Commit Graph

28329 Commits

Author SHA1 Message Date
Linus Torvalds f9efc94447 sound fixes for 4.15-rc3
All fixes are small and for stable:
 - A PCM ioctl race fix
 - Yet another USB-audio hardening for malicious descriptors
 - Realtek ALC257 codec support
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAlonvnwOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+1cA//SIYwnAE0LcvD2IhC+3B4j9dQW5JET7vtTfvr
 cP+sncYoGMtI/4cSYrcDO/crxb1KSGLWwmql09+LamBjOvbhPbmKhD7xZvZ32a0O
 RJ1oY2SKx5hgBmqowZu5la8gGHF9YTtLd8Q4XFbcf8lK+eCC19ndpkQOuENkXBKU
 SJYIW1D2X3Dw3Cy9PGFtKoYbwxe/Yb5tYcTDtLZgiqMm8B8nb9fPRkUjBBOIRZVv
 gi+YI6I/CjtIxH9AFVhDrDlDobZOOT7xQP/Sbwa4YTabiIQPFK3oIF+T9ZkwuwLG
 vKx9DjYjZEa/mbmre83KTF9zLP4MYva/+hiuGxJOW+Vx+LEUH+R7F7we3TfwuQJ0
 DxI/CpJi+xzHDMzFcHrjTZqxKw2MFNI85VVJUlzRmAvhMQrzjm3ckzYw8JUOytL5
 OavOAR8j9QAWpK4aBEQ8EqA9qInu0ibBlRhTbTzjJjwheUnyckW+V+n48wvo46I+
 xnenMgMjuZHC8CxJYgur0WvVbBtyC+/dPCJ+0FEEn5I67KwrB+Cbso7fP5OVxcAR
 Yc62fgb58OInpZA77s6Gc0T0QbN/udjqDUyDvtA+IROau5uOmjAILKw8ym5giR9+
 eNHKNFTIhQB2F6taAdVGdujAfN8JNklv742PZWt3uVXvI1y9/G7IxnX771fBPiUu
 jZoj6ok=
 =Tbdj
 -----END PGP SIGNATURE-----

Merge tag 'sound-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "All fixes are small and for stable:

   - a PCM ioctl race fix

   - yet another USB-audio hardening for malicious descriptors

   - Realtek ALC257 codec support"

* tag 'sound-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: pcm: prevent UAF in snd_pcm_info
  ALSA: hda/realtek - New codec support for ALC257
  ALSA: usb-audio: Add check return value for usb_string()
  ALSA: usb-audio: Fix out-of-bound error
  ALSA: seq: Remove spurious WARN_ON() at timer check
2017-12-06 10:49:14 -08:00
Robb Glasser 362bca57f5 ALSA: pcm: prevent UAF in snd_pcm_info
When the device descriptor is closed, the `substream->runtime` pointer
is freed. But another thread may be in the ioctl handler, case
SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
calls snd_pcm_info() which accesses the now freed `substream->runtime`.

Note: this fixes CVE-2017-0861

Signed-off-by: Robb Glasser <rglasser@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-12-05 23:28:08 +01:00
Kailang Yang f429e7e494 ALSA: hda/realtek - New codec support for ALC257
Add new support for ALC257 codec.

[ It's supposed to be almost equivalent with other ALC25x variants,
  just adding another type and id -- tiwai ]

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-12-05 10:54:10 +01:00
Jaejoong Kim 89b89d121f ALSA: usb-audio: Add check return value for usb_string()
snd_usb_copy_string_desc() returns zero if usb_string() fails.
In case of failure, we need to check the snd_usb_copy_string_desc()'s
return value and add an exception case

Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-12-04 09:15:55 +01:00
Jaejoong Kim 251552a2b0 ALSA: usb-audio: Fix out-of-bound error
The snd_usb_copy_string_desc() retrieves the usb string corresponding to
the index number through the usb_string(). The problem is that the
usb_string() returns the length of the string (>= 0) when successful, but
it can also return a negative value about the error case or status of
usb_control_msg().

If iClockSource is '0' as shown below, usb_string() will returns -EINVAL.
This will result in '0' being inserted into buf[-22], and the following
KASAN out-of-bound error message will be output.

AudioControl Interface Descriptor:
  bLength                 8
  bDescriptorType        36
  bDescriptorSubtype     10 (CLOCK_SOURCE)
  bClockID                1
  bmAttributes         0x07 Internal programmable Clock (synced to SOF)
  bmControls           0x07
  Clock Frequency Control (read/write)
  Clock Validity Control (read-only)
  bAssocTerminal          0
  iClockSource            0

To fix it, check usb_string()'return value and bail out.

