Skip to content

K
Kernel

openeuler / Kernel
大约 1 年 前同步成功

通知 5
Star 0
Fork 0
K
Kernel

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 20 4月, 2018 1 次提交
    • T
      ALSA: rawmidi: Fix missing input substream checks in compat ioctls · 8a56ef4f
      由 Takashi Iwai 提交于 
      Some rawmidi compat ioctls lack of the input substream checks
(although they do check only for rfile->output).  This many eventually
lead to an Oops as NULL substream is passed to the rawmidi core
functions.

Fix it by adding the proper checks before each function call.

The bug was spotted by syzkaller.

Reported-by: syzbot+f7a0348affc3b67bc617@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      8a56ef4f
  3. 19 4月, 2018 2 次提交
  5. 16 4月, 2018 1 次提交
  7. 12 4月, 2018 1 次提交
    • F
      ALSA: line6: Use correct endpoint type for midi output · 7ecb46e9
      由 Fabián Inostroza 提交于 
      Sending MIDI messages to a PODxt through the USB connection shows
"usb_submit_urb failed" in dmesg and the message is not received by
the POD.

The error is caused because in the funcion send_midi_async() in midi.c
there is a call to usb_sndbulkpipe() for endpoint 3 OUT, but the PODxt
USB descriptor shows that this endpoint it's an interrupt endpoint.

Patch tested with PODxt only.

[ The bug has been present from the very beginning in the staging
  driver time, but Fixes below points to the commit moving to sound/
  directory so that the fix can be cleanly applied -- tiwai ]

Fixes: 61864d84 ("ALSA: move line6 usb driver into sound/usb")
Signed-off-by: NFabián Inostroza <fabianinostroza@udec.cl>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      7ecb46e9
  9. 09 4月, 2018 1 次提交
    • T
      ALSA: pcm: Remove WARN_ON() at snd_pcm_hw_params() error · e1a3a981
      由 Takashi Iwai 提交于 
      snd_pcm_hw_params() (more exactly snd_pcm_hw_params_choose()) contains
a check of the return error from snd_pcm_hw_param_first() and _last()
with snd_BUG_ON() -- i.e. it may trigger WARN_ON() depending on the
kconfig.

This was a valid check in the past, as these functions shouldn't
return any error if the parameters have been already refined via
snd_pcm_hw_refine() beforehand.  However, the recent rewrite
introduced a kmalloc() in snd_pcm_hw_refine() for removing VLA, and
this brought a possibility to trigger an error.  As a result, syzbot
caught lots of superfluous kernel WARN_ON() and paniced via fault
injection.

As the WARN_ON() is no longer valid with the introduction of
kmalloc(), let's drop snd_BUG_ON() check, in order to make the world
peaceful place again.

Reported-by: syzbot+803e0047ac3a3096bb4f@syzkaller.appspotmail.com
Fixes: 5730f9f7 ("ALSA: pcm: Remove VLA usage")
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      e1a3a981
  11. 07 4月, 2018 4 次提交
  13. 03 4月, 2018 1 次提交
    • T
      ALSA: pcm: Fix UAF at PCM release via PCM timer access · a820ccbe
      由 Takashi Iwai 提交于 
      The PCM runtime object is created and freed dynamically at PCM stream
open / close time.  This is tracked via substream->runtime, and it's
cleared at snd_pcm_detach_substream().

The runtime object assignment is protected by PCM open_mutex, so for
all PCM operations, it's safely handled.  However, each PCM substream
provides also an ALSA timer interface, and user-space can access to
this while closing a PCM substream.  This may eventually lead to a
UAF, as snd_pcm_timer_resolution() tries to access the runtime while
clearing it in other side.

Fortunately, it's the only concurrent access from the PCM timer, and
it merely reads runtime->timer_resolution field.  So, we can avoid the
race by reordering kfree() and wrapping the substream->runtime
clearance with the corresponding timer lock.

Reported-by: syzbot+8e62ff4e07aa2ce87826@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      a820ccbe
  15. 30 3月, 2018 1 次提交
  17. 29 3月, 2018 2 次提交
  19. 28 3月, 2018 4 次提交
  21. 27 3月, 2018 5 次提交
  23. 26 3月, 2018 2 次提交
  25. 24 3月, 2018 8 次提交
    • A
      ALSA: usb-audio: update clock valid control · 568fa7e0
      由 Andrew Chant 提交于 
      Make the "clock valid" control a global control instead of a mixer
so that it doesn't appear in mixer applications.

Additionally, remove the check for writeability prohibited by spec, and
Use common code to read the control value.

Tested with a UAC2 Audio device that presents a clock validity
control.  The control still shows up in /proc usbmixer but not
in alsamixer.
Signed-off-by: NAndrew Chant <achant@google.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      568fa7e0
    • A
      ALSA: usb-audio: UAC2 jack detection · 5a222e84
      由 Andrew Chant 提交于 
      This implements UAC2 jack detection support, presenting
jack status as a boolean read-only mono mixer.

The presence of any channel in the UAC2_TE_CONNECTOR
control for a terminal will result in the mixer saying
the jack is connected.

Mixer naming follows the convention in sound/core/ctljack.c,
terminating the mixer with " Jack".
For additional clues as to which jack is being presented,
the name is prefixed with " - Input Jack" or " - Output Jack"
depending on if it's an input or output terminal.

This is required because terminal names are ambiguous
between inputs and outputs and often duplicated -
Bidirectional terminal types (0x400 -> 0x4FF)
"... may be used separately for input only or output only.
These types require two Terminal descriptors. Both have the same type."
(quote from "USB Device Class Definition for Terminal Types")

Since bidirectional terminal types are common for headphone adapters,
this distinguishes between two otherwise identically-named
jack controls.

Tested with a UAC2 audio device with connector control capability.
Signed-off-by: NAndrew Chant <achant@google.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      5a222e84
    • T
      ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams · 40cab6e8
      由 Takashi Iwai 提交于 
      OSS PCM stream management isn't modal but it allows ioctls issued at
any time for changing the parameters.  In the previous hardening
patch ("ALSA: pcm: Avoid potential races between OSS ioctls and
read/write"), we covered these races and prevent the corruption by
protecting the concurrent accesses via params_lock mutex.  However,
this means that some ioctls that try to change the stream parameter
(e.g. channels or format) would be blocked until the read/write
finishes, and it may take really long.

Basically changing the parameter while reading/writing is an invalid
operation, hence it's even more user-friendly from the API POV if it
returns -EBUSY in such a situation.

This patch adds such checks in the relevant ioctls with the addition
of read/write access refcount.

Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      40cab6e8
    • T
      ALSA: pcm: Avoid potential races between OSS ioctls and read/write · 02a5d692
      由 Takashi Iwai 提交于 
      Although we apply the params_lock mutex to the whole read and write
operations as well as snd_pcm_oss_change_params(), we may still face
some races.

First off, the params_lock is taken inside the read and write loop.
This is intentional for avoiding the too long locking, but it allows
the in-between parameter change, which might lead to invalid
pointers.  We check the readiness of the stream and set up via
snd_pcm_oss_make_ready() at the beginning of read and write, but it's
called only once, by assuming that it remains ready in the rest.

Second, many ioctls that may change the actual parameters
(i.e. setting runtime->oss.params=1) aren't protected, hence they can
be processed in a half-baked state.

This patch is an attempt to plug these holes.  The stream readiness
check is moved inside the read/write inner loop, so that the stream is
always set up in a proper state before further processing.  Also, each
ioctl that may change the parameter is wrapped with the params_lock
for avoiding the races.

The issues were triggered by syzkaller in a few different scenarios,
particularly the one below appearing as GPF in loopback_pos_update.

