- Alsa-devel - mailman.alsa-project.org

[PATCH 5.10.y] ALSA: pcm: Properly take rwsem lock in ctl_elem_read_user/ctl_elem_write_user to prevent UAF
by Takashi Iwai 13 Jan '23

13 Jan '23

From: Clement Lecigne <clecigne(a)google.com> [ Note: this is a fix that works around the bug equivalently as the two upstream commits: 1fa4445f9adf ("ALSA: control - introduce snd_ctl_notify_one() helper") 56b88b50565c ("ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF") but in a simpler way to fit with older stable trees -- tiwai ] Add missing locking in ctl_elem_read_user/ctl_elem_write_user which can be easily triggered and turned into an use-after-free. Example code paths with SNDRV_CTL_IOCTL_ELEM_READ: 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits (compat): snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Signed-off-by: Clement Lecigne <clecigne(a)google.com> Cc: stable(a)kernel.org # 5.12 and older Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- Greg, this is a patch for the last ALSA PCM UCM fix for the older stable trees. Please take this to 5.10.y and older stable trees. Thanks! sound/core/control_compat.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c index 97467f6a32a1..980ab3580f1b 100644 --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -304,7 +304,9 @@ static int ctl_elem_read_user(struct snd_card *card, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_read(&card->controls_rwsem); err = snd_ctl_elem_read(card, data); + up_read(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); @@ -332,7 +334,9 @@ static int ctl_elem_write_user(struct snd_ctl_file *file, err = snd_power_wait(card, SNDRV_CTL_POWER_D0); if (err < 0) goto error; + down_write(&card->controls_rwsem); err = snd_ctl_elem_write(card, file, data); + up_write(&card->controls_rwsem); if (err < 0) goto error; err = copy_ctl_value_to_user(userdata, valuep, data, type, count); -- 2.35.3

3 2

[PATCH 1/2] ASoC: Intel: avs: Use asoc_substream_to_rtd() to obtain rtd
by Amadeusz Sławiński 13 Jan '23

13 Jan '23

From: Cezary Rojewski <cezary.rojewski(a)intel.com> Utilize the helper function instead of casting from ->private_data or snd_pcm_substream_chip() directly. Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> --- sound/soc/intel/avs/boards/rt286.c | 2 +- sound/soc/intel/avs/boards/rt298.c | 2 +- sound/soc/intel/avs/pcm.c | 30 +++++++++++++++--------------- 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/sound/soc/intel/avs/boards/rt286.c b/sound/soc/intel/avs/boards/rt286.c index 8447b37a2a41..3551a05bd599 100644 --- a/sound/soc/intel/avs/boards/rt286.c +++ b/sound/soc/intel/avs/boards/rt286.c @@ -98,7 +98,7 @@ static int avs_rt286_be_fixup(struct snd_soc_pcm_runtime *runtime, struct snd_pc static int avs_rt286_hw_params(struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params) { - struct snd_soc_pcm_runtime *runtime = substream->private_data; + struct snd_soc_pcm_runtime *runtime = asoc_substream_to_rtd(substream); struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(runtime, 0); int ret; diff --git a/sound/soc/intel/avs/boards/rt298.c b/sound/soc/intel/avs/boards/rt298.c index bd25f0fde35e..2923f3805bbe 100644 --- a/sound/soc/intel/avs/boards/rt298.c +++ b/sound/soc/intel/avs/boards/rt298.c @@ -109,7 +109,7 @@ static int avs_rt298_be_fixup(struct snd_soc_pcm_runtime *runtime, struct snd_pc static int avs_rt298_hw_params(struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params) { - struct snd_soc_pcm_runtime *rtd = substream->private_data; + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0); unsigned int clk_freq; int ret; diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c index f930c5e86a84..c4376c9c35ef 100644 --- a/sound/soc/intel/avs/pcm.c +++ b/sound/soc/intel/avs/pcm.c @@ -60,7 +60,7 @@ avs_dai_find_path_template(struct snd_soc_dai *dai, bool is_fe, int direction) static int avs_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_dai *dai, bool is_fe, const struct snd_soc_dai_ops *ops) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct avs_dev *adev = to_avs_dev(dai->dev); struct avs_tplg_path_template *template; struct avs_dma_data *data; @@ -169,7 +169,7 @@ static int avs_dai_nonhda_be_startup(struct snd_pcm_substream *substream, struct static void avs_dai_nonhda_be_shutdown(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct avs_dev *adev = to_avs_dev(dai->dev); struct avs_dma_data *data; @@ -218,7 +218,7 @@ static int avs_dai_nonhda_be_prepare(struct snd_pcm_substream *substream, struct static int avs_dai_nonhda_be_trigger(struct snd_pcm_substream *substream, int cmd, struct snd_soc_dai *dai) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct avs_dma_data *data; int ret = 0; @@ -305,7 +305,7 @@ static int avs_dai_hda_be_hw_params(struct snd_pcm_substream *substream, static int avs_dai_hda_be_hw_free(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) { struct avs_dma_data *data; - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct hdac_ext_stream *link_stream; struct hdac_ext_link *link; struct hda_codec *codec; @@ -335,7 +335,7 @@ static int avs_dai_hda_be_hw_free(struct snd_pcm_substream *substream, struct sn static int avs_dai_hda_be_prepare(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct snd_pcm_runtime *runtime = substream->runtime; struct hdac_ext_stream *link_stream = runtime->private_data; struct hdac_ext_link *link; @@ -374,7 +374,7 @@ static int avs_dai_hda_be_prepare(struct snd_pcm_substream *substream, struct sn static int avs_dai_hda_be_trigger(struct snd_pcm_substream *substream, int cmd, struct snd_soc_dai *dai) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct hdac_ext_stream *link_stream; struct avs_dma_data *data; int ret = 0; @@ -489,7 +489,7 @@ static int avs_dai_fe_startup(struct snd_pcm_substream *substream, struct snd_so static void avs_dai_fe_shutdown(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct avs_dev *adev = to_avs_dev(dai->dev); struct avs_dma_data *data; @@ -628,7 +628,7 @@ static int avs_dai_fe_prepare(struct snd_pcm_substream *substream, struct snd_so static int avs_dai_fe_trigger(struct snd_pcm_substream *substream, int cmd, struct snd_soc_dai *dai) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct avs_dma_data *data; struct hdac_ext_stream *host_stream; struct hdac_bus *bus; @@ -836,7 +836,7 @@ static int avs_dai_resume_hw_params(struct snd_soc_dai *dai, struct avs_dma_data int ret; substream = data->substream; - rtd = snd_pcm_substream_chip(substream); + rtd = asoc_substream_to_rtd(substream); ret = dai->driver->ops->hw_params(substream, &rtd->dpcm[substream->stream].hw_params, dai); if (ret) @@ -931,7 +931,7 @@ static int avs_component_pm_op(struct snd_soc_component *component, bool be, for_each_component_dais(component, dai) { data = dai->playback_dma_data; if (data) { - rtd = snd_pcm_substream_chip(data->substream); + rtd = asoc_substream_to_rtd(data->substream); if (rtd->dai_link->no_pcm == be && !rtd->dai_link->ignore_suspend) { ret = op(dai, data); if (ret < 0) { @@ -944,7 +944,7 @@ static int avs_component_pm_op(struct snd_soc_component *component, bool be, data = dai->capture_dma_data; if (data) { - rtd = snd_pcm_substream_chip(data->substream); + rtd = asoc_substream_to_rtd(data->substream); if (rtd->dai_link->no_pcm == be && !rtd->dai_link->ignore_suspend) { ret = op(dai, data); if (ret < 0) { @@ -1048,7 +1048,7 @@ static const struct snd_pcm_hardware avs_pcm_hardware = { static int avs_component_open(struct snd_soc_component *component, struct snd_pcm_substream *substream) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); /* only FE DAI links are handled here */ if (rtd->dai_link->no_pcm) @@ -1066,7 +1066,7 @@ static unsigned int avs_hda_stream_dpib_read(struct hdac_ext_stream *stream) static snd_pcm_uframes_t avs_component_pointer(struct snd_soc_component *component, struct snd_pcm_substream *substream) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct avs_dma_data *data; struct hdac_ext_stream *host_stream; unsigned int pos; @@ -1394,7 +1394,7 @@ static void avs_component_hda_remove(struct snd_soc_component *component) static int avs_component_hda_open(struct snd_soc_component *component, struct snd_pcm_substream *substream) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct hdac_ext_stream *link_stream; struct hda_codec *codec; @@ -1441,7 +1441,7 @@ static int avs_component_hda_open(struct snd_soc_component *component, static int avs_component_hda_close(struct snd_soc_component *component, struct snd_pcm_substream *substream) { - struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream); + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); struct hdac_ext_stream *link_stream; /* only BE DAI links are handled here */ -- 2.25.1

2 3

[PATCH 0/3] Fixes for avs driver
by Amadeusz Sławiński 13 Jan '23

13 Jan '23

First patch fixes problems reported when performing shutdown. Second one is for a problem reported by LKP. Last one fixes problem reported by checkpatch. Amadeusz Sławiński (3): ASoC: Intel: avs: Implement PCI shutdown ASoC: Intel: avs: Correctly access topology fiels ASoC: Intel: avs: Use min_t instead of min with cast sound/soc/intel/avs/core.c | 24 ++++++++++++++++++++++++ sound/soc/intel/avs/topology.c | 2 +- sound/soc/intel/avs/trace.c | 2 +- 3 files changed, 26 insertions(+), 2 deletions(-) -- 2.25.1

3 5

[PATCH 0/3] Add the Renesas IDT821034 codec support
by Herve Codina 13 Jan '23

13 Jan '23

Hi, The Renesas IDT821034 codec is four channel PCM codec with on-chip filters and programmable gain setting. It also provides SLIC (Subscriber Line Interface Circuit) signals as GPIOs. Best regards, Herve Codina Herve Codina (3): dt-bindings: sound: Add Renesas IDT821034 codec ASoC: codecs: Add support for the Renesas IDT821034 codec MAINTAINERS: add the Renesas IDT821034 codec entry .../bindings/sound/renesas,idt821034.yaml | 97 ++ MAINTAINERS | 7 + sound/soc/codecs/Kconfig | 12 + sound/soc/codecs/Makefile | 2 + sound/soc/codecs/idt821034.c | 1234 +++++++++++++++++ 5 files changed, 1352 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/renesas,idt821034.yaml create mode 100644 sound/soc/codecs/idt821034.c -- 2.38.1

3 11

[bug report] ALSA: firewire-lib: extend tracepoints event including CYCLE_TIME of 1394 OHCI
by Dan Carpenter 13 Jan '23

13 Jan '23

Hello Takashi Sakamoto, The patch fef4e61b0b76: "ALSA: firewire-lib: extend tracepoints event including CYCLE_TIME of 1394 OHCI" from Jan 10, 2023, leads to the following Smatch static checker warning: sound/firewire/amdtp-stream.c:944 generate_tx_packet_descs() error: uninitialized symbol 'curr_cycle_time'. sound/firewire/amdtp-stream.c:1099 process_rx_packets() error: uninitialized symbol 'curr_cycle_time'. sound/firewire/amdtp-stream.c 1047 static void process_rx_packets(struct fw_iso_context *context, u32 tstamp, size_t header_length, 1048 void *header, void *private_data) 1049 { 1050 struct amdtp_stream *s = private_data; 1051 const struct amdtp_domain *d = s->domain; 1052 const __be32 *ctx_header = header; 1053 const unsigned int events_per_period = d->events_per_period; 1054 unsigned int event_count = s->ctx_data.rx.event_count; 1055 struct pkt_desc *desc = s->packet_descs_cursor; 1056 unsigned int pkt_header_length; 1057 unsigned int packets; 1058 u32 curr_cycle_time; ^^^^^^^^^^^^^^^^^^^ 1059 bool need_hw_irq; 1060 int i; 1061 1062 if (s->packet_index < 0) 1063 return; 1064 1065 // Calculate the number of packets in buffer and check XRUN. 1066 packets = header_length / sizeof(*ctx_header); 1067 1068 generate_rx_packet_descs(s, desc, ctx_header, packets); 1069 1070 process_ctx_payloads(s, desc, packets); 1071 1072 if (!(s->flags & CIP_NO_HEADER)) 1073 pkt_header_length = IT_PKT_HEADER_SIZE_CIP; 1074 else 1075 pkt_header_length = 0; 1076 1077 if (s == d->irq_target) { 1078 // At NO_PERIOD_WAKEUP mode, the packets for all IT/IR contexts are processed by 1079 // the tasks of user process operating ALSA PCM character device by calling ioctl(2) 1080 // with some requests, instead of scheduled hardware IRQ of an IT context. 1081 struct snd_pcm_substream *pcm = READ_ONCE(s->pcm); 1082 need_hw_irq = !pcm || !pcm->runtime->no_period_wakeup; 1083 } else { 1084 need_hw_irq = false; 1085 } 1086 1087 if (trace_amdtp_packet_enabled()) 1088 (void)fw_card_read_cycle_time(fw_parent_device(s->unit)->card, &curr_cycle_time); No error checking and no else path. 1089 1090 for (i = 0; i < packets; ++i) { 1091 struct { 1092 struct fw_iso_packet params; 1093 __be32 header[CIP_HEADER_QUADLETS]; 1094 } template = { {0}, {0} }; 1095 bool sched_irq = false; 1096 1097 build_it_pkt_header(s, desc->cycle, &template.params, pkt_header_length, 1098 desc->data_blocks, desc->data_block_counter, --> 1099 desc->syt, i, curr_cycle_time); ^^^^^^^^^^^^^^^ Uninitialized. 1100 1101 if (s == s->domain->irq_target) { 1102 event_count += desc->data_blocks; 1103 if (event_count >= events_per_period) { 1104 event_count -= events_per_period; 1105 sched_irq = need_hw_irq; 1106 } 1107 } 1108 1109 if (queue_out_packet(s, &template.params, sched_irq) < 0) { 1110 cancel_stream(s); 1111 return; 1112 } 1113 1114 desc = amdtp_stream_next_packet_desc(s, desc); 1115 } 1116 1117 s->ctx_data.rx.event_count = event_count; 1118 s->packet_descs_cursor = desc; 1119 } regards, dan carpenter

2 1

[PATCH] ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
by Takashi Iwai 13 Jan '23

13 Jan '23

From: Clement Lecigne <clecigne(a)google.com> Takes rwsem lock inside snd_ctl_elem_read instead of snd_ctl_elem_read_user like it was done for write in commit 1fa4445f9adf1 ("ALSA: control - introduce snd_ctl_notify_one() helper"). Doing this way we are also fixing the following locking issue happening in the compat path which can be easily triggered and turned into an use-after-free. 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits: snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Cc: stable(a)kernel.org # 5.13+ Signed-off-by: Clement Lecigne <clecigne(a)google.com> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- Note: the fixes for older stable trees will be submitted in another patch sound/core/control.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/sound/core/control.c b/sound/core/control.c index 50e7ba66f187..82aa1af1d1d8 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1203,14 +1203,19 @@ static int snd_ctl_elem_read(struct snd_card *card, const u32 pattern = 0xdeadbeef; int ret; + down_read(&card->controls_rwsem); kctl = snd_ctl_find_id(card, &control->id); - if (kctl == NULL) - return -ENOENT; + if (kctl == NULL) { + ret = -ENOENT; + goto unlock; + } index_offset = snd_ctl_get_ioff(kctl, &control->id); vd = &kctl->vd[index_offset]; - if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) - return -EPERM; + if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) { + ret = -EPERM; + goto unlock; + } snd_ctl_build_ioff(&control->id, kctl, index_offset); @@ -1220,7 +1225,7 @@ static int snd_ctl_elem_read(struct snd_card *card, info.id = control->id; ret = __snd_ctl_elem_info(card, kctl, &info, NULL); if (ret < 0) - return ret; + goto unlock; #endif if (!snd_ctl_skip_validation(&info)) @@ -1230,7 +1235,7 @@ static int snd_ctl_elem_read(struct snd_card *card, ret = kctl->get(kctl, control); snd_power_unref(card); if (ret < 0) - return ret; + goto unlock; if (!snd_ctl_skip_validation(&info) && sanity_check_elem_value(card, control, &info, pattern) < 0) { dev_err(card->dev, @@ -1238,8 +1243,11 @@ static int snd_ctl_elem_read(struct snd_card *card, control->id.iface, control->id.device, control->id.subdevice, control->id.name, control->id.index); - return -EINVAL; + ret = -EINVAL; + goto unlock; } +unlock: + up_read(&card->controls_rwsem); return ret; } @@ -1253,9 +1261,7 @@ static int snd_ctl_elem_read_user(struct snd_card *card, if (IS_ERR(control)) return PTR_ERR(control); - down_read(&card->controls_rwsem); result = snd_ctl_elem_read(card, control); - up_read(&card->controls_rwsem); if (result < 0) goto error; -- 2.35.3

2 1

question about byte alignment (snd_pcm_hw_constraint_msbits and SNDRV_PCM_FMTBIT_S32_LE)
by Gagan Sidhu 13 Jan '23

13 Jan '23

1 0

[PATCH v2 0/5] ASoC: samsung: fsd: audio support for FSD SoC
by Padmanabhan Rajanbabu 13 Jan '23

13 Jan '23

The intention of this patch series is to enable audio support on FSD SoC. Changes in v2: 1. New compatible added in Exynos I2S driver for FSD platform. 2. Added Fixup support for Exynos I2S CPU DAI. 3. Migration of manual PSR, OPCLK configuration to Exynos CPU DAI driver as fixup. 4. Migrated from dedicated sound card to simple audio card. 5. Support added for tlv320aic3x-i2c codec on FSD platform. Changes in v1: 1. Add TDM support on samsung I2S interface. 2. Allow sound card to directly configure I2S prescaler divider instead of calculating it from frame clock. 3. The sound card support for FSD SoC which utilizes samsung I2S interface as CPU DAI. Padmanabhan Rajanbabu (5): ASoC: samsung-i2s: add FSD compatibile string ASoC: samsung: i2s: add support for FSD I2S arm64: dts: fsd: Add I2S DAI node for Tesla FSD arm64: dts: fsd: Add codec node for Tesla FSD arm64: dts: fsd: Add sound card node for Tesla FSD .../bindings/sound/samsung-i2s.yaml | 4 ++ arch/arm64/boot/dts/tesla/fsd-evb.dts | 59 +++++++++++++++++++ arch/arm64/boot/dts/tesla/fsd-pinctrl.dtsi | 14 +++++ arch/arm64/boot/dts/tesla/fsd.dtsi | 34 +++++++++++ sound/soc/samsung/i2s.c | 57 ++++++++++++++++++ 5 files changed, 168 insertions(+) -- 2.17.1

4 19

[PATCH 0/6] ALSA: fireface: support knob control event for Fireface 400
by Takashi Sakamoto 13 Jan '23

13 Jan '23

Hi, Fireface 400 uses asynchronous transaction mechanism to deliver event of hardware knob control as well as received MIDI messages. Current implementation doesn't distinguish them, thus all arrived messages are processed for MIDI message. This patchset adds the parser to distinguish them, and deliver knob control event to user space via ALSA hwdep character device. The implementation works well as long as I tested with the patches for libhitaki library: https://github.com/alsa-project/libhitaki/tree/topic/ff/400-msg I note that Fireface 400 transmits no asynchronous transaction when it is not configured by block write transaction to offset 0x000080100514, which turn off HOST led from red. Takashi Sakamoto (6): ALSA: fireface: rename callback functions ALSA: fireface: pick up time stamp for request subaction of asynchronous transaction ALSA: fireface: add helper function to parse MIDI messages transmitted by Fireface 400 ALSA: fireface: update UAPI for data of knob control ALSA: fireface: add local framework to message parser ALSA: fireface: implement message parser for Fireface 400 include/uapi/sound/firewire.h | 24 +++ sound/firewire/fireface/ff-hwdep.c | 41 ++-- sound/firewire/fireface/ff-protocol-former.c | 186 +++++++++++++++---- sound/firewire/fireface/ff-protocol-latter.c | 6 +- sound/firewire/fireface/ff-transaction.c | 17 +- sound/firewire/fireface/ff.c | 10 + sound/firewire/fireface/ff.h | 9 +- 7 files changed, 239 insertions(+), 54 deletions(-) -- 2.37.2

2 7

[PATCH] ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate()
by Jaroslav Kysela 13 Jan '23

13 Jan '23

The subs function argument may be NULL, so do not use it before the NULL check. Fixes: 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Reported-by: coverity-bot <keescook(a)chromium.org> Link: https://lore.kernel.org/alsa-devel/202301121424.4A79A485@keescook/ Signed-off-by: Jaroslav Kysela <perex(a)perex.cz> --- sound/usb/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 1f72960d0d53..d959da7a1afb 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -160,11 +160,12 @@ find_substream_format(struct snd_usb_substream *subs, bool snd_usb_pcm_has_fixed_rate(struct snd_usb_substream *subs) { const struct audioformat *fp; - struct snd_usb_audio *chip = subs->stream->chip; + struct snd_usb_audio *chip; int rate = -1; if (!subs) return false; + chip = subs->stream->chip; if (!(chip->quirk_flags & QUIRK_FLAG_FIXED_RATE)) return false; list_for_each_entry(fp, &subs->fmt_list, list) { -- 2.39.0

2 1