This patch adds extra init functions for the Sound Blaster Z and
Recon3Di. It also adds more checks to make sure that the DSP isn't
downloaded twice on startup, by checking if the dsp_state is already set
to DSP_DOWNLOADED. It also adds the ability to re-download the DSP on a
resume.
It also changes the init verbs table to apply to all codecs, and takes
the two specific end verbs and puts them into a separate function in
ca0132_init instead.
GPIO functions are also added.
Signed-off-by: Connor McAdams <conmanx360@gmail.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch adds extra functions for shutdown on the Sound Blaster Z and
Recon3Di. The Recon3Di only has one specific functions, which sets the
GPIO data pins to 0 to prevent a popping noise.
The Sound Blaster Z exit sequence was taken from Windows. Without this
exit function, the card will not reload properly unless the PC has been
shutdown to clear the onboard memory. There are commented out functions
currently in the sbz_exit_chip function that are added in a later patch.
Also, a reboot notify function has been added, to make sure these
functions are ran before a reboot. This helps when using the card
through VFIO in a virtual machine, to make sure the card reloads the DSP
properly.
Signed-off-by: Connor McAdams <conmanx360@gmail.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch adds iomapping for the region2 section of memory on the SBZ.
This memory region is used in later patches for setting inputs and
outputs. If the mapping fails, the quirk is changed back to QUIRK_NONE
to avoid attempts to write to uninitialized memory.
It also adds a new exit sequence to unmap the iomem for the SBZ.
[ Reordered linux/*.h inclusion in the patch by tiwai ]
Signed-off-by: Connor McAdams <conmanx360@gmail.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch adds an unsolicited response tag for the front headphone
panel which uses the same hp_callback as the rear headphone detection.
This patch also adds pincfgs for the R3Di and SBZ which were taken from
the Windows driver. The pins are also defined in the function
ca0132_config. Both the R3Di and SBZ are also given a max out channel
value of 6 to handle 5.1 surround sound in later patches.
Signed-off-by: Connor McAdams <conmanx360@gmail.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch adds PCI quirk ID's for the Sound Blaster Z and Recon3Di.
Only the currently tested ID's have been added.
This patch also adds the ability to load alternative firmwares for each
card, the firmwares can be obtained from within the Windows driver.
The Recon3Di uses "ctefx-r3di.bin" and the Sound Blaster Z uses
"ctefx-sbz.bin". If the alternative firmware for the given quirk is not
found, the original ctefx.bin will be used. This has been confirmed to
work for both the R3Di and the SBZ.
This patch also makes the character array *dirstr a const.
Signed-off-by: Connor McAdams <conmanx360@gmail.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Recently released USB Audio Class 3.0 specification
contains BADD (Basic Audio Device Definition) document
which describes pre-defined UAC3 configurations.
BADD support is mandatory for UAC3 devices, it should be
implemented as a separate USB device configuration.
As per BADD document, class-specific descriptors
shall not be included in the Device’s Configuration
descriptor ("inferred"), but host can guess them
from BADD profile number, number of endpoints and
their max packed sizes.
This patch adds support of all BADD profiles from the spec
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Tested-by: Jorge Sanjuan <jorge.sanjuan@codethink.co.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The snd_pcm_stream_lock_irq*() functions decouple disabling interrupts
from the actual locking process. This does not work as expected if the
locking primitives are replaced like on preempt-rt.
Provide one function for locking which uses correct locking primitives.
Signed-off-by: Anna-Maria Gleixner <anna-maria@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add BADD-specific predefined values to audio-v3
so usb-audio in ALSA and UAC3 gadget can use them
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Functions like snd_usb_copy_string_desc() or
get_term_name() don't actually need mixer_build
state but can use snd_usb_audio structure instead
to get usb device.
This patch has no functional change but prepares
to future UAC3 BADD profiles support which don't
have class-specific descriptors so won't have
mixer_build state.
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The control header needs to be read from buffer at this point only
in the case of UAC1 protocol. Move it inside the switch case as other
protocols such as the Basic Audio Device spec will have an empty buffer
that is latter filled as inferred.
Signed-off-by: Jorge Sanjuan <jorge.sanjuan@codethink.co.uk>
[Ruslan: updated with recently added sanity checks]
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Offload snd_usb_parse_audio_interface() function
which became quite long after adding UAC3 spec support.
Move class-specific parts of uac3 parsing to separate
function which now produce audioformat structure that
is ready to be fed to snd_usb_add_audio_stream().
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Offload snd_usb_parse_audio_interface() function
which became quite long after adding UAC3 spec support.
Move class-specific parts of uac1/2 parsing to separate
function which now produce audioformat structure that
is ready to be fed to snd_usb_add_audio_stream().
This also broke Blue Microphones workaround (which
relies on audioformat decoded from previous altsetting)
into two parts: prepare quirk flag analyzing previous
altsetting then use it with current altsetting.
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Offload snd_usb_parse_audio_interface() function which
became quite long after adding UAC3 spec support.
Move audioformat allocation and initialization
into separate function, this will make easier
future refactoring.
Attributes left in the original func because it'll
be used for UAC3 BADD profiles suport in the future
There is no functional change.
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Introduce a new macro for iterating over mixer element list for
avoiding the open codes in many places. Also the open-coded
container_of() and the forced cast to struct usb_mixer_elem_info are
replaced with another simple macro, too.
No functional changes but just readability improvement.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
dbri driver allocates a resource with GFP_ATOMIC unnecessarily in its
probe function. Replace it with the standard GFP_KERNEL for avoiding
the bogus allocation failures.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Dell WD15 Dock with 0bda:4014 doesn't give any useful strings for the
vendor and the product names. Name them more specifically via quirk,
as well as the UCM profile name.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Historically USB-audio driver sets the card's longname field with the
details of the device and the bus information. It's good per se, but
not preferable when it's referred as the identifier for UCM profile.
This patch adds a quirk profile_name field to override the card's
longname string to a pre-defined one, so that one can create a unique
and consistent ID string for the specific USB device via a quirk table
to be used as a UCM profile name.
The patch does a slight code refactoring to split out the functions to
set shortname and longname fields as well.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch adds "Keep Interface" control for each USB-audio device.
The control element is with SND_CTL_IFACE_CARD, so that it won't
appear on any sane mixer applications. For a device that is confirmed
to work well with "keep-interface" mode, user can flip the control via
amixer, e.g.
% amixer -c1 cset iface=CARD,name='Keep Interface' on
and save/restore the state via alsactl.
The reason to provide this via control API is that the behavior must
be pretty depending on the device (and the firmware in it), so it's
not ideal to apply via module option.
For a device that certainly works, we may set it statically via a
quirk table entry. But a device like Dell WD15 dock behaves so
differently depending on the firmware, and we can't set it
statically. So leave this as a dynamic switch each user can adjust
freely.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Introduce a new flag to struct snd_usb_audio for allowing the device
to skip usb_set_interface() calls at changing or closing the stream.
As of this patch, the flag is nowhere set, so it's just a place
holder. The dynamic switching will be added in the following patch.
A background information for this change:
Dell WD15 dock with Realtek chip gives a very long pause at each time
the driver changes the altset, which eventually happens at every PCM
stream open/close and parameter change. As the long pause happens in
each usb_set_interface() call, there is nothing we can do as long as
it's called. The workaround is to reduce calling it as much as
possible, and this flag indicates that behavior.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This is a preliminary change for the upcoming quirk implementation.
Currently USB-audio driver tries to call usb_set_interface() whenever
the format change with interface/altset modification happens. In this
patch, the check is replaced with the comparison of cur_altsetting and
the targeted altsetting pointer, so that the driver may skip the
unnecessary function calls.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
In the early commit adcdd0d5a1 ("ALSA: usb-audio: Skip volume
controls triggers hangup on Dell USB Dock"), we add the mixer quirks
for Dell dock to skip two mixer FU's for playback. This supposed that
the device has always the proper initial volume, but it doesn't seem
always correct.
This patch adds the explicit initialization of the volumes to the
fixed 0dB at the device probe time. Also, such a fixup is needed
after the resume, so a new function is hooked to the resume callback
as well.
Bugzilla: http://bugzilla.suse.com/show_bug.cgi?id=1089467
Signed-off-by: Takashi Iwai <tiwai@suse.de>
At present, to add PCM substreams for each of available tx/rx streams,
this driver uses a condition based on model-name. This is not enough
to support unknown models.
In former commits, this driver gains cache of stream formats. For models
which support protocol extension, all of available steam formats are
cached. For known models, hard-coded stream formats are used to generate
the cache. For unknown models, stream formats at current mode of sampling
transmission frequency is cached.
Anyway, at least, the cached formats are used to expose constrains of PCM
substreams for userspace applications. Thus, The cached data can be also
used to add PCM substreams themselves, instead of the name-based
conditions.
This commit obsoletes local frag of force_two_pcms.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
In former commits, proxy structure gets members for cache of stream
formats. The cache allows to apply correct constraints and rules to
runtime of PCM substream. They allows userspace applications to change
current sampling transmission frequency.
This commit uses the cacher for the PCM constraints and rules.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
In former commits, proxy structure gets members for cache of stream
formats. The cache can be used to count the number of MIDI substreams
to add.
This commit uses the cache for this purpose.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This is a preparation for userspace applications to change current sampling
transmission frequency via ALSA PCM interface.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is a small refactoring for better readability.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
At present, to check running stream, available stream formats are used
at current sampling transmission frequency (stf). But when changing stf,
it's convenient to use cache of stream formats.
This commit applies this idea.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
TC Applied Technologies (TCAT) have added extension to DICE protocol. This
protocol extension is called as Extended Application Protocol, a.k.a. EAP.
In this protocol extension, units get additional 9 address spaces. One of
it is for current configuration. In this address space, a pair of router
and stream formats are exposed per mode of three sampling transmission
frequencies.
This commit adds support the protocol extension for address space of the
current configuration to generate cache of stream formats.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Alesis shipped some models with DICE ASICs. All of them just support
DICE original protocol and drivers can't retrieve all of available stream
formats without changing status of sampling transmission frequency
actually.
This commit puts some hard-coded parameters for the models. When detecting
the models, the corresponding parameters are copied as cache of stream
formats.
I note that each of pair of iO14/iO26 and MultiMix 8/12/16 has the same
model ID on their configuration ROM. The MultiMix 8/12/16 just support
one mode for sampling transmission frequency and ALSA dice driver already
handles them correctly. The iO14/iO26 support three modes and need
hard-coded parameters. To distinguish these two models, this commit let
the driver to retrieve current stream formats and compare it to known
parameters, then decide it.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
TC Electronic shipped some models with DICE ASICs. All of them just support
DICE original protocol and drivers can't retrieve all of available stream
formats without changing status of sampling transmission frequency
actually.
This commit puts some hard-coded parameters for the models. When detecting
the models, the corresponding parameters are copied as cache of stream
formats.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
In former commits, proxy structure get members for cache of stream
formats. This commit fills the cache with stream formats at current mode
of sampling transmission frequency.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Products with DICE interface in market can support variable stream
formats for three levels of sampling transmission frequencies. To
record these formats, a proxy structure got several fields in former
commit.
This commit adds a proc node to output the stream formats for debugging
purpose.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Unlike the other drivers in ALSA firewire stack, ALSA dice driver does't
create 'firewire' directory for proc nodes because it has 'dice' node
only. But this is inconvenient because I have a plan to add another proc
node to output available stream formats from cache.
This commit let the driver to create the directory and put 'dice' node
into it.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A previous commit 6f688268b3 ('ALSA: dice: purge generating channel
cache') purged cache of stream formats. DICE interface originally has
no feature to assist drivers to retrieve available formats for all of
supported sampling transmission frequencies, without changing the
frequency actually.
For later release of Dice ASICs such as TCD2210, Dice interface has
extended protocol and can support the feature. This assists drivers
to retrieve available stream formats.
This commit is a first step to regain the cache to generate PCM rules
for all of supported sampling transmission frequencies.
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Trivial fix to spelling mistake in KERN_ERR error messages
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
DECLARE_TLV_DB_SCALE (alias of SNDRV_CTL_TLVD_DECLARE_DB_SCALE) is used but
tlv.h is not included. This causes build failure when local macro is
defined by comment-out.
