Commit graph

25568 commits

Author SHA1 Message Date
Aditya Bavanari
92ba699743 ASoC: msm: qdsp6v2: Remove param_size from pkt_size of apr header
As param_size is included in apr header pkt_size, out of
bounds access occurs in glink. Remove the param size addition
to fix this issue.

CRs-Fixed: 2472208
Change-Id: If8b34aeacd3bc9ba67ac9276eb1a8ebf0933f9f9
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
2019-08-30 09:24:36 +02:00
codeworkx
f6334e63fa Merge tag 'LA.UM.7.4.r1-05400-8x98.0' into lineage-16.0
"LA.UM.7.4.r1-05400-8x98.0"

Change-Id: Iaa6db184c519b1a6f8de9b989ba402f156bec25c
2019-08-10 14:13:49 +02:00
Linux Build Service Account
2692bfe650 Merge "dsp: q6core: validate payload size before memory copy" 2019-06-24 20:00:53 -07:00
codeworkx
15f81a19b5 Merge tag 'LA.UM.7.4.r1-05300-8x98.0' into lineage-16.0
"LA.UM.7.4.r1-05300-8x98.0"

Change-Id: I8e27939efccb7d0bda0ac7c4e32afdf3c6d62507
2019-06-16 08:15:21 +02:00
Linux Build Service Account
84253b6fc6 Merge "asoc: Ratelimit error logs to avoid excessive logging" 2019-06-09 08:03:25 -07:00
Linux Build Service Account
b901478900 Merge "soc: msm8998: Add 16ch playback and record support for TDM" 2019-06-08 11:26:05 -07:00
Dhanalakshmi Siddani
5f7a491185 soc: msm8998: Add 16ch playback and record support for TDM
Add support for 16ch playback and record usecase support
for primary and quaternary TDM ports.
Add mixer controls to set slot width, slot mapping and
calculate bit clock dynamically. Set bit clock for all
TDM ports dynamically.

Change-Id: I9d356d61f29ba18dd77138bd895139042a3c01f6
Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>
2019-06-08 07:47:03 -07:00
kunleiz
ae49a1758f dsp: q6core: validate payload size before memory copy
Payload size is not checked before memory copy.
Check payload size to avoid out-of-boundary memory
access.

Change-Id: I07857564d4e8ce415df3810b25f0e9e17a60993d
Signed-off-by: Kunlei Zhang <kunleiz@codeaurora.org>
2019-06-07 15:16:09 +05:30
Dhanalakshmi Siddani
8c174167dc asoc: Update max channels for TDM ports
Update max channels supported for TDM ports from 8 to 16.
Update pcm driver to support 32 channels and 32bit format.

Change-Id: I3d3b42983fff22e0102b9eb2aaca1a5698820605
Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>
2019-06-06 21:57:27 -07:00
Aditya Bavanari
5bee717e43 asoc: Ratelimit error logs to avoid excessive logging
Ratelimit error logs of boundary check conditions
in audio effects driver to avoid excessive logging.

CRs-Fixed: 2426159
Change-Id: Iaf10eee281389773a21340997e3ffbe88c6e79f6
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
2019-06-06 15:03:25 +05:30
Vignesh Kulothungan
a935cbe437 msm: adm: validate ADSP payload size before access
Check the size of ADSP payload before accessing it.

CRs-Fixed: 2380694
Change-Id: Icdc19a85b39a397ba6d7177f42ece4626b901832
Signed-off-by: Vignesh Kulothungan <vigneshk@codeaurora.org>
2019-05-22 12:18:41 -07:00
Linux Build Service Account
44d964e1d2 Merge "dsp: afe: check for minimum size before payload access" 2019-05-21 18:16:58 -07:00
Karthikeyan Mani
a919f50d96 dsp: afe: check for minimum size before payload access
Check if payload data is atleast the minimum expected size
before accessing the data in it.

Change-Id: Ia1295ca5ad5d002122e416fae53588681da687ea
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
2019-05-21 10:37:29 -07:00
Vatsal Bucha
f455966ef0 msm: qdsp6v2: Check size of payload before access
Check size of payload array before access in qdsp_mvm_callback.

Change-Id: I81d945f963cfb4a3cb26155700b82880d891ec5e
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
2019-05-21 05:43:31 -07:00
Karthikeyan Mani
26ac9f568e dsp: afe: check for payload size before payload access
Check if payload data is big enough before accessing
the data in it.

Change-Id: I939f205a8cebf6ef4859f81fae5429bca013d540
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
2019-05-20 00:39:09 -07:00
kunleiz
15c87d11b5 lsm: check payload size validity before using it as array index
Payload size validity is not checked before using it in array index.
Check payload size to avoid out-of-boundary memory.

Change-Id: Ic0b06bb331fc1753ff7543bb218ab12d6a4a3ca8
Signed-off-by: kunleiz <kunleiz@codeaurora.org>
2019-04-29 02:14:22 -07:00
Jean-Baptiste Theou
d02272f418 remove faulty trace_printk
For production, we shouldn't have any trace_printk entries

Change-Id: I48e9fabdbbb8da595db350630463bb065a8a6ff7
(cherry picked from commit 99bb9adb91b350bd7ec09c9018eb0901687d85a4)
Signed-off-by: celtare21 <celtare21@gmail.com>
2019-04-19 09:24:48 +02:00
Xiaojun Sang
1b75396524 dsp: asm: validate payload size before access
Payload size is not checked before payload access. Check it
to avoid out-of-boundary memory access.

Change-Id: Iaa39ee4ea5489bb5579e7b7d5dfada12d88c5809
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
2019-04-10 15:36:09 +08:00
Linux Build Service Account
dd45e2fcea Merge "msm: asm: validate ADSP data before access" 2019-04-02 14:00:26 -07:00
Linux Build Service Account
1dc6edb0ef Merge "dsp: q6voice: Check size of shared memory buffer before access" into msm-4.4.c10 2019-04-02 13:42:06 -07:00
Xiaojun Sang
950b66256c asoc: check payload length against structure size
Payload length must exceed structure size. Otherwise, it may
lead to out-of-boundary memory access.

Change-Id: I090de5116ab04a4ca2b9c485e17617fe9e861ad5
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
2019-04-01 19:56:53 -07:00
Vatsal Bucha
920b58ced9 dsp: q6voice: Check size of shared memory buffer before access
Check buffer size in qdsp_cvs_callback before access in
ul_pkt.

Change-Id: Ic19994b46086709231656ec747d2df988b7a512f
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
2019-04-01 04:42:20 -07:00
Vignesh Kulothungan
ed93ca6232 msm: asm: validate ADSP data before access
Validate buffer index obtained from ADSP token before using it.

CRs-Fixed: 2372302
Change-Id: I5c3b1634bd08b516844638dd67f726a882edfc17
Signed-off-by: Vignesh Kulothungan <vigneshk@codeaurora.org>
2019-03-28 18:29:01 -07:00
Xiaojun Sang
7289a6a51e dsp: validate token before usage as array index
Token from DSP might be invalid for array index. Validate the
token before being used as array index.

Change-Id: I9f47e1328d75d9f9acf7e85ddb452019b6eced0a
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
2019-03-26 05:23:32 -07:00
Laxminath Kasam
5557ce5cc8 asoc: codecs: Fix out of bound register access
For TX5 MUX registers, offset is not followed
in TXn order. Update driver to read/write correct
register offset when TX5 MUX registers access.

CRs-Fixed: 2218938
Change-Id: I8958b6cd1847967cbd37e7145c9f3909b0b8853b
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
2019-03-05 01:10:35 -08:00
Rohit kumar
8c12285cf3 dsp: asm: Add check for num_channels before calling q6asm_map_channels
Channel_mapping array size varies for different commands.
Add check for num_channels before calling q6asm_map_channels.

Change-Id: Iccbcfe82f716fc0ffe0a26b1779dcaa1c3cb805b
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>
2019-03-01 03:42:08 -08:00
Rohit kumar
1e9e68e4ef ASoC: Fix UBSAN warning at snd_soc_get/put_volsw_sx()
In functions snd_soc_get_volsw_sx() or snd_soc_put_volsw_sx(),
if the result of (min + max) is negative, then fls() returns
signed integer with value as 32. This leads to signed integer
overflow as complete operation is considered as signed integer.

UBSAN: Undefined behaviour in sound/soc/soc-ops.c:382:50
signed integer overflow:
-2147483648 - 1 cannot be represented in type 'int'
Call trace:
[<ffffff852f746fe4>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffff852f746fe4>] dump_stack+0xec/0x158 lib/dump_stack.c:51
[<ffffff852f7b5f3c>] ubsan_epilogue+0x18/0x50 lib/ubsan.c:164
[<ffffff852f7b6840>] handle_overflow+0xf8/0x130 lib/ubsan.c:195
[<ffffff852f7b68f0>] __ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:211
[<ffffff85307971a0>] snd_soc_get_volsw_sx+0x1a8/0x1f8 sound/soc/soc-ops.c:382

Typecast the operation to unsigned int to fix the issue.

Change-Id: I40d070b1357f016eb1622146180e4abb340e5d00
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Git-commit: ae7d1247d8673ebfd686b17e759d4be391165368
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>
2018-12-26 07:58:34 +01:00
Banajit Goswami
458cfa59c9 ASoC: change mask in snd_soc_get/put_volsw_sx to unsigned int
If the result of (min + max) is negative in functions
snd_soc_get_volsw_sx() or snd_soc_put_volsw_sx(), there
will be an overflow for the variable 'mask'.
   UBSAN: Undefined behaviour in sound/soc/soc-ops.c:382:6
   signed integer overflow:
   -2147483648 - 1 cannot be represented in type 'int'

Fix this by updating the variable type of 'mask' to unsigned int.

Change-Id: Ia34f397fad5b93c0e2ffacae60e051ad20c20bdf
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
2018-12-26 07:58:34 +01:00
Laxminath Kasam
9da7997716 ASoC: wsa881x: Fix regcache sync issue during playback
When temperature on a single wsa881x device is being read,
then soundwire master wakes up both wsa881x devices but
regcache_sync is happening only for one wsa881x device on
which the temperature is being read. This results in
audio playback mute after temperature read. Fix the
regcache sync during temperature read and playback usecase.

CRs-Fixed: 2282230
Change-Id: I054f4432d7ae7bce922341ad62b20544cccd5865
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
2018-12-26 07:53:58 +01:00
liochen
8148b9d900 Synchronize codes for OnePlus5 & 5T OxygenOS 9.0.0
kernel device tree source code for OnePlus 5 & 5T P device

Change-Id: I84f40e66833ea1ce30eb1d9a710d6e1529e9e637
2018-12-26 11:02:39 +08:00
Rohit kumar
4ed2bedbea ASoC: Fix UBSAN warning at snd_soc_get/put_volsw_sx()
In functions snd_soc_get_volsw_sx() or snd_soc_put_volsw_sx(),
if the result of (min + max) is negative, then fls() returns
signed integer with value as 32. This leads to signed integer
overflow as complete operation is considered as signed integer.

UBSAN: Undefined behaviour in sound/soc/soc-ops.c:382:50
signed integer overflow:
-2147483648 - 1 cannot be represented in type 'int'
Call trace:
[<ffffff852f746fe4>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffff852f746fe4>] dump_stack+0xec/0x158 lib/dump_stack.c:51
[<ffffff852f7b5f3c>] ubsan_epilogue+0x18/0x50 lib/ubsan.c:164
[<ffffff852f7b6840>] handle_overflow+0xf8/0x130 lib/ubsan.c:195
[<ffffff852f7b68f0>] __ubsan_handle_sub_overflow+0x34/0x44 lib/ubsan.c:211
[<ffffff85307971a0>] snd_soc_get_volsw_sx+0x1a8/0x1f8 sound/soc/soc-ops.c:382

Typecast the operation to unsigned int to fix the issue.

Change-Id: I40d070b1357f016eb1622146180e4abb340e5d00
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Git-commit: ae7d1247d8673ebfd686b17e759d4be391165368
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>
2018-11-22 21:31:44 -08:00
Banajit Goswami
eca745fc5a ASoC: change mask in snd_soc_get/put_volsw_sx to unsigned int
If the result of (min + max) is negative in functions
snd_soc_get_volsw_sx() or snd_soc_put_volsw_sx(), there
will be an overflow for the variable 'mask'.
   UBSAN: Undefined behaviour in sound/soc/soc-ops.c:382:6
   signed integer overflow:
   -2147483648 - 1 cannot be represented in type 'int'

Fix this by updating the variable type of 'mask' to unsigned int.

Change-Id: Ia34f397fad5b93c0e2ffacae60e051ad20c20bdf
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
2018-11-22 02:46:01 -08:00
Laxminath Kasam
e6a032c67e ASoC: wsa881x: Fix regcache sync issue during playback
When temperature on a single wsa881x device is being read,
then soundwire master wakes up both wsa881x devices but
regcache_sync is happening only for one wsa881x device on
which the temperature is being read. This results in
audio playback mute after temperature read. Fix the
regcache sync during temperature read and playback usecase.

CRs-Fixed: 2282230
Change-Id: I054f4432d7ae7bce922341ad62b20544cccd5865
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
2018-10-02 22:33:23 -07:00
Soumya Managoli
8448418180 ASoC: msm: qdsp6v2: Handle invalid session for dtmf enable
If session id is invalid then dtmf voice info will also
be invalid.

Add check to return error if session id is invalid.

CRs-Fixed: 2306771
Change-Id: I362340f9f666c95949eaa94d0ced4cb3a1b9abab
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
2018-09-17 07:27:44 -07:00
Soumya Managoli
c29b12e26d ASoC: msm: qdsp6v2: Handle invalid session for dtmf enable
If session id is invalid then dtmf voice info will also
be invalid.

Add check to return error if session id is invalid.

CRs-Fixed: 2306771
Change-Id: I362340f9f666c95949eaa94d0ced4cb3a1b9abab
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
2018-09-17 03:53:13 -07:00
Tanya Dixit
700502714a rtac: Add mutex lock to ensure proper fops access
Add mutex lock in rtac_open and rtac_release
to avoid usage count discrepancies leading
to multiple calls to unmap memory resulting in
null pointer dereference.

CRs-Fixed: 2271712
Change-Id: Ie6da28837c352030b8d7e377d68a70cf04e7072a
Signed-off-by: Tanya Dixit <tdixit@codeaurora.org>
2018-09-11 19:07:54 +05:30
Linux Build Service Account
c44da670c2 Merge "Merge android-4.4.153 (5e24b4e) into msm-4.4" 2018-09-06 14:14:24 -07:00
Soumya Managoli
5206b51937 asoc : msm: Fix zero size pointer issue
APPS crashes randomly due to invalid memory allocation
in q6asm_audio_client_buf_free_contiguous.
Added check to return error if memory allocation size is 0.

Change-Id: I40f49aa147d513b29b56224a5ee77ccbb2dcc110
CRs-Fixed: 2285272
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
2018-09-04 04:53:26 -07:00
Srinivasarao P
b87d31674a Merge android-4.4.153 (5e24b4e) into msm-4.4
* refs/heads/tmp-5e24b4e
  Linux 4.4.153
  ovl: warn instead of error if d_type is not supported
  ovl: Do d_type check only if work dir creation was successful
  ovl: Ensure upper filesystem supports d_type
  x86/mm: Fix use-after-free of ldt_struct
  x86/mm/pat: Fix L1TF stable backport for CPA
  ANDROID: x86_64_cuttlefish_defconfig: Enable lz4 compression for zram
  UPSTREAM: drivers/block/zram/zram_drv.c: fix bug storing backing_dev
  BACKPORT: zram: introduce zram memory tracking
  BACKPORT: zram: record accessed second
  BACKPORT: zram: mark incompressible page as ZRAM_HUGE
  UPSTREAM: zram: correct flag name of ZRAM_ACCESS
  UPSTREAM: zram: Delete gendisk before cleaning up the request queue
  UPSTREAM: drivers/block/zram/zram_drv.c: make zram_page_end_io() static
  BACKPORT: zram: set BDI_CAP_STABLE_WRITES once
  UPSTREAM: zram: fix null dereference of handle
  UPSTREAM: zram: add config and doc file for writeback feature
  BACKPORT: zram: read page from backing device
  BACKPORT: zram: write incompressible pages to backing device
  BACKPORT: zram: identify asynchronous IO's return value
  BACKPORT: zram: add free space management in backing device
  UPSTREAM: zram: add interface to specif backing device
  UPSTREAM: zram: rename zram_decompress_page to __zram_bvec_read
  UPSTREAM: zram: inline zram_compress
  UPSTREAM: zram: clean up duplicated codes in __zram_bvec_write
  Linux 4.4.152
  reiserfs: fix broken xattr handling (heap corruption, bad retval)
  i2c: imx: Fix race condition in dma read
  PCI: pciehp: Fix use-after-free on unplug
  PCI: Skip MPS logic for Virtual Functions (VFs)
  PCI: hotplug: Don't leak pci_slot on registration failure
  parisc: Remove unnecessary barriers from spinlock.h
  bridge: Propagate vlan add failure to user
  packet: refine ring v3 block size test to hold one frame
  netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
  xfrm_user: prevent leaking 2 bytes of kernel memory
  parisc: Remove ordered stores from syscall.S
  ext4: fix spectre gadget in ext4_mb_regular_allocator()
  KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
  staging: android: ion: check for kref overflow
  tcp: identify cryptic messages as TCP seq # bugs
  net: qca_spi: Fix log level if probe fails
  net: qca_spi: Make sure the QCA7000 reset is triggered
  net: qca_spi: Avoid packet drop during initial sync
  net: usb: rtl8150: demote allmulti message to dev_dbg()
  net/ethernet/freescale/fman: fix cross-build error
  drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply()
  tcp: remove DELAYED ACK events in DCTCP
  qlogic: check kstrtoul() for errors
  packet: reset network header if packet shorter than ll reserved space
  ixgbe: Be more careful when modifying MAC filters
  ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller
  ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot
  perf llvm-utils: Remove bashism from kernel include fetch script
  bnxt_en: Fix for system hang if request_irq fails
  drm/armada: fix colorkey mode property
  ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem
  ieee802154: at86rf230: use __func__ macro for debug messages
  ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem
  ARM: pxa: irq: fix handling of ICMR registers in suspend/resume
  netfilter: x_tables: set module owner for icmp(6) matches
  smsc75xx: Add workaround for gigabit link up hardware errata.
  kasan: fix shadow_size calculation error in kasan_module_alloc
  tracing: Use __printf markup to silence compiler
  ARM: imx_v4_v5_defconfig: Select ULPI support
  ARM: imx_v6_v7_defconfig: Select ULPI support
  HID: wacom: Correct touch maximum XY of 2nd-gen Intuos
  m68k: fix "bad page state" oops on ColdFire boot
  bnx2x: Fix receiving tx-timeout in error or recovery state.
  drm/exynos: decon5433: Fix WINCONx reset value
  drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes
  drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes
  md/raid10: fix that replacement cannot complete recovery after reassemble
  dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
  ARM: dts: da850: Fix interrups property for gpio
  selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs
  perf report powerpc: Fix crash if callchain is empty
  perf test session topology: Fix test on s390
  usb: xhci: increase CRS timeout value
  ARM: dts: am437x: make edt-ft5x06 a wakeup source
  brcmfmac: stop watchdog before detach and free everything
  cxgb4: when disabling dcb set txq dcb priority to 0
  Smack: Mark inode instant in smack_task_to_inode
  ipv6: mcast: fix unsolicited report interval after receiving querys
  locking/lockdep: Do not record IRQ state within lockdep code
  net: davinci_emac: match the mdio device against its compatible if possible
  ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP
  net: propagate dev_get_valid_name return code
  net: hamradio: use eth_broadcast_addr
  enic: initialize enic->rfs_h.lock in enic_probe
  qed: Add sanity check for SIMD fastpath handler.
  arm64: make secondary_start_kernel() notrace
  scsi: xen-scsifront: add error handling for xenbus_printf
  usb: gadget: dwc2: fix memory leak in gadget_init()
  usb: gadget: composite: fix delayed_status race condition when set_interface
  usb: dwc2: fix isoc split in transfer with no data
  ARM: dts: Cygnus: Fix I2C controller interrupt type
  selftests: sync: add config fragment for testing sync framework
  selftests: zram: return Kselftest Skip code for skipped tests
  selftests: user: return Kselftest Skip code for skipped tests
  selftests: static_keys: return Kselftest Skip code for skipped tests
  selftests: pstore: return Kselftest Skip code for skipped tests
  netfilter: ipv6: nf_defrag: reduce struct net memory waste
  ARC: Explicitly add -mmedium-calls to CFLAGS
  ANDROID: x86_64_cuttlefish_defconfig: Enable zram and zstd
  BACKPORT: crypto: zstd - Add zstd support
  UPSTREAM: zram: add zstd to the supported algorithms list
  UPSTREAM: lib: Add zstd modules
  UPSTREAM: lib: Add xxhash module
  UPSTREAM: zram: rework copy of compressor name in comp_algorithm_store()
  UPSTREAM: zram: constify attribute_group structures.
  UPSTREAM: zram: count same page write as page_stored
  UPSTREAM: zram: reduce load operation in page_same_filled
  UPSTREAM: zram: use zram_free_page instead of open-coded
  UPSTREAM: zram: introduce zram data accessor
  UPSTREAM: zram: remove zram_meta structure
  UPSTREAM: zram: use zram_slot_lock instead of raw bit_spin_lock op
  BACKPORT: zram: partial IO refactoring
  BACKPORT: zram: handle multiple pages attached bio's bvec
  UPSTREAM: zram: fix operator precedence to get offset
  BACKPORT: zram: extend zero pages to same element pages
  BACKPORT: zram: remove waitqueue for IO done
  UPSTREAM: zram: remove obsolete sysfs attrs
  UPSTREAM: zram: support BDI_CAP_STABLE_WRITES
  UPSTREAM: zram: revalidate disk under init_lock
  BACKPORT: mm: support anonymous stable page
  UPSTREAM: zram: use __GFP_MOVABLE for memory allocation
  UPSTREAM: zram: drop gfp_t from zcomp_strm_alloc()
  UPSTREAM: zram: add more compression algorithms
  UPSTREAM: zram: delete custom lzo/lz4
  UPSTREAM: zram: cosmetic: cleanup documentation
  UPSTREAM: zram: use crypto api to check alg availability
  BACKPORT: zram: switch to crypto compress API
  UPSTREAM: zram: rename zstrm find-release functions
  UPSTREAM: zram: introduce per-device debug_stat sysfs node
  UPSTREAM: zram: remove max_comp_streams internals
  UPSTREAM: zram: user per-cpu compression streams
  BACKPORT: zsmalloc: require GFP in zs_malloc()
  UPSTREAM: zram/zcomp: do not zero out zcomp private pages
  UPSTREAM: zram: pass gfp from zcomp frontend to backend
  UPSTREAM: socket: close race condition between sock_close() and sockfs_setattr()
  ANDROID: Refresh x86_64_cuttlefish_defconfig
  Linux 4.4.151
  isdn: Disable IIOCDBGVAR
  Bluetooth: avoid killing an already killed socket
  x86/mm: Simplify p[g4um]d_page() macros
  serial: 8250_dw: always set baud rate in dw8250_set_termios
  ACPI / PM: save NVS memory for ASUS 1025C laptop
  ACPI: save NVS memory for Lenovo G50-45
  USB: option: add support for DW5821e
  USB: serial: sierra: fix potential deadlock at close
  ALSA: vxpocket: Fix invalid endian conversions
  ALSA: memalloc: Don't exceed over the requested size
  ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry
  ALSA: cs5535audio: Fix invalid endian conversion
  ALSA: virmidi: Fix too long output trigger loop
  ALSA: vx222: Fix invalid endian conversions
  ALSA: hda - Turn CX8200 into D3 as well upon reboot
  ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs
  net_sched: fix NULL pointer dereference when delete tcindex filter
  vsock: split dwork to avoid reinitializations
  net_sched: Fix missing res info when create new tc_index filter
  llc: use refcount_inc_not_zero() for llc_sap_find()
  l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache
  dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()

Conflicts:
	drivers/block/zram/zram_drv.c
	drivers/staging/android/ion/ion.c
	include/linux/swap.h
	mm/zsmalloc.c

Change-Id: I1c437ac5133503a939d06d51ec778b65371df6d1
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-08-28 17:28:39 +05:30
Srinivasarao P
40eed1f500 Merge android-4.4.150 (5541782) into msm-4.4
* refs/heads/tmp-5541782
  Linux 4.4.150
  x86/speculation/l1tf: Exempt zeroed PTEs from inversion
  Linux 4.4.149
  x86/mm: Add TLB purge to free pmd/pte page interfaces
  ioremap: Update pgtable free interfaces with addr
  Bluetooth: hidp: buffer overflow in hidp_process_report
  ASoC: Intel: cht_bsw_max98090_ti: Fix jack initialization
  crypto: ablkcipher - fix crash flushing dcache in error path
  crypto: blkcipher - fix crash flushing dcache in error path
  crypto: vmac - separate tfm and request context
  crypto: vmac - require a block cipher with 128-bit block size
  kbuild: verify that $DEPMOD is installed
  i2c: ismt: fix wrong device address when unmap the data buffer
  kasan: don't emit builtin calls when sanitization is off
  tcp: Fix missing range_truesize enlargement in the backport
  x86/mm: Disable ioremap free page handling on x86-PAE

Conflicts:
	Makefile

Change-Id: I9cbfedbeb3bdb1df021d4f192a2a7392010cd627
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-08-28 16:40:54 +05:30
Takashi Iwai
09b56641dd ALSA: vxpocket: Fix invalid endian conversions
commit 3acd3e3bab95ec3622ff98da313290ee823a0f68 upstream.

The endian conversions used in vxp_dma_read() and vxp_dma_write() are
superfluous and even wrong on big-endian machines, as inw() and outw()
already do conversions.  Kill them.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-22 07:48:36 +02:00
Takashi Iwai
dd65a18b20 ALSA: memalloc: Don't exceed over the requested size
commit dfef01e150824b0e6da750cacda8958188d29aea upstream.

snd_dma_alloc_pages_fallback() tries to allocate pages again when the
allocation fails with reduced size.  But the first try actually
*increases* the size to power-of-two, which may give back a larger
chunk than the requested size.  This confuses the callers, e.g. sgbuf
assumes that the size is equal or less, and it may result in a bad
loop due to the underflow and eventually lead to Oops.

The code of this function seems incorrectly assuming the usage of
get_order().  We need to decrease at first, then align to
power-of-two.

Reported-and-tested-by: he, bo <bo.he@intel.com>
Reported-by: zhang jun <jun.zhang@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-22 07:48:36 +02:00
Hans de Goede
ad76ea373e ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry
commit 8e82a728792bf66b9f0a29c9d4c4b0630f7b9c79 upstream.

I added the subsys product-id for the HDMI HDA device rather then for
the PCH one, this commit fixes this.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1525104
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-22 07:48:36 +02:00
Takashi Iwai
dbc8ab8952 ALSA: cs5535audio: Fix invalid endian conversion
commit 69756930f2de0457d51db7d505a1e4f40e9fd116 upstream.

One place in cs5535audio_build_dma_packets() does an extra conversion
via cpu_to_le32(); namely jmpprd_addr is passed to setup_prd() ops,
which writes the value via cs_writel().  That is, the callback does
the conversion by itself, and we don't need to convert beforehand.

This patch fixes that bogus conversion.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-22 07:48:36 +02:00
Takashi Iwai
8419b74a43 ALSA: virmidi: Fix too long output trigger loop
commit 50e9ffb1996a5d11ff5040a266585bad4ceeca0a upstream.

The virmidi output trigger tries to parse the all available bytes and
process sequencer events as much as possible.  In a normal situation,
this is supposed to be relatively short, but a program may give a huge
buffer and it'll take a long time in a single spin lock, which may
eventually lead to a soft lockup.

This patch simply adds a workaround, a cond_resched() call in the loop
if applicable.  A better solution would be to move the event processor
into a work, but let's put a duct-tape quickly at first.

Reported-and-tested-by: Dae R. Jeong <threeearcat@gmail.com>
Reported-by: syzbot+619d9f40141d826b097e@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-22 07:48:36 +02:00
Takashi Iwai
c48a18584d ALSA: vx222: Fix invalid endian conversions
commit fff71a4c050ba46e305d910c837b99ba1728135e upstream.

The endian conversions used in vx2_dma_read() and vx2_dma_write() are
superfluous and even wrong on big-endian machines, as inl() and outl()
already do conversions.  Kill them.

Spotted by sparse, a warning like:
  sound/pci/vx222/vx222_ops.c:278:30: warning: incorrect type in argument 1 (different base types)

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-22 07:48:36 +02:00
Park Ju Hyung
caf8fe5173 ALSA: hda - Turn CX8200 into D3 as well upon reboot
commit d77a4b4a5b0b2ebcbc9840995d91311ef28302ab upstream.

As an equivalent codec with CX20724,
CX8200 is also subject to the reboot bug.

Late 2017 and 2018 LG Gram and some HP Spectre laptops are known victims
to this issue, causing extremely loud noises upon reboot.

Now that we know that this bug is subject to multiple codecs,
fix the comment as well.

Signed-off-by: Park Ju Hyung <qkrwngud825@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-22 07:48:36 +02:00
Park Ju Hyung
1b692b786b ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs
commit f59cf9a0551dd954ad8b752461cf19d9789f4b1d upstream.

On rare occasions, we are still noticing that the internal speaker
spitting out spurious noises even after adding the problematic codec
to the list.

Adding a 10ms artificial delay before rebooting fixes the issue entirely.

Patch for Realtek codecs also adds the same amount of delay after
entering D3.

Signed-off-by: Park Ju Hyung <qkrwngud825@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-22 07:48:35 +02:00
Thierry Escande
59e68641ad ASoC: Intel: cht_bsw_max98090_ti: Fix jack initialization
commit 3bbda5a38601f7675a214be2044e41d7749e6c7b upstream.

If the ts3a227e audio accessory detection hardware is present and its
driver probed, the jack needs to be created before enabling jack
detection in the ts3a227e driver. With this patch, the jack is
instantiated in the max98090 headset init function if the ts3a227e is
present. This fixes a null pointer dereference as the jack detection
enabling function in the ts3a driver was called before the jack is
created.

[minor correction to keep error handling on jack creation the same
as before by Pierre Bossart]

Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Acked-By: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-17 20:56:45 +02:00
Erin Yan
2a7de56683 q6asm: retry asm_open_read and asm_open_loopback when session id conflict
The ADSP asm session ids are managed by the kernel driver. It's all right
for native use cases. But for virtualization use cases, there's no way to
synchronize the session ids' status among virtual machines.  Playing back
in one virtual machine is probably failed, because the session id may had
been occupied by a use case in another virtual machine.

The patch allowed audio capture stream and loopback stream to try all
available session ids in case of session id conflict error, to support
concurrent playback from multiple virtual machines.

Change-Id: I01b4da65f3e5716dd14c20c614b53f3c45dd9ea3
Signed-off-by: Erin Yan <xinyey@codeaurora.org>
2018-08-14 19:49:31 -07:00