linux-stable.git/include/sound/soc.h, branch linux-5.0.y

ASoC: dpcm: prevent snd_soc_dpcm use after free

2019-05-10T16:36:05+00:00

[ Upstream commit a9764869779081e8bf24da07ac040e8f3efcf13a ]

The dpcm get from fe_clients/be_clients
may be free before use

Add a spin lock at snd_soc_card level,
to protect the dpcm instance.
The lock may be used in atomic context, so use spin lock.

Use irq spin lock version,
since the lock may be used in interrupts.

possible race condition between
void dpcm_be_disconnect(
	...
	list_del(&dpcm->list_be);
	list_del(&dpcm->list_fe);
	kfree(dpcm);
	...

and
	for_each_dpcm_fe()
	for_each_dpcm_be*()

race condition example
Thread 1:
    snd_soc_dapm_mixer_update_power()
        -> soc_dpcm_runtime_update()
            -> dpcm_be_disconnect()
                -> kfree(dpcm);
Thread 2:
    dpcm_fe_dai_trigger()
        -> dpcm_be_dai_trigger()
            -> snd_soc_dpcm_can_be_free_stop()
                -> if (dpcm->fe == fe)

Excpetion Scenario:
	two FE link to same BE
	FE1 -> BE
	FE2 ->

	Thread 1: switch of mixer between FE2 -> BE
	Thread 2: pcm_stop FE1

Exception:

Unable to handle kernel paging request at virtual address dead0000000000e0

pc=<> [] dpcm_be_dai_trigger+0x29c/0x47c
	sound/soc/soc-pcm.c:3226
		if (dpcm->fe == fe)
lr=<> [] dpcm_fe_dai_do_trigger+0x94/0x26c

Backtrace:
[] notify_die+0x68/0xb8
[] die+0x118/0x2a8
[] __do_kernel_fault+0x13c/0x14c
[] do_translation_fault+0x64/0xa0
[] do_mem_abort+0x4c/0xd0
[] el1_da+0x24/0x40
[] dpcm_be_dai_trigger+0x29c/0x47c
[] dpcm_fe_dai_do_trigger+0x94/0x26c
[] dpcm_fe_dai_trigger+0x3c/0x44
[] snd_pcm_do_stop+0x50/0x5c
[] snd_pcm_action+0xb4/0x13c
[] snd_pcm_drop+0xa0/0x128
[] snd_pcm_common_ioctl+0x9d8/0x30f0
[] snd_pcm_ioctl_compat+0x29c/0x2f14
[] compat_SyS_ioctl+0x128/0x244
[] el0_svc_naked+0x34/0x38
[] 0xffffffffffffffff

Signed-off-by: KaiChieh Chuang 
Signed-off-by: Mark Brown 
Signed-off-by: Sasha Levin

ASoC: soc-core: fix init platform memory handling

2019-01-14T22:48:16+00:00

snd_soc_init_platform initializes pointers to snd_soc_dai_link which is
statically allocated and it does this by devm_kzalloc. In the event of
an EPROBE_DEFER the memory will be freed and the pointers are left
dangling. snd_soc_init_platform sees the dangling pointers and assumes
they are pointing to initialized memory and does not reallocate them on
the second probe attempt which results in a use after free bug since
devm has freed the memory from the first probe attempt.

Since the intention for snd_soc_dai_link->platform is that it can be set
statically by the machine driver we need to respect the pointer in the
event we did not set it but still catch dangling pointers. The solution
is to add a flag to track whether the pointer was dynamically allocated
or not.

Signed-off-by: Curtis Malainey 
Signed-off-by: Mark Brown

Merge branch 'for-4.20' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into asoc-4.21 intel dep

2018-12-13T14:36:46+00:00

ASoC: soc.h: makes snd_soc_of_parse_audio_prefix() inline

2018-11-26T12:23:22+00:00

commit 3b7103562c03c ("ASoC: soc-core: add
snd_soc_of_parse_node_prefix()") maked snd_soc_of_parse_audio_prefix()
as #define. But it'd be better to make this a static inline rather than
a #define. It helps with error messages and type safety.
This patch makes it inline.

Signed-off-by: Kuninori Morimoto 
Signed-off-by: Mark Brown

ASoC: soc-core: add snd_soc_of_parse_node_prefix()

2018-11-23T14:01:47+00:00

Current ASoC has snd_soc_of_parse_audio_prefix() to get codec_conf
settings from DT which is used to avoid DAI naming conflict when
CPU/Codec matching.

Currently, it is parsing from "top node",
but, we want to parse from "each sub node" if sound card had multi
cpus/codecs.

This patch adds new snd_soc_of_parse_node_prefix() to allow parsing
settings from selected node.
It is keeping existing snd_soc_of_parse_audio_prefix() by using macro.

Signed-off-by: Kuninori Morimoto 
Signed-off-by: Mark Brown

ASoC: wm97xx: fix uninitialized regmap pointer problem

2018-11-05T10:37:39+00:00

gcc notices that without either the ac97 bus or the pdata, we never
initialize the regmap pointer, which leads to an uninitialized variable
access:

sound/soc/codecs/wm9712.c: In function 'wm9712_soc_probe':
sound/soc/codecs/wm9712.c:666:2: error: 'regmap' may be used uninitialized in this function [-Werror=maybe-uninitialized]

Since that configuration is invalid, it's better to return an error
here. I tried to avoid adding complexity to the conditions, and turned
the #ifdef into a regular if(IS_ENABLED()) check for readability.
This in turn requires moving some header file declarations out of
an #ifdef.

The same code is used in three drivers, all of which I'm changing
the same way.

Fixes: 2ed1a8e0ce8d ("ASoC: wm9712: add ac97 new bus support")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Mark Brown

ASoC: fix oops w/ for_each_rtd_codec_dai_rollback() macro

2018-10-30T15:31:11+00:00

A kernel oops happens on an error case (usual missing BE mixer
configuration required by Intel SST driver). Git bisect points to this
macro and an operator precedence issue.

	for (; ((i--) >= 0) && ((dai) = rtd->codec_dais[i]);)

The initial code replaced by this macro was
	while (--i >= 0) {
		codec_dai = rtd->codec_dais[i];

Fix the C operator precedence difference by reverting to pre-decrement

Fixes: 0b7990e3897 ('ASoC: add for_each_rtd_codec_dai() macro')
Cc: Kuninori Morimoto 
Signed-off-by: Pierre-Louis Bossart 
Signed-off-by: Mark Brown

ASoC: add for_each_component_dais() macro

2018-09-21T17:12:44+00:00

To be more readable code, this patch adds
new for_each_component_dais() macro, and replace existing code to it.

Signed-off-by: Kuninori Morimoto 
Signed-off-by: Mark Brown

ASoC: add for_each_comp_order() macro

2018-09-20T17:31:18+00:00

To be more readable code, this patch adds
new for_each_comp_order() macro, and replace existing code to it.

Signed-off-by: Kuninori Morimoto 
Signed-off-by: Mark Brown

ASoC: add for_each_card_components() macro

2018-09-20T17:22:58+00:00

To be more readable code, this patch adds
new for_each_card_components() macro, and replace existing code to it.

Signed-off-by: Kuninori Morimoto 
Signed-off-by: Mark Brown