January 2012 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH] ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()
by Xi Wang 08 Jan '12

08 Jan '12

A malicious USB device may feed in carefully crafted min/max/res values, so that the inner loop in parse_uac2_sample_rate_range() could run for a long time or even never terminate, e.g., given max = INT_MAX. Also nr_rates could be a large integer, which causes an integer overflow in the subsequent call to kmalloc() in parse_audio_format_rates_v2(). Thus, kmalloc() would allocate a smaller buffer than expected, leading to a memory corruption. To exploit the two vulnerabilities, an attacker needs physical access to the machine to plug in a malicious USB device. This patch makes two changes. 1) The type of "rate" is changed to unsigned int, so that the loop could stop once "rate" is larger than INT_MAX. 2) Limit nr_rates to avoid overflow. Signed-off-by: Xi Wang <xi.wang(a)gmail.com> --- sound/usb/format.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/sound/usb/format.c b/sound/usb/format.c index 89421d1..a99de67 100644 --- a/sound/usb/format.c +++ b/sound/usb/format.c @@ -226,7 +226,7 @@ static int parse_uac2_sample_rate_range(struct audioformat *fp, int nr_triplets, int min = combine_quad(&data[2 + 12 * i]); int max = combine_quad(&data[6 + 12 * i]); int res = combine_quad(&data[10 + 12 * i]); - int rate; + unsigned int rate; if ((max < 0) || (min < 0) || (res < 0) || (max < min)) continue; @@ -253,6 +253,9 @@ static int parse_uac2_sample_rate_range(struct audioformat *fp, int nr_triplets, fp->rates |= snd_pcm_rate_to_rate_bit(rate); nr_rates++; + /* avoid overflow */ + if (nr_rates == KMALLOC_MAX_SIZE / sizeof(int)) + break; /* avoid endless loop */ if (res == 0) -- 1.7.5.4

2 6

[alsa-devel] ASoC updates for 3.3
by Mark Brown 08 Jan '12

08 Jan '12

The following changes since commit 32696af13724aaf7651d1cf95bc1a7a8af97a5c8: ASoC: Convert corgi to table based DAPM and control init (2011-12-30 10:44:45 +0000) are available in the git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-3.3 and are the last fixes for 3.3. Ashish Chavan (1): ASoC: da7210: Add support for line input and mic Axel Lin (28): ASoC: Convert cs42l51 to devm_kzalloc() ASoC: Convert max98088 to devm_kzalloc() ASoC: Convert max98095 to devm_kzalloc() ASoC: Convert max9850 to devm_kzalloc() ASoC: Convert rt5631 to devm_kzalloc() ASoC: Convert ssm2602 to devm_kzalloc() ASoC: Convert sta32x to devm_kzalloc() ASoC: Convert tlv320aic23 to devm_kzalloc() ASoC: Convert tlv320aic26 to devm_kzalloc() ASoC: Convert tlv320aic3x to devm_kzalloc() ASoC: Convert alc5623 to devm_kzalloc() ASoC: Convert cs4270 to devm_kzalloc() ASoC: Convert tlv320dac33 to devm_kzalloc() ASoC: Convert tpa6130a2 to devm_kzalloc() ASoC: Fix return value of ak4641_pcm_set_dai_fmt() ASoC: Fix return value of wm8962_gpio_direction_out() ASoC: Use dai_fmt in saarb machine driver ASoC: Use dai_fmt in spitz machine driver ASoC: Use dai_fmt in z2 machine driver ASoC: Convert saarb to table based DAPM init ASoC: Convert spitz to table based DAPM and control init ASoC: Convert tavorevb3 to table based DAPM init ASoC: Convert z2 to table based DAPM init ASoC: Fix return value of wm8903_gpio_direction_in() and wm8903_gpio_direction_out() ASoC: Use dai_fmt in tavorevb3 machine driver ASoC: Fix return value of wm8580_set_sysclk() ASoC: pxa: Convert corgi to use snd_soc_register_card() ASoC: sta32x: Optimize the array work to find rate_min and rate_max Julia Lawall (9): ASoC: davinci-vcif.c: use devm_ functions ASoC: davinci-mcasp.c: use devm_ functions ASoC: davinci-i2s.c: use devm_ functions ASoC: psc-i2s.c: use devm_ functions ASoC: psc-ac97.c: use devm_ functions ASoC: i2sc.c: use devm_ functions ASoC: dma.c: use devm_ functions ASoC: dbdma2.c: use devm_ functions ASoC: ac97c.c: use devm_ functions Sangsu Park (1): ASoC: soc-pcm: Allocate PCM operations dynamically to support multiple DAIs arch/arm/mach-pxa/corgi.c | 9 ++++ sound/soc/au1x/ac97c.c | 40 ++++++------------- sound/soc/au1x/dbdma2.c | 14 ++----- sound/soc/au1x/dma.c | 12 +----- sound/soc/au1x/i2sc.c | 45 ++++++--------------- sound/soc/au1x/psc-ac97.c | 41 +++++++------------- sound/soc/au1x/psc-i2s.c | 42 +++++++------------- sound/soc/codecs/ak4641.c | 7 +++- sound/soc/codecs/alc5623.c | 11 +---- sound/soc/codecs/cs4270.c | 6 +-- sound/soc/codecs/cs42l51.c | 8 +--- sound/soc/codecs/da7210.c | 77 +++++++++++++++++++++++++++++++++++++ sound/soc/codecs/max98088.c | 6 +-- sound/soc/codecs/max98095.c | 7 +-- sound/soc/codecs/max9850.c | 6 +-- sound/soc/codecs/rt5631.c | 7 +-- sound/soc/codecs/ssm2602.c | 12 ++---- sound/soc/codecs/sta32x.c | 14 ++---- sound/soc/codecs/tlv320aic23.c | 5 +-- sound/soc/codecs/tlv320aic26.c | 8 +--- sound/soc/codecs/tlv320aic3x.c | 5 +-- sound/soc/codecs/tlv320dac33.c | 6 +-- sound/soc/codecs/tpa6130a2.c | 5 +-- sound/soc/codecs/wm8580.c | 8 +++- sound/soc/codecs/wm8903.c | 18 +++++++-- sound/soc/codecs/wm8962.c | 10 +++- sound/soc/davinci/davinci-i2s.c | 39 ++++++------------ sound/soc/davinci/davinci-mcasp.c | 40 ++++++------------- sound/soc/davinci/davinci-vcif.c | 14 ++----- sound/soc/pxa/corgi.c | 43 +++++++++++---------- sound/soc/pxa/saarb.c | 23 ++++------- sound/soc/pxa/spitz.c | 37 +++++------------- sound/soc/pxa/tavorevb3.c | 24 ++++-------- sound/soc/pxa/z2.c | 28 ++++---------- sound/soc/soc-pcm.c | 38 +++++++++---------- 35 files changed, 313 insertions(+), 402 deletions(-)

2 1

[alsa-devel] [PATCH] - ALSA au88x0 - XTALK fixes
by Raymond Yau 08 Jan '12

08 Jan '12

[PATCH ALSA 1/2] Au88x0 - Xtalk - fix write/read of eq and xt instates - fix write/read of eq and xt instates [PATCH ALSA 2/2] Au88x0 - Fix Xtalk's constants] - Fix XtalkGainsDefault, XtalkGains1Chn - Fix XtalkWideCoefsLeftEQ, XtalkWideCoefsRightEQ - Fix XtlakWideCoefsLeftXT, XtalkWideCoefsRightXT

2 1

[alsa-devel] [PATCH - ice1724 1/1] ALSA: ice1724 - Check for ac97 to avoid kernel oops
by pavel.hofman＠ivitera.com 08 Jan '12

08 Jan '12

From: Pavel Hofman <pavel.hofman(a)ivitera.com> Cards with identical PCI ids but no AC97 config in EEPROM do not have the ac97 field initialized. We must check for this case to avoid kernel oops. Signed-off-by: Pavel Hofman <pavel.hofman(a)ivitera.com> diff --git a/pci/ice1712/amp.c b/pci/ice1712/amp.c index e328cfb..e525da2 100644 --- a/pci/ice1712/amp.c +++ b/pci/ice1712/amp.c @@ -68,8 +68,11 @@ static int __devinit snd_vt1724_amp_init(struct snd_ice1712 *ice) static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice) { - /* we use pins 39 and 41 of the VT1616 for left and right read outputs */ - snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000); + if (ice->ac97) + /* we use pins 39 and 41 of the VT1616 for left and right + read outputs */ + snd_ac97_write_cache(ice->ac97, 0x5a, + snd_ac97_read(ice->ac97, 0x5a) & ~0x8000); return 0; } -- 1.7.0.4

2 1

Re: [alsa-devel] ALSA regression in recent kernels: Intel HDA/ALC892 sound glitches
by Takashi Iwai 08 Jan '12

08 Jan '12

At Sun, 8 Jan 2012 09:49:27 +0000 (GMT), Artem S. Tashkinov wrote: > > > On Jan 8, 2012, Takashi Iwai <tiwai(a)suse.de> wrote: > > > > At Thu, 5 Jan 2012 11:29:40 +0000 (GMT), > > Artem S. Tashkinov wrote: > > > > > > Hello, > > > > > > Since kernel 3.0.11 I have quite terrible sound artifacts - random pops, clicks and > > > short pauses (~500ms). Linux kernel 3.0.0 is *bug free*. So, some some of patches in > > > kernel *3.0.11* broke the driver, the bug is, of course, present in kernels 3.1 and 3.2. > > > > Could you give alsa-info.sh output to check more details? > > Also, any chance to identify which 3.0.x release breaks the things? > > alsa-info output was attached to my original mail posted into LKML, please check out > you e-mail client. Ah, OK, I'll check it later. I'm still on vacation so I can't check in details. > There are so few changes in Intel/Realtek HDA ALSA code between 3.0 and 3.0.11 > I thought you could identify the culprit just by looking at the list. Well, it's not too easy since the problem isn't deterministic. You can check the patches with ALSA: hda (or capital) and ALSA: pcm prefix. > ALSA: fm801: Fix double free in case of error in tuner detection > ALSA: fm801: Gracefully handle failure of tuner auto-detect > ALSA: HDA: Add new revision for ALC662 > ALSA: hda - Add position_fix quirk for Dell Inspiron 1010 > ALSA: hda - Add support for 92HD65 / 92HD66 family of codecs > ALSA: HDA: Add support for IDT 92HD93 > ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name > ALSA: HDA: conexant support for Lenovo T520/W520 > ALSA: hda - Disable power-widget control for IDT 92HD83/93 as default > ALSA: hda - Don't add elements of other codecs to vmaster slave > ALSA: hda - Fix ADC input-amp handling for Cx20549 codec > ALSA: HDA: No power nids on 92HD93 > ALSA: hda/realtek - Avoid bogus HP-pin assignment > ALSA: hda/realtek - Fix auto-mute with HP+LO configuration > ALSA: hda/realtek - Skip invalid digital out pins > ALSA: hda - Remove bad code for IDT 92HD83 family patch > ALSA: pcm - fix race condition in wait_for_avail() > ALSA: ua101: fix crash when unplugging > ALSA: usb-audio: Check for possible chip NULL pointer before clearing probing flag > ALSA: usb-audio - Check the dB-range validity in the later read, too > ALSA: usb-audio - clear chip->probing on error exit > ALSA: usb-audio - Fix the missing volume quirks at delayed init > > If you have no ideas about which patch could have broken things, I will try to figure it out > by bisecting. That'll be helpful. thanks, Takashi

1 0

Re: [alsa-devel] ALSA regression in recent kernels: Intel HDA/ALC892 sound glitches
by Takashi Iwai 08 Jan '12

08 Jan '12

At Thu, 5 Jan 2012 11:29:40 +0000 (GMT), Artem S. Tashkinov wrote: > > Hello, > > Since kernel 3.0.11 I have quite terrible sound artifacts - random pops, clicks and > short pauses (~500ms). Linux kernel 3.0.0 is *bug free*. So, some some of patches in > kernel *3.0.11* broke the driver, the bug is, of course, present in kernels 3.1 and 3.2. Could you give alsa-info.sh output to check more details? Also, any chance to identify which 3.0.x release breaks the things? thanks, Takashi

1 0

[alsa-devel] [PATCH] hda_intel: Add Oaktrail identifiers
by Alan Cox 08 Jan '12

08 Jan '12

From: Li Peng <pengi.li(a)intel.com> Oaktrail has 0x8086, 0x080a - AZX_DRIVER_SCH Taken from the Meego patches for Oaktrail Signed-off-by: Li Peng <peng.li(a)intel.com> Signed-off-by: Alan Cox <alan(a)linux.intel.com> --- sound/pci/hda/hda_intel.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index c2f79e6..b339eb5 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2972,6 +2972,9 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = { { PCI_DEVICE(0x8086, 0x811b), .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP | AZX_DCAPS_BUFSIZE | AZX_DCAPS_POSFIX_LPIB }, /* Poulsbo */ + { PCI_DEVICE(0x8086, 0x080a), + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP | + AZX_DCAPS_BUFSIZE}, /* ICH */ { PCI_DEVICE(0x8086, 0x2668), .driver_data = AZX_DRIVER_ICH | AZX_DCAPS_OLD_SSYNC |

3 8

[alsa-devel] [PATCH] ALSA: HDA: Remove Poulsbo position fix quirks
by David Henningsson 08 Jan '12

08 Jan '12

Now that we have changed the poulsbo chip to use LPIB position fix, we can remove the individual machine quirks that do the same thing. Signed-off-by: David Henningsson <david.henningsson(a)canonical.com> --- sound/pci/hda/hda_intel.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 8e232ab..0852e20 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2493,12 +2493,10 @@ static int azx_dev_free(struct snd_device *device) static struct snd_pci_quirk position_fix_list[] __devinitdata = { SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB), SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB), - SND_PCI_QUIRK(0x1028, 0x02c6, "Dell Inspiron 1010", POS_FIX_LPIB), SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB), SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB), - SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS 1101HA", POS_FIX_LPIB), SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB), SND_PCI_QUIRK(0x1297, 0x3166, "Shuttle", POS_FIX_LPIB), SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB), -- 1.7.5.4

2 1

[alsa-devel] [PATCH 1/3] ALSA: HDA: Fix master control for Cirrus Logic 421X
by David Henningsson 08 Jan '12

08 Jan '12

The control name "HP/Speakers" is non-standard, and since there is only one DAC on this chip there is no need for a virtual master anyway. Cc: stable(a)kernel.org Signed-off-by: David Henningsson <david.henningsson(a)canonical.com> --- sound/pci/hda/patch_cirrus.c | 13 +------------ 1 files changed, 1 insertions(+), 12 deletions(-) diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c index acfb645..9139558 100644 --- a/sound/pci/hda/patch_cirrus.c +++ b/sound/pci/hda/patch_cirrus.c @@ -1779,30 +1779,19 @@ static int build_cs421x_output(struct hda_codec *codec) struct auto_pin_cfg *cfg = &spec->autocfg; struct snd_kcontrol *kctl; int err; - char *name = "HP/Speakers"; + char *name = "Master"; fix_volume_caps(codec, dac); - if (!spec->vmaster_sw) { - err = add_vmaster(codec, dac); - if (err < 0) - return err; - } err = add_mute(codec, name, 0, HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl); if (err < 0) return err; - err = snd_ctl_add_slave(spec->vmaster_sw, kctl); - if (err < 0) - return err; err = add_volume(codec, name, 0, HDA_COMPOSE_AMP_VAL(dac, 3, 0, HDA_OUTPUT), 0, &kctl); if (err < 0) return err; - err = snd_ctl_add_slave(spec->vmaster_vol, kctl); - if (err < 0) - return err; if (cfg->speaker_outs) { err = snd_hda_ctl_add(codec, 0, -- 1.7.5.4

2 3

[alsa-devel] [PATCH] ASoC: Optimise performance of WM8904 ADC 128fs OSR mode
by Mark Brown 08 Jan '12

