History

Merge tag 'sound-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai: "A few small fixes for the last spurt. All changes are small, mostly consisting of driver-specific fixes, along with two UAF fixes for the ALSA timer core. Core: - Two UAF fixes in ALSA timer core ASoC: - SDCA: Fix NULL pointer dereference - amd / yc: Add DMI quirk for ASUS ExpertBook PM1403CDA - SOF amd: Fix garbage/spurious warnings - wm_adsp: Fix potential NULL dereference when removing firmware controls - loongson: Fix negative position calculation - spi-rzv2h-rspi: Fix SPDR read access width on 16-bit RX path" * tag 'sound-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions ASoC: loongson: Fix invalid position error in ls_pcm_pointer spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1403CDA ASoC: SOF: amd: set ipc flags to zero ASoC: SOF: amd: fix for ipc flags check ASoC: wm_adsp: Fix NULL dereference when removing firmware controls ALSA: timer: Fix UAF at snd_timer_user_params() ALSA: timer: Forcibly close timer instances at closing

Linus Torvalds committed 5 months ago

Commit 1dadb7e2 parents fd41dc4 b0d15539 files · +85 −15Browse files

Unified · Split

9 files
  1. drivers/spi/spi-rzv2h-rspi.c +2 −1
  2. sound/core/timer.c +10 −7
  3. sound/soc/amd/yc/acp6x-mach.c +7 −0
  4. sound/soc/codecs/wm_adsp.c +3 −0
  5. sound/soc/loongson/loongson_dma.c +10 −2
  6. sound/soc/sdca/sdca_function_device.c +21 −3
  7. sound/soc/sof/amd/acp-ipc.c +2 −2
  8. sound/soc/sof/amd/acp.c +28 −0
  9. sound/soc/sof/amd/acp.h +2 −0
drivers/spi/spi-rzv2h-rspi.c+2−1
@@ -135,8 +135,9 @@ static inline void rzv2h_rspi_rx_##type(struct rzv2h_rspi_priv *rspi, \ · 134 unmodified lines
135135 RZV2H_RSPI_TX(writel, u32)
136136 RZV2H_RSPI_TX(writew, u16)
137137 RZV2H_RSPI_TX(writeb, u8)
138+/* The read access size for RSPI_SPDR is fixed at 32 bits */
138139 RZV2H_RSPI_RX(readl, u32)
139−RZV2H_RSPI_RX(readw, u16)
140+RZV2H_RSPI_RX(readl, u16)
140141 RZV2H_RSPI_RX(readl, u8)
141142
142143 static void rzv2h_rspi_reg_rmw(const struct rzv2h_rspi_priv *rspi,
sound/core/timer.c+10−7
@@ -430,6 +430,8 @@ static void snd_timer_close_locked(struct snd_timer_instance *timeri, · 429 unmodified lines
430430
431431 if (timer) {
432432 guard(spinlock_irq)(&timer->lock);
433+ if (timeri->flags & SNDRV_TIMER_IFLG_DEAD)
434+ return; /* already closed */
433435 timeri->flags |= SNDRV_TIMER_IFLG_DEAD;
434436 }
435437
@@ -975,18 +977,18 @@ EXPORT_SYMBOL(snd_timer_new); · 539 unmodified lines
975977
976978 static int snd_timer_free(struct snd_timer *timer)
977979 {
980+ struct snd_timer_instance *ti, *n;
981+
978982 if (!timer)
979983 return 0;
980984
981985 guard(mutex)(&register_mutex);
982986 if (! list_empty(&timer->open_list_head)) {
983− struct list_head *p, *n;
984− struct snd_timer_instance *ti;
985− pr_warn("ALSA: timer %p is busy?\n", timer);
986− list_for_each_safe(p, n, &timer->open_list_head) {
987− list_del_init(p);
988− ti = list_entry(p, struct snd_timer_instance, open_list);
989− ti->timer = NULL;
987+ list_for_each_entry_safe(ti, n, &timer->open_list_head, open_list) {
988+ struct device *card_dev_to_put = NULL;
989+
990+ snd_timer_close_locked(ti, &card_dev_to_put);
991+ put_device(card_dev_to_put);
990992 }
991993 }
992994 list_del(&timer->device_list);
@@ -1809,6 +1811,7 @@ static int snd_timer_user_params(struct file *file, · 816 unmodified lines
18091811 struct snd_timer *t;
18101812 int err;
18111813
1814+ guard(mutex)(&register_mutex);
18121815 tu = file->private_data;
18131816 if (!tu->timeri)
18141817 return -EBADFD;
sound/soc/amd/yc/acp6x-mach.c+7−0
@@ -808,6 +808,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { · 807 unmodified lines
808808 DMI_MATCH(DMI_BOARD_NAME, "MS-17LN"),
809809 }
810810 },
811+ {
812+ .driver_data = &acp6x_card,
813+ .matches = {
814+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
815+ DMI_MATCH(DMI_BOARD_NAME, "PM1403CDA"),
816+ }
817+ },
811818 {}
812819 };
813820
sound/soc/codecs/wm_adsp.c+3−0
@@ -679,6 +679,9 @@ static void wm_adsp_control_remove(struct cs_dsp_coeff_ctl *cs_ctl) · 678 unmodified lines
679679 {
680680 struct wm_coeff_ctl *ctl = cs_ctl->priv;
681681
682+ if (!ctl)
683+ return;
684+
682685 cancel_work_sync(&ctl->work);
683686
684687 kfree(ctl->name);
sound/soc/loongson/loongson_dma.c+10−2
@@ -199,6 +199,7 @@ loongson_pcm_pointer(struct snd_soc_component *component, · 198 unmodified lines
199199 struct snd_pcm_substream *substream)
200200 {
201201 struct snd_pcm_runtime *runtime = substream->runtime;
202+ struct device *dev = substream->pcm->card->dev;
202203 struct loongson_runtime_data *prtd = runtime->private_data;
203204 struct loongson_dma_desc *desc;
204205 snd_pcm_uframes_t x;
@@ -207,9 +208,16 @@ loongson_pcm_pointer(struct snd_soc_component *component, · 2 unmodified lines
207208 desc = dma_desc_save(prtd);
208209 addr = ((u64)desc->saddr_hi << 32) | desc->saddr;
209210
210− x = bytes_to_frames(runtime, addr - runtime->dma_addr);
211− if (x == runtime->buffer_size)
211+ if (addr < runtime->dma_addr ||
212+ addr > runtime->dma_addr + runtime->dma_bytes) {
213+ dev_warn(dev, "WARNING! dma_addr:0x%llx\n", addr);
212214 x = 0;
215+ } else {
216+ x = bytes_to_frames(runtime, addr - runtime->dma_addr);
217+ if (x == runtime->buffer_size)
218+ x = 0;
219+ }
220+
213221 return x;
214222 }
215223
sound/soc/sdca/sdca_function_device.c+21−3
@@ -82,6 +82,9 @@ static struct sdca_dev *sdca_dev_register(struct device *parent, · 81 unmodified lines
8282
8383 static void sdca_dev_unregister(struct sdca_dev *sdev)
8484 {
85+ if (!sdev)
86+ return;
87+
8588 auxiliary_device_delete(&sdev->auxdev);
8689 auxiliary_device_uninit(&sdev->auxdev);
8790 }
@@ -90,14 +93,24 @@ int sdca_dev_register_functions(struct sdw_slave *slave) · 2 unmodified lines
9093 {
9194 struct sdca_device_data *sdca_data = &slave->sdca_data;
9295 int i;
96+ int ret;
9397
9498 for (i = 0; i < sdca_data->num_functions; i++) {
9599 struct sdca_dev *func_dev;
96100
97101 func_dev = sdca_dev_register(&slave->dev,
98102 &sdca_data->function[i]);
99− if (IS_ERR(func_dev))
100− return PTR_ERR(func_dev);
103+ if (IS_ERR(func_dev)) {
104+ ret = PTR_ERR(func_dev);
105+ /*
106+ * Unregister functions that were successfully
107+ * registered before this failure. This also
108+ * sets func_dev to NULL so the caller will not
109+ * try to unregister them again.
110+ */
111+ sdca_dev_unregister_functions(slave);
112+ return ret;
113+ }
101114
102115 sdca_data->function[i].func_dev = func_dev;
103116 }
@@ -111,7 +124,12 @@ void sdca_dev_unregister_functions(struct sdw_slave *slave) · 7 unmodified lines
111124 struct sdca_device_data *sdca_data = &slave->sdca_data;
