Skip to content

Commit 6e49f9e

Browse files
torvaldstorvalds
committed
Merge tag 'sound-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai: "A collection of a few more small fixes for HD- and USB-audio, including a regression fix for the OOB fix that was included in the previous pull request" * tag 'sound-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio ALSA: hda/realtek: Add quirk for Samsung 730QED to fix headphone ALSA: usb-audio: Use the right limit for PCM OOB check ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU ALSA: ctxfi: Fix potential OOB access in audio mixer handling selftests: ALSA: Remove unused variable in utimer-test ALSA: usb-audio: Add delay quirk for MOONDROP Moonriver2 Ti ALSA: scarlett2: Fix buffer overflow in config retrieval ALSA: usb: Increase volume range that triggers a warning
2 parents d6112dd + 64e0924 commit 6e49f9e

7 files changed

Lines changed: 54 additions & 11 deletions

File tree

‎sound/hda/codecs/realtek/alc269.c‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3736,6 +3736,7 @@ enum {
37363736
ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
37373737
ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
37383738
ALC298_FIXUP_LENOVO_C940_DUET7,
3739+
ALC287_FIXUP_LENOVO_YOGA_BOOK_9I,
37393740
ALC287_FIXUP_13S_GEN2_SPEAKERS,
37403741
ALC256_FIXUP_SET_COEF_DEFAULTS,
37413742
ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
@@ -3823,6 +3824,23 @@ static void alc298_fixup_lenovo_c940_duet7(struct hda_codec *codec,
38233824
__snd_hda_apply_fixup(codec, id, action, 0);
38243825
}
38253826

3827+
/* A special fixup for Lenovo Yoga 9i and Yoga Book 9i 13IRU8
3828+
* both have the very same PCI SSID and vendor ID, so we need
3829+
* to apply different fixups depending on the subsystem ID
3830+
*/
3831+
static void alc287_fixup_lenovo_yoga_book_9i(struct hda_codec *codec,
3832+
const struct hda_fixup *fix,
3833+
int action)
3834+
{
3835+
int id;
3836+
3837+
if (codec->core.subsystem_id == 0x17aa3881)
3838+
id = ALC287_FIXUP_TAS2781_I2C; /* Yoga Book 9i 13IRU8 */
3839+
else
3840+
id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP; /* Yoga 9i */
3841+
__snd_hda_apply_fixup(codec, id, action, 0);
3842+
}
3843+
38263844
static const struct hda_fixup alc269_fixups[] = {
38273845
[ALC269_FIXUP_GPIO2] = {
38283846
.type = HDA_FIXUP_FUNC,
@@ -5834,6 +5852,10 @@ static const struct hda_fixup alc269_fixups[] = {
58345852
.type = HDA_FIXUP_FUNC,
58355853
.v.func = alc298_fixup_lenovo_c940_duet7,
58365854
},
5855+
[ALC287_FIXUP_LENOVO_YOGA_BOOK_9I] = {
5856+
.type = HDA_FIXUP_FUNC,
5857+
.v.func = alc287_fixup_lenovo_yoga_book_9i,
5858+
},
58375859
[ALC287_FIXUP_13S_GEN2_SPEAKERS] = {
58385860
.type = HDA_FIXUP_VERBS,
58395861
.v.verbs = (const struct hda_verb[]) {
@@ -7013,6 +7035,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
70137035
SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP),
70147036
SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_AMP),
70157037
SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
7038+
SND_PCI_QUIRK(0x144d, 0xc876, "Samsung 730QED (NP730QED-KA2US)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
70167039
SND_PCI_QUIRK(0x144d, 0xca03, "Samsung Galaxy Book2 Pro 360 (NP930QED)", ALC298_FIXUP_SAMSUNG_AMP),
70177040
SND_PCI_QUIRK(0x144d, 0xca06, "Samsung Galaxy Book3 360 (NP730QFG)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
70187041
SND_PCI_QUIRK(0x144d, 0xc868, "Samsung Galaxy Book2 Pro (NP930XED)", ALC298_FIXUP_SAMSUNG_AMP),
@@ -7191,7 +7214,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
71917214
SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),
71927215
SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
71937216
SND_PCI_QUIRK(0x17aa, 0x383d, "Legion Y9000X 2019", ALC285_FIXUP_LEGION_Y9000X_SPEAKERS),
7194-
SND_PCI_QUIRK(0x17aa, 0x3843, "Yoga 9i", ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP),
7217+
SND_PCI_QUIRK(0x17aa, 0x3843, "Lenovo Yoga 9i / Yoga Book 9i", ALC287_FIXUP_LENOVO_YOGA_BOOK_9I),
71957218
SND_PCI_QUIRK(0x17aa, 0x3847, "Legion 7 16ACHG6", ALC287_FIXUP_LEGION_16ACHG6),
71967219
SND_PCI_QUIRK(0x17aa, 0x384a, "Lenovo Yoga 7 15ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
71977220
SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
@@ -7782,6 +7805,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
77827805
{0x12, 0x90a60140},
77837806
{0x19, 0x04a11030},
77847807
{0x21, 0x04211020}),
7808+
SND_HDA_PIN_QUIRK(0x10ec0274, 0x1d05, "TongFang", ALC274_FIXUP_HP_HEADSET_MIC,
7809+
{0x17, 0x90170110},
7810+
{0x19, 0x03a11030},
7811+
{0x21, 0x03211020}),
77857812
SND_HDA_PIN_QUIRK(0x10ec0282, 0x1025, "Acer", ALC282_FIXUP_ACER_DISABLE_LINEOUT,
77867813
ALC282_STANDARD_PINS,
77877814
{0x12, 0x90a609c0},

