linux-stable.git/sound, branch v4.6.6

ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt

2016-08-10T10:54:44+00:00

commit e4ec8cc8039a7063e24204299b462bd1383184a5 upstream.

The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: Kangjie Lu 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: timer: Fix leak in events via snd_timer_user_ccallback

2016-08-10T10:54:44+00:00

commit 9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6 upstream.

The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: Kangjie Lu 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS

2016-08-10T10:54:44+00:00

commit cec8f96e49d9be372fdb0c3836dcf31ec71e457e upstream.

The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: Kangjie Lu 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: hda: add AMD Stoney PCI ID with proper driver caps

2016-07-27T15:42:23+00:00

commit d716fb03f76411fc7e138692e33b749cada5c094 upstream.

This allows the device to correctly show up as ATI HDMI
rather than a generic one and allows the driver to use
the available caps.

Signed-off-by: Awais Belal 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: hda - fix use-after-free after module unload

2016-07-27T15:42:23+00:00

commit ab58d8cc870ef3f0771c197700441936898d1f1d upstream.

register_vga_switcheroo() sets the PM ops from the hda structure which
is freed later in azx_free. Make sure that these ops are cleared.

Caught by KASAN, initially noticed due to a general protection fault.

Fixes: 246efa4a072f ("snd/hda: add runtime suspend/resume on optimus support (v4)")
Signed-off-by: Peter Wu 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: ctl: Stop notification after disconnection

2016-07-27T15:42:23+00:00

commit f388cdcdd160687c6650833f286b9c89c50960ff upstream.

snd_ctl_remove() has a notification for the removal event.  It's
superfluous when done during the device got disconnected.  Although
the notification itself is mostly harmless, it may potentially be
harmful, and should be suppressed.  Actually some components PCM may
free ctl elements during the disconnect or free callbacks, thus it's
no theoretical issue.

This patch adds the check of card->shutdown flag for avoiding
unnecessary notifications after (or during) the disconnect.

Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: pcm: Free chmap at PCM free callback, too

2016-07-27T15:42:23+00:00

commit a8ff48cb70835f48de5703052760312019afea55 upstream.

The chmap ctls assigned to PCM streams are freed in the PCM disconnect
callback.  However, since the disconnect callback isn't called when
the card gets freed before registering, the chmap ctls may still be
left assigned.  They are eventually freed together with other ctls,
but it may cause an Oops at pcm_chmap_ctl_private_free(), as the
function refers to the assigned PCM stream, while the PCM objects have
been already freed beforehand.

The fix is to free the chmap ctls also at PCM free callback, not only
at PCM disconnect.

Reported-by: Laxminath Kasam 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: hda/realtek - add new pin definition in alc225 pin quirk table

2016-07-27T15:42:23+00:00

commit 8a132099f080d7384bb6ab4cc168f76cb4b47d08 upstream.

We have some Dell laptops which can't detect headset mic, the machines
use the codec ALC225, they have some new pin configuration values,
after adding them in the alc225 pin quirk table, they work well.

Signed-off-by: Hui Wang 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: usb-audio: Fix quirks code is not called

2016-07-27T15:42:22+00:00

commit 76df52969711ae3725a98f26fbbc6a349803dcbf upstream.

snd_usb_{set_interface,ctl_msg}_quirk checks chip->usb_id to need
calling a quirks code. But existed code path that not calling
dev_set_drvdata in usb_audio_probe.

Fixes: 79289e24194a ("ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation")
Signed-off-by: Kazuki Oikawa 
Reviewed-by: Takashi Sakamoto 
Tested-by: Takashi Sakamoto 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: hda - fix read before array start

2016-07-27T15:42:22+00:00

commit 81e43960dce1c8e58e682fb3ec26c1d8f83a9afc upstream.

UBSAN reports the following warning from accessing path->path[-1]
in set_path_power():

[   16.078040] ================================================================================
[   16.078124] UBSAN: Undefined behaviour in sound/pci/hda/hda_generic.c:3981:17
[   16.078198] index -1 is out of range for type 'hda_nid_t [10]'
[   16.078270] CPU: 2 PID: 1738 Comm: modprobe Not tainted 4.7.0-rc1-wt+ #47
[   16.078274] Hardware name: LENOVO 3443CTO/3443CTO, BIOS G6ET23WW (1.02 ) 08/14/2012
[   16.078278]  ffff8800cb246000 ffff8800cb3638b8 ffffffff815c4fe3 0000000000000032
[   16.078286]  ffff8800cb3638e0 ffffffffffffffff ffff8800cb3638d0 ffffffff8162443d
[   16.078294]  ffffffffa0894200 ffff8800cb363920 ffffffff81624af7 0000000000000292
[   16.078302] Call Trace:
[   16.078311]  [] dump_stack+0x86/0xd3
[   16.078317]  [] ubsan_epilogue+0xd/0x40
[   16.078324]  [] __ubsan_handle_out_of_bounds+0x67/0x70
[   16.078335]  [] set_path_power+0x1bf/0x230 [snd_hda_codec_generic]
[   16.078344]  [] add_pin_power_ctls+0x8d/0xc0 [snd_hda_codec_generic]
[   16.078352]  [] ? pin_power_down_callback+0x20/0x20 [snd_hda_codec_generic]
[   16.078360]  [] add_all_pin_power_ctls+0x107/0x150 [snd_hda_codec_generic]
[   16.078370]  [] snd_hda_gen_parse_auto_config+0x2d73/0x49e0 [snd_hda_codec_generic]
[   16.078376]  [] ? trace_hardirqs_on_caller+0x1b0/0x2c0
[   16.078390]  [] alc_parse_auto_config+0x147/0x310 [snd_hda_codec_realtek]
[   16.078402]  [] patch_alc269+0x23a/0x560 [snd_hda_codec_realtek]
[   16.078417]  [] hda_codec_driver_probe+0xa4/0x1a0 [snd_hda_codec]
[   16.078424]  [] driver_probe_device+0x101/0x380
[   16.078430]  [] __driver_attach+0xb9/0x100
[   16.078438]  [] ? driver_probe_device+0x380/0x380
[   16.078444]  [] bus_for_each_dev+0x70/0xc0
[   16.078449]  [] driver_attach+0x27/0x50
[   16.078454]  [] bus_add_driver+0x166/0x2c0
[   16.078460]  [] ? 0xffffffffa0369000
[   16.078465]  [] driver_register+0x7d/0x130
[   16.078477]  [] __hda_codec_driver_register+0x6f/0x90 [snd_hda_codec]
[   16.078488]  [] realtek_driver_init+0x1e/0x1000 [snd_hda_codec_realtek]
[   16.078493]  [] do_one_initcall+0x4e/0x1d0
[   16.078499]  [] ? rcu_read_lock_sched_held+0x6d/0x80
[   16.078504]  [] ? kmem_cache_alloc_trace+0x391/0x560
[   16.078510]  [] ? do_init_module+0x28/0x273
[   16.078515]  [] do_init_module+0x9b/0x273
[   16.078522]  [] load_module+0x20b2/0x3410
[   16.078527]  [] ? m_show+0x210/0x210
[   16.078533]  [] ? kernel_read+0x66/0xe0
[   16.078541]  [] SYSC_finit_module+0xba/0xc0
[   16.078547]  [] SyS_finit_module+0xe/0x10
[   16.078552]  [] entry_SYSCALL_64_fastpath+0x1f/0xbd
[   16.078556] ================================================================================

Fix by checking path->depth before use.

Signed-off-by: Bob Copeland 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman