09 Mar, 2018

2 commits


08 Mar, 2018

4 commits

  • One version of Lenovo Thinkpad T570 did not use ALC298
    (like other Kaby Lake devices). Instead it uses ALC292.
    In order to make the Lenovo dock working with that codec
    the dock quirk for ALC292 will be used.

    Signed-off-by: Dennis Wassenberg
    Cc:
    Signed-off-by: Takashi Iwai

    Dennis Wassenberg
     
  • With the previous two fixes for the write / ioctl races:
    ALSA: seq: Don't allow resizing pool in use
    ALSA: seq: More protection for concurrent write and ioctl races
    the cells aren't any longer in queues at the point calling
    snd_seq_pool_done() in snd_seq_ioctl_set_client_pool(). Hence the
    function call snd_seq_queue_client_leave_cells() can be dropped safely
    from there.

    Suggested-by: Nicolai Stange
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     
  • This patch is an attempt for further hardening against races between
    the concurrent write and ioctls. The previous fix d15d662e89fc
    ("ALSA: seq: Fix racy pool initializations") covered the race of the
    pool initialization at writer and the pool resize ioctl by the
    client->ioctl_mutex (CVE-2018-1000004). However, basically this mutex
    should be applied more widely to the whole write operation for
    avoiding the unexpected pool operations by another thread.

    The only change outside snd_seq_write() is the additional mutex
    argument to helper functions, so that we can unlock / relock the given
    mutex temporarily during schedule() call for blocking write.

    Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
    Reported-by: 范龙飞
    Reported-by: Nicolai Stange
    Reviewed-and-tested-by: Nicolai Stange
    Cc:
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     
  • This is a fix for a (sort of) fallout in the recent commit
    d15d662e89fc ("ALSA: seq: Fix racy pool initializations") for
    CVE-2018-1000004.
    As the pool resize deletes the existing cells, it may lead to a race
    when another thread is writing concurrently, eventually resulting a
    UAF.

    A simple workaround is not to allow the pool resizing when the pool is
    in use. It's an invalid behavior in anyway.

    Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
    Reported-by: 范龙飞
    Reported-by: Nicolai Stange
    Cc:
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

06 Mar, 2018

4 commits

  • The dock line-out pin (NID 0x17 of ALC3254 codec) on Dell Precision
    7520 may route to three different DACs, 0x02, 0x03 and 0x06. The
    first two DACS have the volume amp controls while the last one
    doesn't. And unfortunately, the auto-parser assigns this pin to DAC3,
    resulting in the non-working volume control for the line out.

    Fix it by disabling the routing to DAC3 on the corresponding pin.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199029
    Cc:
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     
  • The internal mic boost on the T480 is too high. Fix this by applying the
    ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine to limit the gain.

    Signed-off-by: Benjamin Berg
    Tested-by: Benjamin Berg
    Cc:
    Signed-off-by: Takashi Iwai

    Benjamin Berg
     
  • This platform was only one phone Jack.
    Add dummy lineout verb to fix automute mode disable.
    This just the workaround.

    [ More background information:
    since the platform has only a headphone jack without speaker, the
    driver doesn't create the auto-mute control. Meanwhile we do update
    the headset mode via the automute hook in the driver, thus with this
    setup, the headset won't be updated any longer.

    By adding a dummy line-out pin here, the auto-mute is added by the
    driver, and the headset update is triggered properly.

    Note that this is different from the other
    ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, which has the real line-out pin,
    while this quirk adds a dummy line-out pin. -- tiwai ]

    Signed-off-by: Kailang Yang
    Cc:
    Signed-off-by: Takashi Iwai

    Kailang Yang
     
  • Enable headset mode support for WYSE platform.

    Signed-off-by: Kailang Yang
    Cc:
    Signed-off-by: Takashi Iwai

    Kailang Yang
     

02 Mar, 2018

1 commit

  • With the alc289, the Pin 0x1b is Headphone-Mic, so we should assign
    ALC269_FIXUP_DELL4_MIC_NO_PRESENCE rather than
    ALC225_FIXUP_DELL1_MIC_NO_PRESENCE to it. And this change is suggested
    by Kailang of Realtek and is verified on the machine.