==================================================================
BUG: KASAN: stack-out-of-bounds in parse_audio_unit+0x1327/0x1960 [snd_usb_audio]
Write of size 1 at addr ffff88007e66735a by task systemd-udevd/18376

CPU: 0 PID: 18376 Comm: systemd-udevd Not tainted 4.13.0+ #3
Hardware name: LG Electronics                   15N540-RFLGL/White Tip Mountain, BIOS 15N5
Call Trace:
dump_stack+0x63/0x8d
print_address_description+0x70/0x290
? parse_audio_unit+0x1327/0x1960 [snd_usb_audio]
kasan_report+0x265/0x350
__asan_store1+0x4a/0x50
parse_audio_unit+0x1327/0x1960 [snd_usb_audio]
? save_stack+0xb5/0xd0
? save_stack_trace+0x1b/0x20
? save_stack+0x46/0xd0
? kasan_kmalloc+0xad/0xe0
? kmem_cache_alloc_trace+0xff/0x230
? snd_usb_create_mixer+0xb0/0x4b0 [snd_usb_audio]
? usb_audio_probe+0x4de/0xf40 [snd_usb_audio]
? usb_probe_interface+0x1f5/0x440
? driver_probe_device+0x3ed/0x660
? build_feature_ctl+0xb10/0xb10 [snd_usb_audio]
? save_stack_trace+0x1b/0x20
? init_object+0x69/0xa0
? snd_usb_find_csint_desc+0xa8/0xf0 [snd_usb_audio]
snd_usb_mixer_controls+0x1dc/0x370 [snd_usb_audio]
? build_audio_procunit+0x890/0x890 [snd_usb_audio]
? snd_usb_create_mixer+0xb0/0x4b0 [snd_usb_audio]
? kmem_cache_alloc_trace+0xff/0x230
? usb_ifnum_to_if+0xbd/0xf0
snd_usb_create_mixer+0x25b/0x4b0 [snd_usb_audio]
? snd_usb_create_stream+0x255/0x2c0 [snd_usb_audio]
usb_audio_probe+0x4de/0xf40 [snd_usb_audio]
? snd_usb_autosuspend.part.7+0x30/0x30 [snd_usb_audio]
? __pm_runtime_idle+0x90/0x90
? kernfs_activate+0xa6/0xc0
? usb_match_one_id_intf+0xdc/0x130
? __pm_runtime_set_status+0x2d4/0x450
usb_probe_interface+0x1f5/0x440

Cc: <stable@vger.kernel.org>
Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-12-04 09:15:38 +01:00
Takashi Iwai 43a3542870 ALSA: seq: Remove spurious WARN_ON() at timer check
The use of snd_BUG_ON() in ALSA sequencer timer may lead to a spurious
WARN_ON() when a slave timer is deployed as its backend and a
corresponding master timer stops meanwhile.  The symptom was triggered
by syzkaller spontaneously.

Since the NULL timer is valid there, rip off snd_BUG_ON().

Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-30 10:08:28 +01:00
Takashi Iwai 3c02a6d946 Revert "ALSA: usb-audio: Fix potential zero-division at parsing FU"
The commit 8428a8ebde ("ALSA: usb-audio: Fix potential zero-division
at parsing FU") is utterly bogus and breaks the case with csize=1
instead of fixing anything.  Just take it back again.

Reported-by: Jörg Otte <jrg.otte@gmail.com>
Fixes: 8428a8ebde ("ALSA: usb-audio: Fix potential zero-division at parsing FU"
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-11-28 09:34:36 -08:00
Linus Torvalds 844056fd74 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer updates from Thomas Gleixner:

 - The final conversion of timer wheel timers to timer_setup().

   A few manual conversions and a large coccinelle assisted sweep and
   the removal of the old initialization mechanisms and the related
   code.

 - Remove the now unused VSYSCALL update code

 - Fix permissions of /proc/timer_list. I still need to get rid of that
   file completely

 - Rename a misnomed clocksource function and remove a stale declaration

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits)
  m68k/macboing: Fix missed timer callback assignment
  treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts
  timer: Remove redundant __setup_timer*() macros
  timer: Pass function down to initialization routines
  timer: Remove unused data arguments from macros
  timer: Switch callback prototype to take struct timer_list * argument
  timer: Pass timer_list pointer to callbacks unconditionally
  Coccinelle: Remove setup_timer.cocci
  timer: Remove setup_*timer() interface
  timer: Remove init_timer() interface
  treewide: setup_timer() -> timer_setup() (2 field)
  treewide: setup_timer() -> timer_setup()
  treewide: init_timer() -> setup_timer()
  treewide: Switch DEFINE_TIMER callbacks to struct timer_list *
  s390: cmm: Convert timers to use timer_setup()
  lightnvm: Convert timers to use timer_setup()
  drivers/net: cris: Convert timers to use timer_setup()
  drm/vc4: Convert timers to use timer_setup()
  block/laptop_mode: Convert timers to use timer_setup()
  net/atm/mpc: Avoid open-coded assignment of timer callback function
  ...
2017-11-25 08:37:16 -10:00
Linus Torvalds b64f26c62d sound fixes for 4.15-rc1
All commits found here are small fixes for regression or stable:
 - PCM timestamp behavior fix that could be seen as a regression
 - Remove spurious WARN_ON() from ALSA timer 32bit compat ioctl
 - HD-audio HDMI/DP channel mapping fix for 32bit archs
 - Fix the previous fix for HD-audio initialization code
 - More hardening USB-audio against malicious USB descriptors
 - HD-audio quirks/fixes (Realtek codec, AMD controller)
 - Missing help text for the recent Intel SST kconfig change
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAloWo6MOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/ZNg//WUXr72TCs6OdO45C0tbmHTa3xYNSZGsMcbBx
 9GoNk69SGpy9KHX5Xdtgax71mrUXO2BN+vU5R04oVWjcBs7L+BpbVRk9/HMgBYPz
 GEnwziRXG7YiHmMsbxLhu3gjky2qwrmCZQAFMTIR1z9tFDwZwraLuvdE5iZoB8bu
 r7fatcyF8Wqfg2IwqRdJ/ECheFN00TqzPSWG/p8DOrGl/lXaOWv1IJ9rXOzNdkgx
 6UOS5Z6kgaxm6d7Ym7Chn3Fl7EbrKCqCFLw/yG1KB199Q+fiQNeGZgVjLbPIFGjS
 K4dA7p7Ko6eqZP4t8QrvbgW6QBVrjXG5iTW4DBKs7VPUiRcNctGjdSf00ERu+HV5
 NCGEpnYQ5O6mAIHUcXPaQX+0lsK5J2In1ZuBql51sSISGxKH3KZR4yubXcjRbGYL
 IrcwLPdnBaG/V2C6EQwjCiJgXPZwclbZgpU+Js6VWwKKChzLexVVnJHvfPAr+Up/
 uMM5qkimNUJAzCP0v3IRr9RSSscdISM5qKhTloE9q5RqnON74GMjtZ+VisHgt7Pd
 elDkMMEpxVs2ydj7AxwquaXkfUtEtRswwg9CmpJ8qjUGLcqU4K7N3NdK3HCh+Tp6
 EbXzaVCesXN3/MUNjpEoD80KsE2DPYgXYw24DT0LuGVXgTlVm8qkZ21rUK94U7W0
 B9XAAsE=
 =iYNz
 -----END PGP SIGNATURE-----

