Skip to content

R
raspberrypi-kernel

openeuler / raspberrypi-kernel

通知 13
Star 1
Fork 0
R
raspberrypi-kernel
切换分支/标签
  1. 15 11月, 2016 1 次提交
    • T
      ALSA: usb-audio: Fix use-after-free of usb_device at disconnect · 6ff1a253
      由 Takashi Iwai 提交于 
      The usb-audio driver implements the deferred device disconnection for
the device in use.  In this mode, the disconnection callback returns
immediately while the actual ALSA card object removal happens later
when all files get closed.  As Shuah reported, this code flow,
however, leads to a use-after-free, detected by KASAN:

 BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
 Write of size 8 by task pulseaudio/2244
 Call Trace:
  [<ffffffff81b31473>] dump_stack+0x67/0x94
  [<ffffffff81564ef1>] kasan_object_err+0x21/0x70
  [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
  [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
  [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
  [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
  [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
  [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
  [<ffffffff8242cae4>] release_card_device+0x34/0x130
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  [<ffffffff81b37ad7>] kobject_release+0x107/0x370
  .....
 Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
 Allocated:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
  [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
  [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
  [<ffffffff8216349d>] hub_event+0xf1d/0x35f0
  ....
 Freed:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
  [<ffffffff81560929>] kfree+0xd9/0x280
  [<ffffffff8214de6e>] usb_release_dev+0xde/0x110
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  ....

It's the code trying to clear drvdata of the assigned usb_device where
the usb_device itself was already released in usb_release_dev() after
the disconnect callback.

This patch fixes it by checking whether the code path is via the
disconnect callback, i.e. chip->shutdown flag is set.

Fixes: 79289e24 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
Reported-and-tested-by: NShuah Khan <shuahkh@osg.samsung.com>
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      6ff1a253
  3. 27 10月, 2016 1 次提交
  5. 13 10月, 2016 1 次提交
  7. 10 10月, 2016 1 次提交
  9. 26 9月, 2016 1 次提交
    • T
      ALSA: usb-line6: use the same declaration as definition in header for MIDI manufacturer ID · 8da08ca0
      由 Takashi Sakamoto 提交于 
      Currently, usb-line6 module exports an array of MIDI manufacturer ID and
usb-pod module uses it. However, the declaration is not the definition in
common header. The difference is explicit length of array. Although
compiler calculates it and everything goes well, it's better to use the
same representation between definition and declaration.

This commit fills the length of array for usb-line6 module. As a small
good sub-effect, this commit suppress below warnings from static analysis
by sparse v0.5.0.

sound/usb/line6/driver.c:274:43: error: cannot size expression
sound/usb/line6/driver.c:275:16: error: cannot size expression
sound/usb/line6/driver.c:276:16: error: cannot size expression
sound/usb/line6/driver.c:277:16: error: cannot size expression

Fixes: 705ececd ("Staging: add line6 usb driver")
Signed-off-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      8da08ca0
  11. 23 9月, 2016 1 次提交
    • A
      ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants · eb1a74b7
      由 Anssi Hannula 提交于 
      The DragonFly quirk added in 42e3121d ("ALSA: usb-audio: Add a more
accurate volume quirk for AudioQuest DragonFly") applies a custom dB map
on the volume control when its range is reported as 0..50 (0 .. 0.2dB).

However, there exists at least one other variant (hw v1.0c, as opposed
to the tested v1.2) which reports a different non-sensical volume range
(0..53) and the custom map is therefore not applied for that device.

This results in all of the volume change appearing close to 100% on
mixer UIs that utilize the dB TLV information.

Add a fallback case where no dB TLV is reported at all if the control
range is not 0..50 but still 0..N where N <= 1000 (3.9 dB). Also
restrict the quirk to only apply to the volume control as there is also
a mute control which would match the check otherwise.

Fixes: 42e3121d ("ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly")
Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
Reported-by: NDavid W <regulars@d-dub.org.uk>
Tested-by: NDavid W <regulars@d-dub.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      eb1a74b7
  13. 21 9月, 2016 1 次提交
  15. 20 9月, 2016 13 次提交
  17. 29 8月, 2016 1 次提交
  19. 22 8月, 2016 7 次提交
    • S
      ALSA: usb-audio: rmove print for failure of kmalloc · 1bc00f32
      由 Shawn Lin 提交于 
      kmalloc already print similar error once failing to alloc
enough memory, so let's remove this dump here.
Signed-off-by: NShawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      1bc00f32
    • D
      ALSA: usb: fine-tune Tenor error compensation value · 36e1ac3c
      由 Daniel Mack 提交于 
      Users of devices affected by the Tenor feedback data error report
buffer underruns, even with the +/- 0x1.0000 quirk applied.
Compensating the error with 0xf000 instead seems to reliably fix
that issue.

See

  https://sourceforge.net/p/alsa/mailman/message/35230259/Reported-and-tested-by: NNorman Nolte <norman.nolte@gmx.net>
Reported-and-tested-by: NThomas Gresens <T.Gresens@intershop.de>
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      36e1ac3c
    • D
      ALSA: usb: use TEAC UD-H01 quirk for more devices · ca0dd273
      由 Daniel Mack 提交于 
      The quirk seems to be necessary not only for TEAC UD-H01 devices, but to
more that are based on the Tenor 8802TL chipset. Devices built by T+A
are affected too, and they apparently all use the same USB PID:PID.

Extend the quirky handling for that device as well, and rename the
quirks flag.
Reported-and-tested-by: NThomas Gresens <T.Gresens@intershop.de>
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      ca0dd273
    • D
      ALSA: usb: move udh01_fb_quirk setting to quirks.c · 9abc1341
      由 Daniel Mack 提交于 
      That's a quirk, after all, so move it where to all the other quirks
live.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      9abc1341
    • A
      ALSA: line6: Fix POD sysfs attributes segfault · b027d112
      由 Andrej Krutak 提交于 
      The commit 02fc76f6 changed base of the sysfs attributes from device to card.
The "show" callbacks dereferenced wrong objects because of this.

Fixes: 02fc76f6 ('ALSA: line6: Create sysfs via snd_card_add_dev_attr()')
Cc: <stable@vger.kernel.org> # v4.0+
Reviewed-by: NStefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      b027d112
    • A
      ALSA: line6: Give up on the lock while URBs are released. · adc8a43a
      由 Andrej Krutak 提交于 
      Done, because line6_stream_stop() locks and calls line6_unlink_audio_urbs(),
which in turn invokes audio_out_callback(), which tries to lock 2nd time.

Fixes:

=============================================
[ INFO: possible recursive locking detected ]
4.4.15+ #15 Not tainted
---------------------------------------------
mplayer/3591 is trying to acquire lock:
 (&(&line6pcm->out.lock)->rlock){-.-...}, at: [<bfa27655>] audio_out_callback+0x70/0x110 [snd_usb_line6]

but task is already holding lock:
 (&(&line6pcm->out.lock)->rlock){-.-...}, at: [<bfa26aad>] line6_stream_stop+0x24/0x5c [snd_usb_line6]

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(&line6pcm->out.lock)->rlock);
  lock(&(&line6pcm->out.lock)->rlock);

 *** DEADLOCK ***

 May be due to missing lock nesting notation

3 locks held by mplayer/3591:
 #0:  (snd_pcm_link_rwlock){.-.-..}, at: [<bf8d49a7>] snd_pcm_stream_lock+0x1e/0x40 [snd_pcm]
 #1:  (&(&substream->self_group.lock)->rlock){-.-...}, at: [<bf8d49af>] snd_pcm_stream_lock+0x26/0x40 [snd_pcm]
 #2:  (&(&line6pcm->out.lock)->rlock){-.-...}, at: [<bfa26aad>] line6_stream_stop+0x24/0x5c [snd_usb_line6]

stack backtrace:
CPU: 0 PID: 3591 Comm: mplayer Not tainted 4.4.15+ #15
Hardware name: Generic AM33XX (Flattened Device Tree)
[<c0015d85>] (unwind_backtrace) from [<c001253d>] (show_stack+0x11/0x14)
[<c001253d>] (show_stack) from [<c02f1bdf>] (dump_stack+0x8b/0xac)
[<c02f1bdf>] (dump_stack) from [<c0076f43>] (__lock_acquire+0xc8b/0x1780)
[<c0076f43>] (__lock_acquire) from [<c007810d>] (lock_acquire+0x99/0x1c0)
[<c007810d>] (lock_acquire) from [<c06171e7>] (_raw_spin_lock_irqsave+0x3f/0x4c)
[<c06171e7>] (_raw_spin_lock_irqsave) from [<bfa27655>] (audio_out_callback+0x70/0x110 [snd_usb_line6])
[<bfa27655>] (audio_out_callback [snd_usb_line6]) from [<c04294db>] (__usb_hcd_giveback_urb+0x53/0xd0)
[<c04294db>] (__usb_hcd_giveback_urb) from [<c046388d>] (musb_giveback+0x3d/0x98)
[<c046388d>] (musb_giveback) from [<c04647f5>] (musb_urb_dequeue+0x6d/0x114)
[<c04647f5>] (musb_urb_dequeue) from [<c042ac11>] (usb_hcd_unlink_urb+0x39/0x98)
[<c042ac11>] (usb_hcd_unlink_urb) from [<bfa26a87>] (line6_unlink_audio_urbs+0x6a/0x6c [snd_usb_line6])
[<bfa26a87>] (line6_unlink_audio_urbs [snd_usb_line6]) from [<bfa26acb>] (line6_stream_stop+0x42/0x5c [snd_usb_line6])
[<bfa26acb>] (line6_stream_stop [snd_usb_line6]) from [<bfa26fe7>] (snd_line6_trigger+0xb6/0xf4 [snd_usb_line6])
[<bfa26fe7>] (snd_line6_trigger [snd_usb_line6]) from [<bf8d47b7>] (snd_pcm_do_stop+0x36/0x38 [snd_pcm])
[<bf8d47b7>] (snd_pcm_do_stop [snd_pcm]) from [<bf8d462f>] (snd_pcm_action_single+0x22/0x40 [snd_pcm])
[<bf8d462f>] (snd_pcm_action_single [snd_pcm]) from [<bf8d46f9>] (snd_pcm_action+0xac/0xb0 [snd_pcm])
[<bf8d46f9>] (snd_pcm_action [snd_pcm]) from [<bf8d4b61>] (snd_pcm_drop+0x38/0x64 [snd_pcm])
[<bf8d4b61>] (snd_pcm_drop [snd_pcm]) from [<bf8d6233>] (snd_pcm_common_ioctl1+0x7fe/0xbe8 [snd_pcm])
[<bf8d6233>] (snd_pcm_common_ioctl1 [snd_pcm]) from [<bf8d6779>] (snd_pcm_playback_ioctl1+0x15c/0x51c [snd_pcm])
[<bf8d6779>] (snd_pcm_playback_ioctl1 [snd_pcm]) from [<bf8d6b59>] (snd_pcm_playback_ioctl+0x20/0x28 [snd_pcm])
[<bf8d6b59>] (snd_pcm_playback_ioctl [snd_pcm]) from [<c016714b>] (do_vfs_ioctl+0x3af/0x5c8)

Fixes: 63e20df1 ('ALSA: line6: Reorganize PCM stream handling')
Cc: <stable@vger.kernel.org> # v4.0+
Reviewed-by: NStefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      adc8a43a
    • A
      ALSA: line6: Remove double line6_pcm_release() after failed acquire. · 7e4379ea
      由 Andrej Krutak 提交于 
      If there's an error, pcm is released in line6_pcm_acquire already.

Fixes: 247d95ee ('ALSA: line6: Handle error from line6_pcm_acquire()')
Cc: <stable@vger.kernel.org> # v4.0+
Reviewed-by: NStefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      7e4379ea
  21. 12 8月, 2016 1 次提交
  23. 09 8月, 2016 2 次提交
  25. 18 7月, 2016 1 次提交
  27. 17 6月, 2016 1 次提交
  29. 12 5月, 2016 1 次提交
  31. 08 5月, 2016 2 次提交
  33. 29 4月, 2016 2 次提交
  35. 12 4月, 2016 1 次提交
    • K
      ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock · adcdd0d5
      由 Kailang Yang 提交于 
      This is Dell usb dock audio workaround.
It was fixed the master volume keep lower.

[Some background: the patch essentially skips the controls of a couple
 of FU volumes.  Although the firmware exposes the dB and the value
 information via the usb descriptor, changing the values (we set the
 min volume as default) screws up the device.  Although this has been
 fixed in the newer firmware, the devices are shipped with the old
 firmware, thus we need the workaround in the driver side.  -- tiwai]
Signed-off-by: NKailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      adcdd0d5
  37. 09 4月, 2016 1 次提交
    • D
      ALSA: usb-audio: allow clock source validity interrupts · 191227d9
      由 Daniel Mack 提交于 
      miniDSP USBStreamer UAC2 devices send clock validity changes with the
control field set to zero. The current interrupt handler ignores all
packets if the control field does not match the mixer element's, but
it really should only do that in case that field is needed to
distinguish multiple elements with the same ID.

This patch implements a logic that lets notifications packets pass
if the element ID is unique for a given device.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      191227d9