    Fixes: 3f2f7c553d07 ("ALSA: hda - Fix headset mic detection problem for two Dell machines")
    Cc: Kailang Yang
    Cc:
    Signed-off-by: Hui Wang
    Signed-off-by: Takashi Iwai

    Hui Wang
     

28 Feb, 2018

3 commits

  • When LPE audio driver gets some error at probing, it may lead to a
    crash because of canceling the pending work in hdmi_lpe_audio_free(),
    since some of ports might be still not initialized.

    For assuring the proper free of each port, initialize all ports at the
    beginning of the probe.

    Fixes: b4eb0d522fcb ("ALSA: x86: Split snd_intelhad into card and PCM specific structures")
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     
  • The commit change for supporting the multiple ports moved involved
    some code shuffling, and there the initializations of spinlock and
    mutex in snd_intelhad object were dropped mistakenly.

    This patch adds the missing initializations again for each port.

    Fixes: b4eb0d522fcb ("ALSA: x86: Split snd_intelhad into card and PCM specific structures")
    Cc:
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     
  • The patch "ALSA: control: code refactoring for ELEM_READ/ELEM_WRITE
    operations" introduced a potential for kernel memory corruption due
    to an incorrect if statement allowing non-readable controls to fall
    through and call the get function. For TLV controls a driver can omit
    SNDRV_CTL_ELEM_ACCESS_READ to ensure that only the TLV get function
    can be called. Instead the normal get() can be invoked unexpectedly
    and as the driver expects that this will only be called for controls
    512 bytes into the 512 byte
    return array, so corrupting kernel memory.

    The problem is an attempt to refactor the snd_ctl_elem_read function
    to invert the logic so that it conditionally aborted if the control
    is unreadable instead of conditionally executing. But the if statement
    wasn't inverted correctly.

    The correct inversion of

    if (a && !b)

    is
    if (!a || b)

    Fixes: becf9e5d553c2 ("ALSA: control: code refactoring for ELEM_READ/ELEM_WRITE operations")
    Signed-off-by: Richard Fitzgerald
    Cc:
    Signed-off-by: Takashi Iwai

    Richard Fitzgerald
     

26 Feb, 2018

1 commit

  • We've added a quirk to enable the recent Lenovo dock support, where it
    overwrites the pin configs of NID 0x17 and 19, not only updating the
    pin config cache. It works right after the boot, but the problem is
    that the pin configs are occasionally cleared when the machine goes to
    PM. Meanwhile the quirk writes the pin configs only at the pre-probe,
    so this won't be applied any longer.

    For addressing that issue, this patch moves the code to overwrite the
    pin configs into HDA_FIXUP_ACT_INIT section so that it's always
    applied at both probe and resume time.

    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195161
    Fixes: 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform")
    Cc:
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

24 Feb, 2018

2 commits

  • The capture interface doesn't work and the playback interface only
    supports 48 kHz sampling rate even though it advertises more rates.

    Signed-off-by: Erik Veijola
    Cc:
    Signed-off-by: Takashi Iwai

    Erik Veijola
     
  • On some boards setting power_save to a non 0 value leads to clicking /
    popping sounds when ever we enter/leave powersaving mode. Ideally we would
    figure out how to avoid these sounds, but that is not always feasible.

    This commit adds a blacklist for devices where powersaving is known to
    cause problems and disables it on these devices.

    Note I tried to put this blacklist in userspace first:
    https://github.com/systemd/systemd/pull/8128

    But the systemd maintainers rightfully pointed out that it would be
    impossible to then later remove entries once we actually find a way to
    make power-saving work on listed boards without issues. Having this list
    in the kernel will allow removal of the blacklist entry in the same commit
    which fixes the clicks / plops.

    The blacklist only applies to the default power_save module-option value,
    if a user explicitly sets the module-option then the blacklist is not
    used.

    [ added an ifdef CONFIG_PM for the build error -- tiwai]

    BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1525104
    BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=198611
    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede
    Signed-off-by: Takashi Iwai

    Hans de Goede
     

22 Feb, 2018

1 commit

  • The recent support for the multiple PCM devices allowed user to use
    multiple HDMI/DP outputs, but at the same time, the PCM stream
    assignment has been changed, too. Due to that, the former PCM#0
    (there was only one stream in the past) is likely assigned to a
    different one (e.g. PCM#2), and it ends up with the regression when
    user sticks with the fixed configuration using the device#0.