Merge tag 'sound-fix-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "All commits found here are small fixes for regression or stable:

   - PCM timestamp behavior fix that could be seen as a regression

   - Remove spurious WARN_ON() from ALSA timer 32bit compat ioctl

   - HD-audio HDMI/DP channel mapping fix for 32bit archs

   - Fix the previous fix for HD-audio initialization code

   - More hardening USB-audio against malicious USB descriptors

   - HD-audio quirks/fixes (Realtek codec, AMD controller)

   - Missing help text for the recent Intel SST kconfig change"

* tag 'sound-fix-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda: Add Raven PCI ID
  ALSA: hda/realtek - Fix ALC700 family no sound issue
  ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization
  ALSA: usb-audio: Add sanity checks in v2 clock parsers
  ALSA: usb-audio: Fix potential zero-division at parsing FU
  ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
  ALSA: usb-audio: Add sanity checks to FE parser
  ALSA: timer: Remove kernel warning at compat ioctl error paths
  ALSA: pcm: update tstamp only if audio_tstamp changed
  ALSA: hda/realtek: Add headset mic support for Intel NUC Skull Canyon
  ALSA: hda: Fix too short HDMI/DP chmap reporting
  ALSA: usb-audio: uac1: Invalidate ctl on interrupt
  ALSA: hda/realtek - Fix ALC275 no sound issue
  ASoC: Intel: Add help text for SND_SOC_INTEL_SST_TOPLEVEL
2017-11-23 21:09:41 -10:00
Vijendar Mukunda 9ceace3c9c ALSA: hda: Add Raven PCI ID
This commit adds PCI ID for Raven platform

Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-23 10:17:59 +01:00
Kailang Yang 2d7fe61857 ALSA: hda/realtek - Fix ALC700 family no sound issue
It maybe the typo for ALC700 support patch.
To fix the bit value on this patch.

Fixes: 6fbae35a31 ("ALSA: hda/realtek - Add support for new codecs ALC700/ALC701/ALC703")
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-23 08:57:37 +01:00
Takashi Iwai d6c0615f51 ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization
The previous fix for addressing the breakage in vmaster slave
initialization, commit a91d66129f ("ALSA: hda - Fix incorrect TLV
callback check introduced during set_fs() removal"), introduced a new
helper to process over each slave kctl.  However, this helper passes
only the original kctl, not the virtual slave kctl.  As a result,
HD-audio driver (which is the only user so far) couldn't initialize
the slave correctly because it's trying to update the value directly
with the original kctl, not with the mapped kctl.

This patch fixes the situation again by passing both the mapped slaved
and original slave kctls to the function.  Luckily there is a single
caller as of now, so changing the call signature is no big matter.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=197959
Fixes: a91d66129f ("ALSA: hda - Fix incorrect TLV callback check introduced during set_fs() removal")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-22 12:34:56 +01:00
Kees Cook 841b86f328 treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts
With all callbacks converted, and the timer callback prototype
switched over, the TIMER_FUNC_TYPE cast is no longer needed,
so remove it. Conversion was done with the following scripts:

    perl -pi -e 's|\(TIMER_FUNC_TYPE\)||g' \
        $(git grep TIMER_FUNC_TYPE | cut -d: -f1 | sort -u)

    perl -pi -e 's|\(TIMER_DATA_TYPE\)||g' \
        $(git grep TIMER_DATA_TYPE | cut -d: -f1 | sort -u)

The now unused macros are also dropped from include/linux/timer.h.

Signed-off-by: Kees Cook <keescook@chromium.org>
2017-11-21 16:35:54 -08:00
Takashi Iwai 0a62d6c966 ALSA: usb-audio: Add sanity checks in v2 clock parsers
The helper functions to parse and look for the clock source, selector
and multiplier unit may return the descriptor with a too short length
than required, while there is no sanity check in the caller side.
Add some sanity checks in the parsers, at least, to guarantee the
given descriptor size, for avoiding the potential crashes.