‎sound/pci/ctxfi/ctamixer.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,7 @@ static int amixer_rsc_init(struct amixer *amixer,
205205

206206
/* Set amixer specific operations */
207207
amixer->rsc.ops = &amixer_basic_rsc_ops;
208+
amixer->rsc.conj = 0;
208209
amixer->ops = &amixer_ops;
209210
amixer->input = NULL;
210211
amixer->sum = NULL;
@@ -367,6 +368,7 @@ static int sum_rsc_init(struct sum *sum,
367368
return err;
368369

369370
sum->rsc.ops = &sum_basic_rsc_ops;
371+
sum->rsc.conj = 0;
370372

371373
return 0;
372374
}

‎sound/usb/mixer.c‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1813,11 +1813,10 @@ static void __build_feature_ctl(struct usb_mixer_interface *mixer,
18131813

18141814
range = (cval->max - cval->min) / cval->res;
18151815
/*
1816-
* Are there devices with volume range more than 255? I use a bit more
1817-
* to be sure. 384 is a resolution magic number found on Logitech
1818-
* devices. It will definitively catch all buggy Logitech devices.
1816+
* There are definitely devices with a range of ~20,000, so let's be
1817+
* conservative and allow for a bit more.
18191818
*/
1820-
if (range > 384) {
1819+
if (range > 65535) {
18211820
usb_audio_warn(mixer->chip,
18221821
"Warning! Unlikely big volume range (=%u), cval->res is probably wrong.",
18231822
range);
@@ -2946,10 +2945,23 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
29462945

29472946
static void snd_usb_mixer_free(struct usb_mixer_interface *mixer)
29482947
{
2948+
struct usb_mixer_elem_list *list, *next;
2949+
int id;
2950+
29492951
/* kill pending URBs */
29502952
snd_usb_mixer_disconnect(mixer);
29512953

2952-
kfree(mixer->id_elems);
2954+
/* Unregister controls first, snd_ctl_remove() frees the element */
2955+
if (mixer->id_elems) {
2956+
for (id = 0; id < MAX_ID_ELEMS; id++) {
2957+
for (list = mixer->id_elems[id]; list; list = next) {
2958+
next = list->next_id_elem;
2959+
if (list->kctl)
2960+
snd_ctl_remove(mixer->chip->card, list->kctl);
2961+
}
2962+
}
2963+
kfree(mixer->id_elems);
2964+
}
29532965
if (mixer->urb) {
29542966
kfree(mixer->urb->transfer_buffer);
29552967
usb_free_urb(mixer->urb);

‎sound/usb/mixer_scarlett2.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2533,13 +2533,13 @@ static int scarlett2_usb_get_config(
25332533
err = scarlett2_usb_get(mixer, config_item->offset, buf, size);
25342534
if (err < 0)
25352535
return err;
2536-
if (size == 2) {
2536+
if (config_item->size == 16) {
25372537
u16 *buf_16 = buf;
25382538

25392539
for (i = 0; i < count; i++, buf_16++)
25402540
*buf_16 = le16_to_cpu(*(__le16 *)buf_16);
2541-
} else if (size == 4) {
2542-
u32 *buf_32 = buf;
2541+
} else if (config_item->size == 32) {
2542+
u32 *buf_32 = (u32 *)buf;
25432543

25442544
for (i = 0; i < count; i++, buf_32++)
25452545
*buf_32 = le32_to_cpu(*(__le32 *)buf_32);

‎sound/usb/pcm.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1553,7 +1553,8 @@ static int prepare_playback_urb(struct snd_usb_substream *subs,
15531553

15541554
for (i = 0; i < ctx->packets; i++) {
15551555
counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, avail);
1556-
if (counts < 0 || frames + counts >= ep->max_urb_frames)
1556+
if (counts < 0 ||
1557+
(frames + counts) * stride > ctx->buffer_size)
15571558
break;
15581559
/* set up descriptor */
15591560
urb->iso_frame_desc[i].offset = frames * stride;

‎sound/usb/quirks.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2390,6 +2390,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
23902390
QUIRK_FLAG_CTL_MSG_DELAY_1M),
23912391
DEVICE_FLG(0x2d99, 0x0026, /* HECATE G2 GAMING HEADSET */
23922392
QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE),
2393+
DEVICE_FLG(0x2fc6, 0xf06b, /* MOONDROP Moonriver2 Ti */
2394+
QUIRK_FLAG_CTL_MSG_DELAY),
23932395
DEVICE_FLG(0x2fc6, 0xf0b7, /* iBasso DC07 Pro */
23942396
QUIRK_FLAG_CTL_MSG_DELAY_1M),
23952397
DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */

‎tools/testing/selftests/alsa/utimer-test.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,6 @@ TEST_F(timer_f, utimer) {
141141
TEST(wrong_timers_test) {
142142
int timer_dev_fd;
143143
int utimer_fd;
144-
size_t i;
145144
struct snd_timer_uinfo wrong_timer = {
146145
.resolution = 0,
147146
.id = UTIMER_DEFAULT_ID,

0 commit comments

Comments
 (0)