24133 Commits

Author SHA1 Message Date
f883982dc1 ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2
HP EliteBook 755 G2 with ALC3228 (ALC280) codec [103c:221c] requires
the known fixup (ALC269_FIXUP_HEADSET_MIC) for making the headset mic
working.  Also, it suffers from the loopback noise problem, so we
should disable aamix path as well.

Reported-by: Derick Eddington <derick.eddington@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-25 14:36:08 +01:00
2ae955774f ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225
On one of the machines we enable, we found that the actual speaker volume
did not always correspond to the volume set in alsamixer. This patch
fixes that problem.

This patch was orginally written by Kailang @ Realtek, I've rebased it
to fit sound git master.

Cc: stable@vger.kernel.org
BugLink: https://bugs.launchpad.net/bugs/1549660
Co-Authored-By: Kailang <kailang@realtek.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-25 10:24:29 +01:00
3b43b71f05 ALSA: hda - Fixing background noise on Dell Inspiron 3162
After login to the desktop on Dell Inspiron 3162,
there's a very loud background noise comes from the builtin speaker.
The noise does not go away even if the speaker is muted.

The noise disappears after using the aamix fixup.

Codec: Realtek ALC3234
Address: 0
AFG Function Id: 0x1 (unsol 1)
    Vendor Id: 0x10ec0255
    Subsystem Id: 0x10280725
    Revision Id: 0x100002
    No Modem Function Group found

BugLink: http://bugs.launchpad.net/bugs/1549620
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-25 09:10:13 +01:00
7c139db2e5 ASoC: adau17x1: Fix incorrect BCLK ratio definitions
Signed-off-by: Andreas Irestål <andire@axis.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-24 13:12:10 +09:00
da9b9303ed ASoC: wm9713: fix regmap free path
In the conversion to regmap, I assumed that the devm_() variant could be
used in the soc probe function.

As a mater of fact with the current code the regmap is freed twice
because of the devm_() call:
(mutex_lock) from [<c01f6624>] (debugfs_remove_recursive+0x50/0x1d0)
(debugfs_remove_recursive) from [<c02bf800>] (regmap_debugfs_exit+0x1c/0xd4)
(regmap_debugfs_exit) from [<c02ba1f8>] (regmap_exit+0x28/0xc8)
(regmap_exit) from [<c02aa258>] (release_nodes+0x18c/0x204)
(release_nodes) from [<c02a278c>] (device_release+0x18/0x90)
(device_release) from [<c0239030>] (kobject_release+0x90/0x1bc)
(kobject_release) from [<c0395c94>] (wm9713_soc_remove+0x1c/0x24)
(wm9713_soc_remove) from [<c0384884>] (soc_remove_component+0x50/0x7c)
(soc_remove_component) from [<c0386c28>] (soc_remove_dai_links+0x118/0x228)
(soc_remove_dai_links) from [<c038721c>] (snd_soc_register_card+0x4e4/0xdd4)
(snd_soc_register_card) from [<c0393c54>] (devm_snd_soc_register_card+0x34/0x70)

Fix this by replacing the devm_regmap initialization code with the non
devm_() variant.

Fixes: 700dadfefc3d ASoC: wm9713: convert to regmap
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-24 12:43:06 +09:00
7e31a01594 ALSA: hda - Apply clock gate workaround to Skylake, too
Some Skylake machines show the codec probe errors in certain
situations, e.g. HP Z240 desktop fails to probe the onboard Realtek
codec at reloading the snd-hda-intel module like:
  snd_hda_intel 0000:00:1f.3: spurious response 0x200:0x2, last cmd=0x000000
  snd_hda_intel 0000:00:1f.3: azx_get_response timeout, switching to polling mode: lastcmd=0x000f0000
  snd_hda_intel 0000:00:1f.3: No response from codec, disabling MSI: last cmd=0x000f0000
  snd_hda_intel 0000:00:1f.3: Codec #0 probe error; disabling it...
  hdaudio hdaudioC0D2: no AFG or MFG node found
  snd_hda_intel 0000:00:1f.3: no codecs initialized

Also, HP G470 G3 suffers from the similar problem, as reported in
bugzilla below.  On this machine, the codec probe error appears even
at a fresh boot.

As Libin suggested, the same workaround used for Broxton in the commit
[6639484ddaf6: ALSA: hda - disable dynamic clock gating on Broxton
 before reset] can be applied for Skylake in order to fix this problem.
The Intel HW team also confirmed that this is needed for SKL.

This patch makes the workaround applied to both SKL and BXT
platforms.  The referred macros are moved and one superfluous macro
(IS_BROXTON()) is another one (IS_BXT()) as well.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112731
Suggested-by: Libin Yang <libin.yang@linux.intel.com>
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-22 17:13:48 +01:00
56e5fd8feb ASoC: fsl_ssi: Go back to explicit register defaults
Commit 5c408fee2546 ("ASoC: fsl_ssi: remove explicit register defaults")
causes the driver to fail to probe:

fsl-ssi-dai 2028000.ssi: No cache defaults, reading back from HW
fsl-ssi-dai 2028000.ssi: Failed to init register map
fsl-ssi-dai: probe of 2028000.ssi failed with error -22

, so revert this commit.

Reported-by: Mika Penttilä <mika.penttila@nextfour.com>
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-22 12:00:03 +09:00
65b4bcb829 ASoC: Intel: Skylake: fix pointer scaling
skl_tplg_tlv_control_set does pointer maths on data but forgets that data
is not uint8_t so the maths is already scaled in the pointer type.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-20 00:32:32 +09:00
316fa9e09a ASoC: samsung: Use IRQ safe spin lock calls
Lockdep warns of a potential lock inversion, i2s->lock is held numerous
times whilst we are under the substream lock (snd_pcm_stream_lock). If
we use the IRQ unsafe spin lock calls, you can also end up locking
snd_pcm_stream_lock whilst under i2s->lock (if an IRQ happens whilst we
are holding i2s->lock). This could result in deadlock.

[   18.147001]        CPU0                    CPU1
[   18.151509]        ----                    ----
[   18.156022]   lock(&(&pri_dai->spinlock)->rlock);
[   18.160701]                                local_irq_disable();
[   18.166622]                                lock(&(&substream->self_group.lock)->rlock);
[   18.174595]                                lock(&(&pri_dai->spinlock)->rlock);
[   18.181806]   <Interrupt>
[   18.184408]     lock(&(&substream->self_group.lock)->rlock);
[   18.190045]
[   18.190045]  *** DEADLOCK ***

This patch changes to using the irq safe spinlock calls, to avoid this
issue.

Fixes: ce8bcdbb61d9 ("ASoC: samsung: i2s: Protect more registers with a spinlock")
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Tested-by: Anand Moon <linux.amoon@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
2016-02-20 00:29:19 +09:00
67ec1072b0 ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream
A non-atomic PCM stream may take snd_pcm_link_rwsem rw semaphore twice
in the same code path, e.g. one in snd_pcm_action_nonatomic() and
another in snd_pcm_stream_lock().  Usually this is OK, but when a
write lock is issued between these two read locks, the problem
happens: the write lock is blocked due to the first reade lock, and
the second read lock is also blocked by the write lock.  This
eventually deadlocks.

The reason is the way rwsem manages waiters; it's queued like FIFO, so
even if the writer itself doesn't take the lock yet, it blocks all the
waiters (including reads) queued after it.

As a workaround, in this patch, we replace the standard down_write()
with an spinning loop.  This is far from optimal, but it's good
enough, as the spinning time is supposed to be relatively short for
normal PCM operations, and the code paths requiring the write lock
aren't called so often.

Reported-by: Vinod Koul <vinod.koul@intel.com>
Tested-by: Ramesh Babu <ramesh.babu@intel.com>
Cc: <stable@vger.kernel.org> # v3.18+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-18 11:27:52 +01:00
13d5e5d472 ALSA: seq: Fix double port list deletion
The commit [7f0973e973cd: ALSA: seq: Fix lockdep warnings due to
double mutex locks] split the management of two linked lists (source
and destination) into two individual calls for avoiding the AB/BA
deadlock.  However, this may leave the possible double deletion of one
of two lists when the counterpart is being deleted concurrently.
It ends up with a list corruption, as revealed by syzkaller fuzzer.

This patch fixes it by checking the list emptiness and skipping the
deletion and the following process.

BugLink: http://lkml.kernel.org/r/CACT4Y+bay9qsrz6dQu31EcGaH9XwfW7o3oBzSQUG9fMszoh=Sg@mail.gmail.com
Fixes: 7f0973e973cd ('ALSA: seq: Fix lockdep warnings due to 'double mutex locks)
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-16 14:37:19 +01:00
0b8c82190c ALSA: hda - Cancel probe work instead of flush at remove
The commit [991f86d7ae4e: ALSA: hda - Flush the pending probe work at
remove] introduced the sync of async probe work at remove for fixing
the race.  However, this may lead to another hangup when the module
removal is performed quickly before starting the probe work, because
it issues flush_work() and it's blocked forever.

The workaround is to use cancel_work_sync() instead of flush_work()
there.

Fixes: 991f86d7ae4e ('ALSA: hda - Flush the pending probe work at remove')
Cc: <stable@vger.kernel.org> # v3.17+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-15 16:37:24 +01:00
d99a36f472 ALSA: seq: Fix leak of pool buffer at concurrent writes
When multiple concurrent writes happen on the ALSA sequencer device
right after the open, it may try to allocate vmalloc buffer for each
write and leak some of them.  It's because the presence check and the
assignment of the buffer is done outside the spinlock for the pool.

The fix is to move the check and the assignment into the spinlock.

(The current implementation is suboptimal, as there can be multiple
 unnecessary vmallocs because the allocation is done before the check
 in the spinlock.  But the pool size is already checked beforehand, so
 this isn't a big problem; that is, the only possible path is the
 multiple writes before any pool assignment, and practically seen, the
 current coverage should be "good enough".)

The issue was triggered by syzkaller fuzzer.

BugLink: http://lkml.kernel.org/r/CACT4Y+bSzazpXNvtAr=WXaL8hptqjHwqEyFA+VN2AWEx=aurkg@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-15 16:26:52 +01:00
07d86ca93d ALSA: usb-audio: avoid freeing umidi object twice
The 'umidi' object will be free'd on the error path by snd_usbmidi_free()
when tearing down the rawmidi interface. So we shouldn't try to free it
in snd_usbmidi_create() after having registered the rawmidi interface.

Found by KASAN.

Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
Acked-by: Clemens Ladisch <clemens@ladisch.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-13 09:30:58 +01:00
a947b72406 ASoC: qcom: Don't specify LE device endianness
This reverts commit 18560a4e3 (ASoC: qcom: Specify LE device
endianness).

The commit that caused us to specify LE device endianness here,
29bb45f25ff3 (regmap-mmio: Use native endianness for read/write,
2015-10-29), has been reverted in mainline so now when we specify
LE it actively breaks big endian kernels because the byte
swapping in regmap-mmio is incorrect. Let's revert this change
because it will 1) fix the big endian kernels and 2) be redundant
to specify LE because that will become the default soon.

Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-12 22:21:10 +00:00
86c2ee1670 ASoC: Fixes for v4.5
A rather large batch of fixes here, almost all in the Intel driver.
 The changes that got merged in this merge window for Skylake were rather
 large and as well as issues that you'd expect in a large block of new
 code there were some problems created for older processors which needed
 fixing up.  Things are largely settling down now hopefully.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJWvSlHAAoJECTWi3JdVIfQfngH/jCOXWPiFqHlN5/zFqiARO53
 1oqBklDvN/XujUBcOVOeA+YYI8+KbUGNIwt7N0KkdXAHOUi7h8JKj+oH6D6SYX+g
 zTLQwvc3Ijy0LCjWqsb6gaZWvkrRRzp2MWbeUym3ppESV823StqiUdH9NMWnn4NV
 zUV8BZm9KW+X468OuvNWP3QA7Z1cxE6df8nKlrI9111jd/VR1tLr0eNRxnDWalBB
 ZGLnQCC9AtisYrwAr6Bgpsh9U3Ty+LUSO0bKsH63+pRkBIcGQcm1E/JQse/o39M3
 VfJ8R1+683atnreNepBCiId+tSugzcRWxiRYpStDCGAiZe70wBJHRld0YTj0GuM=
 =P9e4
 -----END PGP SIGNATURE-----

Merge tag 'asoc-fix-v4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v4.5

A rather large batch of fixes here, almost all in the Intel driver.
The changes that got merged in this merge window for Skylake were rather
large and as well as issues that you'd expect in a large block of new
code there were some problems created for older processors which needed
fixing up.  Things are largely settling down now hopefully.
2016-02-12 09:48:51 +01:00
f11aec0d7c Merge remote-tracking branches 'asoc/fix/rt5659', 'asoc/fix/sigmadsp', 'asoc/fix/simple', 'asoc/fix/wm5110' and 'asoc/fix/wm8960' into asoc-linus 2016-02-10 19:23:09 +00:00
733f4c79de Merge remote-tracking branches 'asoc/fix/imx-spdif', 'asoc/fix/mtk', 'asoc/fix/mxs-saif', 'asoc/fix/qcom' and 'asoc/fix/rt286' into asoc-linus 2016-02-10 19:23:07 +00:00
cf0d6dd9d3 Merge remote-tracking branches 'asoc/fix/amd', 'asoc/fix/arizona', 'asoc/fix/dpcm', 'asoc/fix/dwc', 'asoc/fix/fsl' and 'asoc/fix/fsl-ssi' into asoc-linus 2016-02-10 19:23:04 +00:00
97b0d5c9b2 Merge remote-tracking branch 'asoc/fix/rt5645' into asoc-linus 2016-02-10 19:23:03 +00:00
6719f657e4 Merge remote-tracking branch 'asoc/fix/intel-kconfig' into asoc-linus 2016-02-10 19:23:02 +00:00
7ff60f58e2 Merge remote-tracking branch 'asoc/fix/intel' into asoc-linus 2016-02-10 19:23:02 +00:00
2022d24e2b Merge remote-tracking branch 'asoc/fix/dapm' into asoc-linus 2016-02-10 19:23:01 +00:00
01582a8414 ASoC: arizona: fref must be limited in pseudo-fractional mode
When the FLL is in pseudo-fractional mode there is an additional
limit on fref based on the fratio, to prevent aliasing around the
Nyquist frequency. If fref exceeds this limit the refclk divider
must be increased and the calculation tried again until a suitable
combination of fref and fratio is found or we have to fall back to
integer mode.

This patch also adds some debug log prints around this code.

Signed-off-by: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-10 19:21:41 +00:00
61c4a1ac4d ASoC: sigmadsp: Fix missleading return value
Forwarding the return value of i2c_master_send, leads to errors
later on, since i2c_master_send returns the number of bytes
transmittet. Check for ret < 0 instead and return 0 otherwise.

Signed-off-by: Pascal Huerst <pascal.huerst@gmail.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-10 18:55:01 +00:00
397da2d0ab Merge branch 'topic/core-fixes' into for-linus 2016-02-09 23:08:37 +01:00
4dff5c7b70 ALSA: timer: Fix race at concurrent reads
snd_timer_user_read() has a potential race among parallel reads, as
qhead and qused are updated outside the critical section due to
copy_to_user() calls.  Move them into the critical section, and also
sanitize the relevant code a bit.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-09 12:23:42 +01:00
b8cb3750ce ALSA: firewire-digi00x: Drop bogus const type qualifier on dot_scrt()
sound/firewire/digi00x/amdtp-dot.c:67: warning: type qualifiers ignored on function return type

Drop the bogus "const" type qualifier on the return type of dot_scrt()
to fix this.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-09 12:16:52 +01:00
2ebab40eb7 ALSA: hda - Fix bad dereference of jack object
The hda_jack_tbl entries are managed by snd_array for allowing
multiple jacks.  It's good per se, but the problem is that struct
hda_jack_callback keeps the hda_jack_tbl pointer.  Since snd_array
doesn't preserve each pointer at resizing the array, we can't keep the
original pointer but have to deduce the pointer at each time via
snd_array_entry() instead.  Actually, this resulted in the deference
to the wrong pointer on codecs that have many pins such as CS4208.

This patch replaces the pointer to the NID value as the search key.
As an unexpected good side effect, this even simplifies the code, as
only NID is needed in most cases.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-09 12:16:31 +01:00
ed8b1d6d2c ALSA: timer: Fix race between stop and interrupt
A slave timer element also unlinks at snd_timer_stop() but it takes
only slave_active_lock.  When a slave is assigned to a master,
however, this may become a race against the master's interrupt
handling, eventually resulting in a list corruption.  The actual bug
could be seen with a syzkaller fuzzer test case in BugLink below.

As a fix, we need to take timeri->timer->lock when timer isn't NULL,
i.e. assigned to a master, while the assignment to a master itself is
protected by slave_active_lock.

BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-09 12:02:32 +01:00
117159f0b9 ALSA: timer: Fix wrong instance passed to slave callbacks
In snd_timer_notify1(), the wrong timer instance was passed for slave
ccallback function.  This leads to the access to the wrong data when
an incompatible master is handled (e.g. the master is the sequencer
timer and the slave is a user timer), as spotted by syzkaller fuzzer.

This patch fixes that wrong assignment.

BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-08 17:40:08 +01:00
8ceffd229f ASoC: Intel: Add module tags for common match module
The match module lacked module license and description, so add it

Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-08 14:36:05 +00:00
cfffcc66a8 ASoC: Intel: Load the atom DPCM driver only
DPCM driver is recommended for BYT, CHT based platforms, so if
CONFIG_SND_SST_IPC_ACPI is selected then don't compile the BYT
Device IDs in common ACPI driver to avoid probe conflicts.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Acked-by: Jie Yang <yang.jie@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-08 14:36:05 +00:00
2dcffcee23 ASoC: Intel: Create independent acpi match module
The ACPI match module is common to all three drivers, HSW, SKL
and Atom-DPCM driver. But Atom-DPCM driver does not use common
sst code so we cannot include the common SST module in Atom-DPCM
driver.

So the solution is to have a independent sst-match-acpi module
which helps in matching for all the three drivers. Now all driver
can be inbuilt in a single image

This patch really fixes the regression introduced by the
commit 95f098014815 ("ASoC: Intel: Move apci find machine routines")

Acked-by: Jie Yang <yang.jie@intel.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-08 14:36:05 +00:00
902c136fe4 ASoC: Intel: Revert "ASoC: Intel: fix ACPI probe regression with Atom DPCM driver"
This reverts commit dc901a354171 ("ASoC: Intel: fix ACPI probe
regression with Atom DPCM driver") as the fix prevented the probe
on HSW/BDW if Atom-DPCM was selected

Acked-by: Jie Yang <yang.jie@intel.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-08 14:36:05 +00:00
ddce57a6f0 ALSA: dummy: Implement timer backend switching more safely
Currently the selected timer backend is referred at any moment from
the running PCM callbacks.  When the backend is switched, it's
possible to lead to inconsistency from the running backend.  This was
pointed by syzkaller fuzzer, and the commit [7ee96216c31a: ALSA:
dummy: Disable switching timer backend via sysfs] disabled the dynamic
switching for avoiding the crash.

This patch improves the handling of timer backend switching.  It keeps
the reference to the selected backend during the whole operation of an
opened stream so that it won't be changed by other streams.

Together with this change, the hrtimer parameter is reenabled as
writable now.

NOTE: this patch also turned out to fix the still remaining race.
Namely, ops was still replaced dynamically at dummy_pcm_open:

  static int dummy_pcm_open(struct snd_pcm_substream *substream)
  {
  ....
          dummy->timer_ops = &dummy_systimer_ops;
          if (hrtimer)
                  dummy->timer_ops = &dummy_hrtimer_ops;

Since dummy->timer_ops is common among all streams, and when the
replacement happens during accesses of other streams, it may lead to a
crash.  This was actually triggered by syzkaller fuzzer and KASAN.

This patch rewrites the code not to use the ops shared by all streams
any longer, too.

BugLink: http://lkml.kernel.org/r/CACT4Y+aZ+xisrpuM6cOXbL21DuM0yVxPYXf4cD4Md9uw0C3dBQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-08 08:15:35 +01:00
c44d9b1181 ALSA: hda - Fix speaker output from VAIO AiO machines
Some Sony VAIO AiO models (VGC-JS4EF and VGC-JS25G, both with PCI SSID
104d:9044) need the same quirk to make the speaker working properly.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112031
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-07 09:41:35 +01:00
6c361d10e0 Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo"
This reverts commit 0c25ad80408e95e0a4fbaf0056950206e95f726f.

The original commit disabled the aamixer path due to the noise
problem, but it turned out that some mobo with the same PCI SSID
doesn't suffer from the issue, and the disabled function (analog
loopback) is still demanded by users.

Since the recent commit [e7fdd52779a6: ALSA: hda - Implement loopback
control switch for Realtek and other codecs], we have the dynamic
mixer switch to enable/disable the aamix path, and we don't have to
disable the path statically any longer.  So, let's revert the
disablement, so that only the user suffering from the noise problem
can turn off the aamix on the fly.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=108301
Reported-by: <mutedbytes@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-05 20:19:00 +01:00
56661a2ed5 ALSA: firewire-tascam: remove needless member for control and status message
Commit 3beab0f844fa added a member for control and status message, while
it's planned and not implemented yet.

This commit removes it.

Fixes: 3beab0f844fa('ALSA: firewire-tascam: add support for outgoing MIDI messages by asynchronous transaction')
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-05 12:47:14 +01:00
61ebe49964 ALSA: firewire-tascam: remove a flag for controller
Currently, 'struct snd_tscm_spec' has a member named as 'is_controller' to
identify MIDI controller. This member was originally added to skip
parse control and status messages in isochronous packets for non-controller
model.

As long as I investigate, FW-1804 (non-controller) also transfers the
control and status message, thus it becomes meaningless.

This commit removes it.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-05 12:46:15 +01:00
3e78e1518e ALSA: firewire-tascam: add support for FW-1804
This model supports:
 * maximum 12 PCM channels for PCM playback
 * maximum 18 PCM channels for PCM capture
 * 4 ports for MIDI playback
 * 4 ports for MIDI capture
 * control and status messages in tx isochronous packets
 * up to 96.0 kHz

This commit adds support for the model. As the other supported models,
all of available PCM channels are always enabled.

As I described in commit c0949b278515da94, Ilya Zimnovich had investigated
TASCAM FireWire series in 2011 with his FW-1804. In his report, this model
has internal multiplexer and any software implementation can control it.
Following to the design of ALSA firewire stack, this commit won't
implement it. It should be in userspace via Linux fw character device.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-05 12:46:07 +01:00
5d2560a427 ALSA: firewire-tascam: fix NULL pointer dereference when model identification fails
When unsupported models are connected, snd-firewire-tascam module causes
NULL pointer dereference in fw_core_remove_address_handler() (due to
list_del_rcu()).

This commit prevents this bug.

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-05 12:45:59 +01:00
360a824568 ALSA: hda - Fix static checker warning in patch_hdmi.c
The static checker warning is:

	sound/pci/hda/patch_hdmi.c:460 hdmi_eld_ctl_get()
	error: __memcpy() 'eld->eld_buffer' too small (256 vs 512)

I have a hard time figuring out if this can ever cause an information leak
(I don't think so), but nonetheless it does not hurt to increase the
robustness of the code.

Fixes: 68e03de98507 ('ALSA: hda - hdmi: Do not expose eld data when eld is invalid')
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Cc: <stable@vger.kernel.org> # v3.9+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-05 12:35:11 +01:00
094fd3be87 ALSA: timer: Fix leftover link at closing
In ALSA timer core, the active timer instance is managed in
active_list linked list.  Each element is added / removed dynamically
at timer start, stop and in timer interrupt.  The problem is that
snd_timer_interrupt() has a thinko and leaves the element in
active_list when it's the last opened element.  This eventually leads
to list corruption or use-after-free error.

This hasn't been revealed because we used to delete the list forcibly
in snd_timer_stop() in the past.  However, the recent fix avoids the
double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link
corruption due to double start or stop]), and this leak hits reality.

This patch fixes the link management in snd_timer_interrupt().  Now it
simply unlinks no matter which stream is.

BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-02-04 17:19:09 +01:00
38c079e230 ASoC: Intel: Skylake: Remove autosuspend delay
The driver used autosuspend delay to delay going to D3. But per
HW recommendation we should go to D3 soon, so remove the delay
from driver

Signed-off-by: Subhransu S. Prusty <subhransu.s.prusty@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-04 11:36:14 +00:00
6e3ffa0042 ASoC: Intel: Skylake: Fix stereo DMIC record
DMIC BE can have 2 or 4 channels supported. The DMIC fixup needs
to take this into account.

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-04 11:36:14 +00:00
de1fedf25b ASoC: Intel: Skylake: Add missing PRE/POST_PMU handlers for vmixer
Some modules may be directly connected to a pipeline without a
mixer module. For these modules, we require PRE_PMU and POST_PMU
handler which will do bind between the pipelines, so add these
missing handlers.

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-04 11:36:14 +00:00
6bd4cf8556 ASoC: Intel: Skylake: Fix bind of source with multiple sinks
skl_tplg_bind_sinks() takes only the first sink widget. This
breaks in case we have multiple sinks for a module.

So pass source widget to skl_tplg_bind_sinks() and bind for all
sinks by calling this recursively

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-04 11:36:14 +00:00
9946f70906 ASoC: Intel: Skylake: Fix not to stop sink pipe in pga pmd event
We should not stop the sink pipe in it's pmd handler for a mixin
module as this module may still be connected to other pipes.

This will be stopped and freed by current implementation on last
connected pipe unbind.

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-04 11:36:14 +00:00
0c684c4825 ASoC: Intel: Skylake: Fix the module state check condition
For binding modules we should check if source or destination
module is in UNINT state. We canot bind even if one of them is
in this state.

So update the check from logical AND to logical OR and do not
bind modules for this case

Signed-off-by: Jeeja KP <jeeja.kp@intel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2016-02-04 11:36:14 +00:00