August 2019 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH 2/2] Fix a stack buffer overflow bug in check_input_term
by Hui Peng 02 Sep '19

02 Sep '19

`check_input_term` recursively calls itself with input from device side (e.g., uac_input_terminal_descriptor.bCSourceID) as argument (id). In `check_input_term`, if `check_input_term` is called with the same `id` argument as the caller, it triggers endless recursive call, resulting kernel space stack overflow. This patch fixes the bug by adding a bitmap to `struct mixer_build` to keep track of the checked ids and stop the execution if some id has been checked (similar to how parse_audio_unit handles unitid argument). CVE: CVE-2018-15118 Reported-by: Hui Peng <benquike(a)gmail.com> Reported-by: Mathias Payer <mathias.payer(a)nebelwelt.net> Signed-off-by: Hui Peng <benquike(a)gmail.com> --- sound/usb/mixer.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 10ddec76f906..e24572fd6e30 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -81,6 +81,7 @@ struct mixer_build { unsigned char *buffer; unsigned int buflen; DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS); + DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS); struct usb_audio_term oterm; const struct usbmix_name_map *map; const struct usbmix_selector_map *selector_map; @@ -709,15 +710,24 @@ static int get_term_name(struct mixer_build *state, struct usb_audio_term *iterm * parse the source unit recursively until it reaches to a terminal * or a branched unit. */ -static int check_input_term(struct mixer_build *state, int id, +static int __check_input_term(struct mixer_build *state, int id, struct usb_audio_term *term) { int err; void *p1; + unsigned char *hdr; memset(term, 0, sizeof(*term)); - while ((p1 = find_audio_control_unit(state, id)) != NULL) { - unsigned char *hdr = p1; + for (;;) { + /* a loop in the terminal chain? */ + if (test_and_set_bit(id, state->termbitmap)) + return -EINVAL; + + p1 = find_audio_control_unit(state, id); + if (!p1) + break; + + hdr = p1; term->id = id; switch (hdr[2]) { case UAC_INPUT_TERMINAL: @@ -732,7 +742,7 @@ static int check_input_term(struct mixer_build *state, int id, /* call recursively to verify that the * referenced clock entity is valid */ - err = check_input_term(state, d->bCSourceID, term); + err = __check_input_term(state, d->bCSourceID, term); if (err < 0) return err; @@ -764,7 +774,7 @@ static int check_input_term(struct mixer_build *state, int id, case UAC2_CLOCK_SELECTOR: { struct uac_selector_unit_descriptor *d = p1; /* call recursively to retrieve the channel info */ - err = check_input_term(state, d->baSourceID[0], term); + err = __check_input_term(state, d->baSourceID[0], term); if (err < 0) return err; term->type = d->bDescriptorSubtype << 16; /* virtual type */ @@ -811,6 +821,15 @@ static int check_input_term(struct mixer_build *state, int id, return -ENODEV; } + +static int check_input_term(struct mixer_build *state, int id, + struct usb_audio_term *term) +{ + memset(term, 0, sizeof(*term)); + memset(state->termbitmap, 0, sizeof(state->termbitmap)); + return __check_input_term(state, id, term); +} + /* * Feature Unit */ -- 2.17.1

3 4

[alsa-devel] [PATCH 1/2] Fix an OOB bug in parse_audio_mixer_unit
by Hui Peng 02 Sep '19

02 Sep '19

The `uac_mixer_unit_descriptor` shown as below is read from the device side. In `parse_audio_mixer_unit`, `baSourceID` field is accessed from index 0 to `bNrInPins` - 1, the current implementation assumes that descriptor is always valid (the length of descriptor is no shorter than 5 + `bNrInPins`). If a descriptor read from the device side is invalid, it may trigger out-of-bound memory access. ``` struct uac_mixer_unit_descriptor { __u8 bLength; __u8 bDescriptorType; __u8 bDescriptorSubtype; __u8 bUnitID; __u8 bNrInPins; __u8 baSourceID[]; } ``` This patch fixes the bug by add a sanity check on the length of the descriptor. CVE: CVE-2018-15117 Reported-by: Hui Peng <benquike(a)gmail.com> Reported-by: Mathias Payer <mathias.payer(a)nebelwelt.net> Signed-off-by: Hui Peng <benquike(a)gmail.com> --- sound/usb/mixer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 1f7eb3816cd7..10ddec76f906 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1628,6 +1628,7 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, int pin, ich, err; if (desc->bLength < 11 || !(input_pins = desc->bNrInPins) || + desc->bLength < sizeof(*desc) + desc->bNrInPins || !(num_outs = uac_mixer_unit_bNrChannels(desc))) { usb_audio_err(state->chip, "invalid MIXER UNIT descriptor %d\n", -- 2.17.1

3 4

[alsa-devel] [PATCH] ASoC: fsl_sai: Set SAI Channel Mode to Output Mode
by Daniel Baluta 02 Sep '19

02 Sep '19

>From SAI datasheet: CHMOD, configures if transmit data pins are configured for TDM mode or Output mode. * (0) TDM mode, transmit data pins are tri-stated when slots are masked or channels are disabled. * (1) Output mode, transmit data pins are never tri-stated and will output zero when slots are masked or channels are disabled. When data pins are tri-stated, there is noise on some channels when FS clock value is high and data is read while fsclk is transitioning from high to low. Fix this by setting CHMOD to Output Mode so that pins will output zero when slots are masked or channels are disabled. Cc: NXP Linux Team <linux-imx(a)nxp.com> Signed-off-by: Cosmin-Gabriel Samoila <cosmin.samoila(a)nxp.com> Signed-off-by: Daniel Baluta <daniel.baluta(a)nxp.com> --- sound/soc/fsl/fsl_sai.c | 15 ++++++++++++--- sound/soc/fsl/fsl_sai.h | 2 ++ 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c index e896b577b1f7..b9daab0eb6eb 100644 --- a/sound/soc/fsl/fsl_sai.c +++ b/sound/soc/fsl/fsl_sai.c @@ -467,6 +467,12 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, val_cr4 |= FSL_SAI_CR4_FRSZ(slots); + /* + * set CHMOD to Output Mode so that transmit data pins will + * output zero when slots are masked or channels are disabled + */ + val_cr4 |= FSL_SAI_CR4_CHMOD; + /* * For SAI master mode, when Tx(Rx) sync with Rx(Tx) clock, Rx(Tx) will * generate bclk and frame clock for Tx(Rx), we should set RCR4(TCR4), @@ -477,7 +483,8 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, if (!sai->is_slave_mode) { if (!sai->synchronous[TX] && sai->synchronous[RX] && !tx) { regmap_update_bits(sai->regmap, FSL_SAI_TCR4(ofs), - FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK, + FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | + FSL_SAI_CR4_CHMOD_MASK, val_cr4); regmap_update_bits(sai->regmap, FSL_SAI_TCR5(ofs), FSL_SAI_CR5_WNW_MASK | FSL_SAI_CR5_W0W_MASK | @@ -486,7 +493,8 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, ~0UL - ((1 << channels) - 1)); } else if (!sai->synchronous[RX] && sai->synchronous[TX] && tx) { regmap_update_bits(sai->regmap, FSL_SAI_RCR4(ofs), - FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK, + FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | + FSL_SAI_CR4_CHMOD_MASK, val_cr4); regmap_update_bits(sai->regmap, FSL_SAI_RCR5(ofs), FSL_SAI_CR5_WNW_MASK | FSL_SAI_CR5_W0W_MASK | @@ -497,7 +505,8 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, } regmap_update_bits(sai->regmap, FSL_SAI_xCR4(tx, ofs), - FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK, + FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | + FSL_SAI_CR4_CHMOD_MASK, val_cr4); regmap_update_bits(sai->regmap, FSL_SAI_xCR5(tx, ofs), FSL_SAI_CR5_WNW_MASK | FSL_SAI_CR5_W0W_MASK | diff --git a/sound/soc/fsl/fsl_sai.h b/sound/soc/fsl/fsl_sai.h index f96f8d97489d..1e3b4a6889a8 100644 --- a/sound/soc/fsl/fsl_sai.h +++ b/sound/soc/fsl/fsl_sai.h @@ -119,6 +119,8 @@ #define FSL_SAI_CR4_FRSZ_MASK (0x1f << 16) #define FSL_SAI_CR4_SYWD(x) (((x) - 1) << 8) #define FSL_SAI_CR4_SYWD_MASK (0x1f << 8) +#define FSL_SAI_CR4_CHMOD BIT(5) +#define FSL_SAI_CR4_CHMOD_MASK GENMASK(5, 5) #define FSL_SAI_CR4_MF BIT(4) #define FSL_SAI_CR4_FSE BIT(3) #define FSL_SAI_CR4_FSP BIT(1) -- 2.17.1

4 4

[alsa-devel] [PATCH 00/16] ASoC: soc-core cleanup
by Kuninori Morimoto 02 Sep '19

02 Sep '19

Hi Mark I want to add multi CPU DAI support to ALSA SoC. But I noticed that we want to cleanup ALSA SoC before that. These patches will do nothing from "technical" point of view. Just for cleanup Kuninori Morimoto (16): ASoC: soc-core: rename soc_post_component_init() to soc_rtd_init() ASoC: soc-core: add soc_rtd_free() ASoC: soc-core: move soc_probe_component() position ASoC: soc-core: dapm related setup at one place ASoC: soc-core: add snd_soc_dapm_init() ASoC: soc-core: move soc_probe_link_components() position ASoC: soc-core: self contained soc_probe_link_components() ASoC: soc-core: self contained soc_remove_link_components() ASoC: soc-core: self contained soc_remove_link_dais() ASoC: soc-core: move soc_probe_dai() next to soc_remove_dai() ASoC: soc-core: add new soc_link_init() ASoC: soc-core: self contained soc_probe_link_dais() ASoC: soc-core: move soc_probe_link_dais() next to soc_remove_link_dais() ASoC: soc-core: self contained soc_bind_aux_dev() ASoC: soc-core: add soc_unbind_aux_dev() ASoC: soc-core: self contained soc_unbind_aux_dev() include/sound/soc-dapm.h | 3 + sound/soc/soc-core.c | 568 ++++++++++++++++++++++++----------------------- sound/soc/soc-dapm.c | 21 ++ 3 files changed, 310 insertions(+), 282 deletions(-) -- 2.7.4

2 22

[alsa-devel] [PATCH] ASoC: sun4i-i2s: incorrect regmap for A83t
by codekipper＠gmail.com 02 Sep '19

02 Sep '19

From: Marcus Cooper <codekipper(a)gmail.com> Fixes: 21faaea1343f ("ASoC: sun4i-i2s: Add support for A83T") Signed-off-by: Marcus Cooper <codekipper(a)gmail.com> --- sound/soc/sunxi/sun4i-i2s.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c index cbc6e59aa089..056a299c03fb 100644 --- a/sound/soc/sunxi/sun4i-i2s.c +++ b/sound/soc/sunxi/sun4i-i2s.c @@ -1109,7 +1109,7 @@ static const struct sun4i_i2s_quirks sun6i_a31_i2s_quirks = { static const struct sun4i_i2s_quirks sun8i_a83t_i2s_quirks = { .has_reset = true, .reg_offset_txdata = SUN8I_I2S_FIFO_TX_REG, - .sun4i_i2s_regmap = &sun4i_i2s_regmap_config, + .sun4i_i2s_regmap = &sun8i_i2s_regmap_config, .field_clkdiv_mclk_en = REG_FIELD(SUN4I_I2S_CLK_DIV_REG, 8, 8), .field_fmt_wss = REG_FIELD(SUN4I_I2S_FMT0_REG, 0, 2), .field_fmt_sr = REG_FIELD(SUN4I_I2S_FMT0_REG, 4, 6), -- 2.23.0

4 3

[alsa-devel] [PATCH] MAINTAINERS: update entry of firewire audio drivers
by Takashi Sakamoto 02 Sep '19

02 Sep '19

This commit adds myself as one of maintainers for firewire audio drivers and IEC 61883-1/6 packet streaming engine. I call them ALSA firewire stack as a whole. 6 years ago I joined in development for this category of drivers with heavy reverse-engineering tasks and over 100 models are now available from ALSA applications. IEEE 1394 bus itself and units on the bus are enough legacy but the development still continues. I have a plan to add drastic enhancement in kernel v5.5 and v5.6 period. This commit adds myself into MAINTAINERS so that developers and users can easily find active developer to post their issues, especially for regression. Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> --- MAINTAINERS | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index 24e29b2e53c9..8929a2ec75f7 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -6264,8 +6264,9 @@ S: Maintained F: drivers/hwmon/f75375s.c F: include/linux/f75375s.h -FIREWIRE AUDIO DRIVERS +FIREWIRE AUDIO DRIVERS and IEC 61883-1/6 PACKET STREAMING ENGINE M: Clemens Ladisch <clemens(a)ladisch.de> ++M: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> L: alsa-devel(a)alsa-project.org (moderated for non-subscribers) T: git git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git S: Maintained -- 2.20.1

2 2

[alsa-devel] [PATCH] drm: dw-hdmi-i2s: enable audio clock in audio_startup
by Cheng-Yi Chiang 02 Sep '19

02 Sep '19

In the designware databook, the sequence of enabling audio clock and setting format is not clearly specified. Currently, audio clock is enabled in the end of hw_param ops after setting format. On some monitors, there is a possibility that audio does not come out. Fix this by enabling audio clock in audio_startup ops before hw_param ops setting format. Signed-off-by: Cheng-Yi Chiang <cychiang(a)chromium.org> --- drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c index 5cbb71a866d5..08b4adbb1ddc 100644 --- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c +++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi-i2s-audio.c @@ -69,6 +69,14 @@ static int dw_hdmi_i2s_hw_params(struct device *dev, void *data, hdmi_write(audio, conf0, HDMI_AUD_CONF0); hdmi_write(audio, conf1, HDMI_AUD_CONF1); + return 0; +} + +static int dw_hdmi_i2s_audio_startup(struct device *dev, void *data) +{ + struct dw_hdmi_i2s_audio_data *audio = data; + struct dw_hdmi *hdmi = audio->hdmi; + dw_hdmi_audio_enable(hdmi); return 0; @@ -105,6 +113,7 @@ static int dw_hdmi_i2s_get_dai_id(struct snd_soc_component *component, } static struct hdmi_codec_ops dw_hdmi_i2s_ops = { + .audio_startup = dw_hdmi_i2s_audio_startup, .hw_params = dw_hdmi_i2s_hw_params, .audio_shutdown = dw_hdmi_i2s_audio_shutdown, .get_dai_id = dw_hdmi_i2s_get_dai_id, -- 2.23.0.187.g17f5b7556c-goog

3 3

[alsa-devel] [PATCH 1/3] ASoC: es8316: judge PCM rate at later timing
by Katsuhiro Suzuki 31 Aug '19

31 Aug '19

This patch change the judge timing about playing/capturing PCM rate. Original code set constraints list of PCM rate limits at set_sysclk. This strategy works well if system is using fixed rate clock. But some boards and SoC (such as RockPro64 and RockChip I2S) has connected SoC MCLK out to ES8316 MCLK in. In this case, SoC side I2S will choose suitable frequency of MCLK such as fs * mclk-fs when user starts playing or capturing. Bad scenario as follows (mclk-fs = 256): - Initialize sysclk by correct value (Ex. 12.288MHz) - ES8316 set constraints of PCM rate by sysclk 48kHz (1/256), 32kHz (1/384), 30.720kHz (1/400), 24kHz (1/512), 16kHz (1/768), 12kHz (1/1024) - Play 48kHz sound, it's acceptable - Sysclk is not changed - Play 32kHz sound, it's acceptable - Set sysclk by 8.192MHz (= fs * mclk-fs = 32k * 256) - ES8316 set constraints of PCM rate by sysclk 32kHz (1/256), 21.33kHz (1/384), 20.48kHz (1/400), 16kHz (1/512), 10.66kHz (1/768), 8kHz (1/1024) - Play 48kHz again, but it's NOT acceptable because constraints list does not allow 48kHz Root cause of this strange behavior is changing constraints list at set_sysclk timing. It seems that is too early to determine. So this patch does not use constraints list and check PCM rate limit more later timing at hw_params. Signed-off-by: Katsuhiro Suzuki <katsuhiro(a)katsuster.net> --- sound/soc/codecs/es8316.c | 37 +++++++++++++++---------------------- 1 file changed, 15 insertions(+), 22 deletions(-) diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c index ed2959dbe1fb..229808fa627c 100644 --- a/sound/soc/codecs/es8316.c +++ b/sound/soc/codecs/es8316.c @@ -363,27 +363,12 @@ static int es8316_set_dai_sysclk(struct snd_soc_dai *codec_dai, { struct snd_soc_component *component = codec_dai->component; struct es8316_priv *es8316 = snd_soc_component_get_drvdata(component); - int i; - int count = 0; es8316->sysclk = freq; if (freq == 0) return 0; - /* Limit supported sample rates to ones that can be autodetected - * by the codec running in slave mode. - */ - for (i = 0; i < NR_SUPPORTED_MCLK_LRCK_RATIOS; i++) { - const unsigned int ratio = supported_mclk_lrck_ratios[i]; - - if (freq % ratio == 0) - es8316->allowed_rates[count++] = freq / ratio; - } - - es8316->sysclk_constraints.list = es8316->allowed_rates; - es8316->sysclk_constraints.count = count; - return 0; } @@ -449,13 +434,6 @@ static int es8316_pcm_startup(struct snd_pcm_substream *substream, return -EINVAL; } - /* The set of sample rates that can be supported depends on the - * MCLK supplied to the CODEC. - */ - snd_pcm_hw_constraint_list(substream->runtime, 0, - SNDRV_PCM_HW_PARAM_RATE, - &es8316->sysclk_constraints); - return 0; } @@ -466,12 +444,27 @@ static int es8316_pcm_hw_params(struct snd_pcm_substream *substream, struct snd_soc_component *component = dai->component; struct es8316_priv *es8316 = snd_soc_component_get_drvdata(component); u8 wordlen = 0; + int i; if (!es8316->sysclk) { dev_err(component->dev, "No MCLK configured\n"); return -EINVAL; } + /* Limit supported sample rates to ones that can be autodetected + * by the codec running in slave mode. + */ + for (i = 0; i < NR_SUPPORTED_MCLK_LRCK_RATIOS; i++) { + const unsigned int ratio = supported_mclk_lrck_ratios[i]; + + if (es8316->sysclk % ratio != 0) + continue; + if (es8316->sysclk / ratio == params_rate(params)) + break; + } + if (i == NR_SUPPORTED_MCLK_LRCK_RATIOS) + return -EINVAL; + switch (params_format(params)) { case SNDRV_PCM_FORMAT_S16_LE: wordlen = ES8316_SERDATA2_LEN_16; -- 2.23.0.rc1

2 4

[alsa-devel] [PATCH 0/4] ASoC: mediatek: mt8183: some cleanups
by Tzung-Bi Shih 30 Aug '19

30 Aug '19

The series contains some cleanup refactors and should not change any behavior. Tzung-Bi Shih (4): ASoC: mediatek: mt8183: move private structure ASoC: mediatek: mt8183: move headset jack to card-specific storage ASoC: mediatek: mt8183: remove forward declaration of headset_init ASoC: mediatek: mt8183: fix space issues .../mt8183/mt8183-mt6358-ts3a227-max98357.c | 55 +++++++++---------- 1 file changed, 26 insertions(+), 29 deletions(-) -- 2.23.0.187.g17f5b7556c-goog

2 8

[alsa-devel] [PATCH v2 1/5] ASoC: dt-bindings: sun4i-spdif: Fix dma-names warning
by Maxime Ripard 30 Aug '19

30 Aug '19

From: Maxime Ripard <maxime.ripard(a)bootlin.com> Even though the H6 compatible has been properly added, the exeption for the number of DMA channels hasn't been updated, leading in a validation warning. Fix this. Fixes: b20453031472 ("dt-bindings: sound: sun4i-spdif: Add Allwinner H6 compatible") Signed-off-by: Maxime Ripard <maxime.ripard(a)bootlin.com> --- Changes from v1: - Fix subject prefix --- .../devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Documentation/devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml b/Documentation/devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml index e0284d8c3b63..38d4cede0860 100644 --- a/Documentation/devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml +++ b/Documentation/devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml @@ -70,7 +70,9 @@ allOf: properties: compatible: contains: - const: allwinner,sun8i-h3-spdif + enum: + - allwinner,sun8i-h3-spdif + - allwinner,sun50i-h6-spdif then: properties: -- 2.21.0

3 12