Skip to content

Commit 379c726

Browse files
torvaldstorvalds
committed
Merge tag 'sound-5.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai: "This became slightly larger as I've been off in the last weeks. The majority of changes here is about ASoC, fixes for dmaengine and for addressing issues reported by CI, as well as other device-specific small fixes. Also, fixes for FireWire core stack and the usual HD-audio quirks are included" * tag 'sound-5.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (23 commits) ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback ASoC: ops: Validate input values in snd_soc_put_volsw_range() ASoC: dmaengine: Restore NULL prepare_slave_config() callback ASoC: atmel: mchp-pdmc: set prepare_slave_config ASoC: max98090: Generate notifications on changes for custom control ASoC: max98090: Reject invalid values in custom control put() ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes ALSA: hda/realtek: Add quirk for Yoga Duet 7 13ITL6 speakers firewire: core: extend card->lock in fw_core_handle_bus_reset firewire: remove check of list iterator against head past the loop body firewire: fix potential uaf in outbound_phy_packet_callback() ASoC: rt9120: Correct the reg 0x09 size to one byte ALSA: hda/realtek: Enable mute/micmute LEDs support for HP Laptops ALSA: hda/realtek: Fix mute led issue on thinkpad with cs35l41 s-codec ASoC: meson: axg-card: Fix nonatomic links ASoC: meson: axg-tdm-interface: Fix formatters in trigger" ASoC: soc-ops: fix error handling ASoC: meson: Fix event generation for G12A tohdmi mux ASoC: meson: Fix event generation for AUI CODEC mux ASoC: meson: Fix event generation for AUI ACODEC mux ...
2 parents 2e3afb4 + ac02e3c commit 379c726

21 files changed

Lines changed: 96 additions & 74 deletions

‎drivers/firewire/core-card.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -668,6 +668,7 @@ EXPORT_SYMBOL_GPL(fw_card_release);
668668
void fw_core_remove_card(struct fw_card *card)
669669
{
670670
struct fw_card_driver dummy_driver = dummy_driver_template;
671+
unsigned long flags;
671672

672673
card->driver->update_phy_reg(card, 4,
673674
PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
@@ -682,7 +683,9 @@ void fw_core_remove_card(struct fw_card *card)
682683
dummy_driver.stop_iso = card->driver->stop_iso;
683684
card->driver = &dummy_driver;
684685

686+
spin_lock_irqsave(&card->lock, flags);
685687
fw_destroy_nodes(card);
688+
spin_unlock_irqrestore(&card->lock, flags);
686689

687690
/* Wait for all users, especially device workqueue jobs, to finish. */
688691
fw_card_put(card);

‎drivers/firewire/core-cdev.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1500,6 +1500,7 @@ static void outbound_phy_packet_callback(struct fw_packet *packet,
15001500
{
15011501
struct outbound_phy_packet_event *e =
15021502
container_of(packet, struct outbound_phy_packet_event, p);
1503+
struct client *e_client;
15031504

15041505
switch (status) {
15051506
/* expected: */
@@ -1516,9 +1517,10 @@ static void outbound_phy_packet_callback(struct fw_packet *packet,
15161517
}
15171518
e->phy_packet.data[0] = packet->timestamp;
15181519

1520+
e_client = e->client;
15191521
queue_event(e->client, &e->event, &e->phy_packet,
15201522
sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0);
1521-
client_put(e->client);
1523+
client_put(e_client);
15221524
}
15231525

15241526
static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *arg)

‎drivers/firewire/core-topology.c‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -375,16 +375,13 @@ static void report_found_node(struct fw_card *card,
375375
card->bm_retries = 0;
376376
}
377377

378+
/* Must be called with card->lock held */
378379
void fw_destroy_nodes(struct fw_card *card)
379380
{
380-
unsigned long flags;
381-
382-
spin_lock_irqsave(&card->lock, flags);
383381
card->color++;
384382
if (card->local_node != NULL)
385383
for_each_fw_node(card, card->local_node, report_lost_node);
386384
card->local_node = NULL;
387-
spin_unlock_irqrestore(&card->lock, flags);
388385
}
389386

390387
static void move_tree(struct fw_node *node0, struct fw_node *node1, int port)
@@ -510,6 +507,8 @@ void fw_core_handle_bus_reset(struct fw_card *card, int node_id, int generation,
510507
struct fw_node *local_node;
511508
unsigned long flags;
512509

510+
spin_lock_irqsave(&card->lock, flags);
511+
513512
/*
514513
* If the selfID buffer is not the immediate successor of the
515514
* previously processed one, we cannot reliably compare the
@@ -521,8 +520,6 @@ void fw_core_handle_bus_reset(struct fw_card *card, int node_id, int generation,
521520
card->bm_retries = 0;
522521
}
523522

524-
spin_lock_irqsave(&card->lock, flags);
525-
526523
card->broadcast_channel_allocated = card->broadcast_channel_auto_allocated;
527524
card->node_id = node_id;
528525
/*

‎drivers/firewire/core-transaction.c‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -73,24 +73,25 @@ static int try_cancel_split_timeout(struct fw_transaction *t)
7373
static int close_transaction(struct fw_transaction *transaction,
7474
struct fw_card *card, int rcode)
7575
{
76-
struct fw_transaction *t;
76+
struct fw_transaction *t = NULL, *iter;
7777
unsigned long flags;
7878

7979
spin_lock_irqsave(&card->lock, flags);
80-
list_for_each_entry(t, &card->transaction_list, link) {
81-
if (t == transaction) {
82-
if (!try_cancel_split_timeout(t)) {
80+
list_for_each_entry(iter, &card->transaction_list, link) {
81+
if (iter == transaction) {
82+
if (!try_cancel_split_timeout(iter)) {
8383
spin_unlock_irqrestore(&card->lock, flags);
8484
goto timed_out;
8585
}
86-
list_del_init(&t->link);
87-
card->tlabel_mask &= ~(1ULL << t->tlabel);
86+
list_del_init(&iter->link);
87+
card->tlabel_mask &= ~(1ULL << iter->tlabel);
88+
t = iter;
8889
break;
8990
}
9091
}
9192
spin_unlock_irqrestore(&card->lock, flags);
9293

93-
if (&t->link != &card->transaction_list) {
94+
if (t) {
9495
t->callback(card, rcode, NULL, 0, t->callback_data);
9596
return 0;
9697
}
@@ -935,7 +936,7 @@ EXPORT_SYMBOL(fw_core_handle_request);
935936

936937
void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
937938
{
938-
struct fw_transaction *t;
939+
struct fw_transaction *t = NULL, *iter;
939940
unsigned long flags;
940941
u32 *data;
941942
size_t data_length;
@@ -947,20 +948,21 @@ void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
947948
rcode = HEADER_GET_RCODE(p->header[1]);
948949

949950
spin_lock_irqsave(&card->lock, flags);
950-
list_for_each_entry(t, &card->transaction_list, link) {
951-
if (t->node_id == source && t->tlabel == tlabel) {
952-
if (!try_cancel_split_timeout(t)) {
951+
list_for_each_entry(iter, &card->transaction_list, link) {
952+
if (iter->node_id == source && iter->tlabel == tlabel) {
953+
if (!try_cancel_split_timeout(iter)) {
953954
spin_unlock_irqrestore(&card->lock, flags);
954955
goto timed_out;
955956
}
956-
list_del_init(&t->link);
957-
card->tlabel_mask &= ~(1ULL << t->tlabel);
957+
list_del_init(&iter->link);
958+
card->tlabel_mask &= ~(1ULL << iter->tlabel);
959+
t = iter;
958960
break;
959961
}
960962
}
961963
spin_unlock_irqrestore(&card->lock, flags);
962964

