Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'sound-4.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
"We've got quite a few fixes at this time, and all are stable patches.

syzkaller strikes back again (episode 19 or so), and we had to plug
some holes in ALSA core part (mostly timer).

In addition, a couple of FireWire audio fixes for the invalid copy
user calls in locks, and a few quirks for HD-audio and USB-audio as
usual are included"

* tag 'sound-4.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: rawmidi: Fix possible deadlock with virmidi registration
ALSA: timer: Fix zero-division by continue of uninitialized instance
ALSA: timer: fix NULL pointer dereference in read()/ioctl() race
ALSA: fireworks: accessing to user space outside spinlock
ALSA: firewire-tascam: accessing to user space outside spinlock
ALSA: hda - Enable subwoofer on Dell Inspiron 7559
ALSA: hda - Add headset mic quirk for Dell Inspiron 5468
ALSA: usb-audio: Add sample rate inquiry quirk for B850V3 CP2114
ALSA: timer: fix NULL pointer dereference on memory allocation failure
ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE

+119 -51
+3 -1
sound/core/rawmidi.c
··· 1633 1633 return -EBUSY; 1634 1634 } 1635 1635 list_add_tail(&rmidi->list, &snd_rawmidi_devices); 1636 + mutex_unlock(&register_mutex); 1636 1637 err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI, 1637 1638 rmidi->card, rmidi->device, 1638 1639 &snd_rawmidi_f_ops, rmidi, &rmidi->dev); 1639 1640 if (err < 0) { 1640 1641 rmidi_err(rmidi, "unable to register\n"); 1642 + mutex_lock(&register_mutex); 1641 1643 list_del(&rmidi->list); 1642 1644 mutex_unlock(&register_mutex); 1643 1645 return err; ··· 1647 1645 if (rmidi->ops && rmidi->ops->dev_register && 1648 1646 (err = rmidi->ops->dev_register(rmidi)) < 0) { 1649 1647 snd_unregister_device(&rmidi->dev); 1648 + mutex_lock(&register_mutex); 1650 1649 list_del(&rmidi->list); 1651 1650 mutex_unlock(&register_mutex); 1652 1651 return err; ··· 1680 1677 } 1681 1678 } 1682 1679 #endif /* CONFIG_SND_OSSEMUL */ 1683 - mutex_unlock(&register_mutex); 1684 1680 sprintf(name, "midi%d", rmidi->device); 1685 1681 entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root); 1686 1682 if (entry) {
+32 -2
sound/core/timer.c
··· 35 35 #include <sound/initval.h> 36 36 #include <linux/kmod.h> 37 37 38 + /* internal flags */ 39 + #define SNDRV_TIMER_IFLG_PAUSED 0x00010000 40 + 38 41 #if IS_ENABLED(CONFIG_SND_HRTIMER) 39 42 #define DEFAULT_TIMER_LIMIT 4 40 43 #else ··· 297 294 get_device(&timer->card->card_dev); 298 295 timeri->slave_class = tid->dev_sclass; 299 296 timeri->slave_id = slave_id; 300 - if (list_empty(&timer->open_list_head) && timer->hw.open) 301 - timer->hw.open(timer); 297 + 298 + if (list_empty(&timer->open_list_head) && timer->hw.open) { 299 + int err = timer->hw.open(timer); 300 + if (err) { 301 + kfree(timeri->owner); 302 + kfree(timeri); 303 + 304 + if (timer->card) 305 + put_device(&timer->card->card_dev); 306 + module_put(timer->module); 307 + mutex_unlock(&register_mutex); 308 + return err; 309 + } 310 + } 311 + 302 312 list_add_tail(&timeri->open_list, &timer->open_list_head); 303 313 snd_timer_check_master(timeri); 304 314 mutex_unlock(&register_mutex); ··· 542 526 } 543 527 } 544 528 timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START); 529 + if (stop) 530 + timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED; 531 + else 532 + timeri->flags |= SNDRV_TIMER_IFLG_PAUSED; 545 533 snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : 546 534 SNDRV_TIMER_EVENT_CONTINUE); 547 535 unlock: ··· 607 587 */ 608 588 int snd_timer_continue(struct snd_timer_instance *timeri) 609 589 { 590 + /* timer can continue only after pause */ 591 + if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED)) 592 + return -EINVAL; 593 + 610 594 if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) 611 595 return snd_timer_start_slave(timeri, false); 612 596 else ··· 837 813 timer->tmr_subdevice = tid->subdevice; 838 814 if (id) 839 815 strlcpy(timer->id, id, sizeof(timer->id)); 816 + timer->sticks = 1; 840 817 INIT_LIST_HEAD(&timer->device_list); 841 818 INIT_LIST_HEAD(&timer->open_list_head); 842 819 INIT_LIST_HEAD(&timer->active_list_head); ··· 1842 1817 tu = file->private_data; 1843 1818 if (!tu->timeri) 1844 1819 return -EBADFD; 1820 + /* start timer instead of continue if it's not used before */ 1821 + if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED)) 1822 + return snd_timer_user_start(file); 1845 1823 tu->timeri->lost = 0; 1846 1824 return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0; 1847 1825 } ··· 1986 1958 tu->qused--; 1987 1959 spin_unlock_irq(&tu->qlock); 1988 1960 1961 + mutex_lock(&tu->ioctl_lock); 1989 1962 if (tu->tread) { 1990 1963 if (copy_to_user(buffer, &tu->tqueue[qhead], 1991 1964 sizeof(struct snd_timer_tread))) ··· 1996 1967 sizeof(struct snd_timer_read))) 1997 1968 err = -EFAULT; 1998 1969 } 1970 + mutex_unlock(&tu->ioctl_lock); 1999 1971 2000 1972 spin_lock_irq(&tu->qlock); 2001 1973 if (err < 0)
-1
sound/firewire/fireworks/fireworks.h
··· 108 108 u8 *resp_buf; 109 109 u8 *pull_ptr; 110 110 u8 *push_ptr; 111 - unsigned int resp_queues; 112 111 }; 113 112 114 113 int snd_efw_transaction_cmd(struct fw_unit *unit,
+53 -20
sound/firewire/fireworks/fireworks_hwdep.c
··· 25 25 { 26 26 unsigned int length, till_end, type; 27 27 struct snd_efw_transaction *t; 28 + u8 *pull_ptr; 28 29 long count = 0; 29 30 30 31 if (remained < sizeof(type) + sizeof(struct snd_efw_transaction)) ··· 39 38 buf += sizeof(type); 40 39 41 40 /* write into buffer as many responses as possible */ 42 - while (efw->resp_queues > 0) { 43 - t = (struct snd_efw_transaction *)(efw->pull_ptr); 41 + spin_lock_irq(&efw->lock); 42 + 43 + /* 44 + * When another task reaches here during this task's access to user 45 + * space, it picks up current position in buffer and can read the same 46 + * series of responses. 47 + */ 48 + pull_ptr = efw->pull_ptr; 49 + 50 + while (efw->push_ptr != pull_ptr) { 51 + t = (struct snd_efw_transaction *)(pull_ptr); 44 52 length = be32_to_cpu(t->length) * sizeof(__be32); 45 53 46 54 /* confirm enough space for this response */ ··· 59 49 /* copy from ring buffer to user buffer */ 60 50 while (length > 0) { 61 51 till_end = snd_efw_resp_buf_size - 62 - (unsigned int)(efw->pull_ptr - efw->resp_buf); 52 + (unsigned int)(pull_ptr - efw->resp_buf); 63 53 till_end = min_t(unsigned int, length, till_end); 64 54 65 - if (copy_to_user(buf, efw->pull_ptr, till_end)) 55 + spin_unlock_irq(&efw->lock); 56 + 57 + if (copy_to_user(buf, pull_ptr, till_end)) 66 58 return -EFAULT; 67 59 68 - efw->pull_ptr += till_end; 69 - if (efw->pull_ptr >= efw->resp_buf + 70 - snd_efw_resp_buf_size) 71 - efw->pull_ptr -= snd_efw_resp_buf_size; 60 + spin_lock_irq(&efw->lock); 61 + 62 + pull_ptr += till_end; 63 + if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size) 64 + pull_ptr -= snd_efw_resp_buf_size; 72 65 73 66 length -= till_end; 74 67 buf += till_end; 75 68 count += till_end; 76 69 remained -= till_end; 77 70 } 78 - 79 - efw->resp_queues--; 80 71 } 72 + 73 + /* 74 + * All of tasks can read from the buffer nearly simultaneously, but the 75 + * last position for each task is different depending on the length of 76 + * given buffer. Here, for simplicity, a position of buffer is set by 77 + * the latest task. It's better for a listening application to allow one 78 + * thread to read from the buffer. Unless, each task can read different 79 + * sequence of responses depending on variation of buffer length. 