Fixes: 79f920fbff ("ALSA: usb-audio: parse clock topology of UAC2 devices")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-21 17:50:34 +01:00
Takashi Iwai 8428a8ebde ALSA: usb-audio: Fix potential zero-division at parsing FU
parse_audio_feature_unit() contains a code dividing potentially with
zero when a malformed FU descriptor is passed.  Although there is
already a sanity check, it checks only the value zero, hence it can
still lead to a zero-division when a value 1 is passed there.

Fix it by correcting the sanity check (and the error message
thereof).

Fixes: 23caaf19b1 ("ALSA: usb-mixer: Add support for Audio Class v2.0")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-21 17:50:32 +01:00
Takashi Iwai f658f17b5e ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
The usb-audio driver may trigger an out-of-bound access at parsing a
malformed selector unit, as it checks the header length only after
evaluating bNrInPins field, which can be already above the given
length.  Fix it by adding the length check beforehand.

Fixes: 99fc86450c ("ALSA: usb-mixer: parse descriptors with structs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-21 17:50:31 +01:00
Takashi Iwai d937cd6790 ALSA: usb-audio: Add sanity checks to FE parser
When the usb-audio descriptor contains the malformed feature unit
description with a too short length, the driver may access
out-of-bounds.  Add a sanity check of the header size at the beginning
of parse_audio_feature_unit().

Fixes: 23caaf19b1 ("ALSA: usb-mixer: Add support for Audio Class v2.0")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-21 17:50:29 +01:00
Takashi Iwai 3d4e8303f2 ALSA: timer: Remove kernel warning at compat ioctl error paths
Some timer compat ioctls have NULL checks of timer instance with
snd_BUG_ON() that bring up WARN_ON() when the debug option is set.
Actually the condition can be met in the normal situation and it's
confusing and bad to spew kernel warnings with stack trace there.
Let's remove snd_BUG_ON() invocation and replace with the simple
checks.  Also, correct the error code to EBADFD to follow the native
ioctl error handling.

Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-21 16:36:11 +01:00
Henrik Eriksson 20e3f985bb ALSA: pcm: update tstamp only if audio_tstamp changed
commit 3179f62001 ("ALSA: core: add .get_time_info") had a side effect
of changing the behaviour of the PCM runtime tstamp.  Prior to this
change tstamp was not updated by snd_pcm_update_hw_ptr0() unless the
hw_ptr had moved, after this change tstamp was always updated.

For an application using alsa-lib, doing snd_pcm_readi() followed by
snd_pcm_status() to estimate the age of the read samples by subtracting
status->avail * [sample rate] from status->tstamp this change degraded
the accuracy of the estimate on devices where the pcm hw does not
provide a granular hw_ptr, e.g., devices using
soc-generic-dmaengine-pcm.c and a dma-engine with residue_granularity
DMA_RESIDUE_GRANULARITY_DESCRIPTOR.  The accuracy of the estimate
depended on the latency between the PCM hw completing a period and the
driver called snd_pcm_period_elapsed() to notify ALSA core, typically
determined by interrupt handling latency.  After the change the accuracy
of the estimate depended on the latency between the PCM hw completing a
period and the application calling snd_pcm_status(), determined by the
scheduling of the application process.  The maximum error of the
estimate is one period length in both cases, but the error average and
variance is smaller when it depends on interrupt latency.

Instead of always updating tstamp, update it only if audio_tstamp
changed.

Fixes: 3179f62001 ("ALSA: core: add .get_time_info")
Suggested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Henrik Eriksson <henrik.eriksson@axis.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-21 13:59:19 +01:00
Kai-Heng Feng 0ce48e1727 ALSA: hda/realtek: Add headset mic support for Intel NUC Skull Canyon
Users have been using knob "model=dell-headset-multi" on Intel Skull
Canyon for a while.

Add the equivalent quirk, ALC269_FIXUP_DELL1_MIC_NO_PRESENCE for Skull
Canyon.

BugLink: https://bugs.launchpad.net/bugs/1732034
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-20 08:37:10 +01:00
Takashi Iwai c2432466f5 ALSA: hda: Fix too short HDMI/DP chmap reporting
We got a regression report about the HD-audio HDMI chmap, where some
surround channels are reported as UNKNOWN.  The git bisection pointed
the culprit at the commit 9b3dc8aa3f ("ALSA: hda - Register chmap
obj as priv data instead of codec").  The story behind scene is like
this:

- While moving the code out of the legacy HDA to the HDA common place,
  the patch modifies the code to obtain the chmap array indirectly in
  a byte array, and it expands it to kctl value array.
- At the latter operation, the size of the array is wrongly passed by
  sizeof() to the pointer.
- It can be 4 on 32bit arch, thus too short for 6+ channels.
  (And that's the reason why it didn't hit other persons; it's 8 on
  64bit arch, thus it's usually enough.)

The code was further changed meanwhile, but the problem persisted.
Let's fix it by correctly evaluating the array size.