Reported-by: syzbot+c4227aec125487ec3efa@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      02a5d692
    • N
      ALSA: usb-audio: Integrate native DSD support for ITF-USB based DACs. · f3b906d7
      由 Nobutaka Okabe 提交于 
      Integrate the native DSD support quirk codes of "ITF-USB DSD" based DACs.

Now, "is_itf_usb_dsd_2alts_dac()" and "is_itf_usb_dsd_3alts_dac()" is
integrated into one function "is_itf_usb_dsd_dac()".
So, remove the logic to distinguish UD-501 and UD-501V2 by the
"Product Name".

The integration is possible by changing the following two functions.

- snd_usb_select_mode_quirk():
Change the determination condition of the DSD mode switch command,
from the altset number being used, to the audio format being played.
Actually, this operation is same as playback using ASIO driver in
Windows environment.

- snd_usb_interface_dsd_format_quirk():
To which altset supports native DSD is determined by the number of altsets.
Previously, it's a constant "2" or "3".
Signed-off-by: NNobutaka Okabe <nob77413@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      f3b906d7
    • N
      ALSA: usb-audio: FIX native DSD support for TEAC UD-501 DAC · 74dc71f8
      由 Nobutaka Okabe 提交于 
      There are two versions of TEAC UD-501, the normal version and
the vendor updated version(UD-501V2).

They have the same VID/PID, but the num of the altsetting is different,
UD-501 has 2 altsets for stream, and UD-501V2 has 3.

So, add the logic to distinguish them by the Product Name, not by the PID.
Signed-off-by: NNobutaka Okabe <nob77413@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      74dc71f8
    • N
      ALSA: usb-audio: Add native DSD support for Luxman DA-06 · 71426535
      由 Nobutaka Okabe 提交于 
      Add native DSD support quirk for Luxman DA-06 DAC, by adding the
PID/VID 1852:5065.

Rename "is_marantz_denon_dac()" function to "is_itf_usb_dsd_2alts_dac()"
to cover broader device family sharing the same USB audio
implementation(*).
For the same reason, rename "is_teac_dsd_dac()" function to
"is_itf_usb_dsd_3alts_dac()".

(*)
These devices have the same USB controller "ITF-USB DSD", supplied by
INTERFACE Co., Ltd.
"ITF-USB DSD" USB controller has two patterns,

Pattern 1. (2 altsets version)
- Altset 0: for control
- Altset 1: for stream (S32)
- Altset 2: for stream (S32, DSD_U32)

Pattern 2. (3 altsets version)
- Altset 0: for control
- Altset 1: for stream (S16)
- Altset 2: for stream (S32)
- Altset 3: for stream (S32, DSD_U32)

"is_itf_usb_dsd_2alts_dac()" returns true, if the DAC has "Pattern 1"
USB controller, and "is_itf_usb_dsd_3alts_dac()" returns true, if
"Pattern2".
Signed-off-by: NNobutaka Okabe <nob77413@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      71426535
    • N
      ALSA: usb-audio: Add native DSD support for TEAC UD-301 · b0021486
      由 Nobutaka Okabe 提交于 
      Add native DSD support quirk for TEAC UD-301 DAC,
by adding the PID/VID 0644:804a.
Signed-off-by: NNobutaka Okabe <nob77413@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      b0021486
  27. 23 3月, 2018 1 次提交
    • A
      ALSA: usb-audio: fix uac control query argument · 21e9b3e9
      由 Andrew Chant 提交于 
      This patch fixes code readability and should have no functional change.

Correct uac control query functions to account for the 1-based indexing
of USB Audio Class control identifiers.

The function parameter, u8 control, should be the
constant defined in audio-v2.h to identify the control to be checked for
readability or writeability.

This patch fixes all callers that had adjusted, and makes explicit
the mapping between audio_feature_info[] array index and the associated
control identifier.
Signed-off-by: NAndrew Chant <achant@google.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      21e9b3e9
  29. 22 3月, 2018 5 次提交
    • T
      ALSA: aloop: Fix access to not-yet-ready substream via cable · 8e6b1a72
      由 Takashi Iwai 提交于 
      In loopback_open() and loopback_close(), we assign and release the
substream object to the corresponding cable in a racy way.  It's
neither locked nor done in the right position.  The open callback
assigns the substream before its preparation finishes, hence the other
side of the cable may pick it up, which may lead to the invalid memory
access.

This patch addresses these: move the assignment to the end of the open
callback, and wrap with cable->lock for avoiding concurrent accesses.

Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      8e6b1a72
    • T
      ALSA: aloop: Sync stale timer before release · 67a01afa
      由 Takashi Iwai 提交于 
      The aloop driver tries to stop the pending timer via timer_del() in
the trigger callback and in the close callback.  The former is
correct, as it's an atomic operation, while the latter expects that
the timer gets really removed and proceeds the resource releases after
that.  But timer_del() doesn't synchronize, hence the running timer
may still access the released resources.

A similar situation can be also seen in the prepare callback after
trigger(STOP) where the prepare tries to re-initialize the things
while a timer is still running.

The problems like the above are seen indirectly in some syzkaller
reports (although it's not 100% clear whether this is the only cause,
as the race condition is quite narrow and not always easy to
trigger).

For addressing these issues, this patch adds the explicit alls of
timer_del_sync() in some places, so that the pending timer is properly
killed / synced.

Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      67a01afa
    • K
      ALSA: hda/realtek - Fix speaker no sound after system resume · 88d42b2b
      由 Kailang Yang 提交于 
      It will have a chance speaker no sound after system resume.
To toggle NID 0x53 index 0x2 bit 15 will solve this issue.
This usage will also suitable with ALC256.

Fixes: 4a219ef8 ("ALSA: hda/realtek - Add ALC256 HP depop function")
Signed-off-by: NKailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      88d42b2b
    • K
      ALSA: hda/realtek - Fix Dell headset Mic can't record · f0ba9d69
      由 Kailang Yang 提交于 
      This platform was hardware fixed type for CTIA type for headset port.
Assigned 0x19 verb will fix can't record issue.
Signed-off-by: NKailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      f0ba9d69
    • J
      ASoC: nau8824: recover system clock when device changes · b53117c0
      由 John Hsu 提交于 
      User reports an issue in Ubuntu about the device switch upon playback.
We find the FLL will disalbe when switching headphone to speaker.
The pulseaudio will stop the headphone and close its power. Then,
it just opens the speaker and turn on its power. Therefore,
the supply of system clock does the OFF event and disables FLL.
But the FLL doesn't enable again when the speaker powers on.

The patch adds the recovery of system clock to enable FLL again
for this case. And it covers the case that system clock from MCLK.
Signed-off-by: NJohn Hsu <KCHSU0@nuvoton.com>
Signed-off-by: NMark Brown <broonie@kernel.org>
      b53117c0
  31. 21 3月, 2018 1 次提交
    • R
      ALSA: usb: initial USB Audio Device Class 3.0 support · 9a2fe9b8
      由 Ruslan Bilovol 提交于 
      Recently released USB Audio Class 3.0 specification
introduces many significant changes comparing to
previous versions, like
 - new Power Domains, support for LPM/L1
 - new Cluster descriptor
 - changed layout of all class-specific descriptors
 - new High Capability descriptors
 - New class-specific String descriptors
 - new and removed units
 - additional sources for interrupts
 - removed Type II Audio Data Formats
 - ... and many other things (check spec)

It also provides backward compatibility through
multiple configurations, as well as requires
mandatory support for BADD (Basic Audio Device
Definition) on each ADC3.0 compliant device

This patch adds initial support of UAC3 specification
that is enough for Generic I/O Profile (BAOF, BAIF)
device support from BADD document.
Signed-off-by: NRuslan Bilovol <ruslan.bilovol@gmail.com>
Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      9a2fe9b8