08 Jan '12

Signed-off-by: Mark Brown <broonie(a)opensource.wolfsonmicro.com> --- sound/soc/codecs/wm8904.c | 31 ++++++++++++++++++++++++++++++- sound/soc/codecs/wm8904.h | 11 +++++++++++ 2 files changed, 41 insertions(+), 1 deletions(-) diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c index 31d2e41..e3bd0eb 100644 --- a/sound/soc/codecs/wm8904.c +++ b/sound/soc/codecs/wm8904.c @@ -304,6 +304,7 @@ static bool wm8904_readable_register(struct device *dev, unsigned int reg) case WM8904_EQ23: case WM8904_EQ24: case WM8904_CONTROL_INTERFACE_TEST_1: + case WM8904_ADC_TEST_0: case WM8904_ANALOGUE_OUTPUT_BIAS_0: case WM8904_FLL_NCO_TEST_0: case WM8904_FLL_NCO_TEST_1: @@ -569,6 +570,29 @@ static const char *hpf_mode_text[] = { static const struct soc_enum hpf_mode = SOC_ENUM_SINGLE(WM8904_ADC_DIGITAL_0, 5, 4, hpf_mode_text); +static int wm8904_adc_osr_put(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) +{ + struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol); + unsigned int val; + int ret; + + ret = snd_soc_put_volsw(kcontrol, ucontrol); + if (ret < 0) + return ret; + + if (ucontrol->value.integer.value[0]) + val = WM8904_ADC_128_OSR_TST_MODE | WM8904_ADC_BIASX1P5; + else + val = 0; + + snd_soc_update_bits(codec, WM8904_ADC_TEST_0, + WM8904_ADC_128_OSR_TST_MODE | WM8904_ADC_BIASX1P5, + val); + + return ret; +} + static const struct snd_kcontrol_new wm8904_adc_snd_controls[] = { SOC_DOUBLE_R_TLV("Digital Capture Volume", WM8904_ADC_DIGITAL_VOLUME_LEFT, WM8904_ADC_DIGITAL_VOLUME_RIGHT, 1, 119, 0, digital_tlv), @@ -585,7 +609,12 @@ SOC_DOUBLE_R("Capture Switch", WM8904_ANALOGUE_LEFT_INPUT_0, SOC_SINGLE("High Pass Filter Switch", WM8904_ADC_DIGITAL_0, 4, 1, 0), SOC_ENUM("High Pass Filter Mode", hpf_mode), -SOC_SINGLE("ADC 128x OSR Switch", WM8904_ANALOGUE_ADC_0, 0, 1, 0), +{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, + .name = "ADC 128x OSR Switch", + .info = snd_soc_info_volsw, .get = snd_soc_get_volsw, + .put = wm8904_adc_osr_put, + .private_value = SOC_SINGLE_VALUE(WM8904_ANALOGUE_ADC_0, 0, 1, 0), +}, }; static const char *drc_path_text[] = { diff --git a/sound/soc/codecs/wm8904.h b/sound/soc/codecs/wm8904.h index 9e8c841..c29a0e8 100644 --- a/sound/soc/codecs/wm8904.h +++ b/sound/soc/codecs/wm8904.h @@ -123,6 +123,7 @@ #define WM8904_EQ23 0x9C #define WM8904_EQ24 0x9D #define WM8904_CONTROL_INTERFACE_TEST_1 0xA1 +#define WM8904_ADC_TEST_0 0xC6 #define WM8904_ANALOGUE_OUTPUT_BIAS_0 0xCC #define WM8904_FLL_NCO_TEST_0 0xF7 #define WM8904_FLL_NCO_TEST_1 0xF8 @@ -1557,6 +1558,16 @@ #define WM8904_USER_KEY_WIDTH 1 /* USER_KEY */ /* + * R198 (0xC6) - ADC Test 0 + */ +#define WM8904_ADC_128_OSR_TST_MODE 0x0004 /* ADC_128_OSR_TST_MODE */ +#define WM8904_ADC_128_OSR_TST_MODE_SHIFT 2 /* ADC_128_OSR_TST_MODE */ +#define WM8904_ADC_128_OSR_TST_MODE_WIDTH 1 /* ADC_128_OSR_TST_MODE */ +#define WM8904_ADC_BIASX1P5 0x0001 /* ADC_BIASX1P5 */ +#define WM8904_ADC_BIASX1P5_SHIFT 0 /* ADC_BIASX1P5 */ +#define WM8904_ADC_BIASX1P5_WIDTH 1 /* ADC_BIASX1P5 */ + +/* * R204 (0xCC) - Analogue Output Bias 0 */ #define WM8904_PGA_BIAS_MASK 0x0070 /* PGA_BIAS - [6:4] */ -- 1.7.7.3

1 0