When 'kzalloc()' fails in 'snd_hda_attach_pcm_stream()', a new pcm instance is
created without setting its operators via 'snd_pcm_set_ops()'. Following
operations on the new pcm instance can trigger kernel null pointer dereferences
and cause kernel oops.
This bug was found with my work on building a gray-box fault-injection tool for
linux-kernel-module binaries. A kernel null pointer dereference was confirmed
from line 'substream->ops->open()' in function 'snd_pcm_open_substream()' in
file 'sound/core/pcm_native.c'.
This patch fixes the bug by calling 'snd_device_free()' in the error handling
path of 'kzalloc()', which removes the new pcm instance from the snd card before
returns with an error code.
Signed-off-by: Bo Chen <chenbo@pdx.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
match_string() returns the index of an array for a matching string,
which can be used instead of open coded variant.
Signed-off-by: Yisheng Xie <xieyisheng1@huawei.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
We want the loop to exit when "to" is set to zero, but in the current
code it's set to -1. Also I tweaked the indenting so it doesn't look
like we're passing "--to" to xenbus_read_unsigned().
Fixes: cc3196ae19 ("ALSA: xen-front: Introduce Xen para-virtualized sound frontend driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
We have several Lenovo AIOs like M810z, M820z and M920z, they have
the same design for mic-mute hotkey and led and they use the same
codec with the same pin configuration, so use the pin conf table to
apply fix to all of them.
Fixes: 29693efcea ("ALSA: hda - Fix micmute hotkey problem for a lenovo AIO machine")
Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Added a new helper file for these fixups due to requiring a huge number
of coefs being set to get the top speakers to work, as well as
setting pin 0x17 for the top speakers and the correct input source
of 0x17 for volume control
[ Note: this is a revised work based on Tom's fixup patch with the
replacement of the full COEF tables provided by Realtek.
Also, the fixup function has a proper HDA_FIXUP_ACT_* handling now.
The credit for the new COEF table goes to Kailang -- tiwai ]
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=189331
Cc: Kailang Yang <kailang@realtek.com>
Signed-off-by: Tom Briden <tom@decompile.me.uk>
Tested-by: Tom Briden <tom@decompile.me.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch adds the mute LED control for HP Spectre x360 Kabylake
model. The mute LED is controlled via VREF bits on NID 0x1b, so we
need a new fixup function.
Note that this doesn't fix the other issues like the missing speaker
output on the machine. They will be addressed by later patches.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=189331
Signed-off-by: Tom Briden <tom@decompile.me.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Currently, USB-audio driver allocates the PCM buffer via vmalloc(), as
this serves merely as an intermediate buffer that is copied to each
URB transfer buffer. This works well in general on x86, but on some
archs this may result in cache coherency issues when mmap is used.
OTOH, it works also on such arch unless mmap is used.
This patch is a step for mitigating the inconvenience; a new module
option "use_vmalloc" is provided so that user can choose to allocate
the DMA coherent buffer instead of the existing vmalloc buffer.
The drawback is that it'd be the standard dma_alloc_coherent() calls
and the system would require contiguous pages on non-x86 archs.
Note that it's a global option and not dynamically switchable since
the buffer is pre-allocated at the probe time. In theory, it's
possible to be switchable, but it'd be trickier and racier.
As default use_vmalloc option is set to true, so that the old behavior
is kept. For allowing the coherent mmap on ARM or MIPS, pass
use_vmalloc=0 option explicitly.
Reported-and-tested-by: Daniel Danzberger <daniel@dd-wrt.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Power-saving is causing a humming sound when active on the Intel
NUC5i7RY, add it to the blacklist.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=199607
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
gcc-8 warns that pcm_instance->name is not necessarily terminated correctly
if the input is more than 80 characters long or lacks a termination byte
itself:
In function 'strncpy',
inlined from 'cfg_device' at sound/xen/xen_snd_front_cfg.c:399:3,
inlined from 'xen_snd_front_cfg_card' at sound/xen/xen_snd_front_cfg.c:509:9:
include/linux/string.h:254:9: error: '__builtin_strncpy' specified bound 80 equals destination size [-Werror=stringop-truncation]
return __builtin_strncpy(p, q, size);
Using strlcpy() instead of strncpy() makes this a bit safer.
Fixes: fd3b36045c ("ALSA: xen-front: Read sound driver configuration from Xen store")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Simplify the device management by replacing the lowlevel device object
allocation with the card->private_data. Nowadays there is almost no
advantage by the lowlevel device, and with card->private_data, the
code becomes cleaner.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Avoid if ((err = ...) style and expand to multiple lines instead.
No change in the end result, but just the beautification.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
... so that we can avoid the extra goto lines.
Also beautify the code to follow the standard codex.
No functional changes.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The stream direction in open and close callbacks can be retrieved from
substream->direction, hence we don't have to stick with the unique PCM
ops hard-coded for each direction. Rewrite the common open/close
callback functions.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The negative error return from the call to to_sndif_format is being
assigned to an unsigned 8 bit integer and hence the check for a negative
value is always going to be false. Fix this by using ret as the error
return and hence the negative error can be detected and assign
the u8 sndif_format to ret if there is no error.
Detected by CoverityScan, CID#1469385 ("Unsigned compared against 0")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamoccchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The error for a -ve value in ret is redundant as all previous
assignments to ret have an associated -ve check and hence it
is impossible for ret to be less that zero at the point of the
check. Remove this redundant error check.
Detected by CoveritScan, CID#1469407 ("Logically Dead code")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Convert the S_<FOO> symbolic permissions to their octal equivalents as
using octal and not symbolic permissions is preferred by many as more
readable.
see: https://lkml.org/lkml/2016/8/2/1945
Done with automated conversion via:
$ ./scripts/checkpatch.pl -f --types=SYMBOLIC_PERMS --fix-inplace <files...>
Miscellanea:
o Wrapped one multi-line call to a single line
Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
At present, all of models produced by TC Electronic except for Konnekt Live
are supported with hard-coded their stream formats. Studio Konnekt 48 is
sore model to support dual streams for both directions. The second stream
has no MIDI conformant data channel in its data block. But current
implementation transfers the second stream with MIDI conformant data
channel.
This commit fixes this issue.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Drop pci_device() macro that just leads to chip->pci->dev, and pass it
directly to request_firmware(). It was introduced for allowing the
external alsa-driver kernel module builds. Since it was discontinued
years ago, we should clean it up now.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Drop the superfluous #ifndef checks that had been put just for
allowing building the alsa-driver kernel modules externally.
Since the external build was discontinued years ago, let's clean up
the old kludges.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Drop the superfluous #ifndef check in memalloc.h that had been put
just for allowing building the alsa-driver kernel modules externally.
Since the external build was discontinued years ago, let's clean up
the old kludges.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Power-saving is causing plops on audio start/stop on ASRock H81M-HDS
machines, add these to the power_save blacklist.
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1525104
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Power-saving is causing plops on audio start/stop on Gigabyte
P55A-UD3 and Gigabyte Z87-D3HP machines, add these to the power_save
blacklist.
Note these 2 boards both use 1458:a002 as subsystem ids, so they share
a single entry.
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1525104
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Power-saving is causing a plop and silences the first 2 seconds
(give or take) of audio, silencing notifications sounds on Medion /
Clevo W35xSS_370SS laptops.
Add the Clevo W35xSS_370SS to the power_save blacklist.
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1581607
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Power-saving is causing a humming sound when active on the Intel
NUC7i3BNB, add it to the blacklist.
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520902
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
HP Z2 G4 requires the same workaround as other HP machines that have
no mic-pin detection.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
match_string() returns the index of an array for a matching string,
which can be used intead of open coded variant.
Signed-off-by: Yisheng Xie <xieyisheng1@huawei.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The "entry" pointer is always non-NULL so this test for out of bounds
won't work.
Fixes: f1f0f330b1 ("ALSA: dice: add parameters of stream formats for models produced by TC Electronic")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
--nextPart3916812.EicPReet6m
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Mytek manufactures some equipment with DICE-based firewire ports. These
devices contain old versions of DICE firmware which lacks detailed
stream format reporting for all sampling clock modes.
Building upon the recent work by Takashi Sakamoto, hard-coded parameters
are added for the Stereo 192 DSD-DAC. When the device vendor and model
match the coded parameters are copied into the stream format cache.
Signed-off-by: Melvin Vermeeren <mail@mel.vin>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
There are still many places calling the timer's hw.c_resolution
callback without lock, and this may lead to some races, as we faced in
the commit a820ccbe21 ("ALSA: pcm: Fix UAF at PCM release via PCM
timer access").
This patch changes snd_timer_resolution() to take the timer->lock for
avoiding the races. A place calling this function already inside the
lock (from the notifier) is replaced with the
snd_timer_hw_resolution() accordingly, as well as wrapping with the
lock around another place calling snd_timer_hw_resolution(), too.
Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Instead of open-coding for getting the timer resolution, use the
standard snd_timer_resolution() helper.
The original code falls back to the callback function when the
resolution is zero, but it must be always so when the callback
function is defined. So this should be no functional change.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
There multiple open-codes to get the hardware timer resolution.
Make a local helper function snd_timer_hw_resolution() and call it
from all relevant places.
There is no functional change by this, just a preliminary work for the
following timer resolution hardening patch.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit f65e0d2998 ("ALSA: timer: Call notifier in the same spinlock")
combined the start/continue and stop/pause functions, and in doing so
changed the event code for the pause case to SNDRV_TIMER_EVENT_CONTINUE.
Change it back to SNDRV_TIMER_EVENT_PAUSE.
Fixes: f65e0d2998 ("ALSA: timer: Call notifier in the same spinlock")
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
UAC3 channel map is created during interface parsing,
and in some cases was not freed in failure paths.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The error messages at sanity checks of memory pages tend to repeat too
many times once when it hits, and without the rate limit, it may flood
and become unreadable. Replace such messages with the *_ratelimited()
variant.
Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1093027
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Trivial fix to spelling mistakes in audigy_outs arrays.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The commit 289ca025ee ("ALSA: Use priority list for managing device
list") changed the way to register/disconnect/free devices via a
single priority list. This helped to make behavior consistent, but it
also changed a slight behavior change: namely, the control device is
registered earlier than others, while it was supposed to be the very
last one.
I've put SNDRV_DEV_CONTROL in the current position as the release of
ctl elements often conflict with the private ctl elements some PCM or
other components may create, which often leads to a double-free.
But, the order of register and disconnect should be indeed fixed as
expected in the early days: the control device gets registered at
last, and disconnected at first.
This patch changes the priority list order to move SNDRV_DEV_CONTROL
as the last guy to assure the register / disconnect order. Meanwhile,
for keeping the messy resource release order, manually treat the
control and lowlevel devices as last freed one.
Additional note:
The lowlevel device is the device where a card driver creates at
probe. And, we still keep the release order control -> lowlevel, as
there might be link from a control element back to a lowlevel object.
Fixes: 289ca025ee ("ALSA: Use priority list for managing device list")
Reported-by: Tzung-Bi Shih <tzungbi@google.com>
Tested-by: Tzung-Bi Shih <tzungbi@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
retire_capture_urb() may print warning messages when the given URB
doesn't align, and this may flood the system log easily.
Put the rate limit to the message for avoiding it.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1093485
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Implement essential initialization of the sound driver:
- introduce required data structures
- handle driver registration
- handle sound card registration
- register sound driver on backend connection
- remove sound driver on backend disconnect
Initialize virtual sound card with streams according to the
Xen store configuration.
Implement ALSA driver operations including:
- manage frontend/backend shared buffers
- manage Xen bus event channel states
Implement requests from front to back for ALSA
PCM operations.
- report ALSA period elapsed event: handle XENSND_EVT_CUR_POS
notifications from the backend when stream position advances
during playback/capture. The event carries a value of how
many octets were played/captured at the time of the event.
- implement explicit stream parameter negotiation between
backend and frontend: handle XENSND_OP_HW_PARAM_QUERY request
to read/update configuration space for the parameter given:
request passes desired parameter interval and the response to
this request returns min/max interval for the parameter to be used.
Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Handle Xen event channels:
- create for all configured streams and publish
corresponding ring references and event channels in Xen store,
so backend can connect
- implement event channels interrupt handlers
- create and destroy event channels with respect to Xen bus state
Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