963-
if (&t->link == &card->transaction_list) {
965+
if (!t) {
964966
timed_out:
965967
fw_notice(card, "unsolicited response (source %x, tlabel %x)\n",
966968
source, tlabel);

‎drivers/firewire/sbp2.c‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -408,7 +408,7 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request,
408408
void *payload, size_t length, void *callback_data)
409409
{
410410
struct sbp2_logical_unit *lu = callback_data;
411-
struct sbp2_orb *orb;
411+
struct sbp2_orb *orb = NULL, *iter;
412412
struct sbp2_status status;
413413
unsigned long flags;
414414

@@ -433,17 +433,18 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request,
433433

434434
/* Lookup the orb corresponding to this status write. */
435435
spin_lock_irqsave(&lu->tgt->lock, flags);
436-
list_for_each_entry(orb, &lu->orb_list, link) {
436+
list_for_each_entry(iter, &lu->orb_list, link) {
437437
if (STATUS_GET_ORB_HIGH(status) == 0 &&
438-
STATUS_GET_ORB_LOW(status) == orb->request_bus) {
439-
orb->rcode = RCODE_COMPLETE;
440-
list_del(&orb->link);
438+
STATUS_GET_ORB_LOW(status) == iter->request_bus) {
439+
iter->rcode = RCODE_COMPLETE;
440+
list_del(&iter->link);
441+
orb = iter;
441442
break;
442443
}
443444
}
444445
spin_unlock_irqrestore(&lu->tgt->lock, flags);
445446

446-
if (&orb->link != &lu->orb_list) {
447+
if (orb) {
447448
orb->callback(orb, &status);
448449
kref_put(&orb->kref, free_orb); /* orb callback reference */
449450
} else {

‎sound/firewire/fireworks/fireworks_hwdep.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
3434
type = SNDRV_FIREWIRE_EVENT_EFW_RESPONSE;
3535
if (copy_to_user(buf, &type, sizeof(type)))
3636
return -EFAULT;
37+
count += sizeof(type);
3738
remained -= sizeof(type);
3839
buf += sizeof(type);
3940

‎sound/pci/hda/patch_realtek.c‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8769,6 +8769,8 @@ static const struct hda_fixup alc269_fixups[] = {
87698769
[ALC287_FIXUP_CS35L41_I2C_2] = {
87708770
.type = HDA_FIXUP_FUNC,
87718771
.v.func = cs35l41_fixup_i2c_two,
8772+
.chained = true,
8773+
.chain_id = ALC269_FIXUP_THINKPAD_ACPI,
87728774
},
87738775
[ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED] = {
87748776
.type = HDA_FIXUP_FUNC,
@@ -9023,12 +9025,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
90239025
SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
90249026
SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
90259027
SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
9026-
SND_PCI_QUIRK(0x103c, 0x896e, "HP EliteBook x360 830 G9", ALC245_FIXUP_CS35L41_SPI_2),
9027-
SND_PCI_QUIRK(0x103c, 0x8971, "HP EliteBook 830 G9", ALC245_FIXUP_CS35L41_SPI_2),
9028-
SND_PCI_QUIRK(0x103c, 0x8972, "HP EliteBook 840 G9", ALC245_FIXUP_CS35L41_SPI_2),
9029-
SND_PCI_QUIRK(0x103c, 0x8973, "HP EliteBook 860 G9", ALC245_FIXUP_CS35L41_SPI_2),
9030-
SND_PCI_QUIRK(0x103c, 0x8974, "HP EliteBook 840 Aero G9", ALC245_FIXUP_CS35L41_SPI_2),
9031-
SND_PCI_QUIRK(0x103c, 0x8975, "HP EliteBook x360 840 Aero G9", ALC245_FIXUP_CS35L41_SPI_2),
9028+
SND_PCI_QUIRK(0x103c, 0x896e, "HP EliteBook x360 830 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
9029+
SND_PCI_QUIRK(0x103c, 0x8971, "HP EliteBook 830 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
9030+
SND_PCI_QUIRK(0x103c, 0x8972, "HP EliteBook 840 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
9031+
SND_PCI_QUIRK(0x103c, 0x8973, "HP EliteBook 860 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
9032+
SND_PCI_QUIRK(0x103c, 0x8974, "HP EliteBook 840 Aero G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
9033+
SND_PCI_QUIRK(0x103c, 0x8975, "HP EliteBook x360 840 Aero G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
90329034
SND_PCI_QUIRK(0x103c, 0x8981, "HP Elite Dragonfly G3", ALC245_FIXUP_CS35L41_SPI_4),
90339035
SND_PCI_QUIRK(0x103c, 0x898e, "HP EliteBook 835 G9", ALC287_FIXUP_CS35L41_I2C_2),
90349036
SND_PCI_QUIRK(0x103c, 0x898f, "HP EliteBook 835 G9", ALC287_FIXUP_CS35L41_I2C_2),
@@ -9245,6 +9247,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
92459247
SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
92469248
SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940", ALC298_FIXUP_LENOVO_SPK_VOLUME),
92479249
SND_PCI_QUIRK(0x17aa, 0x3819, "Lenovo 13s Gen2 ITL", ALC287_FIXUP_13S_GEN2_SPEAKERS),
9250+
SND_PCI_QUIRK(0x17aa, 0x3820, "Yoga Duet 7 13ITL6", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
92489251
SND_PCI_QUIRK(0x17aa, 0x3824, "Legion Y9000X 2020", ALC285_FIXUP_LEGION_Y9000X_SPEAKERS),
92499252
SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),
92509253
SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),

‎sound/soc/atmel/mchp-pdmc.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -966,6 +966,7 @@ static int mchp_pdmc_process(struct snd_pcm_substream *substream,
966966

967967
static struct snd_dmaengine_pcm_config mchp_pdmc_config = {
968968
.process = mchp_pdmc_process,
969+
.prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
969970
};
970971

971972
static int mchp_pdmc_probe(struct platform_device *pdev)

‎sound/soc/codecs/da7219.c‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -446,21 +446,27 @@ static int da7219_tonegen_freq_put(struct snd_kcontrol *kcontrol,
446446
struct soc_mixer_control *mixer_ctrl =
447447
(struct soc_mixer_control *) kcontrol->private_value;
448448
unsigned int reg = mixer_ctrl->reg;
449-
__le16 val;
449+
__le16 val_new, val_old;
450450
int ret;
451451

452452
/*
453453
* Frequency value spans two 8-bit registers, lower then upper byte.
454454
* Therefore we need to convert to little endian here to align with
455455
* HW registers.
456456
*/
457-
val = cpu_to_le16(ucontrol->value.integer.value[0]);
457+
val_new = cpu_to_le16(ucontrol->value.integer.value[0]);
458458

459459
mutex_lock(&da7219->ctrl_lock);
460-
ret = regmap_raw_write(da7219->regmap, reg, &val, sizeof(val));
460+
ret = regmap_raw_read(da7219->regmap, reg, &val_old, sizeof(val_old));
461+
if (ret == 0 && (val_old != val_new))
462+
ret = regmap_raw_write(da7219->regmap, reg,
463+
&val_new, sizeof(val_new));
461464
mutex_unlock(&da7219->ctrl_lock);
462465

463-
return ret;
466+
if (ret < 0)
467+
return ret;
468+
469+
return val_old != val_new;
464470
}
465471

466472

‎sound/soc/codecs/max98090.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol,
413413

414414
val = (val >> mc->shift) & mask;
415415

416+
if (sel < 0 || sel > mc->max)
417+
return -EINVAL;
418+
416419
*select = sel;
417420

418421
/* Setting a volume is only valid if it is already On */
@@ -427,7 +430,7 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol,
427430
mask << mc->shift,
428431
sel << mc->shift);
429432

430-
return 0;
433+
return *select != val;
431434
}
432435

433436
static const char *max98090_perf_pwr_text[] =

0 commit comments

Comments
 (0)