Skip to content

Commit 216a8b2

Browse files
torvaldstorvalds
committed
Merge tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai: "A standard set of driver-specific fixes and quirks accumulated since the merge window: ASoC: - SOF: Sanity check to prevent OOB reads - rsnd: Fix clock leak and double-disable issues with PM - tas675x: Misc fixes for register fields, etc - lpass-va-macro: Correct codec version for Qualcomm SC7280 - amd-yc: DMIC quirk for Alienware m15 R7 AMD Others: - us144mkii: Fix a UAF on disconnect and anchor list corruption - HD-audio: Realtek quirks for HP models" * tag 'sound-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: rsnd: src: Add missing scu_supply clock to suspend/resume Documentation: sound: tas675x: Fix temperature range and impedance documentation ASoC: codecs: tas675x: Fix CHx temperature range register bit fields ASoC: codecs: tas675x: use READ_ONCE for params to be used concurrently ASoC: rsnd: adg: make rsnd_adg_clk_control() idempotent ASoC: SOF: validate probe info element counts ALSA: usx2y: us144mkii: fix work UAF on disconnect ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED MAINTAINERS: ASoC: SOF: add AMD reviewer for Sound Open Firmware ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
2 parents 9c9330c + 5720dea commit 216a8b2

12 files changed

Lines changed: 99 additions & 26 deletions

File tree

‎Documentation/sound/codecs/tas675x.rst‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -281,18 +281,19 @@ Global Temperature
281281
:Description: Global die temperature sense register.
282282
:Type: Integer (read-only)
283283
:Range: 0 to 255
284-
:Conversion: (value × 0.5 °C) − 50 °C
284+
:Conversion: value × 2.19 K; subtract 273.15 for °C
285285
:Register: 0x75
286286

287287
CHx Temperature Range
288288
---------------------
289289

290290
:Description: Per-channel coarse temperature range indicator (x = 1, 2, 3, 4).
291291
:Type: Integer (read-only)
292-
:Range: 0 to 3
293-
:Mapping: 0 = <80 °C, 1 = 80–100 °C, 2 = 100–120 °C, 3 = >120 °C
294-
:Register: 0xBB bits [7:6] (CH1), bits [5:4] (CH2),
295-
0xBC bits [3:2] (CH3), bits [1:0] (CH4)
292+
:Range: 0 to 7
293+
:Mapping: 0 = <95 °C, 1 = 95–110 °C, 2 = 110–125 °C, 3 = 125–135 °C,
294+
4 = 135–145 °C, 5 = 145–155 °C, 6 = 155–165 °C, 7 = >165 °C
295+
:Register: 0xBB bits [2:0] (CH1), bits [5:3] (CH2),
296+
0xBC bits [2:0] (CH3), bits [5:3] (CH4)
296297

297298
Load Diagnostics
298299
================

‎MAINTAINERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25377,6 +25377,7 @@ M: Bard Liao <yung-chuan.liao@linux.intel.com>
2537725377
M: Daniel Baluta <daniel.baluta@nxp.com>
2537825378
R: Kai Vehmanen <kai.vehmanen@linux.intel.com>
2537925379
R: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
25380+
R: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
2538025381
L: sound-open-firmware@alsa-project.org (moderated for non-subscribers)
2538125382
S: Supported
2538225383
W: https://github.com/thesofproject/linux/

‎sound/hda/codecs/realtek/alc269.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7068,6 +7068,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
70687068
SND_PCI_QUIRK(0x103c, 0x88d1, "HP Pavilion 15-eh1xxx (mainboard 88D1)", ALC245_FIXUP_HP_MUTE_LED_V1_COEFBIT),
70697069
SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
70707070
SND_PCI_QUIRK(0x103c, 0x88eb, "HP Victus 16-e0xxx", ALC245_FIXUP_HP_MUTE_LED_V2_COEFBIT),
7071+
SND_PCI_QUIRK(0x103c, 0x88ee, "HP Victus 16-e0xxx (MB 88EE)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
70717072
SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED),
70727073
SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
70737074
SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),

‎sound/soc/amd/yc/acp6x-mach.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -528,6 +528,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
528528
DMI_MATCH(DMI_PRODUCT_NAME, "Raider A18 HX A9WJG"),
529529
}
530530
},
531+
{
532+
.driver_data = &acp6x_card,
533+
.matches = {
534+
DMI_MATCH(DMI_BOARD_VENDOR, "Alienware"),
535+
DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m15 R7 AMD"),
536+
}
537+
},
531538
{
532539
.driver_data = &acp6x_card,
533540
.matches = {

‎sound/soc/codecs/lpass-va-macro.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,11 @@ static const struct va_macro_data sm8250_va_data = {
244244
.version = LPASS_CODEC_VERSION_1_0,
245245
};
246246

247+
static const struct va_macro_data sc7280_va_data = {
248+
.has_swr_master = false,
249+
.has_npl_clk = false,
250+
};
251+
247252
static const struct va_macro_data sm8450_va_data = {
248253
.has_swr_master = true,
249254
.has_npl_clk = true,
@@ -1755,7 +1760,7 @@ static const struct dev_pm_ops va_macro_pm_ops = {
17551760
};
17561761

17571762
static const struct of_device_id va_macro_dt_match[] = {
1758-
{ .compatible = "qcom,sc7280-lpass-va-macro", .data = &sm8250_va_data },
1763+
{ .compatible = "qcom,sc7280-lpass-va-macro", .data = &sc7280_va_data },
17591764
{ .compatible = "qcom,sm6115-lpass-va-macro", .data = &sm8450_va_data },
17601765
{ .compatible = "qcom,sm8250-lpass-va-macro", .data = &sm8250_va_data },
17611766
{ .compatible = "qcom,sm8450-lpass-va-macro", .data = &sm8450_va_data },

‎sound/soc/codecs/tas675x.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -954,10 +954,10 @@ static const struct snd_kcontrol_new tas675x_snd_controls[] = {
954954
/* Temperature and Voltage Monitoring */
955955
SOC_SINGLE_RO("PVDD Sense", TAS675X_PVDD_SENSE_REG, 0, 0xFF),
956956
SOC_SINGLE_RO("Global Temperature", TAS675X_TEMP_GLOBAL_REG, 0, 0xFF),
957-
SOC_SINGLE_RO("CH1 Temperature Range", TAS675X_TEMP_CH1_CH2_REG, 6, 3),
958-
SOC_SINGLE_RO("CH2 Temperature Range", TAS675X_TEMP_CH1_CH2_REG, 4, 3),
959-
SOC_SINGLE_RO("CH3 Temperature Range", TAS675X_TEMP_CH3_CH4_REG, 2, 3),
960-
SOC_SINGLE_RO("CH4 Temperature Range", TAS675X_TEMP_CH3_CH4_REG, 0, 3),
957+
SOC_SINGLE_RO("CH1 Temperature Range", TAS675X_TEMP_CH1_CH2_REG, 0, 7),
958+
SOC_SINGLE_RO("CH2 Temperature Range", TAS675X_TEMP_CH1_CH2_REG, 3, 7),
959+
SOC_SINGLE_RO("CH3 Temperature Range", TAS675X_TEMP_CH3_CH4_REG, 0, 7),
960+
SOC_SINGLE_RO("CH4 Temperature Range", TAS675X_TEMP_CH3_CH4_REG, 3, 7),
961961

962962
/* Speaker Protection & Detection */
963963
SOC_SINGLE("Tweeter Detection Switch", TAS675X_TWEETER_DETECT_CTRL_REG, 0, 1, 1),
@@ -1133,7 +1133,7 @@ static int tas675x_hw_params(struct snd_pcm_substream *substream,
11331133
* Single clock domain: SDIN and SDOUT share one SCLK/FSYNC pair,
11341134
* so all active DAIs must use the same sample rate.
11351135
*/
1136-
if ((tas->active_playback_dais || tas->active_capture_dais) &&
1136+
if ((READ_ONCE(tas->active_playback_dais) || READ_ONCE(tas->active_capture_dais)) &&
11371137
tas->rate && tas->rate != rate) {
11381138
dev_err(component->dev,
11391139
"Rate %u conflicts with active rate %u\n",
@@ -1397,14 +1397,14 @@ static int tas675x_mute_stream(struct snd_soc_dai *dai, int mute, int direction)
13971397
set_bit(dai->id, &tas->active_playback_dais);
13981398

13991399
/* Last playback stream */
1400-
if (mute && !tas->active_playback_dais) {
1400+
if (mute && !READ_ONCE(tas->active_playback_dais)) {
14011401
ret = tas675x_set_state_all(tas, TAS675X_STATE_SLEEP_BOTH);
14021402
regmap_read(tas->regmap, TAS675X_CLK_FAULT_LATCHED_REG, &discard);
14031403
return ret;
14041404
}
14051405

14061406
return tas675x_set_state_all(tas,
1407-
tas->active_playback_dais ?
1407+
READ_ONCE(tas->active_playback_dais) ?
14081408
TAS675X_STATE_PLAY_BOTH :
14091409
TAS675X_STATE_SLEEP_BOTH);
14101410
}

‎sound/soc/renesas/rcar/adg.c‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ struct rsnd_adg {
4545
struct rsnd_mod mod;
4646
int clkin_rate[CLKINMAX];
4747
bool ssi_clk_prepared;
48+
bool clk_enabled;
4849
int clkin_size;
4950
int clkout_size;
5051
u32 ckr;
@@ -463,6 +464,22 @@ int rsnd_adg_clk_control(struct rsnd_priv *priv, int enable)
463464
struct clk *clk;
464465
int ret = 0, i;
465466

467+
/*
468+
* rsnd_adg_clk_enable() and rsnd_adg_clk_disable() can be called
469+
* redundantly, for example when system suspend follows a resume
470+
* whose enable failed. Make this function idempotent so that the
471+
* "adg" clock, which has no clkin_rate[] style guard, is never
472+
* disabled twice.
473+
*/
474+
if (enable) {
475+
if (adg->clk_enabled)
476+
return 0;
477+
} else {
478+
if (!adg->clk_enabled)
479+
return 0;
480+
adg->clk_enabled = false;
481+
}
482+
466483
if (enable) {
467484
ret = clk_prepare_enable(adg->adg);
468485
if (ret < 0)
@@ -520,12 +537,22 @@ int rsnd_adg_clk_control(struct rsnd_priv *priv, int enable)
520537
* rsnd_adg_clk_enable() might return error (_disable() will not).
521538
* We need to rollback in such case
522539
*/
523-
if (ret < 0)
540+
if (ret < 0) {
541+
/*
542+
* Mark as enabled so that the rollback below is not
543+
* short-circuited by the idempotency guard. It clears
544+
* the flag again on its way through.
545+
*/
546+
adg->clk_enabled = true;
524547
rsnd_adg_clk_disable(priv);
548+
return ret;
549+
}
525550

526551
/* disable adg */
527552
if (!enable)
528553
clk_disable_unprepare(adg->adg);
554+
else
555+
adg->clk_enabled = true;
529556

530557
return ret;
531558
}

‎sound/soc/renesas/rcar/src.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -850,6 +850,7 @@ void rsnd_src_suspend(struct rsnd_priv *priv)
850850

851851
clk_disable_unprepare(src_ctrl->scu_x2);
852852
clk_disable_unprepare(src_ctrl->scu);
853+
clk_disable_unprepare(src_ctrl->scu_supply);
853854
}
854855

855856
void rsnd_src_resume(struct rsnd_priv *priv)
@@ -861,6 +862,7 @@ void rsnd_src_resume(struct rsnd_priv *priv)
861862
if (!src_ctrl)
862863
return;
863864

865+
clk_prepare_enable(src_ctrl->scu_supply);
864866
clk_prepare_enable(src_ctrl->scu);
865867
clk_prepare_enable(src_ctrl->scu_x2);
866868

‎sound/soc/sof/sof-client-probes-ipc3.c‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ static int ipc3_probes_info(struct sof_client_dev *cdev, unsigned int cmd,
107107
struct device *dev = &cdev->auxdev.dev;
108108
struct sof_ipc_probe_info_params msg = {{{0}}};
109109
struct sof_ipc_probe_info_params *reply;
110-
size_t bytes;
110+
size_t bytes, elem_size, payload_size;
111111
int ret;
112112

113113
*params = NULL;
@@ -128,14 +128,29 @@ static int ipc3_probes_info(struct sof_client_dev *cdev, unsigned int cmd,
128128
if (ret < 0 || reply->rhdr.error < 0)
129129
goto exit;
130130

131+
payload_size = reply->rhdr.hdr.size;
132+
if (payload_size < offsetof(struct sof_ipc_probe_info_params, dma)) {
133+
ret = -EINVAL;
134+
goto exit;
135+
}
136+
131137
if (!reply->num_elems)
132138
goto exit;
133139

134140
if (cmd == SOF_IPC_PROBE_DMA_INFO)
135-
bytes = sizeof(reply->dma[0]);
141+
elem_size = sizeof(reply->dma[0]);
136142
else
137-
bytes = sizeof(reply->desc[0]);
138-
bytes *= reply->num_elems;
143+
elem_size = sizeof(reply->desc[0]);
144+
145+
payload_size -= offsetof(struct sof_ipc_probe_info_params, dma);
146+
if (reply->num_elems > payload_size / elem_size) {
147+
dev_err(dev, "%s: invalid probe info element count %u\n",
148+
__func__, reply->num_elems);
149+
ret = -EINVAL;
150+
goto exit;
151+
}
152+
153+
bytes = reply->num_elems * elem_size;
139154
*params = kmemdup(&reply->dma[0], bytes, GFP_KERNEL);
140155
if (!*params) {
141156
ret = -ENOMEM;

‎sound/soc/sof/sof-client-probes-ipc4.c‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -248,10 +248,19 @@ static int ipc4_probes_points_info(struct sof_client_dev *cdev,
248248
return ret;
249249
}
250250
info = msg.data_ptr;
251+
if (msg.data_size < sizeof(*info) ||
252+
info->num_elems > (msg.data_size - sizeof(*info)) /
253+
sizeof(info->points[0])) {
254+
dev_err(dev, "%s: invalid probe info element count %u\n",
255+
__func__, info->num_elems);
256+
kfree(msg.data_ptr);
257+
return -EINVAL;
258+
}
259+
251260
*num_desc = info->num_elems;
252261
dev_dbg(dev, "%s: got %zu probe points", __func__, *num_desc);
253262

254-
*desc = kzalloc(*num_desc * sizeof(**desc), GFP_KERNEL);
263+
*desc = kcalloc(*num_desc, sizeof(**desc), GFP_KERNEL);
255264
if (!*desc) {
256265
kfree(msg.data_ptr);
257266
return -ENOMEM;

0 commit comments

Comments
 (0)