80 + */ 81 + efw->pull_ptr = pull_ptr; 82 + 83 + spin_unlock_irq(&efw->lock); 81 84 82 85 return count; 83 86 } ··· 99 76 hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count, 100 77 loff_t *offset) 101 78 { 102 - union snd_firewire_event event; 79 + union snd_firewire_event event = { 80 + .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS, 81 + }; 103 82 104 - memset(&event, 0, sizeof(event)); 83 + spin_lock_irq(&efw->lock); 105 84 106 - event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; 107 85 event.lock_status.status = (efw->dev_lock_count > 0); 108 86 efw->dev_lock_changed = false; 87 + 88 + spin_unlock_irq(&efw->lock); 109 89 110 90 count = min_t(long, count, sizeof(event.lock_status)); 111 91 ··· 124 98 { 125 99 struct snd_efw *efw = hwdep->private_data; 126 100 DEFINE_WAIT(wait); 101 + bool dev_lock_changed; 102 + bool queued; 127 103 128 104 spin_lock_irq(&efw->lock); 129 105 130 - while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) { 106 + dev_lock_changed = efw->dev_lock_changed; 107 + queued = efw->push_ptr != efw->pull_ptr; 108 + 109 + while (!dev_lock_changed && !queued) { 131 110 prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE); 132 111 spin_unlock_irq(&efw->lock); 133 112 schedule(); ··· 140 109 if (signal_pending(current)) 141 110 return -ERESTARTSYS; 142 111 spin_lock_irq(&efw->lock); 112 + dev_lock_changed = efw->dev_lock_changed; 113 + queued = efw->push_ptr != efw->pull_ptr; 143 114 } 144 115 145 - if (efw->dev_lock_changed) 146 - count = hwdep_read_locked(efw, buf, count, offset); 147 - else if (efw->resp_queues > 0) 148 - count = hwdep_read_resp_buf(efw, buf, count, offset); 149 - 150 116 spin_unlock_irq(&efw->lock); 117 + 118 + if (dev_lock_changed) 119 + count = hwdep_read_locked(efw, buf, count, offset); 120 + else if (queued) 121 + count = hwdep_read_resp_buf(efw, buf, count, offset); 151 122 152 123 return count; 153 124 } ··· 193 160 poll_wait(file, &efw->hwdep_wait, wait); 194 161 195 162 spin_lock_irq(&efw->lock); 196 - if (efw->dev_lock_changed || (efw->resp_queues > 0)) 163 + if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr) 197 164 events = POLLIN | POLLRDNORM; 198 165 else 199 166 events = 0;
+2 -2
sound/firewire/fireworks/fireworks_proc.c
··· 188 188 else 189 189 consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr); 190 190 191 - snd_iprintf(buffer, "%d %d/%d\n", 192 - efw->resp_queues, consumed, snd_efw_resp_buf_size); 191 + snd_iprintf(buffer, "%d/%d\n", 192 + consumed, snd_efw_resp_buf_size); 193 193 } 194 194 195 195 static void
+2 -3
sound/firewire/fireworks/fireworks_transaction.c
··· 121 121 size_t capacity, till_end; 122 122 struct snd_efw_transaction *t; 123 123 124 - spin_lock_irq(&efw->lock); 125 - 126 124 t = (struct snd_efw_transaction *)data; 127 125 length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length); 126 + 127 + spin_lock_irq(&efw->lock); 128 128 129 129 if (efw->push_ptr < efw->pull_ptr) 130 130 capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr); ··· 155 155 } 156 156 157 157 /* for hwdep */ 158 - efw->resp_queues++; 159 158 wake_up(&efw->hwdep_wait); 160 159 161 160 *rcode = RCODE_COMPLETE;
