1. 28 Apr, 2019 3 commits
    • Wenwen Wang's avatar
      ALSA: usb-audio: Fix a memory leak bug · cb517359
      Wenwen Wang authored
      In parse_audio_selector_unit(), the string array 'namelist' is allocated
      through kmalloc_array(), and each string pointer in this array, i.e.,
      'namelist[]', is allocated through kmalloc() in the following for loop.
      Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
      an error occurs during the creation process, the string array 'namelist',
      including all string pointers in the array 'namelist[]', should be freed,
      before the error code ENOMEM is returned. However, the current code does
      not free 'namelist[]', resulting in memory leaks.
      
      To fix the above issue, free all string pointers 'namelist[]' in a loop.
      Signed-off-by: default avatarWenwen Wang <wang6495@umn.edu>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      cb517359
    • Fuqian Huang's avatar
      ALSA: gus: fix misuse of %x · 4ab1ae34
      Fuqian Huang authored
      Pointers should be printed with %p or %px rather than
      cast to long type and printed with %lx.
      Drop the address printing.
      Signed-off-by: default avatarFuqian Huang <huangfq.daxian@gmail.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      4ab1ae34
    • Kailang Yang's avatar
      ALSA: hda/realtek - EAPD turn on later · 607ca3bd
      Kailang Yang authored
      Let EAPD turn on after set pin output.
      
      [ NOTE: This change is supposed to reduce the possible click noises at
        (runtime) PM resume.  The functionality should be same (i.e. the
        verbs are executed correctly) no matter which order is, so this
        should be safe to apply for all codecs -- tiwai ]
      Signed-off-by: default avatarKailang Yang <kailang@realtek.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      607ca3bd
  2. 24 Apr, 2019 1 commit
  3. 17 Apr, 2019 3 commits
    • YueHaibing's avatar
      ALSA: ps3: Remove set but not used variables 'start_vaddr' and 'pcm_index' · 442e321e
      YueHaibing authored
      Fixes gcc '-Wunused-but-set-variable' warnings:
      
      sound/ppc/snd_ps3.c: In function 'snd_ps3_program_dma':
      sound/ppc/snd_ps3.c:236:8: warning: variable 'start_vaddr' set but not used [-Wunused-but-set-variable]
      sound/ppc/snd_ps3.c: In function 'snd_ps3_pcm_open':
      sound/ppc/snd_ps3.c:529:6: warning: variable 'pcm_index' set but not used [-Wunused-but-set-variable]
      
      They are never used and can be removed.
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
      Acked-by: default avatarGeoff Levand <geoff@infradead.org>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      442e321e
    • Takashi Iwai's avatar
      ALSA: core: Don't refer to snd_cards array directly · f4fa9689
      Takashi Iwai authored
      The snd_cards[] array holds the card pointers that have been currently
      registered, and it's exported for the external modules that may need
      to refer a card object.  But accessing to this array can be racy
      against the driver probe or removal, as the card registration or free
      may happen concurrently.
      
      This patch gets rid of the direct access to snd_cards[] array and
      provides a helper function to give the card object from the index
      number with a refcount management.  Then the caller can access to the
      given card object safely, and releases it via snd_card_unref().
      
      While we're at it, add a proper comment to snd_card_unref() and make
      it an inlined function for type-safety, too.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      f4fa9689
    • Takashi Iwai's avatar
      ALSA: emu10k1: Drop superfluous id-uniquification behavior · c9899549
      Takashi Iwai authored
      The emu10k1 driver tries to create a unique id string by itself when
      it's copied from the card list, but it's rather superfluous, as the
      same thing will be done in ALSA core side at the card registration.
      Let's drop the code.  This allows us removing snd_cards export.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      c9899549
  4. 15 Apr, 2019 2 commits
    • Takashi Iwai's avatar
      ALSA: seq: Correct unlock sequence at snd_seq_client_ioctl_unlock() · b5fd12d6
      Takashi Iwai authored
      The doubly unlock sequence at snd_seq_client_ioctl_unlock() is tricky.
      I took a direct unref call since I thought it would avoid
      misunderstanding, but rather this seems more confusing.  Let's use
      snd_seq_client_unlock() consistently even if they look strange to be
      called twice, and add more comments for avoiding reader's confusion.
      
      Fixes: 6b580f52 ("ALSA: seq: Protect racy pool manipulation from OSS sequencer")
      Reviewed-by: default avatarKai Vehmanen <kai.vehmanen@linux.intel.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      b5fd12d6
    • Roope Salmi's avatar
      ALSA: usb-audio: Add quirk for Focusrite Scarlett Solo · 46f5710f
      Roope Salmi authored
      The device reports Synch: Synchronous on the playback interface.
      This causes regular audible napping on sample rates that are not multiples
      of 1 kHz. Fix to Synch: Asynchronous.
      
      Specifically observed on Focusrite Scarlett Solo 2nd generation. I assume
      the first generation model has a different device ID. A first generation
      Scarlett 2i2 I was able to test advertised Synch: Asynchronous by default.
      
      For example, with a sample rate of 44100 Hz, a silent sample is played
      every 40.96 seconds (likely 44.0 samples instead of 44.1 transmitted per
      USB frame on average, 4096 being the size of some internal buffer).
      There may be some other bug at play here since this doesn't happen
      on other platforms. However, a feedback endpoint is listed and using it
      fixes the issue. That is the only change in the quirk,
      but I didn't find a way to declare only it.
      
      Tested on two units and on two different computers.
      Signed-off-by: default avatarRoope Salmi <rpsalmi@gmail.com>
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      46f5710f
  5. 13 Apr, 2019 3 commits
  6. 12 Apr, 2019 3 commits
    • Takashi Iwai's avatar
      ALSA: seq: Protect racy pool manipulation from OSS sequencer · 6b580f52
      Takashi Iwai authored
      OSS sequencer emulation still allows to queue and issue the events
      that manipulate the client pool concurrently in a racy way.  This
      patch serializes the access like the normal sequencer write / ioctl
      via taking the client ioctl_mutex.  Since the access to the sequencer
      client is done indirectly via a client id number, a new helper to
      take/release the mutex is introduced.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      6b580f52
    • Takashi Iwai's avatar
      ALSA: seq: Simplify snd_seq_kernel_client_enqueue() helper · 6740ea67
      Takashi Iwai authored
      We have two helpers for queuing a sequencer event from the kernel
      client, and both are used only from OSS sequencer layer without any
      hop and atomic set.  Let's simplify and unify two helpers into one.
      
      No functional change, just a call pattern change.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      6740ea67
    • Takashi Iwai's avatar
      ALSA: seq: Cover unsubscribe_port() in list_mutex · 7c32ae35
      Takashi Iwai authored
      The call of unsubscribe_port() which manages the group count and
      module refcount from delete_and_unsubscribe_port() looks racy; it's
      not covered by the group list lock, and it's likely a cause of the
      reported unbalance at port deletion.  Let's move the call inside the
      group list_mutex to plug the hole.
      
      Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      7c32ae35
  7. 11 Apr, 2019 2 commits
    • Takashi Iwai's avatar
      Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex" · f0654ba9
      Takashi Iwai authored
      This reverts commit feb68902.
      
      The fix attempt was incorrect, leading to the mutex deadlock through
      the close of OSS sequencer client.  The proper fix needs more
      consideration, so let's revert it now.
      
      Fixes: feb68902 ("ALSA: seq: Protect in-kernel ioctl calls with mutex")
      Reported-by: syzbot+47ded6c0f23016cde310@syzkaller.appspotmail.com
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      f0654ba9
    • Takashi Iwai's avatar
      Merge tag 'asoc-fix-v5.1-rc4' of... · 9b0dcd0e
      Takashi Iwai authored
      Merge tag 'asoc-fix-v5.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
      
      ASoC: Fixes for v5.1
      
      A few core fixes along with the driver specific ones, mainly fixing
      small issues that only affect x86 platforms for various reasons (their
      unusual machine enumeration mechanisms mainly, plus a fix for error
      handling in topology).
      
      There's some of the driver fixes that look larger than they are, like
      the hdmi-codec changes which resulted in an indentation change, and most
      of the other large changes are for new drivers like the STM32 changes.
      9b0dcd0e
  8. 10 Apr, 2019 7 commits
  9. 09 Apr, 2019 6 commits
    • Takashi Iwai's avatar
      ALSA: seq: Fix race of get-subscription call vs port-delete ioctls · 2eabc5ec
      Takashi Iwai authored
      The snd_seq_ioctl_get_subscription() retrieves the port subscriber
      information as a pointer, while the object isn't protected, hence it
      may be deleted before the actual reference.  This race was spotted by
      syzkaller and may lead to a UAF.
      
      The fix is simply copying the data in the lookup function that
      performs in the rwsem to protect against the deletion.
      
      Reported-by: syzbot+9437020c82413d00222d@syzkaller.appspotmail.com
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      2eabc5ec
    • Takashi Iwai's avatar
      ALSA: seq: Protect in-kernel ioctl calls with mutex · feb68902
      Takashi Iwai authored
      ALSA OSS sequencer calls the ioctl function indirectly via
      snd_seq_kernel_client_ctl().  While we already applied the protection
      against races between the normal ioctls and writes via the client's
      ioctl_mutex, this code path was left untouched.  And this seems to be
      the cause of still remaining some rare UAF as spontaneously triggered
      by syzkaller.
      
      For the sake of robustness, wrap the ioctl_mutex also for the call via
      snd_seq_kernel_client_ctl(), too.
      
      Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      feb68902
    • Takashi Iwai's avatar
      ALSA: seq: Remove superfluous irqsave flags · f823b8a7
      Takashi Iwai authored
      spin_lock_irqsave() is used unnecessarily in various places in
      sequencer core code although it's pretty obvious that the context is
      sleepable.  Remove irqsave and use the plain spin_lock_irq() in such
      places for simplicity.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      f823b8a7
    • Takashi Iwai's avatar
      ALSA: seq: Align temporary re-locking with irqsave version · 4b24b960
      Takashi Iwai authored
      In a few places in sequencer core, we temporarily unlock / re-lock the
      pool spin lock while waiting for the allocation in the blocking mode.
      There spin_unlock_irq() / spin_lock_irq() pairs are called while
      initially spin_lock_irqsave() is used (and spin_lock_irqrestore() at
      the end of the function again).  This is likely OK for now, but it's a
      bit confusing and error-prone.
      
      This patch replaces these temporary relocking lines with the irqsave
      variant to make the lock/unlock sequence more consistently.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      4b24b960
    • Takashi Iwai's avatar
      ALSA: seq: Use kvmalloc() for cell pools · fd7ae83d
      Takashi Iwai authored
      Use kvmalloc() for allocating cell pools since the pool size can be
      relatively small that may be covered better by slab.
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      fd7ae83d
    • Takashi Iwai's avatar
      ALSA: timer: Revert active callback sync check at close · df55531b
      Takashi Iwai authored
      This is essentially a revert of the commit a7588c89 ("ALSA: timer:
      Check ack_list emptiness instead of bit flag").  The intended change
      by the commit turns out to be insufficient, as snd_timer_close*()
      always calls snd_timer_stop() that deletes the ack_list beforehand.
      
      In theory, we can change the behavior of snd_timer_stop() to sync the
      pending ack_list, but this will become a deadlock for the callback
      like sequencer that calls again snd_timer_stop() from itself.  So,
      reverting the change is a more straightforward solution.
      
      Fixes: a7588c89 ("ALSA: timer: Check ack_list emptiness instead of bit flag")
      Reported-by: syzbot+58813d77154713f4de15@syzkaller.appspotmail.com
      Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      df55531b
  10. 08 Apr, 2019 5 commits
  11. 05 Apr, 2019 3 commits
  12. 04 Apr, 2019 2 commits