linux-stable.git/sound, branch v4.0.4

sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND)

2015-05-17T16:55:10+00:00

commit bc26d4d06e337ade069f33d3f4377593b24e6e36 upstream.

A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND)
on /dev/sequencer with TMR_ECHO midi event.

In this case the control flow is:
sound_ioctl()
-> case SND_DEV_SEQ:
   case SND_DEV_SEQ2:
     sequencer_ioctl()
     -> case SNDCTL_SEQ_OUTOFBAND:
          spin_lock_irqsave(&lock,flags);
          play_event();
          -> case EV_TIMING:
               seq_timing_event()
               -> case TMR_ECHO:
                    seq_copy_to_input()
                    -> spin_lock_irqsave(&lock,flags);

It seems that spin_lock_irqsave() around play_event() is not necessary,
because the only other call location in seq_startplay() makes the call
without acquiring spinlock.

So, the patch just removes spinlocks around play_event().
By the way, it removes unreachable code in seq_timing_event(),
since (seq_mode == SEQ_2) case is handled in the beginning.

Compile tested only.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: Takashi Iwai 
Cc: Willy Tarreau 
Signed-off-by: Greg Kroah-Hartman

ASoC: rt5677: fixed wrong DMIC ref clock

2015-05-13T12:14:27+00:00

commit 60a8d62b8497c23eb3d48149af7e55dac2dd83a2 upstream.

DMIC clock source is not from codec system clock directly. it is
generated from the division of system clock. And it should be 256 *
sample rate of AIF1.

Signed-off-by: Bard Liao 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

ASoC: rt5677: add register patch for PLL

2015-05-13T12:14:27+00:00

commit 74d6ea52aeef0236242221c6eff6d892565c5a92 upstream.

The PLL output will be unstable in some cases. We can fix it by
setting some registers.

Signed-off-by: Bard Liao 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

ASoC: tfa9879: Fix return value check in tfa9879_i2c_probe()

2015-05-13T12:14:26+00:00

commit 427ced4b203dfea4f08b1298cd1f88e19039fca4 upstream.

In case of error, the function devm_kzalloc() returns NULL
not ERR_PTR(). The IS_ERR() test in the return value check
should be replaced with NULL test.

Signed-off-by: Wei Yongjun 
Acked-by: Peter Rosin 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

ASoC: samsung: s3c24xx-i2s: Fix return value check in s3c24xx_iis_dev_probe()

2015-05-13T12:14:26+00:00

commit c479163a1b6ab424786fbcd9225b4e3c1c58eb0b upstream.

In case of error, the function devm_ioremap_resource() returns
ERR_PTR() and never returns NULL. The NULL test in the return
value check should be replaced with IS_ERR().

Signed-off-by: Wei Yongjun 
Reviewed-by: Krzysztof Kozlowski 
Signed-off-by: Mark Brown 
Signed-off-by: Greg Kroah-Hartman

ALSA: hda - Add mute-LED mode control to Thinkpad

2015-05-13T12:14:25+00:00

commit 7290006d8c0900c56d8c58428134f02c35109d17 upstream.

This patch adds the missing flag to enable "Mute-LED Mode" mixer enum
ctl for Thinkpads that have also the software mute-LED control.

Reported-and-tested-by: Pali Rohár 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: hda - Fix mute-LED fixed mode

2015-05-13T12:14:25+00:00

commit ee52e56e7b12834476cd0031c5986254ba1b6317 upstream.

The mute-LED mode control has the fixed on/off states that are
supposed to remain on/off regardless of the master switch.  However,
this doesn't work actually because the vmaster hook is called in the
vmaster code itself.

This patch fixes it by calling the hook indirectly after checking the
mute LED mode.

Reported-and-tested-by: Pali Rohár 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: emu10k1: Emu10k2 32 bit DMA mode

2015-05-13T12:14:24+00:00

commit 7241ea558c6715501e777396b5fc312c372e11d9 upstream.

Looks like audigy emu10k2 (probably emu10k1 - sb live too) support two
modes for DMA. Second mode is useful for 64 bit os with more then 2 GB
of ram (fixes problems with big soundfont loading)

1) 32MB from 2 GB address space using 8192 pages (used now as default)
2) 16MB from 4 GB address space using 4096 pages

Mode is set using HCFG_EXPANDED_MEM flag in HCFG register.
Also format of emu10k2 page table is then different.

Signed-off-by: Peter Zubaj 
Tested-by: Takashi Iwai 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: emu10k1: Fix card shortname string buffer overflow

2015-05-13T12:14:24+00:00

commit d02260824e2cad626fb2a9d62e27006d34b6dedc upstream.

Some models provide too long string for the shortname that has 32bytes
including the terminator, and it results in a non-terminated string
exposed to the user-space.  This isn't too critical, though, as the
string is stopped at the succeeding longname string.

This patch fixes such entries by dropping "SB" prefix (it's enough to
fit within 32 bytes, so far).  Meanwhile, it also changes strcpy()
with strlcpy() to make sure that this kind of problem won't happen in
future, too.

Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: emux: Fix mutex deadlock in OSS emulation

2015-05-13T12:14:24+00:00

commit 1c94e65c668f44d2c69ae7e7fc268ab3268fba3e upstream.

The OSS emulation in synth-emux helper has a potential AB/BA deadlock
at the simultaneous closing and opening:

  close ->
    snd_seq_release() ->
      sne_seq_free_client() ->
        snd_seq_delete_all_ports(): takes client->ports_mutex ->
	  port_delete() ->
	    snd_emux_unuse(): takes emux->register_mutex

  open ->
    snd_seq_oss_open() ->
      snd_emux_open_seq_oss(): takes emux->register_mutex ->
        snd_seq_event_port_attach() ->
	  snd_seq_create_port(): takes client->ports_mutex

This patch addresses the deadlock by reducing the rance taking
emux->register_mutex in snd_emux_open_seq_oss().  The lock is needed
for the refcount handling, so move it locally.  The calls in
emux_seq.c are already with the mutex, thus they are replaced with the
version without mutex lock/unlock.

Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman