Eric Lee / smarc-fsl-linux-kernel

15 Nov, 2016

1 commit

  • 6ff1a2531   ALSA: usb-audio: Fix use-after-free of usb_device at disconnect ... Browse Code »

    The usb-audio driver implements the deferred device disconnection for
    the device in use. In this mode, the disconnection callback returns
    immediately while the actual ALSA card object removal happens later
    when all files get closed. As Shuah reported, this code flow,
    however, leads to a use-after-free, detected by KASAN:

    BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
    Write of size 8 by task pulseaudio/2244
    Call Trace:
    [] dump_stack+0x67/0x94
    [] kasan_object_err+0x21/0x70
    [] kasan_report_error+0x1fa/0x4e0
    [] ? kasan_slab_free+0x87/0xb0
    [] __asan_report_store8_noabort+0x43/0x50
    [] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
    [] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
    [] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
    [] __snd_device_free+0x12a/0x210
    [] snd_device_free_all+0x85/0xd0
    [] release_card_device+0x34/0x130
    [] device_release+0x76/0x1e0
    [] kobject_release+0x107/0x370
    .....
    Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
    Allocated:
    [] save_stack_trace+0x2b/0x50
    [] save_stack+0x46/0xd0
    [] kasan_kmalloc+0xad/0xe0
    [] kmem_cache_alloc_trace+0xfa/0x240
    [] usb_alloc_dev+0x57/0xc90
    [] hub_event+0xf1d/0x35f0
    ....
    Freed:
    [] save_stack_trace+0x2b/0x50
    [] save_stack+0x46/0xd0
    [] kasan_slab_free+0x71/0xb0
    [] kfree+0xd9/0x280
    [] usb_release_dev+0xde/0x110
    [] device_release+0x76/0x1e0
    ....

    It's the code trying to clear drvdata of the assigned usb_device where
    the usb_device itself was already released in usb_release_dev() after
    the disconnect callback.

    This patch fixes it by checking whether the code path is via the
    disconnect callback, i.e. chip->shutdown flag is set.

    Fixes: 79289e24194a ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
    Reported-and-tested-by: Shuah Khan
    Cc: # v4.6+
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

27 Oct, 2016

1 commit

  • bdc3478f9   ALSA: usb-audio: Add quirk for Syntek STK1160 ... Browse Code »

    The stk1160 chip needs QUIRK_AUDIO_ALIGN_TRANSFER. This patch resolves
    the issue reported on the mailing list
    (http://marc.info/?l=linux-sound&m=139223599126215&w=2) and also fixes
    bug 180071 (https://bugzilla.kernel.org/show_bug.cgi?id=180071).

    Signed-off-by: Marcel Hasler
    Cc:
    Signed-off-by: Takashi Iwai

    Marcel Hasler
     

13 Oct, 2016

1 commit

10 Oct, 2016

1 commit

  • b907900ec   ALSA: line6: Fix POD X3 Live audio input ... Browse Code »

    The commit c039aaa77a7d1d9375665a8b59ec16dc7d23e259 was incomplete,
    missing part of the setup for Live. This makes also audio input work,
    in addition to audio output.

    Fixes: c039aaa77a7d1d9375665a8b59ec16dc7d23e259
    Reported-by: Eddi De Pieri
    Signed-off-by: Andrej Krutak
    Signed-off-by: Takashi Iwai

    Andrej Krutak
     

30 Sep, 2016

1 commit

26 Sep, 2016

1 commit

  • 8da08ca03   ALSA: usb-line6: use the same declaration as definition in header for MIDI manufacturer ID ... Browse Code »

    Currently, usb-line6 module exports an array of MIDI manufacturer ID and
    usb-pod module uses it. However, the declaration is not the definition in
    common header. The difference is explicit length of array. Although
    compiler calculates it and everything goes well, it's better to use the
    same representation between definition and declaration.

    This commit fills the length of array for usb-line6 module. As a small
    good sub-effect, this commit suppress below warnings from static analysis
    by sparse v0.5.0.

    sound/usb/line6/driver.c:274:43: error: cannot size expression
    sound/usb/line6/driver.c:275:16: error: cannot size expression
    sound/usb/line6/driver.c:276:16: error: cannot size expression
    sound/usb/line6/driver.c:277:16: error: cannot size expression

    Fixes: 705ececd1c60 ("Staging: add line6 usb driver")
    Signed-off-by: Takashi Sakamoto
    Signed-off-by: Takashi Iwai

    Takashi Sakamoto
     

23 Sep, 2016

1 commit

  • eb1a74b7b   ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants ... Browse Code »

    The DragonFly quirk added in 42e3121d90f4 ("ALSA: usb-audio: Add a more
    accurate volume quirk for AudioQuest DragonFly") applies a custom dB map
    on the volume control when its range is reported as 0..50 (0 .. 0.2dB).

    However, there exists at least one other variant (hw v1.0c, as opposed
    to the tested v1.2) which reports a different non-sensical volume range
    (0..53) and the custom map is therefore not applied for that device.

    This results in all of the volume change appearing close to 100% on
    mixer UIs that utilize the dB TLV information.

    Add a fallback case where no dB TLV is reported at all if the control
    range is not 0..50 but still 0..N where N
    Reported-by: David W
    Tested-by: David W
    Cc:
    Signed-off-by: Takashi Iwai

    Anssi Hannula
     

21 Sep, 2016

1 commit

  • 0da325afb   ALSA: line6: snd-usb-line6 depends on CONFIG_SND_HWDEP ... Browse Code »

    ERROR: "snd_hwdep_new" [sound/usb/line6/snd-usb-line6.ko] undefined!
    scripts/Makefile.modpost:91: recipe for target '__modpost' failed
    make[1]: *** [__modpost] Error 1

    Fixes: a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages')
    Signed-off-by: Valdis Kletnieks
    Reviewed-by: Takashi Sakamoto
    Signed-off-by: Takashi Iwai

    Valdis Kletnieks
     

20 Sep, 2016

13 commits

11 Sep, 2016

1 commit

29 Aug, 2016

1 commit

22 Aug, 2016

7 commits

  • 1bc00f32b   ALSA: usb-audio: rmove print for failure of kmalloc ... Browse Code »

    kmalloc already print similar error once failing to alloc
    enough memory, so let's remove this dump here.

    Signed-off-by: Shawn Lin
    Signed-off-by: Takashi Iwai

    Shawn Lin
     
  • 36e1ac3cf   ALSA: usb: fine-tune Tenor error compensation value ... Browse Code »

    Users of devices affected by the Tenor feedback data error report
    buffer underruns, even with the +/- 0x1.0000 quirk applied.
    Compensating the error with 0xf000 instead seems to reliably fix
    that issue.

    See

    https://sourceforge.net/p/alsa/mailman/message/35230259/

    Reported-and-tested-by: Norman Nolte
    Reported-and-tested-by: Thomas Gresens
    Signed-off-by: Daniel Mack
    Signed-off-by: Takashi Iwai

    Daniel Mack
     
  • ca0dd2736   ALSA: usb: use TEAC UD-H01 quirk for more devices ... Browse Code »

    The quirk seems to be necessary not only for TEAC UD-H01 devices, but to
    more that are based on the Tenor 8802TL chipset. Devices built by T+A
    are affected too, and they apparently all use the same USB PID:PID.

    Extend the quirky handling for that device as well, and rename the
    quirks flag.

    Reported-and-tested-by: Thomas Gresens
    Signed-off-by: Daniel Mack
    Signed-off-by: Takashi Iwai

    Daniel Mack
     
  • 9abc13416   ALSA: usb: move udh01_fb_quirk setting to quirks.c ... Browse Code »

    That's a quirk, after all, so move it where to all the other quirks
    live.

    Signed-off-by: Daniel Mack
    Signed-off-by: Takashi Iwai

    Daniel Mack
     
  • b027d1126   ALSA: line6: Fix POD sysfs attributes segfault ... Browse Code »

    The commit 02fc76f6a changed base of the sysfs attributes from device to card.
    The "show" callbacks dereferenced wrong objects because of this.

    Fixes: 02fc76f6a7db ('ALSA: line6: Create sysfs via snd_card_add_dev_attr()')
    Cc: # v4.0+
    Reviewed-by: Stefan Hajnoczi
    Signed-off-by: Andrej Krutak
    Signed-off-by: Takashi Iwai

    Andrej Krutak
     
  • adc8a43a6   ALSA: line6: Give up on the lock while URBs are released. ... Browse Code »

    Done, because line6_stream_stop() locks and calls line6_unlink_audio_urbs(),
    which in turn invokes audio_out_callback(), which tries to lock 2nd time.

    Fixes:

    =============================================
    [ INFO: possible recursive locking detected ]
    4.4.15+ #15 Not tainted
    ---------------------------------------------
    mplayer/3591 is trying to acquire lock:
    (&(&line6pcm->out.lock)->rlock){-.-...}, at: [] audio_out_callback+0x70/0x110 [snd_usb_line6]

    but task is already holding lock:
    (&(&line6pcm->out.lock)->rlock){-.-...}, at: [] line6_stream_stop+0x24/0x5c [snd_usb_line6]

    other info that might help us debug this:
    Possible unsafe locking scenario:

    CPU0
    ----
    lock(&(&line6pcm->out.lock)->rlock);
    lock(&(&line6pcm->out.lock)->rlock);

    *** DEADLOCK ***

    May be due to missing lock nesting notation

    3 locks held by mplayer/3591:
    #0: (snd_pcm_link_rwlock){.-.-..}, at: [] snd_pcm_stream_lock+0x1e/0x40 [snd_pcm]
    #1: (&(&substream->self_group.lock)->rlock){-.-...}, at: [] snd_pcm_stream_lock+0x26/0x40 [snd_pcm]
    #2: (&(&line6pcm->out.lock)->rlock){-.-...}, at: [] line6_stream_stop+0x24/0x5c [snd_usb_line6]

    stack backtrace:
    CPU: 0 PID: 3591 Comm: mplayer Not tainted 4.4.15+ #15
    Hardware name: Generic AM33XX (Flattened Device Tree)
    [] (unwind_backtrace) from [] (show_stack+0x11/0x14)
    [] (show_stack) from [] (dump_stack+0x8b/0xac)
    [] (dump_stack) from [] (__lock_acquire+0xc8b/0x1780)
    [] (__lock_acquire) from [] (lock_acquire+0x99/0x1c0)
    [] (lock_acquire) from [] (_raw_spin_lock_irqsave+0x3f/0x4c)
    [] (_raw_spin_lock_irqsave) from [] (audio_out_callback+0x70/0x110 [snd_usb_line6])
    [] (audio_out_callback [snd_usb_line6]) from [] (__usb_hcd_giveback_urb+0x53/0xd0)
    [] (__usb_hcd_giveback_urb) from [] (musb_giveback+0x3d/0x98)
    [] (musb_giveback) from [] (musb_urb_dequeue+0x6d/0x114)
    [] (musb_urb_dequeue) from [] (usb_hcd_unlink_urb+0x39/0x98)
    [] (usb_hcd_unlink_urb) from [] (line6_unlink_audio_urbs+0x6a/0x6c [snd_usb_line6])
    [] (line6_unlink_audio_urbs [snd_usb_line6]) from [] (line6_stream_stop+0x42/0x5c [snd_usb_line6])
    [] (line6_stream_stop [snd_usb_line6]) from [] (snd_line6_trigger+0xb6/0xf4 [snd_usb_line6])
    [] (snd_line6_trigger [snd_usb_line6]) from [] (snd_pcm_do_stop+0x36/0x38 [snd_pcm])
    [] (snd_pcm_do_stop [snd_pcm]) from [] (snd_pcm_action_single+0x22/0x40 [snd_pcm])
    [] (snd_pcm_action_single [snd_pcm]) from [] (snd_pcm_action+0xac/0xb0 [snd_pcm])
    [] (snd_pcm_action [snd_pcm]) from [] (snd_pcm_drop+0x38/0x64 [snd_pcm])
    [] (snd_pcm_drop [snd_pcm]) from [] (snd_pcm_common_ioctl1+0x7fe/0xbe8 [snd_pcm])
    [] (snd_pcm_common_ioctl1 [snd_pcm]) from [] (snd_pcm_playback_ioctl1+0x15c/0x51c [snd_pcm])
    [] (snd_pcm_playback_ioctl1 [snd_pcm]) from [] (snd_pcm_playback_ioctl+0x20/0x28 [snd_pcm])
    [] (snd_pcm_playback_ioctl [snd_pcm]) from [] (do_vfs_ioctl+0x3af/0x5c8)

    Fixes: 63e20df1e5b2 ('ALSA: line6: Reorganize PCM stream handling')
    Cc: # v4.0+
    Reviewed-by: Stefan Hajnoczi
    Signed-off-by: Andrej Krutak
    Signed-off-by: Takashi Iwai

    Andrej Krutak
     
  • 7e4379eae   ALSA: line6: Remove double line6_pcm_release() after failed acquire. ... Browse Code »

    If there's an error, pcm is released in line6_pcm_acquire already.

    Fixes: 247d95ee6dd2 ('ALSA: line6: Handle error from line6_pcm_acquire()')
    Cc: # v4.0+
    Reviewed-by: Stefan Hajnoczi
    Signed-off-by: Andrej Krutak
    Signed-off-by: Takashi Iwai

    Andrej Krutak
     

12 Aug, 2016

1 commit

09 Aug, 2016

2 commits

25 Jul, 2016

1 commit

18 Jul, 2016

1 commit

  • 76df52969   ALSA: usb-audio: Fix quirks code is not called ... Browse Code »

    snd_usb_{set_interface,ctl_msg}_quirk checks chip->usb_id to need
    calling a quirks code. But existed code path that not calling
    dev_set_drvdata in usb_audio_probe.

    Fixes: 79289e24194a ("ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation")
    Signed-off-by: Kazuki Oikawa
    Cc: # v4.6+
    Reviewed-by: Takashi Sakamoto
    Tested-by: Takashi Sakamoto
    Signed-off-by: Takashi Iwai

    Kazuki Oikawa
     

17 Jun, 2016

1 commit

  • e5c532787   ALSA: usb-audio: Change structure initialisation to C99 style ... Browse Code »

    To allow for structure randomisation, replace the in order struct
    initialisation style with explicit field style.

    The Coccinelle semantic patch used to make this change is as follows:

    @decl@
    identifier i1,fld;
    type T;
    field list[n] fs;
    @@

    struct i1 {
    fs
    T fld;
    ...};

    @@
    identifier decl.i1,i2,decl.fld;
    expression e;
    position bad.p, bad.fix;
    @@

    struct i1 i2@p = { ...,
    + .fld = e
    - e@fix
    ,...};

    Signed-off-by: Amitoj Kaur Chawla
    Signed-off-by: Takashi Iwai

    Amitoj Kaur Chawla
     

16 May, 2016

1 commit

12 May, 2016

1 commit

10 May, 2016

1 commit

08 May, 2016

1 commit