summaryrefslogtreecommitdiff
path: root/sound
AgeCommit message (Collapse)Author
2016-12-14ASoC: max98090: Add extcon support for jack detection notificationDongwoo Lee
This patch applies extcon for jack detection notification. Changes in jack state is reported to input driver with snd-soc framework, as well as to extcon framework. Change-Id: Id46f10320b18258472521fad57cbbfc98547bb6d Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
2016-12-14ASoC: max98090: fix interrupt handling problemDongwoo Lee
The max98090_interrupt handler currently will read the device status register. After that, it will act only when the JDET bit is set. However, when max98090_interrupt handler is triggered and jack status register has really changed, the JDET bit of device status register is not set as expected for unknown reason. Because of this, the jack status cannot be reported. This patch adds a workaround solution for jack detection, by adding the second chance to recognize the reason of interrupt generation. If the interrupt is generated without setting any values on device status register, jack status register is compared to the current jack states. If the jack status is changed, the JDET bit is manually set. Change-Id: I74f6fb54fb9cc47e292f1f8e116032faae89c063 Reported-by: Huang Chao <chao7.huang@samsung.com> Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
2016-12-14ASoC: max98504A: fix build warningInki Dae
This patch fixes below build warnings, sound/soc/codecs/max98504a.c:271:1: warning: label 'err_access' defined but not used [-Wunused-label] sound/soc/codecs/max98504a.c:173:15: warning: unused variable 'value' [-Wunused-variable] Change-Id: I74bbe99e44591052daa05eadcbfaa795fb0e99d4 Signed-off-by: Inki Dae <inki.dae@samsung.com>
2016-12-14ASoC: ymu831: remove IRQF_DISABLEDSeung-Woo Kim
After mainline commit "d8bf368 genirq: Remove the deprecated 'IRQF_DISABLED' request_irq() flag entirely", IRQF_DISABLED is removed. The flags is deprecated in early kernel, so it can be replaced with 0x0 like other drivers. This patch fixes following build error: sound/soc/codecs/ymu831/ymu831.c: In function 'init_irq': sound/soc/codecs/ymu831/ymu831.c:8525:54: error: 'IRQF_DISABLED' undeclared (first use in this function) err = request_irq(mc_asoc->pdata->irq, irq_handler, IRQF_DISABLED, ^ Change-Id: Id06d964fbe2a62f8c9c642d13479782b9663e7cc Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
2016-12-14ASoC: ymu831: replace snd_soc_jack_new() to snd_soc_card_jack_new()Seung-Woo Kim
After mainline commit "77c7176 ASoC: Remove snd_soc_jack_new()", snd_soc_jack_new() should be replaced with snd_soc_card_jack_new(). This patch fixes following build error: sound/soc/codecs/ymu831/ymu831.c:8525:54: note: each undeclared identifier is reported only once for each function it appears in sound/soc/codecs/ymu831/ymu831.c: In function 'mc_asoc_probe': sound/soc/codecs/ymu831/ymu831.c:8787:2: error: implicit declaration of function 'snd_soc_jack_new' [-Werror=implicit-function-declaration] snd_soc_jack_new(codec, "Headset", ^ Change-Id: Ic043abca5a0dc55eacaf60830b760b95d06551cf Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Add PM operation to ensure playback after PM ↵Inha Song
suspend/resume This patch add suspend/resume operation to ensure playback after PM suspend/resume. If you wakeup by the resume after entering to suspend during the playback, We should be re-setup the codec's pll and sysclk to ensure codec operation. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Add SYSCLK stop in stop_sysclk for reset base rateInha Song
This patch add SYSCLK stop in stop_sysclk function for set base rate. In arizona codec, pcm hw rate is set reference to base_rate. If not initialize the base_rate, we can't change pcm rate. So it can makes underrun issues. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14ASoC: ymu831: Fix memory corruption by exceeding too small reg_cacheKrzysztof Kozlowski
The driver allocated reg_cache of word size int16 but accessed it by integers. So allocated memory was (MC_ASOC_N_REG * sizeof(int16)) but referenced (read and write) was (MC_ASOC_N_REG * sizeof(int)). This lead to memory corruption of kernel and multiple NULL pointer exceptions in different places. One common NULL pointer caused by this was during freezing workqueues in suspend to RAM: [ 39.782297] PM: Preparing system for mem sleep [ 39.783612] Freezing user space processes ... (elapsed 0.004 seconds) done. [ 39.791994] Freezing remaining freezable tasks ... [ 39.917890] freeze_workqueues_begin: WQ: Freeze mkdeten db2fa200 [ 39.924005] freeze_workqueues_begin:4752 db2fa400 [ 39.928575] freeze_workqueues_begin: WQ: Freeze mb4 db2fa400 [ 39.934307] Unable to handle kernel NULL pointer dereference at virtual address 00000001 ... [ 40.186412] [<c02bc1ac>] (__list_add) from [<c0667a54>] (mutex_lock_nested+0x138/0x474) [ 