linux-stable.git/sound, branch v3.2.81

ALSA: timer: Use mod_timer() for rearming the system timer

2016-04-30T22:05:23+00:00

commit 4a07083ed613644c96c34a7dd2853dc5d7c70902 upstream.

ALSA system timer backend stops the timer via del_timer() without sync
and leaves del_timer_sync() at the close instead.  This is because of
the restriction by the design of ALSA timer: namely, the stop callback
may be called from the timer handler, and calling the sync shall lead
to a hangup.  However, this also triggers a kernel BUG() when the
timer is rearmed immediately after stopping without sync:
 kernel BUG at kernel/time/timer.c:966!
 Call Trace:
  
  [] snd_timer_s_start+0x13e/0x1a0
  [] snd_timer_interrupt+0x504/0xec0
  [] ? debug_check_no_locks_freed+0x290/0x290
  [] snd_timer_s_function+0xb4/0x120
  [] call_timer_fn+0x162/0x520
  [] ? call_timer_fn+0xcd/0x520
  [] ? snd_timer_interrupt+0xec0/0xec0
  ....

It's the place where add_timer() checks the pending timer.  It's clear
that this may happen after the immediate restart without sync in our
cases.

So, the workaround here is just to use mod_timer() instead of
add_timer().  This looks like a band-aid fix, but it's a right move,
as snd_timer_interrupt() takes care of the continuous rearm of timer.

Reported-by: Jiri Slaby 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call

2016-04-30T22:05:22+00:00

commit 836b34a935abc91e13e63053d0a83b24dfb5ea78 upstream.

create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and
create_uaxx_quirk() functions allocate the audioformat object by themselves
and free it upon error before returning. However, once the object is linked
to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be
double-freed, eventually resulting in a memory corruption.

This patch fixes these failures in the error paths by unlinking the audioformat
object before freeing it.

Based on a patch by Takashi Iwai 

[Note for stable backports:
 this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor
 code cleanup in create_fixed_stream_quirk()')]

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()

2016-04-30T22:05:21+00:00

commit 902eb7fd1e4af3ac69b9b30f8373f118c92b9729 upstream.

Just a minor code cleanup: unify the error paths.

Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

ALSA: usb-audio: Add sanity checks for endpoint accesses

2016-04-30T22:05:18+00:00

commit 447d6275f0c21f6cc97a88b3a0c601436a4cdf2a upstream.

Add some sanity check codes before actually accessing the endpoint via
get_endpoint() in order to avoid the invalid access through a
malformed USB descriptor.  Mostly just checking bNumEndpoints, but in
one place (snd_microii_spdif_default_get()), the validity of iface and
altsetting index is checked as well.

Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.2: drop changes to code we don't have]
Signed-off-by: Ben Hutchings

ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()

2016-04-30T22:05:18+00:00

commit 0f886ca12765d20124bd06291c82951fd49a33be upstream.

create_fixed_stream_quirk() may cause a NULL-pointer dereference by
accessing the non-existing endpoint when a USB device with a malformed
USB descriptor is used.

This patch avoids it simply by adding a sanity check of bNumEndpoints
before the accesses.

Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.2:
 - There's no altsd variable
 - Adjust context]
Signed-off-by: Ben Hutchings

ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.

2016-04-30T22:05:17+00:00

commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream.

The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41
will often fail, so add a quirk entry to fix it.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087
Signed-off-by: Vittorio Gambaletta 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: seq: oss: Don't drain at closing a client

2016-04-01T00:54:36+00:00

commit 197b958c1e76a575d77038cc98b4bebc2134279f upstream.

The OSS sequencer client tries to drain the pending events at
releasing.  Unfortunately, as spotted by syzkaller fuzzer, this may
lead to an unkillable process state when the event has been queued at
the far future.  Since the process being released can't be signaled
any longer, it remains and waits for the echo-back event in that far
future.

Back to history, the draining feature was implemented at the time we
misinterpreted POSIX definition for blocking file operation.
Actually, such a behavior is superfluous at release, and we should
just release the device as is instead of keeping it up forever.

This patch just removes the draining call that may block the release
for too long time unexpectedly.

BugLink: http://lkml.kernel.org/r/CACT4Y+Y4kD-aBGj37rf-xBw9bH3GMU6P+MYg4W1e-s-paVD2pg@mail.gmail.com
Reported-by: Dmitry Vyukov 
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.2: snd_seq_oss_drain_write() has an extra log statement
 to be deleted]
Signed-off-by: Ben Hutchings

ASoC: wm8994: Fix enum ctl accesses in a wrong type

2016-04-01T00:54:36+00:00

commit 8019c0b37cd5a87107808300a496388b777225bf upstream.

The DRC Mode like "AIF1DRC1 Mode" and EQ Mode like "AIF1.1 EQ Mode" in
wm8994 codec driver are enum ctls, while the current driver accesses
wrongly via value.integer.value[].  They have to be via
value.enumerated.item[] instead.

Signed-off-by: Takashi Iwai 
Signed-off-by: Mark Brown 
Signed-off-by: Ben Hutchings

ASoC: wm8958: Fix enum ctl accesses in a wrong type

2016-04-01T00:54:36+00:00

commit d0784829ae3b0beeb69b476f017d5c8a2eb95198 upstream.

"MBC Mode", "VSS Mode", "VSS HPF Mode" and "Enhanced EQ Mode" ctls in
wm8958 codec driver are enum, while the current driver accesses
wrongly via value.integer.value[].  They have to be via
value.enumerated.item[] instead.

Signed-off-by: Takashi Iwai 
Signed-off-by: Mark Brown 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

ALSA: hdsp: Fix wrong boolean ctl value accesses

2016-04-01T00:54:36+00:00

commit eab3c4db193f5fcccf70e884de9a922ca2c63d80 upstream.

snd-hdsp driver accesses enum item values (int) instead of boolean
values (long) wrongly for some ctl elements.  This patch fixes them.

Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings