summaryrefslogtreecommitdiff
path: root/sound/drivers
AgeCommit message (Collapse)Author
10 daysALSA: aloop: Fix peer runtime UAF during format-change stopCássio Gabriel
loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved the peer lookup under cable->lock, but the actual snd_pcm_stop() still runs after dropping that lock. A concurrent close can clear the capture entry from cable->streams[] and detach or free its runtime while the playback trigger path still holds a stale peer substream pointer. Keep a per-cable count of in-flight peer stops before dropping cable->lock, and make free_cable() wait for those stops before detaching the runtime. This preserves the existing behavior while making the peer runtime lifetime explicit. Reported-by: syzbot+8fa95c41eafbc9d2ff6f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8fa95c41eafbc9d2ff6f Fixes: 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback") Cc: stable@vger.kernel.org Suggested-by: Takashi Iwai <tiwai@suse.com> Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260424-alsa-aloop-peer-stop-uaf-v2-1-94e68101db8a@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-23Revert "ALSA: pcmtest: fix reference leak on failed device registration"Takashi Iwai
We'd like to address the problem rather in the error code path of platform_device_register() itself instead of leaving it all callers, since less than 1% of all callers of over 100 platform_device_register() do call platform_device_put() properly as of now. For making the work easier, revert the previous change commit 4ff036f95238 ("ALSA: pcmtest: fix reference leak on failed device registration") again. Link: https://lore.kernel.org/20260415193138.3861297-1-lgs201920130244@gmail.com Link: https://patch.msgid.link/20260423075211.3977366-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-21ALSA: pcmtest: Fix resource leaks in module init error pathsCássio Gabriel
pcmtest allocates its pattern buffers and creates its debugfs tree before registering the platform device and driver, but mod_init() does not release those resources when a later init step fails. As a result, a debugfs directory creation failure leaks the pattern buffers, while platform_device_register() and platform_driver_register() failures leave both the pattern buffers and the debugfs tree behind. The recent fix for failed device registration only dropped the embedded device reference. Add the missing cleanup for the debugfs tree and pattern buffers in the remaining module init error paths. Fixes: 315a3d57c64c ("ALSA: Implement the new Virtual PCM Test Driver") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260421-alsa-pcmtest-init-unwind-v1-1-03fe0c423dbb@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17ALSA: pcmtest: fix reference leak on failed device registrationGuangshuo Li
When platform_device_register() fails in mod_init(), the embedded struct device in pcmtst_pdev has already been initialized by device_initialize(), but the failure path returns the error without dropping the device reference for the current platform device: mod_init() -> platform_device_register(&pcmtst_pdev) -> device_initialize(&pcmtst_pdev.dev) -> setup_pdev_dma_masks(&pcmtst_pdev) -> platform_device_add(&pcmtst_pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: 315a3d57c64c5 ("ALSA: Implement the new Virtual PCM Test Driver") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Link: https://patch.msgid.link/20260415193138.3861297-1-lgs201920130244@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-17ALSA: vx: use correct function name in kernel-doc commentRandy Dunlap
Use the correct function name to avoid a kernel-doc warning (when W=1 is used): vx_cmd.h:210: warning: expecting prototype for vx_send_pipe_cmd_params(). Prototype was for vx_set_pipe_cmd_params() instead Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260216060010.2784438-1-rdunlap@infradead.org
2026-02-21Convert more 'alloc_obj' cases to default GFP_KERNEL argumentsLinus Torvalds
This converts some of the visually simpler cases that have been split over multiple lines. I only did the ones that are easy to verify the resulting diff by having just that final GFP_KERNEL argument on the next line. Somebody should probably do a proper coccinelle script for this, but for me the trivial script actually resulted in an assertion failure in the middle of the script. I probably had made it a bit _too_ trivial. So after fighting that far a while I decided to just do some of the syntactically simpler cases with variations of the previous 'sed' scripts. The more syntactically complex multi-line cases would mostly really want whitespace cleanup anyway. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21Convert 'alloc_obj' family to use the new default GFP_KERNEL argumentLinus Torvalds
This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21treewide: Replace kmalloc with kmalloc_obj for non-scalar typesKees Cook
This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-08Merge branch 'for-linus' into for-nextTakashi Iwai
Pull 6.19-devel branch. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-02-03ALSA: aloop: Fix racy access at PCM triggerTakashi Iwai
