summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-05-05ASoC: cs35l35: Add use_single_rw to regmap configPaul Handrigan
Add the use_single_rw flag to regmap config since the device does not support bulk transactions over i2c. Signed-off-by: Paul Handrigan <Paul.Handrigan@cirrus.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2018-05-04ALSA: pcm: Hide local_irq_disable/enable() and local_irqsave/restore()Anna-Maria Gleixner
The snd_pcm_stream_lock_irq*() functions decouple disabling interrupts from the actual locking process. This does not work as expected if the locking primitives are replaced like on preempt-rt. Provide one function for locking which uses correct locking primitives. Signed-off-by: Anna-Maria Gleixner <anna-maria@linutronix.de> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-04include: usb: audio-v3: add BADD-specific valuesRuslan Bilovol
Add BADD-specific predefined values to audio-v3 so usb-audio in ALSA and UAC3 gadget can use them Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-04ALSA: usb: mixer: make string parsing independent of mixer_build stateRuslan Bilovol
Functions like snd_usb_copy_string_desc() or get_term_name() don't actually need mixer_build state but can use snd_usb_audio structure instead to get usb device. This patch has no functional change but prepares to future UAC3 BADD profiles support which don't have class-specific descriptors so won't have mixer_build state. Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-04ALSA: usb: Only get AudioControl header for UAC1 class.Jorge Sanjuan
The control header needs to be read from buffer at this point only in the case of UAC1 protocol. Move it inside the switch case as other protocols such as the Basic Audio Device spec will have an empty buffer that is latter filled as inferred. Signed-off-by: Jorge Sanjuan <jorge.sanjuan@codethink.co.uk> [Ruslan: updated with recently added sanity checks] Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-04ALSA: usb: stream: refactor uac3 audio interface parsingRuslan Bilovol
Offload snd_usb_parse_audio_interface() function which became quite long after adding UAC3 spec support. Move class-specific parts of uac3 parsing to separate function which now produce audioformat structure that is ready to be fed to snd_usb_add_audio_stream(). Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-04ALSA: usb: stream: refactor uac1/2 audio interface parsingRuslan Bilovol
Offload snd_usb_parse_audio_interface() function which became quite long after adding UAC3 spec support. Move class-specific parts of uac1/2 parsing to separate function which now produce audioformat structure that is ready to be fed to snd_usb_add_audio_stream(). This also broke Blue Microphones workaround (which relies on audioformat decoded from previous altsetting) into two parts: prepare quirk flag analyzing previous altsetting then use it with current altsetting. Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-04ALSA: usb: stream: move audioformat alloc/init into separate functionRuslan Bilovol
Offload snd_usb_parse_audio_interface() function which became quite long after adding UAC3 spec support. Move audioformat allocation and initialization into separate function, this will make easier future refactoring. Attributes left in the original func because it'll be used for UAC3 BADD profiles suport in the future There is no functional change. Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-04ASoC: tas6424: Allow disabling auto diagnostics for faster power-onJean-Jacques Hiblot
The TAS6424 incorporates both DC-load and AC-load diagnostics which are used to determine the status of the load. The DC diagnostics runs when any channel is directed to leave the Hi-Z state and enter the MUTE or PLAY state. The DC diagnostics are turned on by default but, if a fast startup without diagnostics is required, the diagnostics can be disabled using a dedicated ALSA control. Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-04ASoC: nau8810: change input PGA mixer stageJohn Hsu
Organize the paths of the mixer, "Input Boost Stage", including the routes of the mixer. The control is not used correctly before. Besides, the driver changes the name of the mixer controls. Signed-off-by: John Hsu <KCHSU0@nuvoton.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-03ALSA: usb-audio: Clean up mixer element list traverseTakashi Iwai
Introduce a new macro for iterating over mixer element list for avoiding the open codes in many places. Also the open-coded container_of() and the forced cast to struct usb_mixer_elem_info are replaced with another simple macro, too. No functional changes but just readability improvement. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-03ALSA: sparc: Use GFP_KERNEL for non-atomic allocationTakashi Iwai
dbri driver allocates a resource with GFP_ATOMIC unnecessarily in its probe function. Replace it with the standard GFP_KERNEL for avoiding the bogus allocation failures. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-03ASoC: fsl_spdif: Switch to SPDX identifierFabio Estevam
Adopt the SPDX license identifier headers to ease license compliance management. Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-03ASoC: fsl_esai: Switch to SPDX identifierFabio Estevam
Adopt the SPDX license identifier headers to ease license compliance management. Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-03ASoC: fsl_sai: Switch to SPDX identifierFabio Estevam
Adopt the SPDX license identifier headers to ease license compliance management. Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-03ASoC: fsl_ssi: Switch to SPDX identifierFabio Estevam
Adopt the SPDX license identifier headers to ease license compliance management. Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-03ASoC: Intel: bytcr_rt565: fix missing assignment to ret_valColin Ian King
Currently, the check that ret_val is not -ENOENT is always true and the quirk bit BYT_RY5651_MCLK_EN is never being cleared because ret_val is always zero at this point from a previous assignment earlier on. I believe that ret_val should actually be assigned to the return from devm_clk_get() as this can return -ENOENT (from a deeper call to clk_get_sys) and that was the original intention to check this. Detected by CoverityScan, CID#1460228 ("Logically dead code") Fixes: 02c0a3b3047f ("ASoC: Intel: bytcr_rt5651: add MCLK, quirks and cleanups") Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-02ALSA: usb-audio: Give proper vendor/product name for Dell WD15 DockTakashi Iwai
Dell WD15 Dock with 0bda:4014 doesn't give any useful strings for the vendor and the product names. Name them more specifically via quirk, as well as the UCM profile name. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: usb-audio: Allow to override the longname stringTakashi Iwai
Historically USB-audio driver sets the card's longname field with the details of the device and the bus information. It's good per se, but not preferable when it's referred as the identifier for UCM profile. This patch adds a quirk profile_name field to override the card's longname string to a pre-defined one, so that one can create a unique and consistent ID string for the specific USB device via a quirk table to be used as a UCM profile name. The patch does a slight code refactoring to split out the functions to set shortname and longname fields as well. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: usb-audio: Add "Keep Interface" controlTakashi Iwai
This patch adds "Keep Interface" control for each USB-audio device. The control element is with SND_CTL_IFACE_CARD, so that it won't appear on any sane mixer applications. For a device that is confirmed to work well with "keep-interface" mode, user can flip the control via amixer, e.g. % amixer -c1 cset iface=CARD,name='Keep Interface' on and save/restore the state via alsactl. The reason to provide this via control API is that the behavior must be pretty depending on the device (and the firmware in it), so it's not ideal to apply via module option. For a device that certainly works, we may set it statically via a quirk table entry. But a device like Dell WD15 dock behaves so differently depending on the firmware, and we can't set it statically. So leave this as a dynamic switch each user can adjust freely. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: usb-audio: Add keep_iface flagTakashi Iwai
Introduce a new flag to struct snd_usb_audio for allowing the device to skip usb_set_interface() calls at changing or closing the stream. As of this patch, the flag is nowhere set, so it's just a place holder. The dynamic switching will be added in the following patch. A background information for this change: Dell WD15 dock with Realtek chip gives a very long pause at each time the driver changes the altset, which eventually happens at every PCM stream open/close and parameter change. As the long pause happens in each usb_set_interface() call, there is nothing we can do as long as it's called. The workaround is to reduce calling it as much as possible, and this flag indicates that behavior. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: usb-audio: Avoid superfluous usb_set_interface() callsTakashi Iwai
This is a preliminary change for the upcoming quirk implementation. Currently USB-audio driver tries to call usb_set_interface() whenever the format change with interface/altset modification happens. In this patch, the check is replaced with the comparison of cur_altsetting and the targeted altsetting pointer, so that the driver may skip the unnecessary function calls. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: usb-audio: Initialize Dell Dock playback volumesTakashi Iwai
In the early commit adcdd0d5a1cb ("ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock"), we add the mixer quirks for Dell dock to skip two mixer FU's for playback. This supposed that the device has always the proper initial volume, but it doesn't seem always correct. This patch adds the explicit initialization of the volumes to the fixed 0dB at the device probe time. Also, such a fixup is needed after the resume, so a new function is hooked to the resume callback as well. Bugzilla: http://bugzilla.suse.com/show_bug.cgi?id=1089467 Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: remove local frag of force_two_pcmsTakashi Sakamoto
At present, to add PCM substreams for each of available tx/rx streams, this driver uses a condition based on model-name. This is not enough to support unknown models. In former commits, this driver gains cache of stream formats. For models which support protocol extension, all of available steam formats are cached. For known models, hard-coded stream formats are used to generate the cache. For unknown models, stream formats at current mode of sampling transmission frequency is cached. Anyway, at least, the cached formats are used to expose constrains of PCM substreams for userspace applications. Thus, The cached data can be also used to add PCM substreams themselves, instead of the name-based conditions. This commit obsoletes local frag of force_two_pcms. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: use cache for PCM constraints and rulesTakashi Sakamoto
In former commits, proxy structure gets members for cache of stream formats. The cache allows to apply correct constraints and rules to runtime of PCM substream. They allows userspace applications to change current sampling transmission frequency. This commit uses the cacher for the PCM constraints and rules. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: use stream formats to add MIDI substreamsTakashi Sakamoto
In former commits, proxy structure gets members for cache of stream formats. The cache can be used to count the number of MIDI substreams to add. This commit uses the cache for this purpose. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: enable to change current sampling transmission frequencyTakashi Sakamoto
This is a preparation for userspace applications to change current sampling transmission frequency via ALSA PCM interface. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: add a helper function to restart all of available streamsTakashi Sakamoto
This commit is a small refactoring for better readability. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: use cache of stream format to check running streamTakashi Sakamoto
At present, to check running stream, available stream formats are used at current sampling transmission frequency (stf). But when changing stf, it's convenient to use cache of stream formats. This commit applies this idea. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: use extended protocol to detect available stream formatsTakashi Sakamoto
TC Applied Technologies (TCAT) have added extension to DICE protocol. This protocol extension is called as Extended Application Protocol, a.k.a. EAP. In this protocol extension, units get additional 9 address spaces. One of it is for current configuration. In this address space, a pair of router and stream formats are exposed per mode of three sampling transmission frequencies. This commit adds support the protocol extension for address space of the current configuration to generate cache of stream formats. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: add parameters of stream formats for models produced by AlesisTakashi Sakamoto
Alesis shipped some models with DICE ASICs. All of them just support DICE original protocol and drivers can't retrieve all of available stream formats without changing status of sampling transmission frequency actually. This commit puts some hard-coded parameters for the models. When detecting the models, the corresponding parameters are copied as cache of stream formats. I note that each of pair of iO14/iO26 and MultiMix 8/12/16 has the same model ID on their configuration ROM. The MultiMix 8/12/16 just support one mode for sampling transmission frequency and ALSA dice driver already handles them correctly. The iO14/iO26 support three modes and need hard-coded parameters. To distinguish these two models, this commit let the driver to retrieve current stream formats and compare it to known parameters, then decide it. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: add parameters of stream formats for models produced by TC ↵Takashi Sakamoto
Electronic TC Electronic shipped some models with DICE ASICs. All of them just support DICE original protocol and drivers can't retrieve all of available stream formats without changing status of sampling transmission frequency actually. This commit puts some hard-coded parameters for the models. When detecting the models, the corresponding parameters are copied as cache of stream formats. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: cache stream formats at current mode of sampling transmission ↵Takashi Sakamoto
frequency In former commits, proxy structure get members for cache of stream formats. This commit fills the cache with stream formats at current mode of sampling transmission frequency. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: add proc node for stream formationTakashi Sakamoto
Products with DICE interface in market can support variable stream formats for three levels of sampling transmission frequencies. To record these formats, a proxy structure got several fields in former commit. This commit adds a proc node to output the stream formats for debugging purpose. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: add 'firewire' directory for proc nodesTakashi Sakamoto
Unlike the other drivers in ALSA firewire stack, ALSA dice driver does't create 'firewire' directory for proc nodes because it has 'dice' node only. But this is inconvenient because I have a plan to add another proc node to output available stream formats from cache. This commit let the driver to create the directory and put 'dice' node into it. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: dice: add cache of stream formatsTakashi Sakamoto
A previous commit 6f688268b3f4 ('ALSA: dice: purge generating channel cache') purged cache of stream formats. DICE interface originally has no feature to assist drivers to retrieve available formats for all of supported sampling transmission frequencies, without changing the frequency actually. For later release of Dice ASICs such as TCD2210, Dice interface has extended protocol and can support the feature. This assists drivers to retrieve available stream formats. This commit is a first step to regain the cache to generate PCM rules for all of supported sampling transmission frequencies. Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: sc6000: fix spelling mistake: "iomaped" -> "iomapped"Colin Ian King
Trivial fix to spelling mistake in KERN_ERR error messages Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: hda/ca0132: fix build failure when a local macro is definedTakashi Sakamoto
DECLARE_TLV_DB_SCALE (alias of SNDRV_CTL_TLVD_DECLARE_DB_SCALE) is used but tlv.h is not included. This causes build failure when local macro is defined by comment-out. This commit fixes the bug. At the same time, the alias macro is replaced with a destination macro added at a commit 46e860f76804 ("ALSA: rename TLV-related macros so that they're friendly to user applications") Reported-by: Connor McAdams <conmanx360@gmail.com> Fixes: 44f0c9782cc6 ('ALSA: hda/ca0132: Add tuning controls') Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: hda - Enforce CONFIG_SND_DYNAMIC_MINORS for HDMI/DP codecTakashi Iwai
The DP-MST support requires more PCM streams than usual, hence CONFIG_SND_DYNAMIC_MINORS is almost mandatory. Currently the driver just warns and continues even if streams are missing, but it doesn't seem to enough convince users to switch to the modern setup. This patch adds the enforced selection of CONFIG_SND_DYNAMIC_MINORS from CONFIG_SND_HDA_CODEC_HDMI for covering that. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02ALSA: pcm: Check PCM state at xfern compat ioctlTakashi Iwai
Since snd_pcm_ioctl_xfern_compat() has no PCM state check, it may go further and hit the sanity check pcm_sanity_check() when the ioctl is called right after open. It may eventually spew a kernel warning, as triggered by syzbot, depending on kconfig. The lack of PCM state check there was just an oversight. Although it's no real crash, the spurious kernel warning is annoying, so let's add the proper check. Reported-by: syzbot+1dac3a4f6bc9c1c675d4@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-05-02Merge remote-tracking branch 'asoc/for-4.17' into asoc-4.18 to resolve aMark Brown
conflict between a fix and new development in mtk
2018-05-02ASoC: dai playback and capture active may be greater than 1Jerome Brunet
At the moment playback_active and capture_active are using only 1 bit so the maximum active count is 1. However, snd_soc_runtime_activate() may be called several time on the same dai. This happens when a dai is part of several dai_links. It is often the case for "snd-soc-dummy-dai". This is a problem if snd_soc_runtime_activate() is called an even number of times on a dai. In this case the active count overflow back to 0. As consequence, ASoC functions, such as soc_dpcm_runtime_update(), won't run correctly. Storing these usage counts on plain 'unsigned int' solves the problem. Fixes: f0fba2ad1b6b ("ASoC: multi-component - ASoC Multi-Component Support") Signed-off-by: Jerome Brunet <jbrunet@baylibre.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-02ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setupAlexander Sverdlin
According to "EP93xx User’s Guide", I2STXLinCtrlData and I2SRXLinCtrlData registers actually have different format. The only currently used bit (Left_Right_Justify) has different position. Fix this and simplify the whole setup taking into account the fact that both registers have zero default value. The practical effect of the above is repaired SND_SOC_DAIFMT_RIGHT_J support (currently unused). Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2018-05-02ASoC: cirrus: i2s: Fix LRCLK configurationAlexander Sverdlin
The bit responsible for LRCLK polarity is i2s_tlrs (0), not i2s_trel (2) (refer to "EP93xx User's Guide"). Previously card drivers which specified SND_SOC_DAIFMT_NB_IF actually got SND_SOC_DAIFMT_NB_NF, an adaptation is necessary to retain the old behavior. Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: stable@vger.kernel.org
2018-05-02ASoC: amd: fix spelling mistake: "failer" -> "failure"Colin Ian King
Trivial fix to spelling mistake in dev_err error message Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-02ASoC: mediatek: add the .probe() callback in mt2701_afe_pcm_dai_componentRyder Lee
For the sake of uniformity, this patch adds a callback mt2701_afe_pcm_probe() in mt2701_afe_pcm_dai_component to retrieve the regmap - the canonical way to obtain the pointer.. Doing so, we could switch to use devm_snd_soc_register_component() to register the component driver. Signed-off-by: Ryder Lee <ryder.lee@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-02ASoC: Intel: cht-bsw-rt5672: allow for topology-defined codec-dai setupPierre-Louis Bossart
Hard-coded setups conflict with topology defined ones. Move this code to codec_fixup so that SOF can override codec dai settings, e.g. to only use 2 channels. Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Acked-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-05-02ASoC: mediatek: avoid using snd_soc_platformKai Chieh Chuang
avoid using snd_soc_platform, which is removed after 4.18 Signed-off-by: KaiChieh Chuang <kaichieh.chuang@mediatek.com> Signed-off-by: Mark Brown <broonie@kernel.org>
2018-04-30ALSA: aloop: Add missing cable lock to ctl API callbacksTakashi Iwai
Some control API callbacks in aloop driver are too lazy to take the loopback->cable_lock and it results in possible races of cable access while it's being freed. It eventually lead to a UAF, as reported by fuzzer recently. This patch covers such control API callbacks and add the proper mutex locks. Reported-by: DaeRyong Jeong <threeearcat@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-04-29ALSA: dice: fix kernel NULL pointer dereference due to invalid calculation ↵Takashi Sakamoto
for array index At a commit f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls'), maximum size of payload for tx isochronous packet is cached to reduce the number of function calls. This cache was programmed to updated at a first callback of ohci1394 IR context. However, the maximum size is required to queueing packets before starting the isochronous context. As a result, the cached value is reused to queue packets in next time to starting the isochronous context. Then the cache is updated in a first callback of the isochronous context. This can cause kernel NULL pointer dereference in a below call graph: (sound/firewire/amdtp-stream.c) amdtp_stream_start() ->queue_in_packet() ->queue_packet() (drivers/firewire/core-iso.c) ->fw_iso_context_queue() ->struct fw_card_driver.queue_iso() (drivers/firewire/ohci.c) = ohci_queue_iso() ->queue_iso_packet_per_buffer() buffer->pages[page] The issued dereference occurs in a case that: - target unit supports different stream formats for sampling transmission frequency. - maximum length of payload for tx stream in a first trial is bigger than the length in a second trial. In this case, correct number of pages are allocated for DMA and the 'pages' array has enough elements, while index of the element is wrongly calculated according to the old value of length of payload in a call of 'queue_in_packet()'. Then it causes the issue. This commit fixes the critical bug. This affects all of drivers in ALSA firewire stack in Linux kernel v4.12 or later. [12665.302360] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [12665.302415] IP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.302439] PGD 0 [12665.302440] P4D 0 [12665.302450] [12665.302470] Oops: 0000 [#1] SMP PTI [12665.302487] Modules linked in: ... [12665.303096] CPU: 1 PID: 12760 Comm: jackd Tainted: P OE 4.13.0-38-generic #43-Ubuntu [12665.303154] Hardware name: /DH77DF, BIOS KCH7710H.86A.0069.2012.0224.1825 02/24/2012 [12665.303215] task: ffff9ce87da2ae80 task.stack: ffffb5b8823d0000 [12665.303258] RIP: 0010:ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.303301] RSP: 0018:ffffb5b8823d3ab8 EFLAGS: 00010086 [12665.303337] RAX: ffff9ce4f4876930 RBX: 0000000000000008 RCX: ffff9ce88a3955e0 [12665.303384] RDX: 0000000000000000 RSI: 0000000034877f00 RDI: 0000000000000000 [12665.303427] RBP: ffffb5b8823d3b68 R08: ffff9ce8ccb390a0 R09: ffff9ce877639ab0 [12665.303475] R10: 0000000000000108 R11: 0000000000000000 R12: 0000000000000003 [12665.303513] R13: 0000000000000000 R14: ffff9ce4f4876950 R15: 0000000000000000 [12665.303554] FS: 00007f2ec467f8c0(0000) GS:ffff9ce8df280000(0000) knlGS:0000000000000000 [12665.303600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12665.303633] CR2: 0000000000000030 CR3: 00000002dcf90004 CR4: 00000000000606e0 [12665.303674] Call Trace: [12665.303698] fw_iso_context_queue+0x18/0x20 [firewire_core] [12665.303735] queue_packet+0x88/0xe0 [snd_firewire_lib] [12665.303770] amdtp_stream_start+0x19b/0x270 [snd_firewire_lib] [12665.303811] start_streams+0x276/0x3c0 [snd_dice] [12665.303840] snd_dice_stream_start_duplex+0x1bf/0x480 [snd_dice] [12665.303882] ? vma_gap_callbacks_rotate+0x1e/0x30 [12665.303914] ? __rb_insert_augmented+0xab/0x240 [12665.303936] capture_prepare+0x3c/0x70 [snd_dice] [12665.303961] snd_pcm_do_prepare+0x1d/0x30 [snd_pcm] [12665.303985] snd_pcm_action_single+0x3b/0x90 [snd_pcm] [12665.304009] snd_pcm_action_nonatomic+0x68/0x70 [snd_pcm] [12665.304035] snd_pcm_prepare+0x68/0x90 [snd_pcm] [12665.304058] snd_pcm_common_ioctl1+0x4c0/0x940 [snd_pcm] [12665.304083] snd_pcm_capture_ioctl1+0x19b/0x250 [snd_pcm] [12665.304108] snd_pcm_capture_ioctl+0x27/0x40 [snd_pcm] [12665.304131] do_vfs_ioctl+0xa8/0x630 [12665.304148] ? entry_SYSCALL_64_after_hwframe+0xe9/0x139 [12665.304172] ? entry_SYSCALL_64_after_hwframe+0xe2/0x139 [12665.304195] ? entry_SYSCALL_64_after_hwframe+0xdb/0x139 [12665.304218] ? entry_SYSCALL_64_after_hwframe+0xd4/0x139 [12665.304242] ? entry_SYSCALL_64_after_hwframe+0xcd/0x139 [12665.304265] ? entry_SYSCALL_64_after_hwframe+0xc6/0x139 [12665.304288] ? entry_SYSCALL_64_after_hwframe+0xbf/0x139 [12665.304312] ? entry_SYSCALL_64_after_hwframe+0xb8/0x139 [12665.304335] ? entry_SYSCALL_64_after_hwframe+0xb1/0x139 [12665.304358] SyS_ioctl+0x79/0x90 [12665.304374] ? entry_SYSCALL_64_after_hwframe+0x72/0x139 [12665.304397] entry_SYSCALL_64_fastpath+0x24/0xab [12665.304417] RIP: 0033:0x7f2ec3750ef7 [12665.304433] RSP: 002b:00007fff99e31388 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [12665.304465] RAX: ffffffffffffffda RBX: 00007fff99e312f0 RCX: 00007f2ec3750ef7 [12665.304494] RDX: 0000000000000000 RSI: 0000000000004140 RDI: 0000000000000007 [12665.304522] RBP: 0000556ebc63fd60 R08: 0000556ebc640560 R09: 0000000000000000 [12665.304553] R10: 0000000000000001 R11: 0000000000000246 R12: 0000556ebc63fcf0 [12665.304584] R13: 0000000000000000 R14: 0000000000000007 R15: 0000000000000000 [12665.304612] Code: 01 00 00 44 89 eb 45 31 ed 45 31 db 66 41 89 1e 66 41 89 5e 0c 66 45 89 5e 0e 49 8b 49 08 49 63 d4 4d 85 c0 49 63 ff 48 8b 14 d1 <48> 8b 72 30 41 8d 14 37 41 89 56 04 48 63 d3 0f 84 ce 00 00 00 [12665.304713] RIP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] RSP: ffffb5b8823d3ab8 [12665.304743] CR2: 0000000000000030 [12665.317701] ---[ end trace 9d55b056dd52a19f ]--- Fixes: f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls') Cc: <stable@vger.kernel.org> # v4.12+ Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>