summaryrefslogtreecommitdiffstats
path: root/sound/core
AgeCommit message (Collapse)AuthorFilesLines
2022-07-13ALSA: core: Fix missing return value comments for kernel docsTakashi Iwai5-2/+18
Each kernel doc comment expects the definition of the return value in a proper format. This patch adds or fixes the missing entries for the remaining ALSA core API functions. Link: https://lore.kernel.org/r/20220713104759.4365-8-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-07-13ALSA: memalloc: Fix missing return value comments for kernel docsTakashi Iwai1-1/+9
Each kernel doc comment expects the definition of the return value in a proper format. This patch adds or fixes the missing entries for memory allocation helpers. Link: https://lore.kernel.org/r/20220713104759.4365-7-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-07-13ALSA: control: Fix missing return value comments for kernel docsTakashi Iwai1-2/+14
Each kernel doc comment expects the definition of the return value in proper format. This patch adds or fixes the missing entries for control API. Link: https://lore.kernel.org/r/20220713104759.4365-6-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-07-13ALSA: compress: Fix kernel doc warningsTakashi Iwai1-0/+4
Each kernel doc comment expects the definition of the return value and the summary for each struct / enum in a proper format. This patch adds or fixes the missing entries for compress-offload API. Link: https://lore.kernel.org/r/20220713104759.4365-5-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-07-13ALSA: dmaengine: Fix missing return value comments for kernel docsTakashi Iwai1-10/+20
Each kernel doc comment expects the definition of the return value in a proper format. This patch adds or fixes the missing entries for PCM dmaengine API. Link: https://lore.kernel.org/r/20220713104759.4365-4-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-07-13ALSA: pcm: Fix missing return value comments for kernel docsTakashi Iwai3-0/+14
Each kernel doc comment expects the definition of the return value in a proper format. This patch adds or fixes the missing entries for PCM API. Link: https://lore.kernel.org/r/20220713104759.4365-3-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-07-13ALSA: compress: Enable kernel doc markers for some functionsTakashi Iwai1-2/+3
The exported functions snd_compress_new() and snd_compr_stop_error() had already kernel-doc-style comments but they were not processed as they weren't marked properly. Let's enable them. This patch also fixes the missing argument id for snd_compress_new comments, too. Reported-by: Mauro Carvalho Chehab <mchehab@kernel.org> Link: https://lore.kernel.org/r/3cd6b93b36b32ad6ae160931aaa00b20688e241a.1656759989.git.mchehab@kernel.org Link: https://lore.kernel.org/r/20220713104759.4365-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-07-04Merge branch 'for-linus' into for-nextTakashi Iwai1-22/+1
Back-merge of 5.19-rc branch for the futher development, mainly about USB-audio and HD-audio Cirrus stuff. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-07-04Merge tag 'asoc-fix-v5.19-rc3' of ↵Takashi Iwai1-2/+0
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.19 A collection of fixes for v5.19, quite large but nothing major - a good chunk of it is more stuff that was identified by mixer-test regarding event generation.
2022-06-20ALSA: rawmidi: Take buffer refcount while draining outputTakashi Iwai1-4/+41
Although snd_rawmidi_drain_output() may take some long time, it has no protection and intrusive operations like the buffer resize may happen meanwhile. For making the operation a bit more robust, this patch takes the buffer refcount for blocking the buffer resize. Also, as this function is exported, in theory, it might be called asynchronously from the stream open/close state. For avoiding the missing refcount, now the close call checks the buffer refcount, too. Link: https://lore.kernel.org/r/20220617144051.18985-6-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-20ALSA: rawmidi: Check stream state at exported functionsTakashi Iwai1-18/+38
The rawmidi interface provides some exported functions to be called from outside, and currently there is no state check for those calls whether the stream is properly opened and running. Although such an invalid call shouldn't happen, but who knows. This patch adds the proper rawmidi stream state checks with spinlocks for avoiding unexpected accesses when such exported functions are called in an invalid state. After this patch, with the substream->opened and substream->runtime are always tied and guaranteed to be set under substream->lock. Link: https://lore.kernel.org/r/20220617144051.18985-5-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-20ALSA: rawmidi: Take open_mutex around parameter changesTakashi Iwai1-14/+25
The input/output parameter changes are pretty intrusive, possibly involving with the buffer resizing operation. Hence those should be performed exclusively; otherwise some ugly race could happen. This patch puts the existing open_mutex for snd_rawmidi_input_params() and *_output_params() for protecting the concurrent calls. Since those are exported, it's also meant for hardening from the external calls, too. Link: https://lore.kernel.org/r/20220617144051.18985-4-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-20ALSA: rawmidi: Move lock to snd_rawmidi_substreamTakashi Iwai1-67/+64
