1. 06 12月, 2016 2 次提交
  2. 05 12月, 2016 1 次提交
    • T
      ALSA: usb-audio: Fix race at stopping the stream · 16200948
      Takashi Iwai 提交于
      We've got a kernel crash report showing like:
      
        Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = a1d7c000
        [00000008] *pgd=31c93831, *pte=00000000, *ppte=00000000
        Internal error: Oops: 17 [#1] PREEMPT SMP ARM
        CPU: 0 PID: 250 Comm: dbus-daemon Not tainted 3.14.51-03479-gf50bdf4 #1
        task: a3ae61c0 ti: a08c8000 task.ti: a08c8000
        PC is at retire_capture_urb+0x10/0x1f4 [snd_usb_audio]
        LR is at snd_complete_urb+0x140/0x1f0 [snd_usb_audio]
        pc : [<7f0eb22c>]    lr : [<7f0e57fc>]    psr: 200e0193
        sp : a08c9c98  ip : a08c9ce8  fp : a08c9ce4
        r10: 0000000a  r9 : 00000102  r8 : 94cb3000
        r7 : 94cb3000  r6 : 94d0f000  r5 : 94d0e8e8  r4 : 94d0e000
        r3 : 7f0eb21c  r2 : 00000000  r1 : 94cb3000  r0 : 00000000
        Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
        Control: 10c5387d  Table: 31d7c04a  DAC: 00000015
        Process dbus-daemon (pid: 250, stack limit = 0xa08c8238)
        Stack: (0xa08c9c98 to 0xa08ca000)
        ...
        Backtrace:
        [<7f0eb21c>] (retire_capture_urb [snd_usb_audio]) from [<7f0e57fc>] (snd_complete_urb+0x140/0x1f0 [snd_usb_audio])
        [<7f0e56bc>] (snd_complete_urb [snd_usb_audio]) from [<80371118>] (__usb_hcd_giveback_urb+0x78/0xf4)
        [<803710a0>] (__usb_hcd_giveback_urb) from [<80371514>] (usb_giveback_urb_bh+0x8c/0xc0)
        [<80371488>] (usb_giveback_urb_bh) from [<80028e3c>] (tasklet_hi_action+0xc4/0x148)
        [<80028d78>] (tasklet_hi_action) from [<80028358>] (__do_softirq+0x190/0x380)
        [<800281c8>] (__do_softirq) from [<80028858>] (irq_exit+0x8c/0xfc)
        [<800287cc>] (irq_exit) from [<8000ea88>] (handle_IRQ+0x8c/0xc8)
        [<8000e9fc>] (handle_IRQ) from [<800085e8>] (gic_handle_irq+0xbc/0xf8)
        [<8000852c>] (gic_handle_irq) from [<80509044>] (__irq_svc+0x44/0x78)
        [<80508820>] (_raw_spin_unlock_irq) from [<8004b880>] (finish_task_switch+0x5c/0x100)
        [<8004b824>] (finish_task_switch) from [<805052f0>] (__schedule+0x48c/0x6d8)
        [<80504e64>] (__schedule) from [<805055d4>] (schedule+0x98/0x9c)
        [<8050553c>] (schedule) from [<800116c8>] (do_work_pending+0x30/0xd0)
        [<80011698>] (do_work_pending) from [<8000e160>] (work_pending+0xc/0x20)
        Code: e1a0c00d e92ddff0 e24cb004 e24dd024 (e5902008)
        Kernel panic - not syncing: Fatal exception in interrupt
      
      There is a race between retire_capture_urb() and stop_endpoints().
      The latter is called at stopping the stream and it sets some endpoint
      fields to NULL.  But its call is asynchronous, thus the pending
      complete callback might get called after these NULL clears, and it
      leads the NULL dereference like the above.
      
      The fix is to move the NULL clearance after the synchronization,
      i.e. wait_clear_urbs().  This is called at prepare and hw_free
      callbacks, so it's assured to be called before the restart of the
      stream or the release of the stream.
      
      Also, while we're at it, put the EP_FLAG_RUNNING flag check at the
      beginning of snd_complete_urb() to skip the pending complete after the
      stream is stopped.
      
      Fixes: b2eb950d ("ALSA: usb-audio: stop both data and sync...")
      Reported-by: NJiada Wang <jiada_wang@mentor.com>
      Reported-by: NMark Craske <Mark_Craske@mentor.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      16200948
  3. 25 11月, 2016 1 次提交
  4. 24 11月, 2016 2 次提交
  5. 15 11月, 2016 1 次提交
    • T
      ALSA: usb-audio: Fix use-after-free of usb_device at disconnect · 6ff1a253
      Takashi Iwai 提交于
      The usb-audio driver implements the deferred device disconnection for
      the device in use.  In this mode, the disconnection callback returns
      immediately while the actual ALSA card object removal happens later
      when all files get closed.  As Shuah reported, this code flow,
      however, leads to a use-after-free, detected by KASAN:
      
       BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
       Write of size 8 by task pulseaudio/2244
       Call Trace:
        [<ffffffff81b31473>] dump_stack+0x67/0x94
        [<ffffffff81564ef1>] kasan_object_err+0x21/0x70
        [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
        [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
        [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
        [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
        [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
        [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
        [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
        [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
        [<ffffffff8242cae4>] release_card_device+0x34/0x130
        [<ffffffff81ef1846>] device_release+0x76/0x1e0
        [<ffffffff81b37ad7>] kobject_release+0x107/0x370
        .....
       Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
       Allocated:
        [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
        [<ffffffff81564296>] save_stack+0x46/0xd0
        [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
        [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
        [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
        [<ffffffff8216349d>] hub_event+0xf1d/0x35f0
        ....
       Freed:
        [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
        [<ffffffff81564296>] save_stack+0x46/0xd0
        [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
        [<ffffffff81560929>] kfree+0xd9/0x280
        [<ffffffff8214de6e>] usb_release_dev+0xde/0x110
        [<ffffffff81ef1846>] device_release+0x76/0x1e0
        ....
      
      It's the code trying to clear drvdata of the assigned usb_device where
      the usb_device itself was already released in usb_release_dev() after
      the disconnect callback.
      
      This patch fixes it by checking whether the code path is via the
      disconnect callback, i.e. chip->shutdown flag is set.
      
      Fixes: 79289e24 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
      Reported-and-tested-by: NShuah Khan <shuahkh@osg.samsung.com>
      Cc: <stable@vger.kernel.org> # v4.6+
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      6ff1a253
  6. 11 11月, 2016 1 次提交
    • T
      ALSA: hda - Fix mic regression by ASRock mobo fixup · 9a254191
      Takashi Iwai 提交于
      The commit [1a3f0991: ALSA: hda - Fix surround output pins for
      ASRock B150M mobo] introduced a fixup of pin configs for ASRock
      mobos to fix the surround outputs.  However, this overrides the pin
      configs of the mic pins as if they are outputs-only, effectively
      disabling the mic inputs.  Of course, it's a regression wrt mic
      functionality.
      
      Actually the pins 0x18 and 0x1a don't need to be changed; we just need
      to disable the bogus pins 0x14 and 0x15.  Then the auto-parser will
      pick up mic pins as switchable and assign the surround outputs there.
      
      This patch removes the incorrect pin overrides of NID 0x18 and 0x1a
      from the ASRock fixup.
      
      Fixes: 1a3f0991 ('ALSA: hda - Fix surround output pins for ASRock...')
      Reported-and-tested-by: NVitor Antunes <vitor.hda@gmail.com>
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=187431
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      9a254191
  7. 10 11月, 2016 1 次提交
  8. 08 11月, 2016 2 次提交
    • T
      ALSA: info: Return error for invalid read/write · 6809cd68
      Takashi Iwai 提交于
      Currently the ALSA proc handler allows read or write even if the proc
      file were write-only or read-only.  It's mostly harmless, does thing
      but allocating memory and ignores the input/output.  But it doesn't
      tell user about the invalid use, and it's confusing and inconsistent
      in comparison with other proc files.
      
      This patch adds some sanity checks and let the proc handler returning
      an -EIO error when the invalid read/write is performed.
      
      Cc: <stable@vger.kernel.org> # v4.2+
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      6809cd68
    • T
      ALSA: info: Limit the proc text input size · 027a9fe6
      Takashi Iwai 提交于
      The ALSA proc handler allows currently the write in the unlimited size
      until kmalloc() fails.  But basically the write is supposed to be only
      for small inputs, mostly for one line inputs, and we don't have to
      handle too large sizes at all.  Since the kmalloc error results in the
      kernel warning, it's better to limit the size beforehand.
      
      This patch adds the limit of 16kB, which must be large enough for the
      currently existing code.
      
      Cc: stable@vger.kernel.org # v4.2+
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      027a9fe6
  9. 02 11月, 2016 2 次提交
  10. 01 11月, 2016 2 次提交
  11. 31 10月, 2016 1 次提交
    • C
      ASoC: sun4i-codec: return error code instead of NULL when create_card fails · 85915b63
      Chen-Yu Tsai 提交于
      When sun4i_codec_create_card fails, we do not assign a proper error
      code to the return value. The return value would be 0 from the previous
      function call, or we would have bailed out sooner. This would confuse
      the driver core into thinking the device probe succeeded, when in fact
      it didn't, leaving various devres based resources lingering.
      
      Make the create_card function pass back a meaningful error code, and
      assign it to the return value.
      
      Fixes: 45fb6b6f ("ASoC: sunxi: add support for the on-chip codec on
      		      early Allwinner SoCs")
      Signed-off-by: NChen-Yu Tsai <wens@csie.org>
      Signed-off-by: NMark Brown <broonie@kernel.org>
      85915b63
  12. 29 10月, 2016 4 次提交
  13. 27 10月, 2016 1 次提交
  14. 26 10月, 2016 2 次提交
  15. 25 10月, 2016 4 次提交
  16. 24 10月, 2016 2 次提交
  17. 20 10月, 2016 1 次提交
  18. 18 10月, 2016 3 次提交
  19. 13 10月, 2016 4 次提交
  20. 12 10月, 2016 2 次提交
    • M
      treewide: remove redundant #include <linux/kconfig.h> · 97139d4a
      Masahiro Yamada 提交于
      Kernel source files need not include <linux/kconfig.h> explicitly
      because the top Makefile forces to include it with:
      
        -include $(srctree)/include/linux/kconfig.h
      
      This commit removes explicit includes except the following:
      
        * arch/s390/include/asm/facilities_src.h
        * tools/testing/radix-tree/linux/kernel.h
      
      These two are used for host programs.
      
      Link: http://lkml.kernel.org/r/1473656164-11929-1-git-send-email-yamada.masahiro@socionext.comSigned-off-by: NMasahiro Yamada <yamada.masahiro@socionext.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      97139d4a
    • P
      kthread: kthread worker API cleanup · 3989144f
      Petr Mladek 提交于
      A good practice is to prefix the names of functions by the name
      of the subsystem.
      
      The kthread worker API is a mix of classic kthreads and workqueues.  Each
      worker has a dedicated kthread.  It runs a generic function that process
      queued works.  It is implemented as part of the kthread subsystem.
      
      This patch renames the existing kthread worker API to use
      the corresponding name from the workqueues API prefixed by
      kthread_:
      
      __init_kthread_worker()		-> __kthread_init_worker()
      init_kthread_worker()		-> kthread_init_worker()
      init_kthread_work()		-> kthread_init_work()
      insert_kthread_work()		-> kthread_insert_work()
      queue_kthread_work()		-> kthread_queue_work()
      flush_kthread_work()		-> kthread_flush_work()
      flush_kthread_worker()		-> kthread_flush_worker()
      
      Note that the names of DEFINE_KTHREAD_WORK*() macros stay
      as they are. It is common that the "DEFINE_" prefix has
      precedence over the subsystem names.
      
      Note that INIT() macros and init() functions use different
      naming scheme. There is no good solution. There are several
      reasons for this solution:
      
        + "init" in the function names stands for the verb "initialize"
          aka "initialize worker". While "INIT" in the macro names
          stands for the noun "INITIALIZER" aka "worker initializer".
      
        + INIT() macros are used only in DEFINE() macros
      
        + init() functions are used close to the other kthread()
          functions. It looks much better if all the functions
          use the same scheme.
      
        + There will be also kthread_destroy_worker() that will
          be used close to kthread_cancel_work(). It is related
          to the init() function. Again it looks better if all
          functions use the same naming scheme.
      
        + there are several precedents for such init() function
          names, e.g. amd_iommu_init_device(), free_area_init_node(),
          jump_label_init_type(),  regmap_init_mmio_clk(),
      
        + It is not an argument but it was inconsistent even before.
      
      [arnd@arndb.de: fix linux-next merge conflict]
       Link: http://lkml.kernel.org/r/20160908135724.1311726-1-arnd@arndb.de
      Link: http://lkml.kernel.org/r/1470754545-17632-3-git-send-email-pmladek@suse.comSuggested-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NPetr Mladek <pmladek@suse.com>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
      Cc: Josh Triplett <josh@joshtriplett.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Jiri Kosina <jkosina@suse.cz>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: Michal Hocko <mhocko@suse.cz>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3989144f
  21. 11 10月, 2016 1 次提交