A malicious USB device may feed in carefully crafted min/max/res values,
so that the inner loop in parse_uac2_sample_rate_range() could run for
a long time or even never terminate, e.g., given max = INT_MAX.
Also nr_rates could be a large integer, which causes an integer overflow
in the subsequent call to kmalloc() in parse_audio_format_rates_v2().
Thus, kmalloc() would allocate a smaller buffer than expected, leading
to a memory corruption.
To exploit the two vulnerabilities, an attacker needs physical access
to the machine to plug in a malicious USB device.
This patch makes two changes.
1) The type of "rate" is changed to unsigned int, so that the loop could
stop once "rate" is larger than INT_MAX.
2) Limit nr_rates to 1024.
Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Fix channels swapping of 4 channels playback by
using vortex_adbdma_stopfifo instead of vortex_adbdma_pausefifo
for SNDRV_PCM_TRIGGER_STOP event
Signed-off-by: Raymond Yau <superquad.vortex2@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Fix IRQ fifo error when playing stereo by set stereo flag of fifo control.
This also fix the swap of front and rear channels on au8830.
Signed-off-by: Raymond Yau <superquad.vortex2@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Append the external clock item to the clock list only if
the SPDIF_IN capability is defined in the SPDIF register.
Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Cards with identical PCI ids but no AC97 config in EEPROM do not have
the ac97 field initialized. We must check for this case to avoid kernel oops.
Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Now that we have changed the poulsbo chip to use LPIB position fix,
we can remove the individual machine quirks that do the same thing.
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This fixup is not actually used, so in practice this is just a
cosmetic fix.
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The CS4213 chip is similar to the CS4210, but it does not have
SPDIF capabilities. Also, it has fewer pins, and the vendor specific
nid is different. With this patch, we have working inputs and outputs
(and automute/autoswitch). However, we don't know anything about
the vendor specific processing coefficients, so we don't read or write
to that node in this patch.
BugLink: https://bugs.launchpad.net/bugs/910792
Tested-by: Hsin-Yi Chen <hychen@canonical.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
There was a bug in the automute logic causing speakers not to
mute when headphones were plugged in.
Cc: stable@kernel.org
Tested-by: Hsin-Yi Chen <hychen@canonical.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The control name "HP/Speakers" is non-standard, and since there is
only one DAC on this chip there is no need for a virtual master
anyway.
Cc: stable@kernel.org
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This is a follow up on 53dea36c70 which fixes the other affected
pcm engines.
Description from 53dea36c70:
Don't rely on the codec's channels_min information to decide wheter or
not allocate a substream's DMA buffer. Rather check if the substream
itself was allocated previously.
Without this patch I was seeing null-pointer dereferenc in atmel-pcm.
Signed-off-by: Joachim Eastwood <joachim.eastwood@jotron.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Make SND_ATMEL_SOC_SSC select ATMEL_SSC to fix below build errors:
LD .tmp_vmlinux1
sound/built-in.o: In function `atmel_ssc_remove':
sound/soc/atmel/atmel_ssc_dai.c:713: undefined reference to `ssc_free'
sound/built-in.o: In function `atmel_ssc_probe':
sound/soc/atmel/atmel_ssc_dai.c:700: undefined reference to `ssc_request'
sound/built-in.o: In function `atmel_ssc_set_audio':
sound/soc/atmel/atmel_ssc_dai.c:845: undefined reference to `ssc_request'
sound/soc/atmel/atmel_ssc_dai.c:851: undefined reference to `ssc_free'
make: *** [.tmp_vmlinux1] Error 1
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
For a given ir and fs, there is at most one possible match for the case
mclk_ratios[ir][j].ratio * fs == freq.
Thus we can break from the inner loop once a match is found.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Johannes Stezenbach <js@sig21.net>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The original code does not cover the case that two DAIs(CPU) have different
ASoC core PCM operations(like mmap, pointer...). Currently we have only one
global soc_pcm_ops for ASoC core PCM operation. When two DAIs have different
pointer functions, second DAI's pointer function is set for both first DAI
and second DAI in case of original code.
This patch uses runtime's pcm_ops instead of global pcm_ops for each DAIs. So
each DAIs can have different ASoC core PCM operations. This is needed to
support multiple DAIs.
Signed-off-by: Sangsu Park <sangsu4u.park@samsung.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Use snd_soc_register_card() instead of creating a "soc-audio" platform device.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
We can't just pass back the return value of snd_soc_update_bits() as it
will be 1 if a bit changed rather than zero.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
We can't just pass back the return value of snd_soc_update_bits() as it
will be 1 if a bit changed rather than zero.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Also remove a unsued ret variable to silence the build warning.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Also remove a unused ret variable to silence the build warning.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Haojian Zhuang <haojian.zhuang@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
We can't just pass back the return value of snd_soc_update_bits() as it
will be 1 if a bit changed rather than zero.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
We can't just pass back the return value of snd_soc_update_bits() as it
will be 1 if a bit changed rather than zero.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The various devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_kzalloc, devm_request_mem_region and
devm_ioremap for data that is allocated in the probe function of a platform
device and is only freed in the remove function.
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The various devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_kzalloc, devm_request_mem_region and
devm_ioremap for data that is allocated in the probe function of a platform
device and is only freed in the remove function.
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The various devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_kzalloc, devm_request_mem_region and
devm_ioremap for data that is allocated in the probe function of a platform
device and is only freed in the remove function.
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The various devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_kzalloc, devm_request_mem_region and
devm_ioremap for data that is allocated in the probe function of a platform
device and is only freed in the remove function.
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The various devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_kzalloc, devm_request_mem_region and
devm_ioremap for data that is allocated in the probe function of a platform
device and is only freed in the remove function.
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The various devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_kzalloc, devm_request_mem_region and
devm_ioremap for data that is allocated in the probe function of a platform
device and is only freed in the remove function.
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The various devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_kzalloc, devm_request_mem_region and
devm_ioremap for data that is allocated in the probe function of a platform
device and is only freed in the remove function.
In this case, the original code did not contain a call to iounmap, nor does
one appear anywhere else in the file. I have assumed that it is safe to
use devm_ioremap for the allocation in any case.
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The various devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_kzalloc, devm_request_mem_region and
devm_ioremap for data that is allocated in the probe function of a platform
device and is only freed in the remove function.
In this case, the original code did not contain a call to iounmap, nor does
one appear anywhere else in the file. I have assumed that it is safe to
use devm_ioremap for the allocation in any case.
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
The various devm_ functions allocate memory that is released when a driver
detaches. This patch uses devm_kzalloc, devm_request_mem_region and
devm_ioremap for data that is allocated in the probe function of a platform
device and is only freed in the remove function.
Signed-off-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