Having a lock in snd_rawmidi_runtime can be a problem especially when a substream is accessed from the outside, as the runtime creation might be racy with the external calls. As a first step for hardening, move the spinlock from snd_rawmidi_runtime to snd_rawmidi_substream. This patch just replaces the lock calls, no real functional change is put yet. Link: https://lore.kernel.org/r/20220617144051.18985-3-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-20ALSA: rawmidi: Make internal functions local staticTakashi Iwai1-7/+6
__snd_rawmidi_transmit_peek() and __snd_rawmidi_transmit_ack() are never called from the outside. Let's make them local static and unexport them. Link: https://lore.kernel.org/r/20220617144051.18985-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-20ALSA: memalloc: Drop x86-specific hack for WC allocationsTakashi Iwai1-22/+1
The recent report for a crash on Haswell machines implied that the x86-specific (rather hackish) implementation for write-cache memory buffer allocation in ALSA core is buggy with the recent kernel in some corner cases. This patch drops the x86-specific implementation and uses the standard dma_alloc_wc() & co generically for avoiding the bug and also for simplification. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216112 Cc: <stable@vger.kernel.org> # v5.18+ Link: https://lore.kernel.org/r/20220620073440.7514-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-15ALSA: control: Add input validationTakashi Iwai2-20/+59
This patch adds a new feature to enable the validation of input data to control elements in the ALSA core side. When CONFIG_SND_CTL_INPUT_VALIDATION is set, ALSA core verifies whether the each input value via control API is in the defined ranges, also checks whether it's aligned to the defined steps. If an invalid value is detected, ALSA core returns -EINVAL error immediately without passing further to the driver's callback. So this is a kind of hardening for (badly written) drivers that have no proper error checks, at the cost of a slight performance overhead. Technically seen, this reuses a part of the existing validation code for CONFIG_SND_CTL_DEBUG case with a slight modification to suppress error prints for the input validation. Link: https://lore.kernel.org/r/20220609120219.3937-5-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-15ALSA: control: Drop superfluous ifdef CONFIG_SND_CTL_DEBUGTakashi Iwai1-16/+0
Compilers should be smart enough to optimize out the dead functions, so we don't need to define ugly dummy functions with ifdef. Link: https://lore.kernel.org/r/20220609120219.3937-4-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-15ALSA: control: Rename CONFIG_SND_CTL_VALIDATION to CONFIG_SND_CTL_DEBUGTakashi Iwai2-8/+13
The purpose of CONFIG_SND_CTL_VALIDATION is rather to enable the debugging feature for the control API. The validation is only a part of it. Let's rename it to be more explicit and intuitive. While we're at it, let's advertise, give more comment to recommend this feature for development in the kconfig help text. Link: https://lore.kernel.org/r/20220609120219.3937-3-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-06-15ALSA: control: Use xarray for faster lookupsTakashi Iwai3-32/+162
The control elements are managed in a single linked list and we traverse the whole list for matching each numid or ctl id per every inquiry of a control element. This is OK-ish for a small number of elements but obviously it doesn't scale. Especially the matching with the ctl id takes time because it checks each field of the snd_ctl_id element, e.g. the name string is matched with strcmp(). This patch adds the hash tables with Xarray for improving the lookup speed of a control element. There are two xarray tables added to the card; one for numid and another for ctl id. For the numid, we use the numid as the index, while for the ctl id, we calculate a hash key. The lookup is done via a single xa_load() execution. As long as the given control element is found on the Xarray table, that's fine, we can give back a quick lookup result. The problem is when no entry hits on the table, and for this case, we have a slight optimization. Namely, the driver checks whether we had a collision on Xarray table, and do a fallback search (linear lookup of the full entries) only if a hash key collision happened beforehand. So, in theory, the inquiry for a non-existing element might take still time even with this patch in a worst case, but this must be pretty rare. The feature is enabled via CONFIG_SND_CTL_FAST_LOOKUP, which is turned on as default. For simplicity, the option can be turned off only when CONFIG_EXPERT is set ("You are expert? Then you manage 1000 knobs"). Link: https://lore.kernel.org/r/20211028130027.18764-1-tiwai@suse.de Link: https://lore.kernel.org/r/20220609180504.775-1-tiwai@suse.de Link: https://lore.kernel.org/all/cover.1653813866.git.quic_rbankapu@quicinc.com/ Link: https://lore.kernel.org/r/20220610064537.18660-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-05-30Merge tag 'm68knommu-for-v5.19' of ↵Linus Torvalds1-2/+0
git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: "A collection of changes to add elf-fdpic loader support for m68k. Also a collection of various fixes. They include typo corrections, undefined symbol compilation fixes, removal of the ISA_DMA_API support and removal of unused code. Summary: - correctly set up ZERO_PAGE pointer - drop ISA_DMA_API support - fix comment typos - fixes for undefined symbols - remove unused code and variables - elf-fdpic loader support for m68k" * tag 'm68knommu-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: fix 68000 CPU link with no platform selected m68k: removed unused "mach_get_ss" m68knommu: fix undefined reference to `mach_get_rtc_pll' m68knommu: fix undefined reference to `_init_sp' m68knommu: allow elf_fdpic loader to be selected m68knommu: add definitions to support elf_fdpic program loader m68knommu: implement minimal regset support m68knommu: use asm-generic/mmu.h for nommu setups m68k: fix typos in comments m68k: coldfire: drop ISA_DMA_API support m68knommu: set ZERO_PAGE() to the allocated zeroed page
2022-05-17ALSA: seq: replace ternary operator with max()Guo Zhengkui1-1/+1
Fix the following coccicheck warning: sound/core/seq/seq_ports.c:142:12-14: WARNING opportunity for max() Signed-off-by: Guo Zhengkui <guozhengkui@vivo.com> Link: https://lore.kernel.org/r/20220517062518.123292-1-guozhengkui@vivo.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-05-16m68k: coldfire: drop ISA_DMA_API supportArnd Bergmann1-2/+0
After a build regression report, I took a look at possible users of CONFIG_ISA_DMA_API on m68k and found none, which Greg confirmed. The CONFIG_GENERIC_ISA_DMA option in turn is only needed to implement ISA_DMA_API, and is clearly not used on the platforms with ISA support. The CONFIG_ISA support for AMIGA_PCMCIA is probably also unneeded, but this is less clear. Unlike other PCMCIA implementations, this one does not use the drivers/pcmcia subsystem at all and just supports the "apne" network driver. When it was first added, one could use ISA drivers on it as well, but this probably broke at some point. With no reason to keep this, let's just drop the corresponding files and prevent the remaining ISA drivers that use this from getting built. The remaining definitions in asm/dma.h are used for PCI support. Link: https://lore.kernel.org/lkml/9e5ee1c3-ca80-f343-a1f5-66f3dd1c0727@linux-m68k.org/ Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Ulf Hansson <ulf.hansson@linaro.org> # For MMC Acked-by: Greg Ungerer <gerg@linux-m68k.org> Acked-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2022-04-25ALSA: pcm: Check for null pointer of pointer substream before dereferencing itColin Ian King1-1/+2
Pointer substream is being dereferenced on the assignment of pointer card before substream is being null checked with the macro PCM_RUNTIME_CHECK. Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the the pointer check before card is assigned. Fixes: d4cfb30fce03 ("ALSA: pcm: Set per-card upper limit of PCM buffer allocations") Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20220424205945.1372247-1-colin.i.king@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-04-14Merge tag 'sound-5.18-rc3' of ↵Linus Torvalds3-2/+139
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This became an unexpectedly large pull request due to various regression fixes in the previous kernels. The majority of fixes are a series of patches to address the regression at probe errors in devres'ed drivers, while there are yet more fixes for the x86 SG allocations and for USB-audio buffer management. In addition, a few HD-audio quirks and other small fixes are found" * tag 'sound-5.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (52 commits) ALSA: usb-audio: Limit max buffer and period sizes per time ALSA: memalloc: Add fallback SG-buffer allocations for x86 ALSA: nm256: Don't call card private_free at probe error path ALSA: mtpav: Don't call card private_free at probe error path ALSA: rme9652: Fix the missing snd_card_free() call at probe error ALSA: hdspm: Fix the missing snd_card_free() call at probe error ALSA: hdsp: Fix the missing snd_card_free() call at probe error ALSA: oxygen: Fix the missing snd_card_free() call at probe error ALSA: lx6464es: Fix the missing snd_card_free() call at probe error ALSA: cmipci: Fix the missing snd_card_free() call at probe error ALSA: aw2: Fix the missing snd_card_free() call at probe error ALSA: als300: Fix the missing snd_card_free() call at probe error ALSA: lola: Fix the missing snd_card_free() call at probe error ALSA: bt87x: Fix the missing snd_card_free() call at probe error ALSA: sis7019: Fix the missing error handling ALSA: intel_hdmi: Fix the missing snd_card_free() call at probe error ALSA: via82xx: Fix the missing snd_card_free() call at probe error ALSA: sonicvibes: Fix the missing snd_card_free() call at probe error ALSA: rme96: Fix the missing snd_card_free() call at probe error ALSA: rme32: Fix the missing snd_card_free() call at probe error ...