112125 int i;
113126
114− for (i = 0; i < sdca_data->num_functions; i++)
127+ for (i = 0; i < sdca_data->num_functions; i++) {
128+ if (!sdca_data->function[i].func_dev)
129+ continue;
130+
115131 sdca_dev_unregister(sdca_data->function[i].func_dev);
132+ sdca_data->function[i].func_dev = NULL;
133+ }
116134 }
117135 EXPORT_SYMBOL_NS(sdca_dev_unregister_functions, "SND_SOC_SDCA");
sound/soc/sof/amd/acp-ipc.c+2−2
@@ -181,14 +181,14 @@ irqreturn_t acp_sof_ipc_irq_thread(int irq, void *context) · 180 unmodified lines
181181 }
182182
183183 dsp_msg = snd_sof_dsp_read(sdev, ACP_DSP_BAR, ACP_SCRATCH_REG_0 + dsp_msg_write);
184− if (dsp_msg) {
184+ if (dsp_msg == ACP_DSP_MSG_SET) {
185185 snd_sof_ipc_msgs_rx(sdev);
186186 acp_dsp_ipc_host_done(sdev);
187187 ipc_irq = true;
188188 }
189189
190190 dsp_ack = snd_sof_dsp_read(sdev, ACP_DSP_BAR, ACP_SCRATCH_REG_0 + dsp_ack_write);
191− if (dsp_ack) {
191+ if (dsp_ack == ACP_DSP_ACK_SET) {
192192 if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) {
193193 guard(spinlock_irq)(&sdev->ipc_lock);
194194
sound/soc/sof/amd/acp.c+28−0
@@ -377,6 +377,33 @@ void memcpy_to_scratch(struct snd_sof_dev *sdev, u32 offset, unsigned int *src, · 376 unmodified lines
377377 snd_sof_dsp_write(sdev, ACP_DSP_BAR, reg_offset + i, src[j]);
378378 }
379379
380+static int acp_init_scratch_mem_ipc_flags(struct snd_sof_dev *sdev)
381+{
382+ u32 dsp_msg_write, dsp_ack_write, host_msg_write, host_ack_write;
383+
384+ dsp_msg_write = sdev->debug_box.offset +
385+ offsetof(struct scratch_ipc_conf, sof_dsp_msg_write);
386+ dsp_ack_write = sdev->debug_box.offset +
387+ offsetof(struct scratch_ipc_conf, sof_dsp_ack_write);
388+ host_msg_write = sdev->debug_box.offset +
389+ offsetof(struct scratch_ipc_conf, sof_host_msg_write);
390+ host_ack_write = sdev->debug_box.offset +
391+ offsetof(struct scratch_ipc_conf, sof_host_ack_write);
392+ /* Initialize host message write flag */
393+ snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SCRATCH_REG_0 + host_msg_write, 0);
394+
395+ /* Initialize host ack write flag */
396+ snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SCRATCH_REG_0 + host_ack_write, 0);
397+
398+ /* Initialize DSP message write flag */
399+ snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SCRATCH_REG_0 + dsp_msg_write, 0);
400+
401+ /* Initialize DSP ack write flag */
402+ snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SCRATCH_REG_0 + dsp_ack_write, 0);
403+
404+ return 0;
405+}
406+
380407 static int acp_memory_init(struct snd_sof_dev *sdev)
381408 {
382409 struct acp_dev_data *adata = sdev->pdata->hw_pdata;
@@ -384,6 +411,7 @@ static int acp_memory_init(struct snd_sof_dev *sdev) · 1 unmodified line
384411
385412 snd_sof_dsp_update_bits(sdev, ACP_DSP_BAR, desc->dsp_intr_base + DSP_SW_INTR_CNTL_OFFSET,
386413 ACP_DSP_INTR_EN_MASK, ACP_DSP_INTR_EN_MASK);
414+ acp_init_scratch_mem_ipc_flags(sdev);
387415 init_dma_descriptor(adata);
388416
389417 return 0;
sound/soc/sof/amd/acp.h+2−0
@@ -116,6 +116,8 @@ · 115 unmodified lines
116116 #define ACP_SRAM_PAGE_COUNT 128
117117 #define ACP6X_SDW_MAX_MANAGER_COUNT 2
118118 #define ACP70_SDW_MAX_MANAGER_COUNT ACP6X_SDW_MAX_MANAGER_COUNT
119+#define ACP_DSP_MSG_SET 1
120+#define ACP_DSP_ACK_SET 1
119121
120122 enum clock_source {
121123 ACP_CLOCK_96M = 0,