+11 -22
sound/firewire/tascam/tascam-hwdep.c
··· 16 16 17 17 #include "tascam.h" 18 18 19 - static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf, 20 - long count) 21 - { 22 - union snd_firewire_event event; 23 - 24 - memset(&event, 0, sizeof(event)); 25 - 26 - event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; 27 - event.lock_status.status = (tscm->dev_lock_count > 0); 28 - tscm->dev_lock_changed = false; 29 - 30 - count = min_t(long, count, sizeof(event.lock_status)); 31 - 32 - if (copy_to_user(buf, &event, count)) 33 - return -EFAULT; 34 - 35 - return count; 36 - } 37 - 38 19 static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, 39 20 loff_t *offset) 40 21 { 41 22 struct snd_tscm *tscm = hwdep->private_data; 42 23 DEFINE_WAIT(wait); 43 - union snd_firewire_event event; 24 + union snd_firewire_event event = { 25 + .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS, 26 + }; 44 27 45 28 spin_lock_irq(&tscm->lock); 46 29 ··· 37 54 spin_lock_irq(&tscm->lock); 38 55 } 39 56 40 - memset(&event, 0, sizeof(event)); 41 - count = hwdep_read_locked(tscm, buf, count); 57 + event.lock_status.status = (tscm->dev_lock_count > 0); 58 + tscm->dev_lock_changed = false; 59 + 42 60 spin_unlock_irq(&tscm->lock); 61 + 62 + count = min_t(long, count, sizeof(event.lock_status)); 63 + 64 + if (copy_to_user(buf, &event, count)) 65 + return -EFAULT; 43 66 44 67 return count; 45 68 }
+15
sound/pci/hda/patch_realtek.c
··· 4855 4855 ALC221_FIXUP_HP_FRONT_MIC, 4856 4856 ALC292_FIXUP_TPT460, 4857 4857 ALC298_FIXUP_SPK_VOLUME, 4858 + ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER, 4858 4859 }; 4859 4860 4860 4861 static const struct hda_fixup alc269_fixups[] = { ··· 5517 5516 .chained = true, 5518 5517 .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, 5519 5518 }, 5519 + [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { 5520 + .type = HDA_FIXUP_PINS, 5521 + .v.pins = (const struct hda_pintbl[]) { 5522 + { 0x1b, 0x90170151 }, 5523 + { } 5524 + }, 5525 + .chained = true, 5526 + .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE 5527 + }, 5520 5528 }; 5521 5529 5522 5530 static const struct snd_pci_quirk alc269_fixup_tbl[] = { ··· 5570 5560 SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), 5571 5561 SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), 5572 5562 SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), 5563 + SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), 5573 5564 SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), 5574 5565 SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), 5575 5566 SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), ··· 5904 5893 {0x21, 0x02211030}), 5905 5894 SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, 5906 5895 {0x12, 0x90a60170}, 5896 + {0x14, 0x90170120}, 5897 + {0x21, 0x02211030}), 5898 + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, 5899 + {0x12, 0x90a60180}, 5907 5900 {0x14, 0x90170120}, 5908 5901 {0x21, 0x02211030}), 5909 5902 SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+1
sound/usb/quirks.c
··· 1141 1141 case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ 1142 1142 case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ 1143 1143 case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ 1144 + case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */ 1144 1145 case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */ 1145 1146 case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */ 1146 1147 case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */