23 Jan, 2016
1 commit
-
Pull sound fixes from Takashi Iwai:
"Here are lots of small fixes that have been collected since the
previous pull. This time, not only trivial ones but fixes for some
serious bugs are included:- Fix for CPU lockups by snd-hrtimer accesses
- Fix for unsafe disconnection handling in ALSA timer code
- Fix for Oops due to race at HD-audio module removal
- Fixes for possible memory corruption via 32bit PCM and sequencer
compat ioctls
- Fix for regression in HD-audio generic model handling
- Suppress kernel warnings for invalid TLV ioctls that may flood up
- Fix the missing SSC clock handling for at73c213
- A pin fixup for ASUS N550JX"* tag 'sound-fix-4.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: timer: Introduce disconnect op to snd_timer_instance
ALSA: timer: Handle disconnection more safely
ALSA: hda - Flush the pending probe work at remove
ALSA: hda - Fix missing module loading with model=generic option
ALSA: hda - Degrade i915 binding failure message
ALSA: at73c213: manage SSC clock
ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0
ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
ALSA: hrtimer: Fix stall by hrtimer_cancel()
ALSA: hda - Fix bass pin fixup for ASUS N550JX
22 Jan, 2016
2 commits
-
Instead of the previous ugly hack, introduce a new op, disconnect, to
snd_timer_instance object for handling the wake up of pending tasks
more cleanly.Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109431
Signed-off-by: Takashi Iwai -
Currently ALSA timer device doesn't take the disconnection into
account very well; it merely unlinks the timer device at disconnection
callback but does nothing else. Because of this, when an application
accessing the timer device is disconnected, it may release the
resource before actually closed. In most cases, it results in a
warning message indicating a leftover timer instance like:
ALSA: timer xxxx is busy?
But basically this is an open race.This patch tries to address it. The strategy is like other ALSA
devices: namely,
- Manage card's refcount at each open/close
- Wake up the pending tasks at disconnection
- Check the shutdown flag appropriately at each possible callNote that this patch has one ugly hack to handle the wakeup of pending
tasks. It'd be cleaner to introduce a new disconnect op to
snd_timer_instance ops. But since it would lead to internal ABI
breakage and it eventually increase my own work when backporting to
stable kernels, I took a different path to implement locally in
timer.c. A cleanup patch will follow at next for 4.5 kernel.Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109431
Cc: # v3.15+
Signed-off-by: Takashi Iwai
21 Jan, 2016
2 commits
-
Pull ARM SoC multiplatform code updates from Arnd Bergmann:
"This branch is the culmination of 5 years of effort to bring the ARMv6
and ARMv7 platforms together such that they can all be enabled and
boot the same kernel. It has been a tremendous amount of cleanup and
refactoring by a huge number of people, and creation of several new
(and major) subsystems to better abstract out all the platform details
in an appropriate manner.The bulk of this branch is a large patchset from Arnd that brings
several of the more minor and older platforms we have closer to
multiplatform support. Among these are MMP, S3C64xx, Orion5x, mv78xx0
and realview Much of this is moving around header files from old mach
directories, but there are also some cleanup patches of debug_ll
(lowlevel debug per-platform options) and other parts.Linus Walleij also has some patchs to clean up the older ARM Realview
platforms by finally introducing DT support, and Rob Herring has some
for ARM Versatile which is now DT-only. Both of these platforms are
now multiplatform.Finally, a couple of patches from Russell for Dove PMU, and a fix from
Valentin Rothberg for Exynos ADC, which were rebased on top of the
series to avoid conflicts"* tag 'armsoc-multiplatform' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (75 commits)
ARM: realview: don't select SMP_ON_UP for UP builds
ARM: s3c: simplify s3c_irqwake_{e,}intallow definition
ARM: s3c64xx: fix pm-debug compilation
iio: exynos-adc: fix irqf_oneshot.cocci warnings
ARM: realview: build realview-dt SMP support only when used
ARM: realview: select apropriate targets
ARM: realview: clean up header files
ARM: realview: make all header files local
ARM: no longer make CPU targets visible separately
ARM: integrator: use explicit core module options
ARM: realview: enable multiplatform
ARM: make default platform work for NOMMU
ARM: debug-ll: move DEBUG_LL_UART_EFM32 to correct Kconfig location
ARM: defconfig: use correct debug_ll settings
ARM: versatile: convert to multi-platform
ARM: versatile: merge mach code into a single file
ARM: versatile: switch to DT only booting and remove legacy code
ARM: versatile: add DT based PCI detection
ARM: pxa: mark ezx structures as __maybe_unused
ARM: pxa: mark raumfeld init functions as __maybe_unused
... -
As HD-audio driver does deferred probe internally via workqueue, the
driver might go into the mixed state doing both probe and remove when
the module gets unloaded during the probe work. This eventually
triggers an Oops, unsurprisingly.For avoiding this race, we just need to flush the pending probe work
explicitly before actually starting the resource release.Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=960710
Cc: # v3.17+
Signed-off-by: Takashi Iwai
20 Jan, 2016
3 commits
-
When the generic codec driver is specified via model option or such,
the hda driver doesn't try to load the generic driver module but still
loads the codec-specific driver, and this ends up with the binding
failure.This patch fixes it by moving the generic module request in the common
helper code.Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111021
Cc: # v4.4+
Signed-off-by: Takashi Iwai -
Currently HD-audio driver on Intel Skylake or Broxteon gives an error
message when binding with i915 audio component fails. However, this
isn't any serious error on a system without Intel graphics. Indeed
there are such systems, where a third-party codec (e.g. Creative) is
put on the mobo while using other discrete GPU (e.g. Nvidia).
Printing a kernel "error" message is overreaction in such a case.This patch downgrades the print level for that message. For systems
that mandate the i915 binding (e.g. Haswell or Broadwell HDMI/DP),
another kernel error message is shown in addition to make clear what
went wrong.Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111021
Signed-off-by: Takashi Iwai -
Since commit 49af54ff0fc7 ("misc: atmel-ssc: prepare clock only when
request") the SSC driver expects clients to manage the SSC clock.
This updates the at73c213 driver to enable the SSC clock whenever it is
needed.Signed-off-by: Mans Rullgard
Signed-off-by: Takashi Iwai
18 Jan, 2016
7 commits
-
When a TLV ioctl with numid zero is handled, the driver may spew a
kernel warning with a stack trace at each call. The check was
intended obviously only for a kernel driver, but not for a user
interaction. Let's fix it.This was spotted by syzkaller fuzzer.
Reported-by: Dmitry Vyukov
Cc:
Signed-off-by: Takashi Iwai -
This reverts one hunk of
commit ef44a1ec6eee ("ALSA: sound/core: use memdup_user()"), which
replaced a number of kmalloc followed by memcpy with memdup calls.In this case, we are copying from a struct snd_seq_port_info32 to a
struct snd_seq_port_info, but the latter is 4 bytes longer than the
32-bit version, so we need to separate kmalloc and copy calls.Fixes: ef44a1ec6eee ('ALSA: sound/core: use memdup_user()')
Signed-off-by: Nicolas Boichat
Cc:
Signed-off-by: Takashi Iwai -
This reverts one hunk of
commit ef44a1ec6eee ("ALSA: sound/core: use memdup_user()"), which
replaced a number of kmalloc followed by memcpy with memdup calls.In this case, we are copying from a struct snd_pcm_hw_params32 to
a struct snd_pcm_hw_params, but the latter is 4 bytes longer than
the 32-bit version, so we need to separate kmalloc and copy calls.This actually leads to an out-of-bounds memory access later on
in sound/soc/soc-pcm.c:soc_pcm_hw_params() (detected using KASan).Fixes: ef44a1ec6eee ('ALSA: sound/core: use memdup_user()')
Signed-off-by: Nicolas Boichat
Cc:
Signed-off-by: Takashi Iwai -
hrtimer_cancel() waits for the completion from the callback, thus it
must not be called inside the callback itself. This was already a
problem in the past with ALSA hrtimer driver, and the early commit
[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.However, the previous fix is still insufficient: it may still cause a
lockup when the ALSA timer instance reprograms itself in its callback.
Then it invokes the start function even in snd_timer_interrupt() that
is called in hrtimer callback itself, results in a CPU stall. This is
no hypothetical problem but actually triggered by syzkaller fuzzer.This patch tries to fix the issue again. Now we call
hrtimer_try_to_cancel() at both start and stop functions so that it
won't fall into a deadlock, yet giving some chance to cancel the queue
if the functions have been called outside the callback. The proper
hrtimer_cancel() is called in anyway at closing, so this should be
enough.Reported-and-tested-by: Dmitry Vyukov
Cc:
Signed-off-by: Takashi Iwai -
ASUS N550JX (PCI SSID 1043:13df) requires the same fixup for a bass
speaker output pin as other N550 models.Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=110001
Cc:
Signed-off-by: Takashi Iwai -
Pull GPIO updates from Linus Walleij:
"Here is the bulk of GPIO changes for v4.5.Notably there are big refactorings mostly by myself, aimed at getting
the gpio_chip into a shape that makes me believe I can proceed to
preserve state for a proper userspace ABI (character device) that has
already been proposed once, but resulted in the feedback that I need
to go back and restructure stuff. So I've been restructuring stuff.
On the way I ran into brokenness (return code from the get_value()
callback) and had to fix it. Also, refactored generic GPIO to be
simpler.Some of that is still waiting to trickle down from the subsystems all
over the kernel that provide random gpio_chips, I've touched every
single GPIO driver in the kernel now, oh man I didn't know I was
responsible for so much...Apart from that we're churning along as usual.
I took some effort to test and retest so it should merge nicely and we
shook out a couple of bugs in -next.Infrastructural changes:
- In struct gpio_chip, rename the .dev node to .parent to better
reflect the fact that this is not the GPIO struct device
abstraction. We will add that soon so this would be totallt
confusing.- It was noted that the driver .get_value() callbacks was sometimes
reporting negative -ERR values to the gpiolib core, expecting them
to be propagated to consumer gpiod_get_value() and gpio_get_value()
calls. This was not happening, so as there was a mess of drivers
returning negative errors and some returning "anything else than
zero" to indicate that a line was active. As some would have bit
31 set to indicate "line active" it clashed with negative error
codes. This is fixed by the largeish series clamping values in all
drivers with !!value to [0,1] and then augmenting the code to
propagate error codes to consumers. (Includes some ACKed patches
in other subsystems.)- Add a void *data pointer to struct gpio_chip. The container_of()
design pattern is indeed very nice, but we want to reform the
struct gpio_chip to be a non-volative, stateless business, and keep
states internal to the gpiolib to be able to hold on to the state
when adding a proper userspace ABI (character device) further down
the road. To achieve this, drivers need a handle at the internal
state that is not dependent on their struct gpio_chip() so we add
gpiochip_add_data() and gpiochip_get_data() following the pattern
of many other subsystems. All the "use gpiochip data pointer"
patches transforms drivers to this scheme.- The Generic GPIO chip header has been merged into the general
header, and the custom header for that
removed. Instead of having a separate mm_gpio_chip struct for
these generic drivers, merge that into struct gpio_chip,
simplifying the code and removing the need for separate and
confusing includes.Misc improvements:
- Stabilize the way GPIOs are looked up from the ACPI legacy
specification.- Incremental driver features for PXA, PCA953X, Lantiq (patches from
the OpenWRT community), RCAR, Zynq, PL061, 104-idi-48New drivers:
- Add a GPIO chip to the ALSA SoC AC97 driver.
- Add a new Broadcom NSP SoC driver (this lands in the pinctrl dir,
but the branch is merged here too to account for infrastructural
changes).- The sx150x driver now supports the sx1502"
* tag 'gpio-v4.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (220 commits)
gpio: generic: make bgpio_pdata always visible
gpiolib: fix chip order in gpio list
gpio: mpc8xxx: Do not use gpiochip_get_data() in mpc8xxx_gpio_save_regs()
gpio: mm-lantiq: Do not use gpiochip_get_data() in ltq_mm_save_regs()
gpio: brcmstb: Allow building driver for BMIPS_GENERIC
gpio: brcmstb: Set endian flags for big-endian MIPS
gpio: moxart: fix build regression
gpio: xilinx: Do not use gpiochip_get_data() in xgpio_save_regs()
leds: pca9532: use gpiochip data pointer
leds: tca6507: use gpiochip data pointer
hid: cp2112: use gpiochip data pointer
bcma: gpio: use gpiochip data pointer
avr32: gpio: use gpiochip data pointer
video: fbdev: via: use gpiochip data pointer
gpio: pch: Optimize pch_gpio_get()
Revert "pinctrl: lantiq: Implement gpio_chip.to_irq"
pinctrl: nsp-gpio: use gpiochip data pointer
pinctrl: vt8500-wmt: use gpiochip data pointer
pinctrl: exynos5440: use gpiochip data pointer
pinctrl: at91-pio4: use gpiochip data pointer
... -
Pull sound updates from Takashi Iwai:
"We've had quite busy weeks in this cycle. Looking at ALSA core, the
significant changes are a few fixes wrt timer and sequencer ioctls
that have been revealed by fuzzer recently. Other than that, ASoC
core got a few updates about DAI link handling, but these are rather
straightforward refactoring.In drivers scene, ASoC received quite lots of new drivers in addition
to bunch of updates for still ongoing Intel Skylake support and
topology API. HD-audio gained a new HDMI/DP hotplug notification via
component. FireWire got a pile of code refactoring/updates with
SCS.1x driver integration.More highlights are shown below.
[ NOTE: this contains also many commits for DRM. This is due to the
pull of drm stable branch into sound tree, as the base of i915 audio
component work for HD-audio. The highlights below don't contain
these DRM changes, as these are supposed to be pulled via drm tree
in anyway sooner or later. ]Core:
- Handful fixes to harden ALSA timer and sequencer ioctls against
races reported by syzkaller fuzzer
- Irq description string can be unique to each card; only for
HD-audio for nowASoC:
- Conversion of the array of DAI links to a list for supporting
dynamically adding and removing DAI links
- Topology API enhancements to make everything more component based
and being able to specify PCM links via topology
- Some more fixes for the topology code, though it is still not final
and ready for enabling in production; we really need to get to the
point where that can be done
- A pile of changes for Intel SkyLake drivers which hopefully deliver
some useful initial functionality for systems with this chipset,
though there is more work still to come
- Lots of new features and cleanups for the Renesas drivers
- ANC support for WM5110
- New drivers: Imagination Technologies IPs, Atmel class D speaker,
Cirrus CS47L24 and WM1831, Dialog DA7128, Realtek RT5659 and
RT56156, Rockchip RK3036, TI PC3168A, and AMD ACP
- Rename PCM1792a driver to be generic pcm179xHD-Audio:
- Use audio component for i915 HDMI/DP hotplug handling
- On-demand binding with i915 driver
- bdl_pos_adj parameter adjustment for Baytrail controllers
- Enable power_save_node for CX20722; this shouldn't lead to
regression, hopefully
- Kabylake HDMI/DP codec support
- Quirks for Lenovo E50-80, Dell Latitude E-series, and other Dell
machines
- A few code refactoringFireWire:
- Lots of code cleanup and refactoring
- Integrate the support of SCS.1x devices into snd-oxfw driver;
snd-scs1x driver is obsoletedUSB-audio:
- Fix possible NULL dereference at disconnection
- A regression fix for Native Instruments devicesMisc:
- A few code cleanups of fm801 driver"* tag 'sound-4.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (722 commits)
ALSA: timer: Code cleanup
ALSA: timer: Harden slave timer list handling
ALSA: hda - Add fixup for Dell Latitidue E6540
ALSA: timer: Fix race among timer ioctls
ALSA: hda - add codec support for Kabylake display audio codec
ALSA: timer: Fix double unlink of active_list
ALSA: usb-audio: Fix mixer ctl regression of Native Instrument devices
ALSA: hda - fix the headset mic detection problem for a Dell laptop
ALSA: hda - Fix white noise on Dell Latitude E5550
ALSA: hda_intel: add card number to irq description
ALSA: seq: Fix race at timer setup and close
ALSA: seq: Fix missing NULL check at remove_events ioctl
ALSA: usb-audio: Avoid calling usb_autopm_put_interface() at disconnect
ASoC: hdac_hdmi: remove unused hdac_hdmi_query_pin_connlist
ASoC: AMD: Add missing include file
ALSA: hda - Fixup inverted internal mic for Lenovo E50-80
ALSA: usb: Add native DSD support for Oppo HA-1
ASoC: Make aux_dev more like a generic component
ASoC: bcm2835: cleanup includes by ordering them alphabetically
ASoC: AMD: Manage ACP 2.x SRAM banks power
...
15 Jan, 2016
4 commits
-
This is a minor code cleanup without any functional changes:
- Kill keep_flag argument from _snd_timer_stop(), as all callers pass
only it false.
- Remove redundant NULL check in _snd_timer_stop().Signed-off-by: Takashi Iwai
-
A slave timer instance might be still accessible in a racy way while
operating the master instance as it lacks of locking. Since the
master operation is mostly protected with timer->lock, we should cope
with it while changing the slave instance, too. Also, some linked
lists (active_list and ack_list) of slave instances aren't unlinked
immediately at stopping or closing, and this may lead to unexpected
accesses.This patch tries to address these issues. It adds spin lock of
timer->lock (either from master or slave, which is equivalent) in a
few places. For avoiding a deadlock, we ensure that the global
slave_active_lock is always locked at first before each timer lock.Also, ack and active_list of slave instances are properly unlinked at
snd_timer_stop() and snd_timer_close().Last but not least, remove the superfluous call of _snd_timer_stop()
at removing slave links. This is a noop, and calling it may confuse
readers wrt locking. Further cleanup will follow in a later patch.Actually we've got reports of use-after-free by syzkaller fuzzer, and
this hopefully fixes these issues.Reported-by: Dmitry Vyukov
Cc:
Signed-off-by: Takashi Iwai -
Another Dell model, another fixup entry: Latitude E6540 needs the same
fixup as other Latitude E series as workaround for noise problems.Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=104341
Cc:
Signed-off-by: Takashi Iwai -
Pull trivial tree updates from Jiri Kosina.
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial:
floppy: make local variable non-static
exynos: fixes an incorrect header guard
dt-bindings: fixes some incorrect header guards
cpufreq-dt: correct dead link in documentation
cpufreq: ARM big LITTLE: correct dead link in documentation
treewide: Fix typos in printk
Documentation: filesystem: Fix typo in fs/eventfd.c
fs/super.c: use && instead of & for warn_on condition
Documentation: fix sysfs-ptp
lib: scatterlist: fix Kconfig description
14 Jan, 2016
4 commits
-
ALSA timer ioctls have an open race and this may lead to a
use-after-free of timer instance object. A simplistic fix is to make
each ioctl exclusive. We have already tread_sem for controlling the
tread, and extend this as a global mutex to be applied to each ioctl.The downside is, of course, the worse concurrency. But these ioctls
aren't to be parallel accessible, in anyway, so it should be fine to
serialize there.Reported-by: Dmitry Vyukov
Tested-by: Dmitry Vyukov
Cc:
Signed-off-by: Takashi Iwai -
This patch adds codec ID (0x8086280b) for Kabylake display codec
and apply the hsw fix-ups to Kabylake.Signed-off-by: Libin Yang
Signed-off-by: Takashi Iwai -
ALSA timer instance object has a couple of linked lists and they are
unlinked unconditionally at snd_timer_stop(). Meanwhile
snd_timer_interrupt() unlinks it, but it calls list_del() which leaves
the element list itself unchanged. This ends up with unlinking twice,
and it was caught by syzkaller fuzzer.The fix is to use list_del_init() variant properly there, too.
Reported-by: Dmitry Vyukov
Tested-by: Dmitry Vyukov
Cc:
Signed-off-by: Takashi Iwai -
Pull dmaengine updates from Vinod Koul:
"This round we have few new features, new driver and updates to few
drivers.The new features to dmaengine core are:
- Synchronized transfer termination API to terminate the dmaengine
transfers in synchronized and async fashion as required by users.
We have its user now in ALSA dmaengine lib, img, at_xdma, axi_dmac
drivers.
- Universal API for channel request and start consolidation of
request flows. It's user is ompa-dma driver.
- Introduce reuse of descriptors and use in pxa_dma driverAdd/Remove:
- New STM32 DMA driver
- Removal of unused R-Car HPB-DMAC driverUpdates:
- ti-dma-crossbar updates for supporting eDMA
- tegra-apb pm updates
- idma64
- mv_xor updates
- ste_dma updates"* tag 'dmaengine-4.5-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (54 commits)
dmaengine: mv_xor: add suspend/resume support
dmaengine: mv_xor: de-duplicate mv_chan_set_mode*()
dmaengine: mv_xor: remove mv_xor_chan->current_type field
dmaengine: omap-dma: Add support for DMA filter mapping to slave devices
dmaengine: edma: Add support for DMA filter mapping to slave devices
dmaengine: core: Introduce new, universal API to request a channel
dmaengine: core: Move and merge the code paths using private_candidate
dmaengine: core: Skip mask matching when it is not provided to private_candidate
dmaengine: mdc: Correct terminate_all handling
dmaengine: edma: Add probe callback to edma_tptc_driver
dmaengine: dw: fix potential memory leak in dw_dma_parse_dt()
dmaengine: stm32-dma: Fix unchecked deference of chan->desc
dmaengine: sh: Remove unused R-Car HPB-DMAC driver
dmaengine: usb-dmac: Document SoC specific compatibility strings
ste_dma40: Delete an unnecessary variable initialisation in d40_probe()
ste_dma40: Delete another unnecessary check in d40_probe()
ste_dma40: Delete an unnecessary check before the function call "kmem_cache_destroy"
dmaengine: tegra-apb: Free interrupts before killing tasklets
dmaengine: tegra-apb: Update driver to use GFP_NOWAIT
dmaengine: tegra-apb: Only save channel state for those in use
...
13 Jan, 2016
6 commits
-
The commit [da6d276957ea: ALSA: usb-audio: Add resume support for
Native Instruments controls] brought a regression where the Native
Instrument audio devices don't get the correct value at update due to
the missing shift at writing. This patch addresses it.Fixes: da6d276957ea ('ALSA: usb-audio: Add resume support for Native Instruments controls')
Reported-and-tested-by: Owen Williams
Cc:
Signed-off-by: Takashi Iwai -
The machine uses codec alc255, and the pin configuration value for
pin 0x14 on this machine is 0x90171130 which is not in the pin quirk
table yet.Cc: stable@vger.kernel.org
BugLink: https://bugs.launchpad.net/bugs/1533461
Signed-off-by: Hui Wang
Signed-off-by: Takashi Iwai -
Dell Latitude E5550 (1028:062c) has a white noise problem like other
Latitude E models, and it gets fixed by the very same quirk as well.Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=110591
Cc: # v4.1+
Signed-off-by: Takashi Iwai -
Currently the info in /proc/interrupts doesn't allow to figure out which
interrupt belongs to which card (HDMI, PCH, ..).
Therefore add card details to the interrupt description.
With the patch the info in /proc/interrupts looks like this:PCI-MSI 442368-edge snd_hda_intel:card1
PCI-MSI 49152-edge snd_hda_intel:card0NOTE: this patch adds the new irq_descr field snd_card struct that is
filled automatically at a card object creation. This can be used
generically for other drivers as well. The changes for others will
follow later -- tiwaiSigned-off-by: Heiner Kallweit
Signed-off-by: Takashi Iwai -
ALSA sequencer code has an open race between the timer setup ioctl and
the close of the client. This was triggered by syzkaller fuzzer, and
a use-after-free was caught there as a result.This patch papers over it by adding a proper queue->timer_mutex lock
around the timer-related calls in the relevant code path.Reported-by: Dmitry Vyukov
Tested-by: Dmitry Vyukov
Cc:
Signed-off-by: Takashi Iwai -
snd_seq_ioctl_remove_events() calls snd_seq_fifo_clear()
unconditionally even if there is no FIFO assigned, and this leads to
an Oops due to NULL dereference. The fix is just to add a proper NULL
check.Reported-by: Dmitry Vyukov
Tested-by: Dmitry Vyukov
Cc:
Signed-off-by: Takashi Iwai
12 Jan, 2016
2 commits
-
ALSA PCM may still have a leftover instance after disconnection and
it delays its release. The problem is that the PCM close code path of
USB-audio driver has a call of snd_usb_autosuspend(). This involves
with the call of usb_autopm_put_interface() and it may lead to a
kernel Oops due to the NULL object like:BUG: unable to handle kernel NULL pointer dereference at 0000000000000190
IP: [] usb_autopm_put_interface+0xf/0x30 PGD 0
Call Trace:
[] snd_usb_autosuspend+0x14/0x20
[] snd_usb_pcm_close.isra.14+0x5c/0x90
[] snd_usb_playback_close+0xf/0x20
[] snd_pcm_release_substream.part.36+0x3a/0x90
[] snd_pcm_release+0xa3/0xb0
[] snd_disconnect_release+0xd0/0xe0
[] __fput+0x97/0x1d0
[] ____fput+0x9/0x10
[] task_work_run+0x72/0x90
[] do_exit+0x280/0xa80
[] do_group_exit+0x3a/0xa0
[] get_signal+0x1df/0x540
[] do_signal+0x23/0x620
[] ? do_readv_writev+0x128/0x200
[] prepare_exit_to_usermode+0x91/0xd0
[] syscall_return_slowpath+0x9a/0x120
[] ? __sys_recvmsg+0x5d/0x70
[] ? ktime_get_ts64+0x45/0xe0
[] ? SyS_poll+0x60/0xf0
[] int_ret_from_sys_call+0x25/0x8fWe have already a check of disconnection in snd_usb_autoresume(), but
the check is missing its counterpart. The fix is just to put the same
check in snd_usb_autosuspend(), too.Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109431
Cc:
Signed-off-by: Takashi Iwai -
…ie/sound into for-next
ASoC: Last updates for v4.5
A bunch more updates for v4.5, mainly driver work:
- More topology API enhancements from Mengdong Lin working towards
making everything more component based and being able to specify PCM
links via topology.
- Large sets driver updates from Cirrus, Intel (mainly more Skylake
support) and Renesas.
- New driver for AMD ACP
- Rename PCM1792a driver to be generic pcm179x
11 Jan, 2016
9 commits