40.194395] [<c0667a54>] (mutex_lock_nested) from [<c00465e0>] (freeze_workqueues_begin+0xec/0x260) [ 40.203421] [<c00465e0>] (freeze_workqueues_begin) from [<c0086690>] (try_to_freeze_tasks+0x2a4/0x474) [ 40.212706] [<c0086690>] (try_to_freeze_tasks) from [<c0087148>] (freeze_kernel_threads+0x20/0x90) [ 40.221645] [<c0087148>] (freeze_kernel_threads) from [<c0089038>] (enter_state+0xa20/0xf58) [ 40.230064] [<c0089038>] (enter_state) from [<c0089584>] (pm_suspend+0x14/0x70) [ 40.237354] [<c0089584>] (pm_suspend) from [<c008611c>] (state_store+0x6c/0xbc) [ 40.244649] [<c008611c>] (state_store) from [<c02a31f8>] (kobj_attr_store+0x14/0x20) [ 40.252376] [<c02a31f8>] (kobj_attr_store) from [<c01c50e0>] (sysfs_kf_write+0x4c/0x50) [ 40.260359] [<c01c50e0>] (sysfs_kf_write) from [<c01c44c4>] (kernfs_fop_write+0xbc/0x198) [ 40.268519] [<c01c44c4>] (kernfs_fop_write) from [<c0158a54>] (vfs_write+0xa0/0x1a8) [ 40.276244] [<c0158a54>] (vfs_write) from [<c0158d74>] (SyS_write+0x40/0x8c) [ 40.283276] [<c0158d74>] (SyS_write) from [<c000f220>] (ret_fast_syscall+0x0/0x58) [ 40.290823] Code: e1a05001 e1a04000 e1530001 1a00000b (e5953000) Switch to sizeof(int) as size of reg_cache word because the that is the internal driver representation. Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
2016-12-14ASoC: ymu831: Remove unneeded castsKrzysztof Kozlowski
Remove useless casts from/to the same type. They may actually introduce errors if type changes by mistake. Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
2016-12-14ASoC: ymu831: Fix workqueues double destroyKrzysztof Kozlowski
Do not destroy the mb4 and mkdeten workqueues on IRQ termination. IRQ termination routine is called during: 1. driver removal - the workqueues are destroyed by removal function; 2. driver suspend - the workqueues are not allocated during resume. Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
2016-12-14ASoC: ymu831: Fix -ERRNO casted to unsigned intigerKrzysztof Kozlowski
The load_file() returns int (size or -ERRNO for erros) so it cannot be assigned to UINT32 because ERRNO will be lost. Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
2016-12-14ASoC: ymu831: Do not dereference pointer before checking it for non-NULLKrzysztof Kozlowski
Fix warnings: sound/soc/codecs/ymu831/ymu831.c:5278 mc_asoc_hw_params() warn: variable dereferenced before check 'substream' (see line 5268) sound/soc/codecs/ymu831/ymu831.c:5475 mc_asoc_hw_free() warn: variable dereferenced before check 'substream' (see line 5470) Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
2016-12-14ASoC: ymu831: Fix overflow when casting int to uint8Krzysztof Kozlowski
The value returned by get_incall_mic() is always used as int and it may be -ERRNO, so it should not be returned as uint8: sound/soc/codecs/ymu831/ymu831.c:1652 get_incall_mic() warn: signedness bug returning '(-5)' Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Fix warning in lpass driverInha Song
This patch fix a compile warning: sound/soc/samsung/lpass.c:30:1: warning: useless storage class specifier in empty declaration Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Add codec set_pll in stop_sysclk for FLL1 stopInha Song
This patch add snd_soc_codec_set_pll function in stop_sysclk for FLL1 stop. Arizona driver use pm runtime. So, we should call pm_runtime_suspend callback function by Stop FLL1. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Add pm ops to lpass driverInha Song
This patch add pm ops to lpass driver. After resume, We should toggle LPASS_CORE_SW_RESET to reset lpass IPs. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Add software reset in lpass enableInha Song
This patch add software reset in lpass enable function. For lpass ip software reset, we should toggle (1 -> 0 -> 1). Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Add audio interface support for Voice call, BT, and ↵Inha Song
external accessory This patch add audio interface support for BT and Voice call and external accessory. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Enable mclk2 for jack detectInha Song
This patch enable mclk2 for jack detect in TM2 board. The internal 32kHz clock must be present and enabed when using the jack insertion or accessory detection. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Change variable names to codec_mclk1Inha Song
This patch chagne variable names to codec_mclk1 from codec_mclk. WM5110 codec have two mclk for FLL1 and FLL2 source. So we should distinguish variable name for that two mclk. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: enable LPASS uart interruptBeomho Seo
This patch enable LPASS uart interrupt for use bluetooth. Bluetooth system use aud-uart. Signed-off-by: Beomho Seo <beomho.seo@samsung.com>
2016-12-14ASoC: samsung: Add ASoC machine driver for Rinato board with YMU831 codecInha Song
This patch add ASoC machine driver for Rinato board with YMU831 codec. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14ASoC: ymu831: Add Yamaha YMU831 codec supportInha Song
This patch add support for ymu831 codec. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Add Samsung Low Power Audio Subsystem driverInha Song
This patch adds LPASS driver. The LPASS (Low Power Audio Subsystem) is a special subsystem that supports audio playback with low power consumption. Signed-off-by: Inha Song <ideal.song@samsung.com>
2016-12-14LOCAL / ASoC: samsung: Add machine driver for Exynos5433-based TM2 boardInha Song
This patch add the sound machine driver for TM2 board. The codec operate in master mode. So, Reference to the codec master clock must be set. This machine driver support SPK playback and Main Mic capture. Signed-off-by: Inha Song <ideal.song@samsung.com> [k.kozlowski: rebased on 4.1] Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
2016-12-14LOCAL / ASoC: max98504A: Add max98504A Speaker amplifier driverInha Song
This patch add MAX98504A Class D Speaker Amplifier driver. The MAX98504A is a high efficiency mono Class D audio amplifier that features an integrated boost converter with voltage and current sensing ADCs for dynamic speaker management solutions. Signed-off-by: Inha Song <ideal.song@samsung.com> [k.kozlowski: rebased on 4.1] Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
2016-11-25ALSA: hda - Merge RIRB_PRE_DELAY into CTX_WORKAROUND capsTakashi Iwai
[ Upstream commit ef85f299c74e6c5dd98ec0230183be33f4c2813d ] AZX_DCAPS_RIRB_PRE_DELAY is always tied with AZX_DCAPS_CTX_WORKAROUND, which is Creative's XFi specific. So, we can replace it and reduce one more bit free for DCAPS. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-11-23ALSA: usb-audio: Add quirk for Syntek STK1160Marcel Hasler
[ Upstream commit bdc3478f90cd4d2928197f36629d5cf93b64dbe9 ] The stk1160 chip needs QUIRK_AUDIO_ALIGN_TRANSFER. This patch resolves the issue reported on the mailing list (http://marc.info/?l=linux-sound&m=139223599126215&w=2) and also fixes bug 180071 (https://bugzilla.kernel.org/show_bug.cgi?id=180071). Signed-off-by: Marcel Hasler <mahasler@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-10-02ALSA: rawmidi: Fix possible deadlock with virmidi registrationTakashi Iwai
[ Upstream commit 816f318b2364262a51024096da7ca3b84e78e3b5 ] When a seq-virmidi driver is initialized, it registers a rawmidi instance with its callback to create an associated seq kernel client. Currently it's done throughly in rawmidi's register_mutex context. Recently it was found that this may lead to a deadlock another rawmidi device that is being attached with the sequencer is accessed, as both open with the same register_mutex. This was actually triggered by syzkaller, as Dmitry Vyukov reported: ====================================================== [ INFO: possible circular locking dependency detected ] 4.8.0-rc1+ #11 Not tainted ------------------------------------------------------- syz-executor/7154 is trying to acquire lock: (register_mutex#5){+.+.+.}, at: [<ffffffff84fd6d4b>] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341 but task is already holding lock: (&grp->list_mutex){++++.+}, at: [<ffffffff850138bb>] check_and_subscribe_port+0x5b/0x5c0 sound/core/seq/seq_ports.c:495 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&grp->list_mutex){++++.+}: [<ffffffff8147a3a8>] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746 [<ffffffff863f6199>] down_read+0x49/0xc0 kernel/locking/rwsem.c:22 [< inline >] deliver_to_subscribers sound/core/seq/seq_clientmgr.c:681 [<ffffffff85005c5e>] snd_seq_deliver_event+0x35e/0x890 sound/core/seq/seq_clientmgr.c:822 [<ffffffff85006e96>] > snd_seq_kernel_client_dispatch+0x126/0x170 sound/core/seq/seq_clientmgr.c:2418 [<ffffffff85012c52>] snd_seq_system_broadcast+0xb2/0xf0 sound/core/seq/seq_system.c:101 [<ffffffff84fff70a>] snd_seq_create_kernel_client+0x24a/0x330 sound/core/seq/seq_clientmgr.c:2297 [< inline >] snd_virmidi_dev_attach_seq sound/core/seq/seq_virmidi.c:383 [<ffffffff8502d29f>] snd_virmidi_dev_register+0x29f/0x750 sound/core/seq/seq_virmidi.c:450 [<ffffffff84fd208c>] snd_rawmidi_dev_register+0x30c/0xd40 sound/core/rawmidi.c:1645 [<ffffffff84f816d3>] __snd_device_register.part.0+0x63/0xc0 sound/core/device.c:164 [< inline >] __snd_device_register sound/core/device.c:162 [<ffffffff84f8235d>] snd_device_register_all+0xad/0x110 sound/core/device.c:212 [<ffffffff84f7546f>] snd_card_register+0xef/0x6c0 sound/core/init.c:749 [<ffffffff85040b7f>] snd_virmidi_probe+0x3ef/0x590 sound/drivers/virmidi.c:123 [<ffffffff833ebf7b>] platform_drv_probe+0x8b/0x170 drivers/base/platform.c:564 ...... -> #0 (register_mutex#5){+.+.+.}: [< inline >] check_prev_add kernel/locking/lockdep.c:1829 [< inline >] check_prevs_add kernel/locking/lockdep.c:1939 [< inline >] validate_chain kernel/locking/lockdep.c:2266 [<ffffffff814791f4>] __lock_acquire+0x4d44/0x4d80 kernel/locking/lockdep.c:3335 [<ffffffff8147a3a8>] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746 [< inline >] __mutex_lock_common kernel/locking/mutex.c:521 [<ffffffff863f0ef1>] mutex_lock_nested+0xb1/0xa20 kernel/locking/mutex.c:621 [<ffffffff84fd6d4b>] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341 [<ffffffff8502e7c7>] midisynth_subscribe+0xf7/0x350 sound/core/seq/seq_midi.c:188 [< inline >] subscribe_port sound/core/seq/seq_ports.c:427 [<ffffffff85013cc7>] check_and_subscribe_port+0x467/0x5c0 sound/core/seq/seq_ports.c:510 [<ffffffff85015da9>] snd_seq_port_connect+0x2c9/0x500 sound/core/seq/seq_ports.c:579 [<ffffffff850079b8>] snd_seq_ioctl_subscribe_port+0x1d8/0x2b0 sound/core/seq/seq_clientmgr.c:1480 [<ffffffff84ffe9e4>] snd_seq_do_ioctl+0x184/0x1e0 sound/core/seq/seq_clientmgr.c:2225 [<ffffffff84ffeae8>] snd_seq_kernel_client_ctl+0xa8/0x110 sound/core/seq/seq_clientmgr.c:2440 [<ffffffff85027664>] snd_seq_oss_midi_open+0x3b4/0x610 sound/core/seq/oss/seq_oss_midi.c:375 [<ffffffff85023d67>] snd_seq_oss_synth_setup_midi+0x107/0x4c0 sound/core/seq/oss/seq_oss_synth.c:281 [<ffffffff8501b0a8>] snd_seq_oss_open+0x748/0x8d0 sound/core/seq/oss/seq_oss_init.c:274 [<ffffffff85019d8a>] odev_open+0x6a/0x90 sound/core/seq/oss/seq_oss.c:138 [<ffffffff84f7040f>] soundcore_open+0x30f/0x640 sound/sound_core.c:639 ...... other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&grp->list_mutex); lock(register_mutex#5); lock(&grp->list_mutex); lock(register_mutex#5); *** DEADLOCK *** ====================================================== The fix is to simply move the registration parts in snd_rawmidi_dev_register() to the outside of the register_mutex lock. The lock is needed only to manage the linked list, and it's not necessarily to cover the whole initialization process. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-10-02ALSA: timer: Fix zero-division by continue of uninitialized instanceTakashi Iwai
[ Upstream commit 9f8a7658bcafb2a7853f7a2eae8a94e87e6e695b ] When a user timer instance is continued without the explicit start beforehand, the system gets eventually zero-division error like: divide error: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN CPU: 1 PID: 27320 Comm: syz-executor Not tainted 4.8.0-rc3-next-20160825+ #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff88003c9b2280 task.stack: ffff880027280000 RIP: 0010:[<ffffffff858e1a6c>] [< inline >] ktime_divns include/linux/ktime.h:195 RIP: 0010:[<ffffffff858e1a6c>] [<ffffffff858e1a6c>] snd_hrtimer_callback+0x1bc/0x3c0 sound/core/hrtimer.c:62 Call Trace: <IRQ> [< inline >] __run_hrtimer kernel/time/hrtimer.c:1238 [<ffffffff81504335>] __hrtimer_run_queues+0x325/0xe70 kernel/time/hrtimer.c:1302 [<ffffffff81506ceb>] hrtimer_interrupt+0x18b/0x420 kernel/time/hrtimer.c:1336 [<ffffffff8126d8df>] local_apic_timer_interrupt+0x6f/0xe0 arch/x86/kernel/apic/apic.c:933 [<ffffffff86e13056>] smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:957 [<ffffffff86e1210c>] apic_timer_interrupt+0x8c/0xa0 arch/x86/entry/entry_64.S:487 <EOI> ..... Although a similar issue was spotted and a fix patch was merged in commit [6b760bb2c63a: ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE], it seems covering only a part of iceberg. In this patch, we fix the issue a bit more drastically. Basically the continue of an uninitialized timer is supposed to be a fresh start, so we do it for user timers. For the direct snd_timer_continue() call, there is no way to pass the initial tick value, so we kick out for the uninitialized case. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-10-02ALSA: timer: Call notifier in the same spinlockTakashi Iwai
[ Upstream commit f65e0d299807d8a11812845c972493c3f9a18e10 ] snd_timer_notify1() is called outside the spinlock and it retakes the lock after the unlock. This is rather racy, and it's safer to move snd_timer_notify() call inside the main spinlock. The patch also contains a slight refactoring / cleanup of the code. Now all start/stop/continue/pause look more symmetric and a bit better readable. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-10-02ALSA: timer: fix NULL pointer dereference in read()/ioctl() raceVegard Nossum
[ Upstream commit 11749e086b2766cccf6217a527ef5c5604ba069c ] I got this with syzkaller: ================================================================== BUG: KASAN: null-ptr-deref on address 0000000000000020 Read of size 32 by task syz-executor/22519 CPU: 1 PID: 22519 Comm: syz-executor Not tainted 4.8.0-rc2+ #169 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2 014 0000000000000001 ffff880111a17a00 ffffffff81f9f141 ffff880111a17a90 ffff880111a17c50 ffff880114584a58 ffff880114584a10 ffff880111a17a80 ffffffff8161fe3f ffff880100000000 ffff880118d74a48 ffff880118d74a68 Call Trace: [<ffffffff81f9f141>] dump_stack+0x83/0xb2 [<ffffffff8161fe3f>] kasan_report_error+0x41f/0x4c0 [<ffffffff8161ff74>] kasan_report+0x34/0x40 [<ffffffff82c84b54>] ? snd_timer_user_read+0x554/0x790 [<ffffffff8161e79e>] check_memory_region+0x13e/0x1a0 [<ffffffff8161e9c1>] kasan_check_read+0x11/0x20 [<ffffffff82c84b54>] snd_timer_user_read+0x554/0x790 [<ffffffff82c84600>] ? snd_timer_user_info_compat.isra.5+0x2b0/0x2b0 [<ffffffff817d0831>] ? proc_fault_inject_write+0x1c1/0x250 [<ffffffff817d0670>] ? next_tgid+0x2a0/0x2a0 [<ffffffff8127c278>] ? do_group_exit+0x108/0x330 [<ffffffff8174653a>] ? fsnotify+0x72a/0xca0 [<ffffffff81674dfe>] __vfs_read+0x10e/0x550 [<ffffffff82c84600>] ? snd_timer_user_info_compat.isra.5+0x2b0/0x2b0 [<ffffffff81674cf0>] ? do_sendfile+0xc50/0xc50 [<ffffffff81745e10>] ? __fsnotify_update_child_dentry_flags+0x60/0x60 [<ffffffff8143fec6>] ? kcov_ioctl+0x56/0x190 [<ffffffff81e5ada2>] ? common_file_perm+0x2e2/0x380 [<ffffffff81746b0e>] ? __fsnotify_parent+0x5e/0x2b0 [<ffffffff81d93536>] ? security_file_permission+0x86/0x1e0 [<ffffffff816728f5>] ? rw_verify_area+0xe5/0x2b0 [<ffffffff81675355>] vfs_read+0x115/0x330 [<ffffffff81676371>] SyS_read+0xd1/0x1a0 [<ffffffff816762a0>] ? vfs_write+0x4b0/0x4b0 [<ffffffff82001c2c>] ? __this_cpu_preempt_check+0x1c/0x20 [<ffffffff8150455a>] ? __context_tracking_exit.part.4+0x3a/0x1e0 [<ffffffff816762a0>] ? vfs_write+0x4b0/0x4b0 [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0 [<ffffffff810052fc>] ? syscall_return_slowpath+0x16c/0x1d0 [<ffffffff83c3276a>] entry_SYSCALL64_slow_path+0x25/0x25 ================================================================== There are a couple of problems that I can see: - ioctl(SNDRV_TIMER_IOCTL_SELECT), which potentially sets tu->queue/tu->tqueue to NULL on memory allocation failure, so read() would get a NULL pointer dereference like the above splat - the same ioctl() can free tu->queue/to->tqueue which means read() could potentially see (and dereference) the freed pointer We can fix both by taking the ioctl_lock mutex when dereferencing ->queue/->tqueue, since that's always held over all the ioctl() code. Just looking at the code I find it likely that there are more problems here such as tu->qhead pointing outside the buffer if the size is changed concurrently using SNDRV_TIMER_IOCTL_PARAMS. Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-10-02ALSA: fireworks: accessing to user space outside spinlockTakashi Sakamoto
[ Upstream commit 6b1ca4bcadf9ef077cc5f03c6822ba276ed14902 ] In hwdep interface of fireworks driver, accessing to user space is in a critical section with disabled local interrupt. Depending on architecture, accessing to user space can cause page fault exception. Then local processor stores machine status and handles the synchronous event. A handler corresponding to the event can call task scheduler to wait for preparing pages. In a case of usage of single core processor, the state to disable local interrupt is worse because it don't handle usual interrupts from hardware. This commit fixes this bug, performing the accessing outside spinlock. This commit also gives up counting the number of queued response messages to simplify ring-buffer management. Reported-by: Vaishali Thakkar <vaishali.thakkar@oracle.com> Cc: stable@vger.kernel.org Fixes: 555e8a8f7f14('ALSA: fireworks: Add command/response functionality into hwdep interface') Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-10-02ALSA: hda - Enable subwoofer on Dell Inspiron 7559Kai-Heng Feng
[ Upstream commit fd06c77eb9200b53d421da5fffe0dcd894b5d72a ] The subwoofer on Inspiron 7559 was disabled originally. Applying a pin fixup to node 0x1b can enable it and make it work. Old pin: 0x411111f0 New pin: 0x90170151 Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-10-02ALSA: usb-audio: Add sample rate inquiry quirk for B850V3 CP2114Ken Lin
[ Upstream commit 83d9956b7e6b310c1062df7894257251c625b22e ] Avoid getting sample rate on B850V3 CP2114 as it is unsupported and causes noisy "current rate is different from the runtime rate" messages when playback starts. Signed-off-by: Ken Lin <ken.lin@advantech.com.tw> Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-10-02ALSA: timer: fix NULL pointer dereference on memory allocation failureVegard Nossum
[ Upstream commit 8ddc05638ee42b18ba4fe99b5fb647fa3ad20456 ] I hit this with syzkaller: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #190 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 task: ffff88011278d600 task.stack: ffff8801120c0000 RIP: 0010:[<ffffffff82c8ba07>] [<ffffffff82c8ba07>] snd_hrtimer_start+0x77/0x100 RSP: 0018:ffff8801120c7a60 EFLAGS: 00010006 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000007 RDX: 0000000000000009 RSI: 1ffff10023483091 RDI: 0000000000000048 RBP: ffff8801120c7a78 R08: ffff88011a5cf768 R09: ffff88011a5ba790 R10: 0000000000000002 R11: ffffed00234b9ef1 R12: ffff880114843980 R13: ffffffff84213c00 R14: ffff880114843ab0 R15: 0000000000000286 FS: 00007f72958f3700(0000) GS:ffff88011aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000603001 CR3: 00000001126ab000 CR4: 00000000000006f0 Stack: ffff880114843980 ffff880111eb2dc0 ffff880114843a34 ffff8801120c7ad0 ffffffff82c81ab1 0000000000000000 ffffffff842138e0 0000000100000000 ffff880111eb2dd0 ffff880111eb2dc0 0000000000000001 ffff880111eb2dc0 Call Trace: [<ffffffff82c81ab1>] snd_timer_start1+0x331/0x670 [<ffffffff82c85bfd>] snd_timer_start+0x5d/0xa0 [<ffffffff82c8795e>] snd_timer_user_ioctl+0x88e/0x2830 [<ffffffff8159f3a0>] ? __follow_pte.isra.49+0x430/0x430 [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80 [<ffffffff815a26fa>] ? do_wp_page+0x3aa/0x1c90 [<ffffffff8132762f>] ? put_prev_entity+0x108f/0x21a0 [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80 [<ffffffff816b0733>] do_vfs_ioctl+0x193/0x1050 [<ffffffff813510af>] ? cpuacct_account_field+0x12f/0x1a0 [<ffffffff816b05a0>] ? ioctl_preallocate+0x200/0x200 [<ffffffff81002f2f>] ? syscall_trace_enter+0x3cf/0xdb0 [<ffffffff815045ba>] ? __context_tracking_exit.part.4+0x9a/0x1e0 [<ffffffff81002b60>] ? exit_to_usermode_loop+0x190/0x190 [<ffffffff82001a97>] ? check_preemption_disabled+0x37/0x1e0 [<ffffffff81d93889>] ? security_file_ioctl+0x89/0xb0 [<ffffffff816b167f>] SyS_ioctl+0x8f/0xc0 [<ffffffff816b15f0>] ? do_vfs_ioctl+0x1050/0x1050 [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0 [<ffffffff83c32b2a>] entry_SYSCALL64_slow_path+0x25/0x25 Code: c7 c7 c4 b9 c8 82 48 89 d9 4c 89 ee e8 63 88 7f fe e8 7e 46 7b fe 48 8d 7b 48 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 04 84 c0 7e 65 80 7b 48 00 74 0e e8 52 46 RIP [<ffffffff82c8ba07>] snd_hrtimer_start+0x77/0x100 RSP <ffff8801120c7a60> ---[ end trace 5955b08db7f2b029 ]--- This can happen if snd_hrtimer_open() fails to allocate memory and returns an error, which is currently not checked by snd_timer_open(): ioctl(SNDRV_TIMER_IOCTL_SELECT) - snd_timer_user_tselect() - snd_timer_close() - snd_hrtimer_close() - (struct snd_timer *) t->private_data = NULL - snd_timer_open() - snd_hrtimer_open() - kzalloc() fails; t->private_data is still NULL ioctl(SNDRV_TIMER_IOCTL_START) - snd_timer_user_start() - snd_timer_start() - snd_timer_start1() - snd_hrtimer_start() - t->private_data == NULL // boom Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-10-02ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUEVegard Nossum
[ Upstream commit 6b760bb2c63a9e322c0e4a0b5daf335ad93d5a33 ] I got this: divide error: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #189 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 task: ffff8801120a9580 task.stack: ffff8801120b0000 RIP: 0010:[<ffffffff82c8bd9a>] [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0 RSP: 0018:ffff88011aa87da8 EFLAGS: 00010006 RAX: 0000000000004f76 RBX: ffff880112655e88 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff880112655ea0 RDI: 0000000000000001 RBP: ffff88011aa87e00 R08: ffff88013fff905c R09: ffff88013fff9048 R10: ffff88013fff9050 R11: 00000001050a7b8c R12: ffff880114778a00 R13: ffff880114778ab4 R14: ffff880114778b30 R15: 0000000000000000 FS: 00007f071647c700(0000) GS:ffff88011aa80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000603001 CR3: 0000000112021000 CR4: 00000000000006e0 Stack: 0000000000000000 ffff880114778ab8 ffff880112655ea0 0000000000004f76 ffff880112655ec8 ffff880112655e80 ffff880112655e88 ffff88011aa98fc0 00000000b97ccf2b dffffc0000000000 ffff88011aa98fc0 ffff88011aa87ef0 Call Trace: <IRQ> [<ffffffff813abce7>] __hrtimer_run_queues+0x347/0xa00 [<ffffffff82c8bbc0>] ? snd_hrtimer_close+0x130/0x130 [<ffffffff813ab9a0>] ? retrigger_next_event+0x1b0/0x1b0 [<ffffffff813ae1a6>] ? hrtimer_interrupt+0x136/0x4b0 [<ffffffff813ae220>] hrtimer_interrupt+0x1b0/0x4b0 [<ffffffff8120f91e>] local_apic_timer_interrupt+0x6e/0xf0 [<ffffffff81227ad3>] ? kvm_guest_apic_eoi_write+0x13/0xc0 [<ffffffff83c35086>] smp_apic_timer_interrupt+0x76/0xa0 [<ffffffff83c3416c>] apic_timer_interrupt+0x8c/0xa0 <EOI> [<ffffffff83c3239c>] ? _raw_spin_unlock_irqrestore+0x2c/0x60 [<ffffffff82c8185d>] snd_timer_start1+0xdd/0x670 [<ffffffff82c87015>] snd_timer_continue+0x45/0x80 [<ffffffff82c88100>] snd_timer_user_ioctl+0x1030/0x2830 [<ffffffff8159f3a0>] ? __follow_pte.isra.49+0x430/0x430 [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80 [<ffffffff815a26fa>] ? do_wp_page+0x3aa/0x1c90 [<ffffffff815aa4f8>] ? handle_mm_fault+0xbc8/0x27f0 [<ffffffff815a9930>] ? __pmd_alloc+0x370/0x370 [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80 [<ffffffff816b0733>] do_vfs_ioctl+0x193/0x1050 [<ffffffff816b05a0>] ? ioctl_preallocate+0x200/0x200 [<ffffffff81002f2f>] ? syscall_trace_enter+0x3cf/0xdb0 [<ffffffff815045ba>] ? __context_tracking_exit.part.4+0x9a/0x1e0 [<ffffffff81002b60>] ? exit_to_usermode_loop+0x190/0x190 [<ffffffff82001a97>] ? check_preemption_disabled+0x37/0x1e0 [<ffffffff81d93889>] ? security_file_ioctl+0x89/0xb0 [<ffffffff816b167f>] SyS_ioctl+0x8f/0xc0 [<ffffffff816b15f0>] ? do_vfs_ioctl+0x1050/0x1050 [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0 [<ffffffff83c32b2a>] entry_SYSCALL64_slow_path+0x25/0x25 Code: e8 fc 42 7b fe 8b 0d 06 8a 50 03 49 0f af cf 48 85 c9 0f 88 7c 01 00 00 48 89 4d a8 e8 e0 42 7b fe 48 8b 45 c0 48 8b 4d a8 48 99 <48> f7 f9 49 01 c7 e8 cb 42 7b fe 48 8b 55 d0 48 b8 00 00 00 00 RIP [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0 RSP <ffff88011aa87da8> ---[ end trace 6aa380f756a21074 ]--- The problem happens when you call ioctl(SNDRV_TIMER_IOCTL_CONTINUE) on a completely new/unused timer -- it will have ->sticks == 0, which causes a divide by 0 in snd_hrtimer_callback(). Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-31ALSA: line6: Fix POD sysfs attributes segfaultAndrej Krutak
[ Upstream commit b027d11263836a0cd335520175257dcb99b43757 ] The commit 02fc76f6a changed base of the sysfs attributes from device to card. The "show" callbacks dereferenced wrong objects because of this. Fixes: 02fc76f6a7db ('ALSA: line6: Create sysfs via snd_card_add_dev_attr()') Cc: <stable@vger.kernel.org> # v4.0+ Reviewed-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-31ALSA: line6: Give up on the lock while URBs are released.Andrej Krutak
[ Upstream commit adc8a43a6d6688272ebffa81789fa857e603dec6 ] Done, because line6_stream_stop() locks and calls line6_unlink_audio_urbs(), which in turn invokes audio_out_callback(), which tries to lock 2nd time. Fixes: ============================================= [ INFO: possible recursive locking detected ] 4.4.15+ #15 Not tainted --------------------------------------------- mplayer/3591 is trying to acquire lock: (&(&line6pcm->out.lock)->rlock){-.-...}, at: [<bfa27655>] audio_out_callback+0x70/0x110 [snd_usb_line6] but task is already holding lock: (&(&line6pcm->out.lock)->rlock){-.-...}, at: [<bfa26aad>] line6_stream_stop+0x24/0x5c [snd_usb_line6] other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&line6pcm->out.lock)->rlock); lock(&(&line6pcm->out.lock)->rlock); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by mplayer/3591: #0: (snd_pcm_link_rwlock){.-.-..}, at: [<bf8d49a7>] snd_pcm_stream_lock+0x1e/0x40 [snd_pcm] #1: (&(&substream->self_group.lock)->rlock){-.-...}, at: [<bf8d49af>] snd_pcm_stream_lock+0x26/0x40 [snd_pcm] #2: (&(&line6pcm->out.lock)->rlock){-.-...}, at: [<bfa26aad>] line6_stream_stop+0x24/0x5c [snd_usb_line6] stack backtrace: CPU: 0 PID: 3591 Comm: mplayer Not tainted 4.4.15+ #15 Hardware name: Generic AM33XX (Flattened Device Tree) [<c0015d85>] (unwind_backtrace) from [<c001253d>] (show_stack+0x11/0x14) [<c001253d>] (show_stack) from [<c02f1bdf>] (dump_stack+0x8b/0xac) [<c02f1bdf>] (dump_stack) from [<c0076f43>] (__lock_acquire+0xc8b/0x1780) [<c0076f43>] (__lock_acquire) from [<c007810d>] (lock_acquire+0x99/0x1c0) [<c007810d>] (lock_acquire) from [<c06171e7>] (_raw_spin_lock_irqsave+0x3f/0x4c) [<c06171e7>] (_raw_spin_lock_irqsave) from [<bfa27655>] (audio_out_callback+0x70/0x110 [snd_usb_line6]) [<bfa27655>] (audio_out_callback [snd_usb_line6]) from [<c04294db>] (__usb_hcd_giveback_urb+0x53/0xd0) [<c04294db>] (__usb_hcd_giveback_urb) from [<c046388d>] (musb_giveback+0x3d/0x98) [<c046388d>] (musb_giveback) from [<c04647f5>] (musb_urb_dequeue+0x6d/0x114) [<c04647f5>] (musb_urb_dequeue) from [<c042ac11>] (usb_hcd_unlink_urb+0x39/0x98) [<c042ac11>] (usb_hcd_unlink_urb) from [<bfa26a87>] (line6_unlink_audio_urbs+0x6a/0x6c [snd_usb_line6]) [<bfa26a87>] (line6_unlink_audio_urbs [snd_usb_line6]) from [<bfa26acb>] (line6_stream_stop+0x42/0x5c [snd_usb_line6]) [<bfa26acb>] (line6_stream_stop [snd_usb_line6]) from [<bfa26fe7>] (snd_line6_trigger+0xb6/0xf4 [snd_usb_line6]) [<bfa26fe7>] (snd_line6_trigger [snd_usb_line6]) from [<bf8d47b7>] (snd_pcm_do_stop+0x36/0x38 [snd_pcm]) [<bf8d47b7>] (snd_pcm_do_stop [snd_pcm]) from [<bf8d462f>] (snd_pcm_action_single+0x22/0x40 [snd_pcm]) [<bf8d462f>] (snd_pcm_action_single [snd_pcm]) from [<bf8d46f9>] (snd_pcm_action+0xac/0xb0 [snd_pcm]) [<bf8d46f9>] (snd_pcm_action [snd_pcm]) from [<bf8d4b61>] (snd_pcm_drop+0x38/0x64 [snd_pcm]) [<bf8d4b61>] (snd_pcm_drop [snd_pcm]) from [<bf8d6233>] (snd_pcm_common_ioctl1+0x7fe/0xbe8 [snd_pcm]) [<bf8d6233>] (snd_pcm_common_ioctl1 [snd_pcm]) from [<bf8d6779>] (snd_pcm_playback_ioctl1+0x15c/0x51c [snd_pcm]) [<bf8d6779>] (snd_pcm_playback_ioctl1 [snd_pcm]) from [<bf8d6b59>] (snd_pcm_playback_ioctl+0x20/0x28 [snd_pcm]) [<bf8d6b59>] (snd_pcm_playback_ioctl [snd_pcm]) from [<c016714b>] (do_vfs_ioctl+0x3af/0x5c8) Fixes: 63e20df1e5b2 ('ALSA: line6: Reorganize PCM stream handling') Cc: <stable@vger.kernel.org> # v4.0+ Reviewed-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-31ALSA: line6: Remove double line6_pcm_release() after failed acquire.Andrej Krutak
[ Upstream commit 7e4379eae0e31994ea645db1d13006ea8e5ce539 ] If there's an error, pcm is released in line6_pcm_acquire already. Fixes: 247d95ee6dd2 ('ALSA: line6: Handle error from line6_pcm_acquire()') Cc: <stable@vger.kernel.org> # v4.0+ Reviewed-by: Stefan Hajnoczi <stefanha@gmail.com> Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-31ASoC: atmel_ssc_dai: Don't unconditionally reset SSC on stream startupChristoph Huber
[ Upstream commit 3e103a65514c2947e53f3171b21255fbde8b60c6 ] commit cbaadf0f90d6 ("ASoC: atmel_ssc_dai: refactor the startup and shutdown") refactored code such that the SSC is reset on every startup; this breaks duplex audio (e.g. first start audio playback, then start record, causing the playback to stop/hang) Fixes: cbaadf0f90d6 (ASoC: atmel_ssc_dai: refactor the startup and shutdown) Signed-off-by: Christoph Huber <c.huber@bct-electronic.com> Signed-off-by: Peter Meerwald-Stadler <p.meerwald@bct-electronic.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-19ALSA: timer: Fix leak in events via snd_timer_user_tinterruptKangjie Lu
[ Upstream commit e4ec8cc8039a7063e24204299b462bd1383184a5 ] The stack object “r1” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-19ALSA: timer: Fix leak in events via snd_timer_user_ccallbackKangjie Lu
[ Upstream commit 9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6 ] The stack object “r1” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-19ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMSKangjie Lu
[ Upstream commit cec8f96e49d9be372fdb0c3836dcf31ec71e457e ] The stack object “tread” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-19ALSA: hda - Fix headset mic detection problem for two dell machinesHui Wang
[ Upstream commit 59ec4b57bcaede46546d54d037a21004b9aa5cef ] One of the machines has ALC255 on it, another one has ALC298 on it. On the machine with the codec ALC298, it also has the speaker volume problem, so we add the fixup chained to ALC298_FIXUP_SPK_VOLUME rather than adding a group of pin definition in the pin quirk table, since the speak volume problem does not happen on other machines yet. Cc: <stable@vger.kernel.org> Signed-off-by: Hui Wang <hui.wang@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-19ALSA: hda - Fix the headset mic that will not work on Dell desktop machineWoodrow Shen
[ Upstream commit e9c28e16a0b7071c88a206ad8ce0c73f6605bba7 ] When the headset was plugged in the Dell desktop, the mic of headset can't be detected and workable. According to the alsa-info, we found the differece between alsa and init_pin_configs on the machine, so we need to add the pin configs to make headset work. Codec: Realtek ALC3234 Vendor Id: 0x10ec0255 Subsystem Id: 0x102806bb BugLink: https://bugs.launchpad.net/bugs/1477900 Signed-off-by: Woodrow Shen <woodrow.shen@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-19ALSA: hda: Fix krealloc() with __GFP_ZERO usageTakashi Iwai
[ Upstream commit 33baefe5e72f17a6df378e48196cd8cada11deec ] krealloc() doesn't work always properly with __GFP_ZERO flag as expected. For clearing the reallocated area, we need to clear explicitly instead. Reported-by: Joe Perches <joe@perches.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-19ALSA: hda: add AMD Bonaire AZ PCI ID with proper driver capsMaruthi Srinivas Bayyavarapu
[ Upstream commit fd48331f9b71d2add941adaee3619f5b8527182d ] This commit fixes garbled audio on Bonaire HDMI Signed-off-by: Maruthi Bayyavarapu <maruthi.bayyavarapu@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-19ALSA: hda/realtek - Can't adjust speaker's volume on a Dell AIOHui Wang
[ Upstream commit dd9aa335c88003d131ac874e7f6809902de0b847 ] We have a Dell AIO on which we can't adjust its speaker's volume. The problem is it is connected to a Audio Output node without Amp-out capability. To fix it, we change it to be connnected to a node with Amp-out capability. Cc: <stable@vger.kernel.org> Signed-off-by: Hui Wang <hui.wang@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
2016-08-19ALSA: hda/realtek: Enable HP amp and mute LED on HP Folio 9480m [v3]Keith Packard
[ Upstream commit 98973f2f083a5ec580da8bbb685e6baa93613546 ] This laptop needs GPIO4 pulled high to enable the headphone amplifier, and has a mute LED on GPIO3. I modelled the patch on the existing GPIO4 code which pulls the line low for the same purpose; this time, the HP amp line is pulled high. v2: Disable the headphone amplifier when no headphone is connected. Don't disable power savings to preserve the LED state. v3: Remove headset-specific hooks and code; this is just a headphone. Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-23 23:00:41 +0000