2022-04-13Merge branch 'for-linus' into for-nextTakashi Iwai3-2/+139
Back-merge the 5.18-rc3 devel branch, as it influences on the further development. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-04-13Merge branch 'topic/cs35l41' into for-nextTakashi Iwai2-18/+18
Pull CS35L41 codec updates Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-04-13ALSA: memalloc: Add fallback SG-buffer allocations for x86Takashi Iwai1-1/+110
The recent change for memory allocator replaced the SG-buffer handling helper for x86 with the standard non-contiguous page handler. This works for most cases, but there is a corner case I obviously overlooked, namely, the fallback of non-contiguous handler without IOMMU. When the system runs without IOMMU, the core handler tries to use the continuous pages with a single SGL entry. It works nicely for most cases, but when the system memory gets fragmented, the large allocation may fail frequently. Ideally the non-contig handler could deal with the proper SG pages, it's cumbersome to extend for now. As a workaround, here we add new types for (minimalistic) SG allocations, instead, so that the allocator falls back to those types automatically when the allocation with the standard API failed. BTW, one better (but pretty minor) improvement from the previous SG-buffer code is that this provides the proper mmap support without the PCM's page fault handling. Fixes: 2c95b92ecd92 ("ALSA: memalloc: Unify x86 SG-buffer handling (take#3)") BugLink: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/2272 BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1198248 Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220413054808.7547-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-04-12ALSA: jack: Access input_dev under mutexAmadeusz Sławiński1-7/+27
It is possible when using ASoC that input_dev is unregistered while calling snd_jack_report, which causes NULL pointer dereference. In order to prevent this serialize access to input_dev using mutex lock. Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com> Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://lore.kernel.org/r/20220412091628.3056922-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-04-12ALSA: core: Add snd_card_free_on_error() helperTakashi Iwai1-0/+28
This is a small helper function to handle the error path more easily when an error happens during the probe for the device with the device-managed card. Since devres releases in the reverser order of the creations, usually snd_card_free() gets called at the last in the probe error path unless it already reached snd_card_register() calls. Due to this nature, when a driver expects the resource releases in card->private_free, this might be called too lately. As a workaround, one should call the probe like: static int __some_probe(...) { // do real probe.... } static int some_probe(...) { return snd_card_free_on_error(dev, __some_probe(dev, ...)); } so that the snd_card_free() is called explicitly at the beginning of the error path from the probe. This function will be used in the upcoming fixes to address the regressions by devres usages. Fixes: e8ad415b7a55 ("ALSA: core: Add managed card creation") Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220412093141.8008-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-04-11ALSA: pcm: Test for "silence" field in struct "pcm_format_data"Fabio M. De Francesco1-1/+1
Syzbot reports "KASAN: null-ptr-deref Write in snd_pcm_format_set_silence".[1] It is due to missing validation of the "silence" field of struct "pcm_format_data" in "pcm_formats" array. Add a test for valid "pat" and, if it is not so, return -EINVAL. [1] https://lore.kernel.org/lkml/000000000000d188ef05dc2c7279@google.com/ Reported-and-tested-by: syzbot+205eb15961852c2c5974@syzkaller.appspotmail.com Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220409012655.9399-1-fmdefrancesco@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-04-01Merge tag 'sound-fix-5.18-rc1' of ↵Linus Torvalds3-11/+38
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Just a few fixes that have been gathered since the previous pull: - An additional fix for potential PCM deadlocks - A series of HD-audio CS8409 codec patches for new models - Other device specific fixes for HD-audio, ASoC mediatek, Intel, fsl, rockchip" * tag 'sound-fix-5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda: Avoid unsol event during RPM suspending ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 ALSA: hda/cs8409: Add new Dolphin HW variants ALSA: hda/cs8409: Disable HSBIAS_SENSE_EN for Cyborg ALSA: hda/cs8409: Support new Warlock MLK Variants ALSA: hda/cs8409: Fix Full Scale Volume setting for all variants ALSA: hda/cs8409: Re-order quirk table into ascending order ALSA: hda/cs8409: Fix Warlock to use mono mic configuration ALSA: cs4236: fix an incorrect NULL check on list iterator ALSA: hda/realtek: Enable headset mic on Lenovo P360 ASoC: SOF: Intel: Fix build error without SND_SOC_SOF_PCI_DEV ALSA: hda/realtek: Add mute and micmut LED support for Zbook Fury 17 G9 ASoC: rockchip: i2s_tdm: Fixup config for SND_SOC_DAIFMT_DSP_A/B ASoC: fsl-asoc-card: Fix jack_event() always return 0 ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs
2022-03-30ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lockTakashi Iwai3-11/+38
syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm->mmap_mutex is already held. Meanwhile, the copy_from/to_user calls at read/write operations also take the mm->mmap_lock internally, hence it may lead to a AB/BA deadlock. A similar problem was already seen in the past and we fixed it with a refcount (in commit b248371628aa). The former fix covered only the call paths with OSS read/write and OSS ioctls, while we need to cover the concurrent access via both ALSA and OSS APIs now. This patch addresses the problem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for OSS. The new field, runtime->buffer_accessing, keeps the number of concurrent read/write operations. Unlike the former buffer_mutex protection, this protects only around the copy_from/to_user() calls; the other codes are basically protected by the PCM stream lock. The refcount can be a negative, meaning blocked by the ioctls. If a negative value is seen, the read/write aborts with -EBUSY. In the ioctl side, OTOH, they check this refcount, too, and set to a negative value for blocking unless it's already being accessed. Reported-by: syzbot+6e5c88838328e99c7e1c@syzkaller.appspotmail.com Fixes: dca947d4d26d ("ALSA: pcm: Fix races among concurrent read/write and buffer changes") Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/000000000000381a0d05db622a81@google.com Link: https://lore.kernel.org/r/20220330120903.4738-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-27Merge tag 'x86_core_for_5.18_rc1' of ↵Linus Torvalds2-18/+18
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 CET-IBT (Control-Flow-Integrity) support from Peter Zijlstra: "Add support for Intel CET-IBT, available since Tigerlake (11th gen), which is a coarse grained, hardware based, forward edge Control-Flow-Integrity mechanism where any indirect CALL/JMP must target an ENDBR instruction or suffer #CP. Additionally, since Alderlake (12th gen)/Sapphire-Rapids, speculation is limited to 2 instructions (and typically fewer) on branch targets not starting with ENDBR. CET-IBT also limits speculation of the next sequential instruction after the indirect CALL/JMP [1]. CET-IBT is fundamentally incompatible with retpolines, but provides, as described above, speculation limits itself" [1] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html * tag 'x86_core_for_5.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (53 commits) kvm/emulate: Fix SETcc emulation for ENDBR x86/Kconfig: Only allow CONFIG_X86_KERNEL_IBT with ld.lld >= 14.0.0 x86/Kconfig: Only enable CONFIG_CC_HAS_IBT for clang >= 14.0.0 kbuild: Fixup the IBT kbuild changes x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy x86: Remove toolchain check for X32 ABI capability x86/alternative: Use .ibt_endbr_seal to seal indirect calls objtool: Find unused ENDBR instructions objtool: Validate IBT assumptions objtool: Add IBT/ENDBR decoding objtool: Read the NOENDBR annotation x86: Annotate idtentry_df() x86,objtool: Move the ASM_REACHABLE annotation to objtool.h x86: Annotate call_on_stack() objtool: Rework ASM_REACHABLE x86: Mark __invalid_creds() __noreturn exit: Mark do_group_exit() __noreturn x86: Mark stop_this_cpu() __noreturn objtool: Ignore extra-symbol code objtool: Rename --duplicate to --lto ...
2022-03-22ALSA: pcm: Add stream lock during PCM reset ioctl operationsTakashi Iwai1-0/+4
snd_pcm_reset() is a non-atomic operation, and it's allowed to run during the PCM stream running. It implies that the manipulation of hw_ptr and other parameters might be racy. This patch adds the PCM stream lock at appropriate places in snd_pcm_*_reset() actions for covering that. Cc: <stable@vger.kernel.org> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322171325.4355-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-22ALSA: pcm: Fix races among concurrent prealloc proc writesTakashi Iwai1-4/+7
We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some weird problem. This patch applies the PCM open_mutex to the proc write operation for avoiding the racy proc writes and the PCM stream open (and further operations). Cc: <stable@vger.kernel.org> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322170720.3529-5-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-22ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free callsTakashi Iwai1-14/+18
Like the previous fixes to hw_params and hw_free ioctl races, we need to paper over the concurrent prepare ioctl calls against hw_params and hw_free, too. This patch implements the locking with the existing runtime->buffer_mutex for prepare ioctls. Unlike the previous case for snd_pcm_hw_hw_params() and snd_pcm_hw_free(), snd_pcm_prepare() is performed to the linked streams, hence the lock can't be applied simply on the top. For tracking the lock in each linked substream, we modify snd_pcm_action_group() slightly and apply the buffer_mutex for the case stream_lock=false (formerly there was no lock applied) there. Cc: <stable@vger.kernel.org> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322170720.3529-4-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-22ALSA: pcm: Fix races among concurrent read/write and buffer changesTakashi Iwai1-0/+4
In the current PCM design, the read/write syscalls (as well as the equivalent ioctls) are allowed before the PCM stream is running, that is, at PCM PREPARED state. Meanwhile, we also allow to re-issue hw_params and hw_free ioctl calls at the PREPARED state that may change or free the buffers, too. The problem is that there is no protection against those mix-ups. This patch applies the previously introduced runtime->buffer_mutex to the read/write operations so that the concurrent hw_params or hw_free call can no longer interfere during the operation. The mutex is unlocked before scheduling, so we don't take it too long. Cc: <stable@vger.kernel.org> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322170720.3529-3-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-22ALSA: pcm: Fix races among concurrent hw_params and hw_free callsTakashi Iwai2-22/+41
Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls. This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity. Reported-by: Hu Jiahui <kirin.say@gmail.com> Cc: <stable@vger.kernel.org> Reviewed-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322170720.3529-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-21Merge branch 'for-next' into for-linusTakashi Iwai3-17/+18
Pull 5.18 development branch Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-18ALSA: oss: Release temporary buffers upon errorsTakashi Iwai1-13/+15
When the parameter changes fails, we don't need to keep the old temporary buffers. Release those (and plugin instances) upon errors for reducing dead memory footprint. Since we always call it at the exit of snd_pcm_oss_changes_params_locked(), the explicit calls of snd_pcm_oss_plugin_clear() can be dropped, too. Along with it, unify the buffer-free calls to a single helper and call it from the needed places. Link: https://lore.kernel.org/r/20220318082157.29769-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-18ALSA: oss: Fix PCM OSS buffer allocation overflowTakashi Iwai2-5/+12
We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INT_MAX, hence it hits WARN_ON(). This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated. In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the converted period size and buffer bytes. Reported-by: syzbot+72732c532ac1454eeee9@syzkaller.appspotmail.com Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/00000000000085b1b305da5a66f3@google.com Link: https://lore.kernel.org/r/20220318082036.29699-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-18ALSA: core: Fix typo in 'PCM Timer Interface' helpElijah Harding1-1/+1
Signed-off-by: Elijah Harding <eharding830@gmail.com> Link: https://lore.kernel.org/r/20220318015201.30871-1-eharding830@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-15x86: Remove toolchain check for X32 ABI capabilityMasahiro Yamada2-18/+18