The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers. For addressing the UAF, this patch changes two things: - It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses. - In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF. Reported-by: syzbot+5f8f3acdee1ec7a7ef7b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/69783ba1.050a0220.c9109.0011.GAE@google.com Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20260203141003.116584-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-12-14ALSA: opl4: Convert to snd_seq bus probe mechanismUwe Kleine-König
The snd_seq bus got a dedicated probe function. Make use of that. This fixes a runtime warning about the driver needing to be converted to the bus probe method. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/15cd19c9c8ec32e92b956eec112e515335bc22cf.1765283601.git.u.kleine-koenig@baylibre.com
2025-12-14ALSA: opl3: Convert to snd_seq bus probe mechanismUwe Kleine-König
The snd_seq bus got a dedicated probe function. Make use of that. This fixes a runtime warning about the driver needing to be converted to the bus probe method. Note that the remove callback returns void now. The actual return value was ignored before (see device_remove() in drivers/base/dd.c), so there is no problem introduced by converting `return -EINVAL` to `return`. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/fb5e44d995cf93b8feae22c4558598859712bc07.1765283601.git.u.kleine-koenig@baylibre.com
2025-11-19ALSA: pcmtest: Replace deprecated strcpy with strscpy_pad in setup_patt_bufsThorsten Blum
strcpy() has been deprecated [1] because it performs no bounds checking on the destination buffer, which can lead to buffer overflows. Replace it with the safer strscpy_pad(), and use kmalloc() instead of kzalloc() because strscpy_pad() zero-pads the destination buffer and therefore avoids writing to it twice. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy [1] Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20251119135217.233084-1-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-15ALSA: serial-generic: remove shared static bufferJohn Keeping
If multiple instances of this driver are instantiated and try to send concurrently then the single static buffer snd_serial_generic_tx_work() will cause corruption in the data output. Move the buffer into the per-instance driver data to avoid this. Signed-off-by: John Keeping <jkeeping@inmusicbrands.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-01ALSA: serial-u16550: Use guard() for spin locksTakashi Iwai
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-14-tiwai@suse.de
2025-09-01ALSA: portman2x4: Use guard() for spin locksTakashi Iwai
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-13-tiwai@suse.de
2025-09-01ALSA: mts64: Use guard() for spin locksTakashi Iwai
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-12-tiwai@suse.de
2025-09-01ALSA: mtpav: Use guard() for spin locksTakashi Iwai
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-11-tiwai@suse.de
2025-09-01ALSA: mpu401: Use guard() for spin locksTakashi Iwai
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-10-tiwai@suse.de
2025-09-01ALSA: dummy: Use guard() for spin locksTakashi Iwai
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-9-tiwai@suse.de
2025-09-01ALSA: vx: Use guard() for mutex locksTakashi Iwai
Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-8-tiwai@suse.de
2025-09-01ALSA: opl4: Use guard() for spin locksTakashi Iwai
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-7-tiwai@suse.de
2025-09-01ALSA: opl4: Use guard() for mutex locksTakashi Iwai
Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-6-tiwai@suse.de
2025-09-01ALSA: opl3: Use guard() for spin locksTakashi Iwai
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-5-tiwai@suse.de
2025-09-01ALSA: opl3: Use guard() for mutex locksTakashi Iwai
Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-4-tiwai@suse.de
2025-09-01ALSA: aloop: Use guard() for spin locksTakashi Iwai
Clean up the code using guard() for spin locks. Merely code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-3-tiwai@suse.de
2025-09-01ALSA: aloop: Use guard() for mutex locksTakashi Iwai
Replace the manual mutex lock/unlock pairs with guard() for code simplification. Only code refactoring, and no behavior change. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250829150026.6379-2-tiwai@suse.de
2025-07-11ALSA: vx: Use safer strscpy() instead of strcpy()Takashi Iwai
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250710100727.22653-13-tiwai@suse.de
2025-07-11ALSA: virmidi: Use safer strscpy() instead of strcpy()Takashi Iwai
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250710100727.22653-12-tiwai@suse.de
2025-07-11ALSA: serial-u16550: Use safer strscpy() instead of strcpy()Takashi Iwai
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250710100727.22653-11-tiwai@suse.de
2025-07-11ALSA: serial-generic: Use safer strscpy() instead of strcpy()Takashi Iwai
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250710100727.22653-10-tiwai@suse.de
2025-07-11ALSA: portman2x4: Use safer strscpy() instead of strcpy()Takashi Iwai
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250710100727.22653-9-tiwai@suse.de
2025-07-11ALSA: pcsp: Use safer strscpy() instead of strcpy()Takashi Iwai
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250710100727.22653-8-tiwai@suse.de
2025-07-11ALSA: opl4: Use safer strscpy() instead of strcpy()Takashi Iwai
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250710100727.22653-7-tiwai@suse.de
2025-07-11ALSA: opl3: Use safer strscpy() instead of strcpy()Takashi Iwai
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250710100727.22653-6-tiwai@suse.de
2025-07-11ALSA: mpu401: Use safer strscpy() instead of strcpy()Takashi Iwai
Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20250710100727.22653-5-tiwai@suse.de
2025-07-07ALSA: mts64: Replace deprecated strcpy() with strscpy()Thorsten Blum
strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20250706160906.416270-1-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-07-04ALSA: mtpav: Replace deprecated strcpy() with strscpy()Thorsten Blum
strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20250703134255.3948-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-07-02ALSA: pcmtest: Replace deprecated strcpy() with strscpy()Thorsten Blum
strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20250701120525.185831-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-06-30ALSA: dummy: Replace deprecated strcpy() with strscpy()Thorsten Blum
strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20250630110945.2225-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-06-20ALSA: aloop: Replace deprecated strcpy() with strscpy()Thorsten Blum
strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20250618223844.1458-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-06-08treewide, timers: Rename from_timer() to timer_container_of()Ingo Molnar
Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com
2025-04-05treewide: Switch/rename to timer_delete[_sync]()Thomas Gleixner
timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree over and remove the historical wrapper inlines. Conversion was done with coccinelle plus manual fixups where necessary. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Ingo Molnar <mingo@kernel.org>
2025-02-10ALSA: Switch to use hrtimer_setup()Nam Cao
hrtimer_setup() takes the callback function pointer as argument and initializes the timer completely. Replace hrtimer_init() and the open coded initialization of hrtimer::function with the new setup mechanism. Patch was created by using Coccinelle. Acked-by: Zack Rusin <zack.rusin@broadcom.com> Signed-off-by: Nam Cao <namcao@linutronix.de> Cc: Takashi Iwai <tiwai@suse.com> Link: https://patch.msgid.link/598031332ce738c82286a158cb66eb7e735b2e79.1738746904.git.namcao@linutronix.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2024-10-30sound: Switch back to struct platform_driver::remove()Uwe Kleine-König
After commit 0edb555a65d1 ("platform: Make platform_driver::remove() return void") .remove() is (again) the right callback to implement for platform drivers. Convert all platform drivers below sound to use .remove(), with the eventual goal to drop struct platform_driver::remove_new(). As .remove() and .remove_new() have the same prototypes, conversion is done by just changing the structure member name in the driver initializer. On the way do a few whitespace changes to make indention consistent. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://patch.msgid.link/20241029073748.508077-2-u.kleine-koenig@baylibre.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2024-08-18ALSA: aloop: Allow using global timersIvan Orlov
Allow using global timers as a timer source when card id is equal to -1 in the timer_source parameter. Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20240813120701.171743-2-ivan.orlov0322@gmail.com
2024-08-08ALSA: pcsp: Use standard print APITakashi Iwai
Use the standard print API with dev_*() instead of the old house-baked one. It gives better information and allows dynamically control of debug prints. Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20240807133452.9424-15-tiwai@suse.de
2024-08-08ALSA: dummy: Use standard print APITakashi Iwai
Use pr_*() macro instead of open-coded printk() just for code simplification. Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20240807133452.9424-14-tiwai@suse.de
2024-08-08ALSA: aloop: Use standard print APITakashi Iwai
Use pr_err() instead of open-coded printk() just for code simplification. Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20240807133452.9424-13-tiwai@suse.de
2024-08-08ALSA: vx_core: Use standard print APITakashi Iwai
Use the standard print API with dev_*() instead of the old house-baked one. It gives better information and allows dynamically control of debug prints. The commented old debug prints are dropped, too. Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20240807133452.9424-12-tiwai@suse.de
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 13:32:47 +0000