07 Feb, 2019
1 commit
-
Pull sound fixes from Takashi Iwai:
"A collection of a few small fixes.The most significant one is the fix for the possible race at loading
HD-audio drivers. This has been present for long time and surfaced
only in a rare occasion, but finally spotted out"* tag 'sound-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda/ca0132 - Fix build error without CONFIG_PCI
ALSA: compress: Fix stop handling on compressed capture streams
ALSA: usb-audio: Add support for new T+A USB DAC
ALSA: hda - Serialize codec registrations
ALSA: hda/realtek - Use a common helper for hp pin reference
ALSA: hda/realtek - Fix lose hp_pins for disable auto mute
ALSA: hda/realtek - Headset microphone support for System76 darp5
06 Feb, 2019
2 commits
-
A call of pci_iounmap() call without CONFIG_PCI leads to a build error
on some architectures. We tried to address this and add a check of
IS_ENABLED(CONFIG_PCI), but this still doesn't seem enough for sh.
Ideally we should fix it globally, it's really a corner case, so let's
paper over it with a simpler ifdef.Fixes: 1e73359a24fa ("ALSA: hda/ca0132 - make pci_iounmap() call conditional")
Reported-by: Kuninori Morimoto
Signed-off-by: Takashi Iwai -
This patch adds the T+A VID to the generic check in order to enable
native DSD support for T+A devices. This works with the new T+A USB
DAC model SD3100HV and will also work with future devices which
support the XMOS/Thesycon style DSD format.Signed-off-by: Udo Eberhardt
Cc:
Signed-off-by: Takashi Iwai
01 Feb, 2019
4 commits
-
In the current code, the codec registration may happen both at the
codec bind time and the end of the controller probe time. In a rare
occasion, they race with each other, leading to Oops due to the still
uninitialized card device.This patch introduces a simple flag to prevent the codec registration
at the codec bind time as long as the controller probe is going on.
The controller probe invokes snd_card_register() that does the whole
registration task, and we don't need to register each piece
beforehand.Cc:
Signed-off-by: Takashi Iwai -
Replace the open-codes in many places with a new common helper for
performing the same thing: referring to the primary headphone pin.This eventually fixes the potentially missing headphone pin on some
weird devices, too.Cc:
Signed-off-by: Takashi Iwai -
When auto_mute = no or spec->suppress_auto_mute = 1, cfg->hp_pins will
lose value.Add this patch to find hp_pins value.
I add fixed for ALC282 ALC225 ALC256 ALC294 and alc_default_init()
alc_default_shutup().Signed-off-by: Kailang Yang
Cc:
Signed-off-by: Takashi Iwai -
Pull sound fixes from Takashi Iwai:
"Only three fixes.The fix for Realtek HD-audio looks lengthy, but it's just a code
shuffling, and the actual changes are fairly small.The rest are a PCM core fix for a long-standing bug that was recently
scratched by syzkaller, and a trivial USB-audio quirk for DSD support"* tag 'sound-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda/realtek - Fixed hp_pin no value
ALSA: pcm: Fix tight loop of OSS capture stream
ALSA: usb-audio: Add Opus #3 to quirks for native DSD support
31 Jan, 2019
1 commit
-
On the System76 Darter Pro (darp5), there is a headset microphone
input attached to 0x1a that does not have a jack detect. In order to
get it working, the pin configuration needs to be set correctly, and
the ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC fixup needs to be applied.
This is similar to the MIC_NO_PRESENCE fixups for some Dell laptops,
except we have a separate microphone jack that is already configured
correctly.Signed-off-by: Jeremy Soller
Cc:
Signed-off-by: Takashi Iwai
29 Jan, 2019
1 commit
-
Fix hp_pin always no value.
[More notes on the changes:
The hp_pin value that is referred in alc294_hp_init() is always zero
at the moment the function gets called, hence this is actually
useless as in the current code.And, this kind of init sequence should be called from the codec init
callback, instead of the parser function. So, the first fix in this
patch to move the call call into its own init_hook.OTOH, this function is needed to be called only once after the boot,
and it'd take too long for invoking at each resume (where the init
callback gets called). So we add a new flag and invoke this only
once as an additional fix.The one case is still not covered, though: S4 resume. But this
change itself won't lead to any regression in that regard, so we
leave S4 issue as is for now and fix it later. -- tiwai ]Fixes: bde1a7459623 ("ALSA: hda/realtek - Fixed headphone issue for ALC700")
Signed-off-by: Kailang Yang
Cc:
Signed-off-by: Takashi Iwai
26 Jan, 2019
2 commits
-
When the trigger=off is passed for a PCM OSS stream, it sets the
start_threshold of the given substream to the boundary size, so that
it won't be automatically started. This can be problematic for a
capture stream, unfortunately, as detected by syzkaller. The scenario
is like the following:- In __snd_pcm_lib_xfer() that is invoked from snd_pcm_oss_read()
loop, we have a check whether the stream was already started or the
stream can be auto-started.
- The function at this check returns 0 with trigger=off since we
explicitly disable the auto-start.
- The loop continues and repeats calling __snd_pcm_lib_xfer() tightly,
which may lead to an RCU stall.This patch fixes the bug by simply allowing the wait for non-started
stream in the case of OSS capture. For native usages, it's supposed
to be done by the caller side (which is user-space), hence it returns
zero like before.(In theory, __snd_pcm_lib_xfer() could wait even for the native API
usage cases, too; but I'd like to stay in a safer side for not
breaking the existing stuff for now.)Reported-by: syzbot+fbe0496f92a0ce7b786c@syzkaller.appspotmail.com
Cc:
Signed-off-by: Takashi Iwai -
This patch adds quirk VID/PID IDs for the Opus #3 DAP (made by 'The Bit')
in order to enable Native DSD support.[ NOTE: this could be handled in the generic way with fp->dvd_raw if
we add 0x10cb to the vendor whitelist, but since 0x10cb shows a
different vendor name (Erantech), put to the individual entry at
this time -- tiwai ]Signed-off-by: Olek Poplavsky
Cc:
Signed-off-by: Takashi Iwai
25 Jan, 2019
1 commit
-
Pull sound fixes from Takashi Iwai:
"A significant amount of fixes at this time, mostly for covering the
recent ASoC issues.- Fixes for the missing ASoC driver initialization with non-deferred
probes; these triggered other problems in chain, which resulted in
yet more fix commits- DaVinci runtime PM fix; the diff looks large but it's just a code
shuffling- Various fixes for ASoC Intel drivers: a regression in HD-A HDMI,
Kconfig dependency, machine driver adjustments, PLL fix.- Other ASoC driver-specific stuff including the trivial fixes caught
by static analysis- Usual HD-audio quirks"
* tag 'sound-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (30 commits)
ALSA: hda - Add mute LED support for HP ProBook 470 G5
ASoC: amd: Fix potential NULL pointer dereference
ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
ASoC: rt5514-spi: Fix potential NULL pointer dereference
ASoC: dapm: change snprintf to scnprintf for possible overflow
ASoC: rt5682: Fix PLL source register definitions
ASoC: core: Don't defer probe on optional, NULL components
ASoC: core: Make snd_soc_find_component() more robust
ASoC: soc-core: fix init platform memory handling
ASoC: intel: skl: Fix display power regression
ALSA: hda/realtek - Fix typo for ALC225 model
ASoC: soc-core: Hold client_mutex around soc_init_dai_link()
ASoC: Intel: Boards: move the codec PLL configuration to _init
ASoC: soc-core: defer card probe until all component is added to list
ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages
ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode
ASoC: ti: davinci-mcasp: Move context save/restore to runtime_pm callbacks
ASoC: Variable "val" in function rt274_i2c_probe() could be uninitialized
ASoC: rt5682: Fix recording no sound issue
ASoC: Intel: atom: Make PCI dependency explicit
...
21 Jan, 2019
1 commit
-
Support speaker and mic mute LEDs on HP ProBook 470 G5.
BugLink: https://bugs.launchpad.net/bugs/1811254
Signed-off-by: Anthony Wong
Cc:
Signed-off-by: Takashi Iwai
18 Jan, 2019
1 commit
-
…/broonie/sound into for-linus
ASoC: Fixes for v5.0
Quite a big batch of fixes here. There's a couple of things going on,
the main one is that we found some issues with not deferring probe when
we should, causing us to skip some driver initialization. The fixes for
this then in turn exposed some issues with how we were searching for
components which had previously gone unnoticed due to the original
issue.There's also been the normal driver specific stuff and there's been what
looks like several batches of automated scanning for issues which have
generated quite a large set of smaller fixes for potential crashes and
missed error handling.
16 Jan, 2019
6 commits
-
Check return value from call to devm_kzalloc() in order to prevent a
potential NULL pointer dereference.Also, notice that it makes no sense to allocate any resources if
res = platform_get_resource(pdev, IORESOURCE_MEM, 0); fails,
so move the call to devm_kzalloc() below the mentioned code.Lastly, improve the use of sizeof in the call to devm_kzalloc() by
changing it from sizeof(struct i2s_dev_data) to sizeof(*adata)This issue was detected with the help of Coccinelle.
Fixes: ac289c7ec0bc ("ASoC: amd: add ACP3x PCM platform driver")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva
Signed-off-by: Mark Brown -
Change snprintf to scnprintf. There are generally two cases where using
snprintf causes problems.1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
In this case, if snprintf would have written more characters than what the
buffer size (SIZE) is, then size will end up larger than SIZE. In later
uses of snprintf, SIZE - size will result in a negative number, leading
to problems. Note that size might already be too large by using
size = snprintf before the code reaches a case of size += snprintf.2) If size is ultimately used as a length parameter for a copy back to user
space, then it will potentially allow for a buffer overflow and information
disclosure when size is greater than SIZE. When the size is used to index
the buffer directly, we can have memory corruption. This also means when
size = snprintf... is used, it may also cause problems since size may become
large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel
configuration.The solution to these issues is to use scnprintf which returns the number of
characters actually written to the buffer, so the size variable will never
exceed SIZE.Signed-off-by: Silvio Cesare
Cc: Timur Tabi
Cc: Nicolin Chen
Cc: Mark Brown
Cc: Xiubo Li
Cc: Fabio Estevam
Cc: Dan Carpenter
Cc: Kees Cook
Cc: Will Deacon
Cc: Greg KH
Signed-off-by: Willy Tarreau
Acked-by: Nicolin Chen
Reviewed-by: Kees Cook
Signed-off-by: Mark Brown -
There is a potential NULL pointer dereference in case devm_kzalloc()
fails and returns NULL.Fix this by adding a NULL check on rt5514_dsp.
This issue was detected with the help of Coccinelle.
Fixes: 6eebf35b0e4a ("ASoC: rt5514: add rt5514 SPI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva
Signed-off-by: Mark Brown -
Change snprintf to scnprintf. There are generally two cases where using
snprintf causes problems.1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
In this case, if snprintf would have written more characters than what the
buffer size (SIZE) is, then size will end up larger than SIZE. In later
uses of snprintf, SIZE - size will result in a negative number, leading
to problems. Note that size might already be too large by using
size = snprintf before the code reaches a case of size += snprintf.2) If size is ultimately used as a length parameter for a copy back to user
space, then it will potentially allow for a buffer overflow and information
disclosure when size is greater than SIZE. When the size is used to index
the buffer directly, we can have memory corruption. This also means when
size = snprintf... is used, it may also cause problems since size may become
large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel
configuration.The solution to these issues is to use scnprintf which returns the number of
characters actually written to the buffer, so the size variable will never
exceed SIZE.Signed-off-by: Silvio Cesare
Cc: Liam Girdwood
Cc: Mark Brown
Cc: Dan Carpenter
Cc: Kees Cook
Cc: Will Deacon
Cc: Greg KH
Signed-off-by: Willy Tarreau
Signed-off-by: Mark Brown -
Fix typo which causes headphone no sound while using BCLK
as PLL source.Signed-off-by: Shuming Fan
Signed-off-by: Mark Brown -
cpu and platform are optional components in DAI links. For example
codec-codec links usually have no platform set.Call snd_soc_find_component only if the name or of_node of
a cpu or platform is set. Otherwise it will return NULL and
soc_init_dai_link bails out immediately with -EPROBE_DEFER,
meaning registering a card with NULL cpu or platform in DAI links
can never succeed.Fixes: 8780cf1142a5 ("ASoC: soc-core: defer card probe until all component is added to list")
Signed-off-by: Matthias Reichl
Signed-off-by: Mark Brown
15 Jan, 2019
3 commits
-
There are some use cases where you're checking for a lot of things on a
card and it makes sense that you might end up trying to call
snd_soc_find_component() without either a name or an of_node. Currently
in that case we try to dereference the name and crash but it's more
useful to allow the caller to just treat that as a case where we don't
find anything, that error handling will already exist.Inspired by a patch from Ajit Pandey fixing some callers.
Fixes: 8780cf1142a5 ("ASoC: soc-core: defer card probe until all component is added to list")
Reported-by: Pierre-Louis Bossart
Signed-off-by: Mark Brown -
snd_soc_init_platform initializes pointers to snd_soc_dai_link which is
statically allocated and it does this by devm_kzalloc. In the event of
an EPROBE_DEFER the memory will be freed and the pointers are left
dangling. snd_soc_init_platform sees the dangling pointers and assumes
they are pointing to initialized memory and does not reallocate them on
the second probe attempt which results in a use after free bug since
devm has freed the memory from the first probe attempt.Since the intention for snd_soc_dai_link->platform is that it can be set
statically by the machine driver we need to respect the pointer in the
event we did not set it but still catch dangling pointers. The solution
is to add a flag to track whether the pointer was dynamically allocated
or not.Signed-off-by: Curtis Malainey
Signed-off-by: Mark Brown -
Since the refactoring of HD-audio display power management, the
display power status is managed per domain. Meanwhile the ASoC
hdac_hdmi driver still keeps and relies (incorrectly) on the
refcounting together with ASoC skl driver, and this leads to the
display state always on.This patch is an attempt to address the regression by simplifying the
PM code of ASoC skl and hdac_hdmi drivers. Basically, since the
refactoring, we don't have to manage the display power at HD-audio
controller suspend / resume but only at HD-audio HDMI codec suspend /
resume. So the patch drops the superfluous snd_hdac_display_power()
calls in skl driver.Meanwhile, in hdac_hdmi side, we rewrite the PM call just to re-use
the runtime PM callbacks like other drivers do. Now the logic is
simple: turn off at suspend and turn on at resume.The patch also fixes the possibly missing display-power off at skl
driver removal as well as some error paths at probe.Fixes: 029d92c289bd ("ALSA: hda: Refactor display power management")
Reported-by: Libin Yang
Signed-off-by: Takashi Iwai
14 Jan, 2019
1 commit
-
Fix typo for model alc255-dell1 to alc225-dell1.
Enable headset mode support for new WYSE NB platform.
Fixes: a26d96c7802e ("ALSA: hda/realtek - Comprehensive model list for ALC259 & co")
Signed-off-by: Kailang Yang
Cc:
Signed-off-by: Takashi Iwai
13 Jan, 2019
1 commit
-
Pull dma_zalloc_coherent() removal from Christoph Hellwig:
"We've always had a weird situation around dma_zalloc_coherent. To
safely support mapping the allocations to userspace major
architectures like x86 and arm have always zeroed allocations from
dma_alloc_coherent, but a couple other architectures were missing that
zeroing either always or in corner cases.Then later we grew anothe dma_zalloc_coherent interface to explicitly
request zeroing, but that just added __GFP_ZERO to the allocation
flags, which for some allocators that didn't end up using the page
allocator ended up being a no-op and still not zeroing the
allocations.So for this merge window I fixed up all remaining architectures to
zero the memory in dma_alloc_coherent, and made dma_zalloc_coherent a
no-op wrapper around dma_alloc_coherent, which fixes all of the above
issues.dma_zalloc_coherent is now pointless and can go away, and Luis helped
me writing a cocchinelle script and patch series to kill it, which I
think we should apply now just after -rc1 to finally settle these
issue"* tag 'remove-dma_zalloc_coherent-5.0' of git://git.infradead.org/users/hch/dma-mapping:
dma-mapping: remove dma_zalloc_coherent()
cross-tree: phase out dma_zalloc_coherent() on headers
cross-tree: phase out dma_zalloc_coherent()
10 Jan, 2019
2 commits
-
soc_init_dai_link() calls soc_find_component() which needs
to be within client_mutex lock. Add client_mutex lock around
soc_init_dai_link() in snd_soc_register_card() to avoid
lockdep warning.Fixes: 8780cf1142a5 ("ASoC: soc-core: defer card probe until all component is added to list")
Reported-by: Kuninori Morimoto
Signed-off-by: Rohit kumar
Signed-off-by: Ajit Pandey
Signed-off-by: Mark Brown -
move the codec PLL to rt5682_codec_init, because codec only need to config the clock source/PLL once.
As the result, remove the platform_clock_controls since no need to control clock anymore.Signed-off-by: Shuming Fan
Signed-off-by: Mac Chiang
Acked-by: Pierre-Louis Bossart
Signed-off-by: Mark Brown
09 Jan, 2019
4 commits
-
DAI component probe is not called if it is not present
in component list during sound card registration.
Check if component is available in component list for
platform and cpu dai before soundcard registration.Signed-off-by: Ajit Pandey
Signed-off-by: Rohit kumar
Signed-off-by: Mark Brown -
Disable Headset Mic VREF for headset mode of ALC225.
This will be controlled by coef bits of headset mode functions.[ Fixed a compile warning and code simplification -- tiwai ]
Signed-off-by: Kailang Yang
Cc:
Signed-off-by: Takashi Iwai -
Forgot to add unplug function to unplug state of headset mode
for ALC225.Signed-off-by: Kailang Yang
Cc:
Signed-off-by: Takashi Iwai -
fix typo after a recent commit causing headphones to have no sound
Fixes: ad43d528a7ac (ALSA: usb-audio: Define registers for CM6206)
Signed-off-by: Amadeusz Sławiński
Signed-off-by: Takashi Iwai
08 Jan, 2019
4 commits
-
We already need to zero out memory for dma_alloc_coherent(), as such
using dma_zalloc_coherent() is superflous. Phase it out.This change was generated with the following Coccinelle SmPL patch:
@ replace_dma_zalloc_coherent @
expression dev, size, data, handle, flags;
@@-dma_zalloc_coherent(dev, size, handle, flags)
+dma_alloc_coherent(dev, size, handle, flags)Suggested-by: Christoph Hellwig
Signed-off-by: Luis Chamberlain
[hch: re-ran the script on the latest tree]
Signed-off-by: Christoph Hellwig -
The "chip->dsp_spos_instance" can be NULL on some of the ealier error
paths in snd_cs46xx_create().Reported-by: "Yavuz, Tuba"
Signed-off-by: Dan Carpenter
Cc:
Signed-off-by: Takashi Iwai -
snd_pcm_lib_malloc_pages() may fail, so let's check its status and
return its error code upstream.Signed-off-by: Kangjie Lu
Acked-by: Pierre-Louis Bossart
Signed-off-by: Mark Brown
Cc: stable@vger.kernel.org -
During the bootup of the kernel, the DAPM bias level is in the OFF
state. As soon as the DAPM framework kicks in it pushes the codec
into STANDBY state.The probe function doesn't prepare the clock, and STANDBY state
does a clk_disable_unprepare() without checking the previous state.
This leads to an OOPS.Not transitioning from an OFF state to the STANDBY state fixes the
problem.Signed-off-by: b-ak
Signed-off-by: Mark Brown
Cc: stable@vger.kernel.org
07 Jan, 2019
5 commits
-
Dell has new platform for ALC274.
This will support to enable headset mode.Signed-off-by: Kailang Yang
Cc:
Signed-off-by: Takashi Iwai -
In `create_composite_quirk`, the terminating condition of for loops is
`quirk->ifnum < 0`. So any composite quirks should end with `struct
snd_usb_audio_quirk` object with ifnum < 0.for (quirk = quirk_comp->data; quirk->ifnum >= 0; ++quirk) {
.....
}the data field of Bower's & Wilkins PX headphones usb device device quirks
do not end with {.ifnum = -1}, wihch may result in out-of-bound read.This Patch fix the bug by adding an ending quirk object.
Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
Signed-off-by: Hui Peng
Cc:
Signed-off-by: Takashi Iwai -
There are a few places where we access the data without checking the
actual object size from the USB audio descriptor. This may result in
OOB access, as recently reported.This patch addresses these missing checks. Most of added codes are
simple bLength checks in the caller side. For the input and output
terminal parsers, we put the length check in the parser functions.
For the input terminal, a new argument is added to distinguish between
UAC1 and the rest, as they treat different objects.Reported-by: Mathias Payer
Reported-by: Hui Peng
Tested-by: Hui Peng
Cc:
Signed-off-by: Takashi Iwai -
We've had some sanity checks of the mixer unit descriptors but they
are too loose and some corner cases are overlooked. Add more strict
checks in uac_mixer_unit_get_channels() for avoiding possible OOB
accesses by malformed descriptors.This also changes the semantics of uac_mixer_unit_get_channels()
slightly. Now it returns zero for the cases where the descriptor
lacks of bmControls instead of -EINVAL. Then the caller side skips
the mixer creation for such unit while it keeps parsing it.
This corresponds to the case like Maya44.Cc:
Signed-off-by: Takashi Iwai -
The parser for the processing unit reads bNrInPins field before the
bLength sanity check, which may lead to an out-of-bound access when a
malformed descriptor is given. Fix it by assignment after the bLength
check.Cc:
Signed-off-by: Takashi Iwai