Commit 0bf6276392e9 ("x32: Warn and disable rather than error if binutils too old") added a small test in arch/x86/Makefile because binutils 2.22 or newer is needed to properly support elf32-x86-64. This check is no longer necessary, as the minimum supported version of binutils is 2.23, which is enforced at configuration time with scripts/min-tool-version.sh. Remove this check and replace all uses of CONFIG_X86_X32 with CONFIG_X86_X32_ABI, as two symbols are no longer necessary. [nathan: Rebase, fix up a few places where CONFIG_X86_X32 was still used, and simplify commit message to satisfy -tip requirements] Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Signed-off-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/20220314194842.3452-2-nathan@kernel.org
2022-03-14ALSA: seq: oss: fix typoJulia Lawall1-1/+1
Fix typo in "announcement". Reported-by: Joe Perches <joe@perches.com> Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Link: https://lore.kernel.org/r/20220313085635.102123-1-Julia.Lawall@inria.fr Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-03-13ALSA: seq: oss: use kzallocJulia Lawall1-2/+1
Use kzalloc instead of kmalloc + memset. The semantic patch that makes this change is: (https://coccinelle.gitlabpages.inria.fr/website/) //<smpl> @@ expression res, size, flag; @@ - res = kmalloc(size, flag); + res = kzalloc(size, flag); ... - memset(res, 0, size); //</smpl> Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr> Link: https://lore.kernel.org/r/20220312102705.71413-4-Julia.Lawall@inria.fr Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-02-10ALSA: memalloc: invalidate SG pages before syncTakashi Iwai1-1/+1
It seems that calling invalidate_kernel_vmap_range() is more correct to be called before dma_sync_*(), judging from the other thread: https://lore.kernel.org/all/20220111085958.GA22795@lst.de/ Although this won't matter much in practice, let's fix the call order for consistency. Fixes: a25684a95646 ("ALSA: memalloc: Support for non-contiguous page allocation") Reported-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220210123344.8756-3-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-02-10ALSA: memalloc: Fix dma_need_sync() checksTakashi Iwai1-4/+9
dma_need_sync() checks each DMA address. Fix the incorrect usages for non-contiguous and non-coherent page allocations. Fortunately, there are no actual call sites that need manual syncs yet. Fixes: a25684a95646 ("ALSA: memalloc: Support for non-contiguous page allocation") Fixes: 73325f60e2ed ("ALSA: memalloc: Support for non-coherent page allocation") Cc: <stable@vger.kernel.org> Reported-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> Link: https://lore.kernel.org/r/20220210123344.8756-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2022-02-01Merge tag 'asoc-fix-v5.17-rc2' of ↵Takashi Iwai1-0/+13
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.17 Quite a few fixes here, including an unusually large set in the core spurred on by various testing efforts as well as the usual small driver fixes. There are quite a few fixes for out of bounds writes in both the core and the various Qualcomm drivers, plus a couple of fixes for locking in the DPCM code.
2022-01-28ASoC: soc-pcm: Fix DPCM lockdep warning due to nested stream locksTakashi Iwai1-0/+13
The recent change for DPCM locking caused spurious lockdep warnings. Actually the warnings are false-positive, as those are triggered due to the nested stream locks for FE and BE. Since both locks belong to the same lock class, lockdep sees it as if a deadlock. For fixing this, we need to take PCM stream locks for BE with the nested lock primitives. Since currently snd_pcm_stream_lock*() helper assumes only the top-level single locking, a new helper function snd_pcm_stream_lock_irqsave_nested() is defined for a single-depth nested lock, which is now used in the BE DAI trigger that is always performed inside a FE stream lock. Fixes: b2ae80663008 ("ASoC: soc-pcm: serialize BE triggers") Reported-and-tested-by: Hans de Goede <hdegoede@redhat.com> Reported-and-tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Link: https://lore.kernel.org/r/73018f3c-9769-72ea-0325-b3f8e2381e30@redhat.com Link: https://lore.kernel.org/alsa-devel/9a0abddd-49e9-872d-2f00-a1697340f786@samsung.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/20220119155249.26754-2-tiwai@suse.de Signed-off-by: Mark Brown <broonie@kernel.org>
2022-01-22proc: remove PDE_DATA() completelyMuchun Song1-2/+2
Remove PDE_DATA() completely and replace it with pde_data(). [akpm@linux-foundation.org: fix naming clash in drivers/nubus/proc.c] [akpm@linux-foundation.org: now fix it properly] Link: https://lkml.kernel.org/r/20211124081956.87711-2-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun@bytedance.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Alexey Gladkov <gladkov.alexey@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-08 16:01:31 +0000