linux-stable.git/sound, branch v3.16.69

ALSA: usb-audio: Fix implicit fb endpoint setup by quirk

2019-05-02T20:41:49+00:00

commit 2bc16b9f3223d049b57202ee702fcb5b9b507019 upstream.

The commit a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to
separate function") introduced an error in the handling of quirks for
implicit feedback endpoints. This commit fixes this.

If a quirk successfully sets up an implicit feedback endpoint, usb-audio
no longer tries to find the implicit fb endpoint itself.

Fixes: a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function")
Signed-off-by: Manuel Reinhardt 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: cs46xx: Potential NULL dereference in probe

2019-05-02T20:41:14+00:00

commit 1524f4e47f90b27a3ac84efbdd94c63172246a6f upstream.

The "chip->dsp_spos_instance" can be NULL on some of the ealier error
paths in snd_cs46xx_create().

Reported-by: "Yavuz, Tuba" 
Signed-off-by: Dan Carpenter 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages

2019-05-02T20:41:13+00:00

commit 44fabd8cdaaa3acb80ad2bb3b5c61ae2136af661 upstream.

snd_pcm_lib_malloc_pages() may fail, so let's check its status and
return its error code upstream.

Signed-off-by: Kangjie Lu 
Acked-by: Pierre-Louis Bossart 
Signed-off-by: Mark Brown 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings

ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode

2019-05-02T20:41:13+00:00

commit 667e9334fa64da2273e36ce131b05ac9e47c5769 upstream.

During the bootup of the kernel, the DAPM bias level is in the OFF
state. As soon as the DAPM framework kicks in it pushes the codec
into STANDBY state.

The probe function doesn't prepare the clock, and STANDBY state
does a clk_disable_unprepare() without checking the previous state.
This leads to an OOPS.

Not transitioning from an OFF state to the STANDBY state fixes the
problem.

Signed-off-by: b-ak 
Signed-off-by: Mark Brown 
[bwh: Backported to 3.16:
 - Open-code snd_soc_component_get_bias_level()
 - Adjust context]
Signed-off-by: Ben Hutchings

ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks

2019-05-02T20:41:11+00:00

commit cbb2ebf70daf7f7d97d3811a2ff8e39655b8c184 upstream.

In `create_composite_quirk`, the terminating condition of for loops is
`quirk->ifnum < 0`. So any composite quirks should end with `struct
snd_usb_audio_quirk` object with ifnum < 0.

    for (quirk = quirk_comp->data; quirk->ifnum >= 0; ++quirk) {

    	.....
    }

the data field of Bower's & Wilkins PX headphones usb device device quirks
do not end with {.ifnum = -1}, wihch may result in out-of-bound read.

This Patch fix the bug by adding an ending quirk object.

Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
Signed-off-by: Hui Peng 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: usb-audio: Always check descriptor sizes in parser code

2019-05-02T20:41:11+00:00

commit 3e96d7280f16e2f787307f695a31296b9e4a1cd7 upstream.

There are a few places where we access the data without checking the
actual object size from the USB audio descriptor.  This may result in
OOB access, as recently reported.

This patch addresses these missing checks.  Most of added codes are
simple bLength checks in the caller side.  For the input and output
terminal parsers, we put the length check in the parser functions.
For the input terminal, a new argument is added to distinguish between
UAC1 and the rest, as they treat different objects.

Reported-by: Mathias Payer 
Reported-by: Hui Peng 
Tested-by: Hui Peng 
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.16:
 - Drop changes in parse_audio_input_terminal() and UAC3 handling
 - Adjust context, indentation]
Signed-off-by: Ben Hutchings

ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()

2019-05-02T20:41:10+00:00

commit f4351a199cc120ff9d59e06d02e8657d08e6cc46 upstream.

The parser for the processing unit reads bNrInPins field before the
bLength sanity check, which may lead to an out-of-bound access when a
malformed descriptor is given.  Fix it by assignment after the bLength
check.

Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: hda/tegra: clear pending irq handlers

2019-04-04T15:14:10+00:00

commit 63d2a9ec310d8bcc955574220d4631aa55c1a80c upstream.

Even after disabling interrupts on the module, it could be possible
that irq handlers are still running. System hang is seen during
suspend path. It was found that, there were pending writes on the
HDA bus and clock was disabled by that time.

Above mentioned issue is fixed by clearing any pending irq handlers
before disabling clocks and returning from hda suspend.

Suggested-by: Mohan Kumar 
Suggested-by: Dara Ramesh 
Signed-off-by: Sameer Pujar 
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.16:
 - Use azx::irq instead of hdac_bus::irq
 - Adjust context]
Signed-off-by: Ben Hutchings

ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities

2019-04-04T15:13:58+00:00

commit 5ae4f61f012a097df93de2285070ec8e34716d29 upstream.

ipcm->substream is indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

sound/pci/emu10k1/emufx.c:1031 snd_emu10k1_ipcm_poke() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap)
sound/pci/emu10k1/emufx.c:1075 snd_emu10k1_ipcm_peek() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap)

Fix this by sanitizing ipcm->substream before using it to index emu->fx8010.pcm

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: rme9652: Fix potential Spectre v1 vulnerability

2019-04-04T15:13:58+00:00

commit 0b84304ef5da92add8dc75a1b07879c5374cdb05 upstream.

info->channel is indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

sound/pci/rme9652/hdsp.c:4100 snd_hdsp_channel_info() warn: potential spectre issue 'hdsp->channel_map' [r] (local cap)

Fix this by sanitizing info->channel before using it to index hdsp->channel_map

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

Also, notice that I refactored the code a bit in order to get rid of the
following checkpatch warning:

ERROR: do not use assignment in if condition
FILE: sound/pci/rme9652/hdsp.c:4103:
	if ((mapped_channel = hdsp->channel_map[info->channel]) < 0)

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings