summaryrefslogtreecommitdiffstats
path: root/sound/core
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | ALSA: pcm: Kill set_fs() in PCM OSS layerTakashi Iwai2017-06-021-65/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the last-standing one: kill the set_fs() usage in PCM OSS layer by replacing with the new API functions to deal with the direct in-kernel buffer copying. The code to fill the silence can be replaced even to a one-liner to pass NULL buffer instead of the manual copying. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Direct in-kernel read/write supportTakashi Iwai2017-06-021-1/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now all materials are ready, let's allow the direct in-kernel read/write, i.e. a kernel-space buffer is passed for read or write, instead of the normal user-space buffer. This feature is used by OSS layer and UAC1 driver, for example. The __snd_pcm_lib_xfer() takes in_kernel argument that indicates the in-kernel buffer copy. When this flag is set, another transfer code is used. It's either via copy_kernel PCM ops or the normal memcpy(), depending on the driver setup. As external API, snd_pcm_kernel_read(), *_write() and other variants are provided. That's all. This support is really simple because of the code refactoring until now. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Simplify snd_pcm_playback_silence()Takashi Iwai2017-06-021-30/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Use the existing silence helper codes for simplification. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Unify read/write loopTakashi Iwai2017-06-021-138/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both __snd_pcm_lib_read() and __snd_pcm_write() functions have almost the same code to loop over samples. For simplification, this patch unifies both as the single helper, __snd_pcm_lib_xfer(). Other than that, there should be no functional change by this patch. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: More unification of PCM transfer codesTakashi Iwai2017-06-021-131/+123
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch proceeds more abstraction of PCM read/write loop codes. For both interleaved and non-interleaved transfers, the same copy or silence transfer code (which is defined as pcm_transfer_f) is used now. This became possible since we switched to byte size to copy_* and fill_silence ops argument instead of frames. And, for both read and write, we can use the same copy function (which is defined as pcm_copy_f), just depending on whether interleaved or non-interleaved mode. The transfer function is determined at the beginning of the loop, depending on whether the driver gives the specific copy ops or it's the standard read/write. Another bonus by this change is that we now guarantee the silencing behavior when NULL buffer is passed to write helpers. It'll simplify some codes later. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Call directly the common read/write helpersTakashi Iwai2017-06-021-101/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make snd_pcm_lib_read() and *_write() static inline functions that call the common helper functions directly. This reduces a slight amount of codes, and at the same time, it's a preparation for the further cleanups / fixes. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Shuffle codesTakashi Iwai2017-06-021-106/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Just shuffle the codes, without any change otherwise. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Check PCM state by a common helper functionTakashi Iwai2017-06-021-52/+29
| | | | | | | | | | | | | | | | | | | | Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Drop the old copy and silence opsTakashi Iwai2017-06-021-37/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that all users of old copy and silence ops have been converted to the new PCM ops, the old stuff can be retired and go away. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Introduce copy_user, copy_kernel and fill_silence opsTakashi Iwai2017-06-021-15/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For supporting the explicit in-kernel copy of PCM buffer data, and also for further code refactoring, three new PCM ops, copy_user, copy_kernel and fill_silence, are introduced. The old copy and silence ops will be deprecated and removed later once when all callers are converted. The copy_kernel ops is the new one, and it's supposed to transfer the PCM data from the given kernel buffer to the hardware ring-buffer (or vice-versa depending on the stream direction), while the copy_user ops is equivalent with the former copy ops, to transfer the data from the user-space buffer. The major difference of the new copy_* and fill_silence ops from the previous ops is that the new ops take bytes instead of frames for size and position arguments. It has two merits: first, it allows the callback implementation often simpler (just call directly memcpy() & co), and second, it may unify the implementations of both interleaved and non-interleaved cases, as we'll see in the later patch. As of this stage, copy_kernel ops isn't referred yet, but only copy_user is used. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Acked-by: Mark Brown <broonie@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: include pcm_local.h and remove some extraneous tabsColin Ian King2017-05-301-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need to include pcm_local.h to clean up some smatch warnings: symbol 'snd_pcm_timer_done' was not declared. Should it be static? symbol 'snd_pcm_timer_init' was not declared. Should it be static? symbol 'snd_pcm_timer_resolution_change' was not declared. Should it be static? Also remove some extraneous tabs on empty lines and replace space intentation with a tab. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: declare snd_kcontrol_new structures as constBhumika Goyal2017-05-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Declare snd_kcontrol_new structures as const as they are only passed an argument to the function snd_ctl_new1. This argument is of type const, so snd_kcontrol_new structures having this property can be made const. Done using Coccinelle: @r disable optional_qualifier@ identifier x; position p; @@ static struct snd_kcontrol_new x@p={...}; @ok@ identifier r.x; position p; @@ snd_ctl_new1(&x@p,...) @bad@ position p != {r.p,ok.p}; identifier r.x; @@ x@p @depends on !bad disable optional_qualifier@ identifier r.x; @@ +const struct snd_kcontrol_new x; Cross compiled these files: sound/aoa/codecs/tas.c - powerpc sound/mips/{hal2.c/sgio2audio.c} - mips sound/ppc/{awacs.c/beep.c/tumbler.c} - powerpc sound/soc/sh/siu_dai.c - sh Could not find an architecture to compile sound/sh/aica.c. Signed-off-by: Bhumika Goyal <bhumirks@gmail.com> Acked-by: Mark Brown <broonie@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: add local header file for snd-pcm moduleTakashi Sakamoto2017-05-265-0/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several files are used to construct PCM core module, a.k.a snd-pcm. Although available APIs are described in 'include/sound/pcm.h', some of them are not exported as symbols in kernel space. Such APIs are just for module local usage. This commit adds module local header file and move some function prototypes into it so that scopes of them are controlled properly and developers get no confusion from unavailable symbols. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Call ack() whenever appl_ptr is updatedTakashi Iwai2017-05-251-9/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although the ack callback is supposed to be called at each appl_ptr or hw_ptr update, we missed a few opportunities: namely, forward, rewind and sync_ptr. Formerly calling ack at rewind may have leaded to unexpected results due to the forgotten negative appl_ptr update in indirect-PCM helper, which is the major user of the PCM ack callback. But now we fixed this oversights, thus we can call ack callback safely even at rewind callback -- of course with the proper handling of the error from the callback. This patch adds the calls of ack callback in the places mentioned in the above. Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: control: remove entry limitation for list operationTakashi Sakamoto2017-05-241-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In current implementation of ALSA control core, list operation has a limitation to handle 16384 entries at once. This seems due to allocation in kernel space to copy data from user space. With a commit 53e7bf452584 ("ALSA: control: Simplify snd_ctl_elem_list() implementation"), for the operation, ALSA control core copies data into user space directly. No need to care of kernel spaces anymore. This commit purges the limitation. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: info: Use kvzalloc() for a temporary write bufferTakashi Iwai2017-05-231-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We used to use kmalloc (more exactly, krealloc()) for creating and growing the temporary buffer for text proc write. It can grow up to 16kB, and it's already a bit doubtful whether it's always safe to use kmalloc(). With the recent addition of kvmalloc(), we can have a better chance for succeed of memory allocation, so let's switch to that new API. Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Remove set_fs() in PCM core codeTakashi Iwai2017-05-232-47/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PCM core code has a few usages of set_fs(), mostly for two codepaths: - The DELAY ioctl call from pcm_compat.c - The ioctl wrapper in kernel context for PCM OSS and other This patch removes the set_fs() usage in these places by a slight code refactoring. For the former point, snd_pcm_delay() is changed to return the value directly instead of putting the value to the given address. Each caller stores the result in an appropriate manner. For fixing the latter, snd_pcm_lib_kernel_ioctl() is changed to call the functions directly as well. For achieving it, now the function accepts only the limited set of ioctls that have been used, so far. The primary user of this function is the PCM OSS layer, and the only other user is USB UAC1 gadget driver. Both drivers don't need the full set of ioctls. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: control: Simplify snd_ctl_elem_list() implementationTakashi Iwai2017-05-231-42/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch simplifies the code of snd_ctl_elem_list() in the following ways: - Avoid a vmalloc() temporary buffer but do copy in each iteration; the vmalloc buffer was introduced at the time we took the spinlock for the ctl element management. - Use the standard list_for_each_entry() macro - Merge two loops into one; it used to be a loop for skipping until offset becomes zero and another loop to copy the data. They can be folded into a single loop easily. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Tested-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Simplify forward/rewind codesTakashi Iwai2017-05-211-68/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Factor out the common codes in snd_pcm_*_forward() and *_rewind() functions to simplify the codes. No functional changes. Reviewd-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Use a common helper for PCM state check and hwsyncTakashi Iwai2017-05-211-118/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The mostly same codes for checking the current PCM state and calling hwsync are found in a few places. This patch simplifies them by creating a common helper function. It also fixes a couple of cases where we missed the proper state check (e.g. PAUSED state wasn't handled in rewind and snd_pcm_hwsync()), too. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm/oss: mark snd_pcm_plug_slave_format arg as constArnd Bergmann2017-05-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Only one of the two declarations has the const modifier in the argument list, so we get a warning when CONFIG_SND_PCM_OSS_PLUGINS is disabled: sound/core/oss/pcm_oss.c: In function 'snd_pcm_oss_change_params': sound/core/oss/pcm_oss.c:898:47: error: passing argument 2 of 'snd_pcm_plug_slave_format' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] This makes the two declarations match again. Fixes: e76bf3c4b4e4 ("ALSA: pcm/oss: refer to parameters instead of copying to reduce usage of kernel stack") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: use "do {} while (0)" for empty macroArnd Bergmann2017-05-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Recent compilers produce a harmless warning for the new pcm_call_notify() macro when CONFIG_SND_PCM_OSS is disabled: sound/core/pcm.c: In function 'snd_pcm_free': sound/core/pcm.c:905:37: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] This turns the empty macro into a 'do {} while (0)' statement to avoid the warning. Fixes: 58f30d650c7f ("ALSA: pcm: Build pcm notifier code conditionally") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: constify function local and read-only tableTakashi Sakamoto2017-05-171-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In a function snd_pcm_hw_params_choose(), target parameters are arranged into a table. Though each entry of this table is read-only, they don't have const qualifier. This commit adds the qualifier. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm/oss: refer to parameters instead of copying to reduce usage of ↵Takashi Sakamoto2017-05-173-11/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel stack Some functions in compatibility layer for Open Sound System interface has local variable to copy some parameters in runtime of PCM substream, while this can be replaced with reference of pointers to parameter itself. This brings an advantage to reduce usage of kernel stack. This commit applies this idea. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: use helper function to refer parameter as read-onlyTakashi Sakamoto2017-05-174-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ALSA pcm core has hw_param_interval_c() to pick up parameter with const qualifier for safe programming. This commit applies it to the cases. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: add const qualifier for read-only table for sampling rateTakashi Sakamoto2017-05-171-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's a read-only table for each sampling rate, while it doesn't have const qualifier and can be modified. This commit add the qualifier. As a result, a symbol for the table moves from .data section to .rodata. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | | ALSA: pcm: Build pcm notifier code conditionallyTakashi Iwai2017-05-171-13/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The PCM notifier code is used only by OSS emulation layer, so we can build it conditionally for reducing the size. Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | | | Merge branch 'linus' into sched/core, to pick up fixesIngo Molnar2017-06-241-2/+2
|\ \ \ \ | | |_|/ | |/| | | | | | Signed-off-by: Ingo Molnar <mingo@kernel.org>
| * | | ALSA: pcm: Don't treat NULL chmap as a fatal errorTakashi Iwai2017-06-141-2/+2
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The standard PCM chmap helper callbacks treat the NULL info->chmap as a fatal error and spews the kernel warning with stack trace when CONFIG_SND_DEBUG is on. This was OK, originally it was supposed to be always static and non-NULL. But, as the recent addition of Intel LPE audio driver shows, the chmap content may vary dynamically, and it can be even NULL when disconnected. The user still sees the kernel warning unnecessarily. For clearing such a confusion, this patch simply removes the snd_BUG_ON() in each place, just returns an error without warning. Cc: <stable@vger.kernel.org> # v4.11+ Signed-off-by: Takashi Iwai <tiwai@suse.de>
* / | sched/wait: Rename wait_queue_t => wait_queue_entry_tIngo Molnar2017-06-2010-15/+15
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rename: wait_queue_t => wait_queue_entry_t 'wait_queue_t' was always a slight misnomer: its name implies that it's a "queue", but in reality it's a queue *entry*. The 'real' queue is the wait queue head, which had to carry the name. Start sorting this out by renaming it to 'wait_queue_entry_t'. This also allows the real structure name 'struct __wait_queue' to lose its double underscore and become 'struct wait_queue_entry', which is the more canonical nomenclature for such data types. Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
* | ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECTTakashi Iwai2017-06-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | snd_timer_user_tselect() reallocates the queue buffer dynamically, but it forgot to reset its indices. Since the read may happen concurrently with ioctl and snd_timer_user_tselect() allocates the buffer via kmalloc(), this may lead to the leak of uninitialized kernel-space data, as spotted via KMSAN: BUG: KMSAN: use of unitialized memory in snd_timer_user_read+0x6c4/0xa10 CPU: 0 PID: 1037 Comm: probe Not tainted 4.11.0-rc5+ #2739 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x143/0x1b0 lib/dump_stack.c:52 kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:1007 kmsan_check_memory+0xc2/0x140 mm/kmsan/kmsan.c:1086 copy_to_user ./arch/x86/include/asm/uaccess.h:725 snd_timer_user_read+0x6c4/0xa10 sound/core/timer.c:2004 do_loop_readv_writev fs/read_write.c:716 __do_readv_writev+0x94c/0x1380 fs/read_write.c:864 do_readv_writev fs/read_write.c:894 vfs_readv fs/read_write.c:908 do_readv+0x52a/0x5d0 fs/read_write.c:934 SYSC_readv+0xb6/0xd0 fs/read_write.c:1021 SyS_readv+0x87/0xb0 fs/read_write.c:1018 This patch adds the missing reset of queue indices. Together with the previous fix for the ioctl/read race, we cover the whole problem. Reported-by: Alexander Potapenko <glider@google.com> Tested-by: Alexander Potapenko <glider@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: timer: Fix race between read and ioctlTakashi Iwai2017-06-071-2/+4
|/ | | | | | | | | | | | | | | | | | The read from ALSA timer device, the function snd_timer_user_tread(), may access to an uninitialized struct snd_timer_user fields when the read is concurrently performed while the ioctl like snd_timer_user_tselect() is invoked. We have already fixed the races among ioctls via a mutex, but we seem to have forgotten the race between read vs ioctl. This patch simply applies (more exactly extends the already applied range of) tu->ioctl_lock in snd_timer_user_tread() for closing the race window. Reported-by: Alexander Potapenko <glider@google.com> Tested-by: Alexander Potapenko <glider@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Merge branch 'for-linus' into for-nextTakashi Iwai2017-04-141-6/+3
|\ | | | | | | Back-merge to prepare for applying more FireWire updates.
| * ALSA: seq: Don't break snd_use_lock_sync() loop by timeoutTakashi Iwai2017-04-131-6/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The snd_use_lock_sync() (thus its implementation snd_use_lock_sync_helper()) has the 5 seconds timeout to break out of the sync loop. It was introduced from the beginning, just to be "safer", in terms of avoiding the stupid bugs. However, as Ben Hutchings suggested, this timeout rather introduces a potential leak or use-after-free that was apparently fixed by the commit 2d7d54002e39 ("ALSA: seq: Fix race during FIFO resize"): for example, snd_seq_fifo_event_in() -> snd_seq_event_dup() -> copy_from_user() could block for a long time, and snd_use_lock_sync() goes timeout and still leaves the cell at releasing the pool. For fixing such a problem, we remove the break by the timeout while still keeping the warning. Suggested-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | Merge branch 'for-linus' into for-nextTakashi Iwai2017-04-124-4/+22
|\|
| * ALSA: seq: Fix race during FIFO resizeTakashi Iwai2017-03-241-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When a new event is queued while processing to resize the FIFO in snd_seq_fifo_clear(), it may lead to a use-after-free, as the old pool that is being queued gets removed. For avoiding this race, we need to close the pool to be deleted and sync its usage before actually deleting it. The issue was spotted by syzkaller. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()Takashi Iwai2017-03-214-4/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When snd_seq_pool_done() is called, it marks the closing flag to refuse the further cell insertions. But snd_seq_pool_done() itself doesn't clear the cells but just waits until all cells are cleared by the caller side. That is, it's racy, and this leads to the endless stall as syzkaller spotted. This patch addresses the racy by splitting the setup of pool->closing flag out of snd_seq_pool_done(), and calling it properly before snd_seq_pool_done(). BugLink: http://lkml.kernel.org/r/CACT4Y+aqqy8bZA1fFieifNxR2fAfFQQABcBHj801+u5ePV0URw@mail.gmail.com Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: timer: Info leak in snd_timer_user_tinterrupt()Dan Carpenter2017-03-311-1/+1
| | | | | | | | | | | | | | | | | | The "r1" struct has memory holes. We clear it with memset on one path where it is used but not the other. Let's just memset it at the start of the function so it's always safe. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: timer: remove some dead codeDan Carpenter2017-03-311-11/+6
|/ | | | | | | | | | | We just checked "id.card < 0" on the lines before so we know it's not true here. We can delete that check. Also checkpatch.pl complains about some extra curly braces so we may as well fix that while we're at it. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* sched/headers: Prepare to move signal wakeup & sigpending methods from ↵Ingo Molnar2017-03-0211-2/+12
| | | | | | | | | | | | | <linux/sched.h> into <linux/sched/signal.h> Fix up affected files that include this signal functionality via sched.h. Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mike Galbraith <efault@gmx.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
* Merge tag 'sound-fix-4.11-rc1' of ↵Linus Torvalds2017-03-012-3/+18
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few last-minute fixes for rc1: - ALSA core timer and sequencer fixes for bugs spotted by syzkaller - a couple of trivial HD-audio fixups - additional PCI / codec IDs for Intel Geminilake - fixes for CT-XFi DMA mask bugs" * tag 'sound-fix-4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: seq: Fix link corruption by event error handling ALSA: hda - Add subwoofer support for Dell Inspiron 17 7000 Gaming ALSA: ctxfi: Fallback DMA mask to 32bit ALSA: timer: Reject user params with too small ticks ALSA: hda: Add Geminilake HDMI codec ID ALSA: hda - Fix micmute hotkey problem for a lenovo AIO machine ALSA: hda - Add Geminilake PCI ID
| * ALSA: seq: Fix link corruption by event error handlingTakashi Iwai2017-02-281-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sequencer FIFO management has a bug that may lead to a corruption (shortage) of the cell linked list. When a sequencer client faces an error at the event delivery, it tries to put back the dequeued cell. When the first queue was put back, this forgot the tail pointer tracking, and the link will be screwed up. Although there is no memory corruption, the sequencer client may stall forever at exit while flushing the pending FIFO cells in snd_seq_pool_done(), as spotted by syzkaller. This patch addresses the missing tail pointer tracking at snd_seq_fifo_cell_putback(). Also the patch makes sure to clear the cell->enxt pointer at snd_seq_fifo_event_in() for avoiding a similar mess-up of the FIFO linked list. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: timer: Reject user params with too small ticksTakashi Iwai2017-02-281-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a user sets a too small ticks with a fine-grained timer like hrtimer, the kernel tries to fire up the timer irq too frequently. This may lead to the condensed locks, eventually the kernel spinlock lockup with warnings. For avoiding such a situation, we define a lower limit of the resolution, namely 1ms. When the user passes a too small tick value that results in less than that, the kernel returns -EINVAL now. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | mm, fs: reduce fault, page_mkwrite, and pfn_mkwrite to take only vmfDave Jiang2017-02-241-9/+6
|/ | | | | | | | | | | | | | | | | | | | | | | ->fault(), ->page_mkwrite(), and ->pfn_mkwrite() calls do not need to take a vma and vmf parameter when the vma already resides in vmf. Remove the vma parameter to simplify things. [arnd@arndb.de: fix ARM build] Link: http://lkml.kernel.org/r/20170125223558.1451224-1-arnd@arndb.de Link: http://lkml.kernel.org/r/148521301778.19116.10840599906674778980.stgit@djiang5-desk3.ch.intel.com Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Ross Zwisler <ross.zwisler@linux.intel.com> Cc: Theodore Ts'o <tytso@mit.edu> Cc: Darrick J. Wong <darrick.wong@oracle.com> Cc: Matthew Wilcox <mawilcox@microsoft.com> Cc: Dave Hansen <dave.hansen@intel.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Jan Kara <jack@suse.com> Cc: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge branch 'for-next' into for-linusTakashi Iwai2017-02-202-3/+3
|\
| * Merge branch 'for-linus' into for-nextTakashi Iwai2017-02-071-8/+1
| |\
| * | ALSA: seq: Constify snd_rawmidi_opsTakashi Iwai2017-01-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Now snd_rawmidi_ops is maintained as a const pointer in snd_rawmidi, we can constify the definitions. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | ALSA: rawmidi: Add const to snd_rawmidi_opsTakashi Iwai2017-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Make snd_rawmidi_substream.ops to be a const pointer to be safer and allow more optimization. The patches to constify each rawmidi ops will follow. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | | ALSA: seq: Fix race at creating a queueTakashi Iwai2017-02-081-13/+20
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | When a sequencer queue is created in snd_seq_queue_alloc(),it adds the new queue element to the public list before referencing it. Thus the queue might be deleted before the call of snd_seq_queue_use(), and it results in the use-after-free error, as spotted by syzkaller. The fix is to reference the queue object at the right time. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: seq: Don't handle loop timeout at snd_seq_pool_done()Takashi Iwai2017-02-061-8/+1
|/ | | | | | | | | | | | | | | | | snd_seq_pool_done() syncs with closing of all opened threads, but it aborts the wait loop with a timeout, and proceeds to the release resource even if not all threads have been closed. The timeout was 5 seconds, and if you run a crazy stuff, it can exceed easily, and may result in the access of the invalid memory address -- this is what syzkaller detected in a bug report. As a fix, let the code graduate from naiveness, simply remove the loop timeout. BugLink: http://lkml.kernel.org/r/CACT4Y+YdhDV2H5LLzDTJDVF-qiYHUHhtRaW4rbb4gUhTCQB81w@mail.gmail.com Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
OpenPOWER on IntegriCloud