting RESET from 12 to 13.5ms to comply
      with the TAS5721 specification.
      
      Signed-off-by: default avatarPetr Kulhavy <brain@jikos.cz>
      Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      e54de7f5
Loading