    Although the multiple monitor support shouldn't matter when user
    deploys the backend like PulseAudio that checks the jack detection
    state, the behavior change isn't always acceptable for some users.

    As a mitigation, this patch introduces an option to switch the
    behavior back to the old-good-days: when the new option,
    single_port=1, is passed, the driver creates only a single PCM device,
    and it's assigned to the first connected one, like the earlier
    versions did. The option is turned off as default still to support
    the multiple monitors.

    Fixes: 8a2d6ae1f737 ("ALSA: x86: Register multiple PCM devices for the LPE audio card")
    Reported-and-tested-by: Hubert Mantel
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

14 Feb, 2018

2 commits

  • These laptops have a combined jack to attach headsets, the U727 on
    the left, the U757 on the right, but a headsets microphone doesn't
    work. Using hdajacksensetest I found that pin 0x19 changed the
    present state when plugging the headset, in addition to 0x21, but
    didn't have the correct configuration (shown as "Not connected").

    So this sets the configuration to the same values as the headphone
    pin 0x21 except for the device type microphone, which makes it
    work correctly. With the patch the configured pins for U727 are

    Pin 0x12 (Internal Mic, Mobile-In): present = No
    Pin 0x14 (Internal Speaker): present = No
    Pin 0x19 (Black Mic, Left side): present = No
    Pin 0x1d (Internal Aux): present = No
    Pin 0x21 (Black Headphone, Left side): present = No

    Signed-off-by: Jan-Marek Glogowski
    Cc:
    Signed-off-by: Takashi Iwai

    Jan-Marek Glogowski
     
  • ALSA sequencer core initializes the event pool on demand by invoking
    snd_seq_pool_init() when the first write happens and the pool is
    empty. Meanwhile user can reset the pool size manually via ioctl
    concurrently, and this may lead to UAF or out-of-bound accesses since
    the function tries to vmalloc / vfree the buffer.

    A simple fix is to just wrap the snd_seq_pool_init() call with the
    recently introduced client->ioctl_mutex; as the calls for
    snd_seq_pool_init() from other side are always protected with this
    mutex, we can avoid the race.

    Reported-by: 范龙飞
    Cc:
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

12 Feb, 2018

6 commits

  • Signed-off-by: Takashi Iwai

    Takashi Iwai
     
  • Add some more devices that need quirks to handle DSD modes correctly.

    Signed-off-by: Daniel Mack
    Reported-and-tested-by: Thomas Gresens
    Cc:
    Signed-off-by: Takashi Iwai

    Daniel Mack
     
  • The layout of the UAC2 Control request and response varies depending on
    the request type. With the current implementation, only the Layout 2
    Parameter Block (with the 2-byte sized RANGE attribute) is handled
    properly. For the Control requests with the 1-byte sized RANGE attribute
    (Bass Control, Mid Control, Tremble Control), the response is parsed
    incorrectly.

    This commit:
    * fixes the wLength field value in the request
    * fixes parsing the range values from the response

    Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
    Signed-off-by: Kirill Marinushkin
    Cc:
    Signed-off-by: Takashi Iwai

    Kirill Marinushkin
     
  • Add quirk to ensure a sync endpoint is properly configured.
    This patch is a fix for same symptoms on Behringer UFX1204 as patch
    from Albertto Aquirre on Dec 8 2016 for Axe-Fx II.

    Signed-off-by: Lassi Ylikojola
    Cc:
    Signed-off-by: Takashi Iwai

    Lassi Ylikojola
     
  • The AC97_BUS_NEW Kconfig symbol selects the globally undefined symbol
    AC97.

    Robert Jarzmik confirmed in https://lkml.org/lkml/2018/2/7/96 that the
    select was put in by mistake and can be safely removed, with no other
    changes required. Remove it.

    Fixes: 74426fbff66e ("ALSA: ac97: add an ac97 bus")
    Signed-off-by: Ulf Magnusson
    Signed-off-by: Takashi Iwai

    Ulf Magnusson
     
  • This is the mindless scripted replacement of kernel use of POLL*
    variables as described by Al, done by this script:

    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
    L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
    for f in $L; do sed -i "-es/^\([^\"]*\)\(\\)/\\1E\\2/" $f; done
    done

    with de-mangling cleanups yet to come.

    NOTE! On almost all architectures, the EPOLL* constants have the same
    values as the POLL* constants do. But they keyword here is "almost".
    For various bad reasons they aren't the same, and epoll() doesn't
    actually work quite correctly in some cases due to this on Sparc et al.

    The next patch from Al will sort out the final differences, and we
    should be all done.

    Scripted-by: Al Viro
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

08 Feb, 2018

1 commit

  • Pull more ASoC updates from Mark Brown:
    "With the merge window having been delayed for another week here's
    another batch of updates that came in during that week.

    There's a few important fixes in here, mainly a fix for I/O on a
    number of devices caused by some of the component rework and a fix for
    a potential issue if more than one component in a link provides
    compressed operations. The I/O fixes are particularly important as the
    problem causes a power regression on a number of OMAP platforms"

    * tag 'asoc-v4.16-5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound: (22 commits)
    ASoC: stm32: add of dependency for stm32 drivers
    ASoC: mt8173-rt5650: fix child-node lookup
    ASoC: dapm: fix debugfs read using path->connected
    ASoC: compress: Fixup error messages
    ASoC: compress: Remove some extraneous blank lines
    ASoC: compress: Correct handling of copy callback
    ASoC: Intel: kbl: Enable mclk and ssp sclk early
    ASoC: Intel: Skylake: Add extended I2S config blob support in Clock driver
    ASoC: Intel: Skylake: Add ssp clock driver
    ASoC: Fix twl4030 and 6040 regression by adding back read and write
    ASoC: sun8i-codec: Add ADC support for a33
    ASoC: rockchip: Use dummy_dai for rt5514 dsp dailink
    ASoC: soc-pcm: rename .pmdown_time to .use_pmdown_time for Component
    ASoC: ak4613: call dummy write for PW_MGMT1/3 when Playback
    ASoC: soc-pcm: don't call flush_delayed_work() many times in soc_pcm_private_free()
    ASoC: soc-core: snd_soc_rtdcom_lookup() cares component driver name
    ASoC: sam9x5_wm8731: Drop 'ASoC' prefix from error messages
    ASoC: sam9g20_wm8731: use dev_*() logging functions
    ASoC: max98373 Changed SPDX header in C++ comments style
    ASoC: dmic: Fix check of return value from read of 'num-channels'
    ...

    Linus Torvalds
     

07 Feb, 2018

12 commits


02 Feb, 2018

1 commit

  • Pull driver core updates from Greg KH:
    "Here is the set of "big" driver core patches for 4.16-rc1.

    The majority of the work here is in the firmware subsystem, with
    reworks to try to attempt to make the code easier to handle in the
    long run, but no functional change. There's also some tree-wide sysfs
    attribute fixups with lots of acks from the various subsystem
    maintainers, as well as a handful of other normal fixes and changes.

    And finally, some license cleanups for the driver core and sysfs code.

    All have been in linux-next for a while with no reported issues"

    * tag 'driver-core-4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (48 commits)
    device property: Define type of PROPERTY_ENRTY_*() macros
    device property: Reuse property_entry_free_data()
    device property: Move property_entry_free_data() upper
    firmware: Fix up docs referring to FIRMWARE_IN_KERNEL
    firmware: Drop FIRMWARE_IN_KERNEL Kconfig option
    USB: serial: keyspan: Drop firmware Kconfig options
    sysfs: remove DEBUG defines
    sysfs: use SPDX identifiers
    drivers: base: add coredump driver ops
    sysfs: add attribute specification for /sysfs/devices/.../coredump
    test_firmware: fix missing unlock on error in config_num_requests_store()
    test_firmware: make local symbol test_fw_config static
    sysfs: turn WARN() into pr_warn()
    firmware: Fix a typo in fallback-mechanisms.rst
    treewide: Use DEVICE_ATTR_WO
    treewide: Use DEVICE_ATTR_RO
    treewide: Use DEVICE_ATTR_RW
    sysfs.h: Use octal permissions
    component: add debugfs support
    bus: simple-pm-bus: convert bool SIMPLE_PM_BUS to tristate
    ...

    Linus Torvalds