Fixes: 9b3dc8aa3f ("ALSA: hda - Register chmap obj as priv data instead of codec")
Reported-by: VDR User <user.vdr@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-17 12:20:37 +01:00
Julian Scheel b2500b584c ALSA: usb-audio: uac1: Invalidate ctl on interrupt
When an interrupt occurs, the value of at least one of the belonging
controls should have changed. To make sure they get re-read from device
on the next read, invalidate the cache. This was correctly implemented
for uac2 already, but missing for uac1.

Signed-off-by: Julian Scheel <julian@jusst.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-17 11:55:45 +01:00
Kailang Yang 3aabf94c2d ALSA: hda/realtek - Fix ALC275 no sound issue
Sound works after a cold boot but not after a reboot from windows.
This patch will solve this issue. This is relation with Class-D power control.

[ The bug was reported in Bugzilla below for Sony VAIO SVS13A1C5E
  -- tiwai]

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=197737
Cc: <stable@vger.kernel.org>
Signed-off-by: Kailang Yang <kailang@realtek.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-15 18:00:19 +01:00
Takashi Iwai f38736c3c6 ASoC: Fix for Intel Kconfig
Fix the Intel Kconfig issue reported by Linus.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAloMZnATHGJyb29uaWVA
 a2VybmVsLm9yZwAKCRAk1otyXVSH0BpWB/42LZqgV/Nz+iLvgSp3VqqH3PmMhtQY
 YVZYAfA4eZrjVb8KKRr0IepI9HMx3d1B/k6JyE8ND5gDnCBtqTfqAKHB7LTPMRfb
 cwqYocTezpPn3PDKWLTi4qvfVYd1+XtrGCLe5EFBbs1I8+3qhcckTUpU6Yv8NJjq
 XS/DcGfeNgW2jKrjDkwx3HHozmeKY4nWEYiytyrLYggTPQbteFmoqnrVYs9fAEFQ
 RYx9xfGKjogDaIvQ/jWMRB8I590PWV/61awLB2aEucbYsLDxMtaNC20AYpYrwCQZ
 B3gn0rlU7QxMaOkKCKbX/rwvlGpNe6uWLqv8OWc/31ME5PQnfJOL6vMw
 =PLuo
 -----END PGP SIGNATURE-----

Merge tag 'asoc-fix-v4.14-intel-kconfig' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fix for Intel Kconfig

Fix the Intel Kconfig issue reported by Linus.
2017-11-15 17:11:16 +01:00
Vinod Koul 20a52c059b
ASoC: Intel: Add help text for SND_SOC_INTEL_SST_TOPLEVEL
Symbol SND_SOC_INTEL_SST_TOPLEVEL is user selectable so add the
help text for this symbol.

Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2017-11-15 11:43:41 +00:00
Linus Torvalds 4e4510fec4 sound updates for 4.15-rc1
There are no big surprising changes in this cycle, yet not too
 boring, either.  The biggest change from diffstat POV is the removal
 of the legacy OSS driver codes that have been already disabled for a
 long time.  This will bring a few trivial merge conflicts.
 
 As new features in ASoC side, there are two things: a new AC97 bus
 implementation and AMD Stony platform support.  Both include the
 relevant changes shared with other subsystems, e.g. AC97 MFD changes
 and DRM AMD changes.
 
 Some other highlighted topics are:
 - A bunch of USB-audio drivers got the hardening against the malicious
   device accesses with a new helper code for endpoint sanity check.
 - Lots of cleanups for ASoC Intel platform code, including support for
   their open source audio firmware.
 - Continued ASoC core componentization works.
 - Support for scaling MCLK with sample rate in ASoC simple-card.
 - Stabler PCM hot-unplug capability, especially for ASoC usages.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEECxfAB4MH3rD5mfB6bDGAVD0pKaQFAloLAk4OHHRpd2FpQHN1
 c2UuZGUACgkQbDGAVD0pKaSCjw/+LUcMsAtjsdjP/GojqxI3FwK5R5e1vLmg+3lD
 TvWbVH23DqASvMhuar9N1Z+yiBWVuU6qa7eElqgOUUopo0Wlyf/93drqwKhqmFgH
 PVYxa3zKu7otU7SghfBVvpivAtvTlsyUVKnSXfL4DQQwXlqvdToQj3+J4eckiqVP
 u02fxn+h7lviLdRFhB+5JAJIK5nupcol1GIxbHwtELBCeoMAXjTbXTz5QToJizPp
 lMuzYLb1tvp7QrpYI5PgZ6YnAfA2GL7cCPMwdx63d8NYGtiWJd+iCtc/fM1WkElm
 8Py0yNvy1gHrjgQpku6Db1mhXNYYbu1qCKfLLMS4W8VOFkZughLNKLLqPQ+Eev5p
 PoHgGZLrCJk2W+vgF6nvoaw5AkZKKmKxzKYH9/gvvFkWrR1BW21XdLLRBm+TOahF
 Bj/c5t1k5WX4FVxotd78h3JVLY9Te+3re5Ak5cb0eGYE5+LHWX9tbObM7zfeZGv2
 5kw8cGTekcYkrKhh/HrORw8mEUFBRJfXfbUn+pIde6P56nJRa43JpE6JhXqstUpL
 n22DxUSIH8DWGkzWXGOmoOSFBolfcsOqTuws2QcT5oRfLnGikRCMii5UeLoW899i
 zlMmxfYSXOgjyWPXhvNROV5vEYNQZDiypjCoq0qbt+uy/mGne+L5ZFCbdJf4rIS/
 rKW4ILU=
 =BCBK
 -----END PGP SIGNATURE-----

Merge tag 'sound-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound updates from Takashi Iwai:
 "There are no big surprising changes in this cycle, yet not too boring,
  either. The biggest change from diffstat POV is the removal of the
  legacy OSS driver codes that have been already disabled for a long
  time. This will bring a few trivial merge conflicts.

  As new features in ASoC side, there are two things: a new AC97 bus
  implementation and AMD Stony platform support. Both include the
  relevant changes shared with other subsystems, e.g. AC97 MFD changes
  and DRM AMD changes.

  Some other highlighted topics are:

   - A bunch of USB-audio drivers got the hardening against the
     malicious device accesses with a new helper code for endpoint
     sanity check

   - Lots of cleanups for ASoC Intel platform code, including support
     for their open source audio firmware

   - Continued ASoC core componentization works

   - Support for scaling MCLK with sample rate in ASoC simple-card

   - Stabler PCM hot-unplug capability, especially for ASoC usages"

* tag 'sound-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (302 commits)
  Documentation: sound: hd-audio: notes.rst
  ASoC: bcm2835: Support left/right justified and DSP modes
  ASoC: bcm2835: Enforce full symmetry
  ASoC: bcm2835: Support additional samplerates up to 384kHz
  ASoC: bcm2835: Add support for TDM modes
  ASoC: add mclk-fs support to audio graph card
  ASoC: add mclk-fs to audio graph card binding
  ASoC: rt5514: work around link error
  ASoC: rt5514: mark PM functions as __maybe_unused
  ASoC: rt5663: Check the JD status in the button pushing
  ASoC: amd: Modified DMA transfer Mechanism for Playback
  ASoC: rt5645: Wait for 400msec before concluding on value of RT5645_VENDOR_ID2
  ASoC: sun4i-codec: fixed 32bit audio capture support for H3/H2+
  ASoC: da7213: add support for DSP modes
  ASoC: sun8i-codec: Add a comment on the LRCK inversion
  ASoC: sun8i-codec: Set the BCLK divider
  ASoC: rt5663: Delay and retry reading rt5663 ID register
  ASoC: amd: use do_div rather than 64 bit division to fix 32 bit builds
  ASoC: cs42l56: Fix reset GPIO name in example DT binding
  ASoC: rt5514-spi: check irq status to schedule data copy in resume function
  ...
2017-11-14 18:01:46 -08:00
Linus Torvalds 2bcc673101 Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer updates from Thomas Gleixner:
 "Yet another big pile of changes:

   - More year 2038 work from Arnd slowly reaching the point where we
     need to think about the syscalls themself.

   - A new timer function which allows to conditionally (re)arm a timer
     only when it's either not running or the new expiry time is sooner
     than the armed expiry time. This allows to use a single timer for
     multiple timeout requirements w/o caring about the first expiry
     time at the call site.

   - A new NMI safe accessor to clock real time for the printk timestamp
     work. Can be used by tracing, perf as well if required.

   - A large number of timer setup conversions from Kees which got
     collected here because either maintainers requested so or they
     simply got ignored. As Kees pointed out already there are a few
     trivial merge conflicts and some redundant commits which was
     unavoidable due to the size of this conversion effort.

   - Avoid a redundant iteration in the timer wheel softirq processing.

   - Provide a mechanism to treat RTC implementations depending on their
     hardware properties, i.e. don't inflict the write at the 0.5
     seconds boundary which originates from the PC CMOS RTC to all RTCs.
     No functional change as drivers need to be updated separately.

   - The usual small updates to core code clocksource drivers. Nothing
     really exciting"

* 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (111 commits)
  timers: Add a function to start/reduce a timer
  pstore: Use ktime_get_real_fast_ns() instead of __getnstimeofday()
  timer: Prepare to change all DEFINE_TIMER() callbacks
  netfilter: ipvs: Convert timers to use timer_setup()
  scsi: qla2xxx: Convert timers to use timer_setup()
  block/aoe: discover_timer: Convert timers to use timer_setup()
  ide: Convert timers to use timer_setup()
  drbd: Convert timers to use timer_setup()
  mailbox: Convert timers to use timer_setup()
  crypto: Convert timers to use timer_setup()
  drivers/pcmcia: omap1: Fix error in automated timer conversion
  ARM: footbridge: Fix typo in timer conversion
  drivers/sgi-xp: Convert timers to use timer_setup()
  drivers/pcmcia: Convert timers to use timer_setup()
  drivers/memstick: Convert timers to use timer_setup()
  drivers/macintosh: Convert timers to use timer_setup()
  hwrng/xgene-rng: Convert timers to use timer_setup()
  auxdisplay: Convert timers to use timer_setup()
  sparc/led: Convert timers to use timer_setup()
  mips: ip22/32: Convert timers to use timer_setup()
  ...
2017-11-13 17:56:58 -08:00
Linus Torvalds 8e9a2dba86 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull core locking updates from Ingo Molnar:
 "The main changes in this cycle are:

   - Another attempt at enabling cross-release lockdep dependency
     tracking (automatically part of CONFIG_PROVE_LOCKING=y), this time
     with better performance and fewer false positives. (Byungchul Park)

   - Introduce lockdep_assert_irqs_enabled()/disabled() and convert
     open-coded equivalents to lockdep variants. (Frederic Weisbecker)

   - Add down_read_killable() and use it in the VFS's iterate_dir()
     method. (Kirill Tkhai)

   - Convert remaining uses of ACCESS_ONCE() to
     READ_ONCE()/WRITE_ONCE(). Most of the conversion was Coccinelle
     driven. (Mark Rutland, Paul E. McKenney)

   - Get rid of lockless_dereference(), by strengthening Alpha atomics,
     strengthening READ_ONCE() with smp_read_barrier_depends() and thus
     being able to convert users of lockless_dereference() to
     READ_ONCE(). (Will Deacon)

   - Various micro-optimizations:

        - better PV qspinlocks (Waiman Long),
        - better x86 barriers (Michael S. Tsirkin)
        - better x86 refcounts (Kees Cook)

   - ... plus other fixes and enhancements. (Borislav Petkov, Juergen
     Gross, Miguel Bernal Marin)"

* 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (70 commits)
  locking/x86: Use LOCK ADD for smp_mb() instead of MFENCE
  rcu: Use lockdep to assert IRQs are disabled/enabled
  netpoll: Use lockdep to assert IRQs are disabled/enabled
  timers/posix-cpu-timers: Use lockdep to assert IRQs are disabled/enabled
  sched/clock, sched/cputime: Use lockdep to assert IRQs are disabled/enabled
  irq_work: Use lockdep to assert IRQs are disabled/enabled
  irq/timings: Use lockdep to assert IRQs are disabled/enabled
  perf/core: Use lockdep to assert IRQs are disabled/enabled
  x86: Use lockdep to assert IRQs are disabled/enabled
  smp/core: Use lockdep to assert IRQs are disabled/enabled
  timers/hrtimer: Use lockdep to assert IRQs are disabled/enabled
  timers/nohz: Use lockdep to assert IRQs are disabled/enabled
  workqueue: Use lockdep to assert IRQs are disabled/enabled
  irq/softirqs: Use lockdep to assert IRQs are disabled/enabled
  locking/lockdep: Add IRQs disabled/enabled assertion APIs: lockdep_assert_irqs_enabled()/disabled()
  locking/pvqspinlock: Implement hybrid PV queued/unfair locks
  locking/rwlocks: Fix comments
  x86/paravirt: Set up the virt_spin_lock_key after static keys get initialized
  block, locking/lockdep: Assign a lock_class per gendisk used for wait_for_completion()
  workqueue: Remove now redundant lock acquisitions wrt. workqueue flushes
  ...
2017-11-13 12:38:26 -08:00
Takashi Iwai 76727c2c3b ASoC: Updates for v4.15
The biggest thing this release has been the conversion of the AC98 bus
 to the driver model, that's been a long time coming so thanks to Robert
 Jarzmik for his dedication there.  Due to there being some AC97 MFD
 there's a few fairly large changes in input and the MFD layer, mainly to
 the wm97xx driver.
 
 There's also some drivers/drm changes to support the new AMD Stoney
 platform, these are shared with the DRM subsystem and should be being
 merged via both.
 
 Within the subsystem the overwhelming bulk of the changes is in the
 Intel drivers which continue to need lots of cleanups and fixes, this
 release they've also gained support for their open source firmware.
 There's also some large changs in the core as Morimoto-san continues to
 mirror operations into the component level in preparation for conversion
 of drivers to that.
 
  - The AC97 bus has finally caught up with the driver model thanks to
    some dedicated and persistent work from Robert Jarzmik.
  - Continued work from Morimoto-san on moving us towards being able to
    use components for everything.
  - Lots of cleanups for the Intel platform code, including support for
    their open source audio firmware.
  - Support for scaling MCLK with sample rate in simple-card.
  - Support for AMD Stoney platform.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAloJhwMTHGJyb29uaWVA
 a2VybmVsLm9yZwAKCRAk1otyXVSH0KzbB/9tXryXYz3dnKVlm9rk+Cq0Xy4TrUNk
 WY+Il+Di1b6CQJbAm9GSacJxR+siupZCjGC5roHznj/AA2l0RuxJXpxG40Db8ZX+
 bDR7mIWtuTUJHazqXltafj9ydElRKVpOGPAi5YJhhW5bXQ3SR9fFy0D3mdcT02v4
 SyMExhOMz+mdnuBhbWx9kqJ9LPzCs0ow+R4uoRgAQxpFXPBGtq06sMkK86lGfsl/
 iRM36J6FIeIQQfSHG/dkkpoybVax43z4OH7G1IL2FOU7miwkjZh/TTh/xHTd86Mc
 OOuGu4hB+MjvccSOa9HSrOqFjxtkZipstwqYVWoYQcUoIVpcg0YRk7TG
 =5KBY
 -----END PGP SIGNATURE-----

Merge tag 'asoc-v4.15' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Updates for v4.15

The biggest thing this release has been the conversion of the AC98 bus
to the driver model, that's been a long time coming so thanks to Robert
Jarzmik for his dedication there.  Due to there being some AC97 MFD
there's a few fairly large changes in input and the MFD layer, mainly to
the wm97xx driver.

There's also some drivers/drm changes to support the new AMD Stoney
platform, these are shared with the DRM subsystem and should be being
merged via both.

Within the subsystem the overwhelming bulk of the changes is in the
Intel drivers which continue to need lots of cleanups and fixes, this
release they've also gained support for their open source firmware.
There's also some large changs in the core as Morimoto-san continues to
mirror operations into the component level in preparation for conversion
of drivers to that.

 - The AC97 bus has finally caught up with the driver model thanks to
   some dedicated and persistent work from Robert Jarzmik.
 - Continued work from Morimoto-san on moving us towards being able to
   use components for everything.
 - Lots of cleanups for the Intel platform code, including support for
   their open source audio firmware.
 - Support for scaling MCLK with sample rate in simple-card.
 - Support for AMD Stoney platform.
2017-11-13 15:45:57 +01:00
Takashi Iwai c429bda21f Merge branch 'for-next' into for-linus
Pull 4.15 updates to take over the previous urgent fixes.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-13 15:43:13 +01:00
Mark Brown df6a3e2455
Merge remote-tracking branches 'asoc/topic/tfa9879', 'asoc/topic/ts3a277e', 'asoc/topic/wm8741', 'asoc/topic/wm97xx' and 'asoc/topic/zte' into asoc-next 2017-11-10 21:31:33 +00:00
Mark Brown 668f21b180
Merge remote-tracking branches 'asoc/topic/samsung', 'asoc/topic/sgtl5000', 'asoc/topic/stm32', 'asoc/topic/sunxi' and 'asoc/topic/tas571x' into asoc-next 2017-11-10 21:31:29 +00:00
Mark Brown 84400d7ff8
Merge remote-tracking branches 'asoc/topic/rt5645', 'asoc/topic/rt5651', 'asoc/topic/rt5659', 'asoc/topic/rt5663' and 'asoc/topic/rt5670' into asoc-next 2017-11-10 21:31:25 +00:00
Mark Brown 0d7b5c93e5
Merge remote-tracking branches 'asoc/topic/rl6231' and 'asoc/topic/rt5514' into asoc-next 2017-11-10 21:31:23 +00:00
Mark Brown 5b04644a48
Merge remote-tracking branches 'asoc/topic/max98925', 'asoc/topic/max98927', 'asoc/topic/msm8916' and 'asoc/topic/omap' into asoc-next 2017-11-10 21:31:20 +00:00
Mark Brown c9e38f31a1
Merge remote-tracking branches 'asoc/topic/hdmi', 'asoc/topic/img' and 'asoc/topic/kirkwood' into asoc-next 2017-11-10 21:31:17 +00:00
Mark Brown 033d56f6c0
Merge remote-tracking branches 'asoc/topic/dwc', 'asoc/topic/fallthrough', 'asoc/topic/fsi', 'asoc/topic/fsl' and 'asoc/topic/graph' into asoc-next 2017-11-10 21:31:13 +00:00
Mark Brown 67e85d4e4e
Merge remote-tracking branches 'asoc/topic/cygnus', 'asoc/topic/da7213', 'asoc/topic/davinci' and 'asoc/topic/doc' into asoc-next 2017-11-10 21:31:10 +00:00
Mark Brown f2470d5291
Merge remote-tracking branches 'asoc/topic/bcm2835', 'asoc/topic/cs42l56' and 'asoc/topic/cs43130' into asoc-next 2017-11-10 21:31:07 +00:00
Mark Brown 242f66c845
Merge remote-tracking branches 'asoc/topic/ac97', 'asoc/topic/ac97-mfd', 'asoc/topic/amd' and 'asoc/topic/arizona-mfd' into asoc-next 2017-11-10 21:31:02 +00:00
Mark Brown 357c59a98f
Merge remote-tracking branch 'asoc/topic/rockchip' into asoc-next 2017-11-10 21:31:00 +00:00
Mark Brown f904f84609
Merge remote-tracking branch 'asoc/topic/rcar' into asoc-next 2017-11-10 21:30:57 +00:00
Mark Brown 1cae41464c
Merge remote-tracking branch 'asoc/topic/qcom' into asoc-next 2017-11-10 21:30:56 +00:00
Mark Brown 40e8cc5689
Merge remote-tracking branch 'asoc/topic/pcm512x' into asoc-next 2017-11-10 21:30:54 +00:00
Mark Brown c44ff31ae0
Merge remote-tracking branch 'asoc/topic/intel' into asoc-next 2017-11-10 21:30:53 +00:00
Mark Brown bd26974f71
Merge remote-tracking branch 'asoc/topic/dapm' into asoc-next 2017-11-10 21:30:51 +00:00
Mark Brown aa38bff808
Merge remote-tracking branch 'asoc/topic/core' into asoc-next 2017-11-10 21:30:50 +00:00
Mark Brown 73e13d0f6c
Merge remote-tracking branch 'asoc/topic/component' into asoc-next 2017-11-10 21:30:48 +00:00
Mark Brown 4d0210e6d0
Merge remote-tracking branch 'asoc/fix/sunxi' into asoc-linus 2017-11-10 21:30:45 +00:00
Mark Brown 60190e46df
Merge remote-tracking branch 'asoc/fix/intel' into asoc-linus 2017-11-10 21:30:41 +00:00