This commit fixes the bug. At the same time, the alias macro is replaced
with a destination macro added at a commit 46e860f768 ("ALSA: rename
TLV-related macros so that they're friendly to user applications")
Reported-by: Connor McAdams <conmanx360@gmail.com>
Fixes: 44f0c9782c ('ALSA: hda/ca0132: Add tuning controls')
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The DP-MST support requires more PCM streams than usual, hence
CONFIG_SND_DYNAMIC_MINORS is almost mandatory. Currently the driver
just warns and continues even if streams are missing, but it doesn't
seem to enough convince users to switch to the modern setup.
This patch adds the enforced selection of CONFIG_SND_DYNAMIC_MINORS
from CONFIG_SND_HDA_CODEC_HDMI for covering that.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Trivial fix to spelling mistake in module parameter description text
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When CONFIG_SND_DYNAMIC_MINORS isn't set, there are only limited
number of devices available, and HD-audio, especially with HDMI/DP
codec, will fail to create more than two devices.
The driver warns about the lack of such devices and skips the PCM
device creations, but the HDMI driver still tries to create the
corresponding JACK, SPDIF and ELD controls even for the non-existing
PCM substreams. This results in confusion on user-space, and even may
break the operation.
Similarly, Intel HDMI/DP codec builds the ELD notification from i915
graphics driver, and this may be broken if a notification is sent for
the non-existing PCM stream.
This patch adds the check of the existence of the assigned PCM
substream in the both scenarios above, and skips the further operation
if the PCM substream is not assigned.
Fixes: 9152085def ("ALSA: hda - add DP MST audio support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A small batch of fixes collected since the merge window, none of which
are particularly large or remarkable. They've all been cooking in -next
for a while.
-----BEGIN PGP SIGNATURE-----
iQFHBAABCgAxFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAlrgVhUTHGJyb29uaWVA
a2VybmVsLm9yZwAKCRAk1otyXVSH0BLSB/9mHlzA1d78kFd0JXJvk2embzdNGUcg
Qaj3FxNiAt4ghZvxYb/o47qIVfimawnMigtad+vIjqJOD1v0P6ydLRKVmaKYBLft
48XTnphOt4X4LfXnKglpWl8F0qwtzU/p2SFzTYmztxLjebqOcPOeG8C4WBega5KR
AXco1APps0u2qwH3hdSlEbstBp+YFOReGrierKkxafwlv8tbryzPFeOOK/znV22Y
ZaQlAdWzkVV+YGOcNCHyR1lgAbi7vkVGPWPl+N6WuCi0a7c1HlWMuRlSDWvdUe5e
PVBEnq0OK6MGI9jalMhJ8i1GEM6IWyaodCphsgDqojKGa415FBuzKG1s
=xFqk
-----END PGP SIGNATURE-----
Merge tag 'asoc-fix-4.17-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v4.17
A small batch of fixes collected since the merge window, none of which
are particularly large or remarkable. They've all been cooking in -next
for a while.
On this Lenovo ThinkCentre machine. There are two front mics,
we change the location for one of them.
Relation: f33f79f3d0 ("ALSA: hda/realtek - change the location for
one of two front microphones")
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
As recently Smatch suggested, one place in RME9652 driver may expand
the array directly from the user-space value with speculation:
sound/pci/rme9652/rme9652.c:2074 snd_rme9652_channel_info() warn: potential spectre issue 'rme9652->channel_map' (local cap)
This patch puts array_index_nospec() for hardening against it.
BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
As recently Smatch suggested, a couple of places in HDSP MADI driver
may expand the array directly from the user-space value with
speculation:
sound/pci/rme9652/hdspm.c:5717 snd_hdspm_channel_info() warn: potential spectre issue 'hdspm->channel_map_out' (local cap)
sound/pci/rme9652/hdspm.c:5734 snd_hdspm_channel_info() warn: potential spectre issue 'hdspm->channel_map_in' (local cap)
This patch puts array_index_nospec() for hardening against them.
BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
As recently Smatch suggested, a couple of places in ASIHPI driver may
expand the array directly from the user-space value with speculation:
sound/pci/asihpi/hpimsginit.c:70 hpi_init_response() warn: potential spectre issue 'res_size' (local cap)
sound/pci/asihpi/hpioctl.c:189 asihpi_hpi_ioctl() warn: potential spectre issue 'adapters'
This patch puts array_index_nospec() for hardening against them.
BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
As recently Smatch suggested, one place in OPL3 driver may expand the
array directly from the user-space value with speculation:
sound/drivers/opl3/opl3_synth.c:476 snd_opl3_set_voice() warn: potential spectre issue 'snd_opl3_regmap'
This patch puts array_index_nospec() for hardening against it.
BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
As recently Smatch suggested, one place in HD-audio hwdep ioctl codes
may expand the array directly from the user-space value with
speculation:
sound/pci/hda/hda_local.h:467 get_wcaps() warn: potential spectre issue 'codec->wcaps'
As get_wcaps() itself is a fairly frequently called inline function,
and there is only one single call with a user-space value, we replace
only the latter one to open-code locally with array_index_nospec()
hardening in this patch.
BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
As recently Smatch suggested, a few places in ALSA control core codes
may expand the array directly from the user-space value with
speculation:
sound/core/control.c:1003 snd_ctl_elem_lock() warn: potential spectre issue 'kctl->vd'
sound/core/control.c:1031 snd_ctl_elem_unlock() warn: potential spectre issue 'kctl->vd'
sound/core/control.c:844 snd_ctl_elem_info() warn: potential spectre issue 'kctl->vd'
sound/core/control.c:891 snd_ctl_elem_read() warn: potential spectre issue 'kctl->vd'
sound/core/control.c:939 snd_ctl_elem_write() warn: potential spectre issue 'kctl->vd'
Although all these seem doing only the first load without further
reference, we may want to stay in a safer side, so hardening with
array_index_nospec() would still make sense.
In this patch, we put array_index_nospec() to the common
snd_ctl_get_ioff*() helpers instead of each caller. These helpers are
also referred from some drivers, too, and basically all usages are to
calculate the array index from the user-space value, hence it's better
to cover there.
BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
As Smatch recently suggested, a few places in OSS sequencer codes may
expand the array directly from the user-space value with speculation,
namely there are a significant amount of references to either
info->ch[] or dp->synths[] array:
sound/core/seq/oss/seq_oss_event.c:315 note_on_event() warn: potential spectre issue 'info->ch' (local cap)
sound/core/seq/oss/seq_oss_event.c:362 note_off_event() warn: potential spectre issue 'info->ch' (local cap)
sound/core/seq/oss/seq_oss_synth.c:470 snd_seq_oss_synth_load_patch() warn: potential spectre issue 'dp->synths' (local cap)
sound/core/seq/oss/seq_oss_event.c:293 note_on_event() warn: potential spectre issue 'dp->synths'
sound/core/seq/oss/seq_oss_event.c:353 note_off_event() warn: potential spectre issue 'dp->synths'
sound/core/seq/oss/seq_oss_synth.c:506 snd_seq_oss_synth_sysex() warn: potential spectre issue 'dp->synths'
sound/core/seq/oss/seq_oss_synth.c:580 snd_seq_oss_synth_ioctl() warn: potential spectre issue 'dp->synths'
Although all these seem doing only the first load without further
reference, we may want to stay in a safer side, so hardening with
array_index_nospec() would still make sense.
We may put array_index_nospec() at each place, but here we take a
different approach:
- For dp->synths[], change the helpers to retrieve seq_oss_synthinfo
pointer directly instead of the array expansion at each place
- For info->ch[], harden in a normal way, as there are only a couple
of places
As a result, the existing helper, snd_seq_oss_synth_is_valid() is
replaced with snd_seq_oss_synth_info(). Also, we cover MIDI device
where a similar array expansion is done, too, although it wasn't
reported by Smatch.
BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When get_synthdev() is called for a MIDI device, it returns the fixed
midi_synth_dev without the use refcounting. OTOH, the caller is
supposed to unreference unconditionally after the usage, so this would
lead to unbalanced refcount.
This patch corrects the behavior and keep up the refcount balance also
for the MIDI synth device.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Connor McAdams