| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
ALSA: ac97: fix PM reference leak in ac97_bus_remove() [ Upstream commit a38e93302ee25b2ca6f4ee76c6c974cf3637985e ] pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. Fix it by replacing it with pm_runtime_resume_and_get to keep usage counter balanced. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yufen Yu <yuyufen@huawei.com> Link: https://lore.kernel.org/r/20210524093811.612302-1-yuyufen@huawei.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> | 4 年前 | |
ALSA: aoa: Fix I2S device accounting stable inclusion from stable-5.10.153 commit 00d6f33f6782e72c8753f30dea126317d6f97c8e category: bugfix issue: #I4UU4A CVE: NA Signed-off-by: Ywenrui <yaowenrui2@huawei.com> --------------------------------------- [ Upstream commit f1fae475f10a26b7e34da4ff2e2f19b7feb3548e ] i2sbus_add_dev() is supposed to return the number of probed devices, i.e. either 1 or 0. However, i2sbus_add_dev() has one error handling that returns -ENODEV; this will screw up the accumulation number counted in the caller, i2sbus_probe(). Fix the return value to 0 and add the comment for better understanding for readers. Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") Link: https://lore.kernel.org/r/20221027065233.13292-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ywenrui <yaowenrui2@huawei.com> | 3 年前 | |
amba: Make the remove callback return void stable inclusion from stable-5.10.110 commit e4c777fd8c371b2a46b7541fbd92903d700def11 category: bugfix issue: #I4UU4A CVE: NA Signed-off-by: gaochao <gaochao49@huawei.com> --------------------------------------- [ Upstream commit 3fd269e74f2feec973f45ee11d822faeda4fe284 ] All amba drivers return 0 in their remove callback. Together with the driver core ignoring the return value anyhow, it doesn't make sense to return a value here. Change the remove prototype to return void, which makes it explicit that returning an error value doesn't work as expected. This simplifies changing the core remove callback to return void, too. Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Krzysztof Kozlowski <krzk@kernel.org> # for drivers/memory Acked-by: Mark Brown <broonie@kernel.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Acked-by: Suzuki K Poulose <suzuki.poulose@arm.com> # for hwtracing/coresight Acked-By: Vinod Koul <vkoul@kernel.org> # for dmaengine Acked-by: Guenter Roeck <linux@roeck-us.net> # for watchdog Acked-by: Wolfram Sang <wsa@kernel.org> # for I2C Acked-by: Takashi Iwai <tiwai@suse.de> # for sound Acked-by: Vladimir Zapolskiy <vz@mleia.com> # for memory/pl172 Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20210126165835.687514-5-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: gc1202 <gaochao49@huawei.com> | 3 年前 | |
ALSA: atmel: ac97: clarify operator precedence Fix cppcheck warnings: sound/atmel/ac97c.c:478:30: style: Clarify calculation precedence for '&' and '?'. [clarifyCalculation] casr & AC97C_CSR_OVRUN ? " OVRUN" : "", ^ sound/atmel/ac97c.c:479:30: style: Clarify calculation precedence for '&' and '?'. [clarifyCalculation] casr & AC97C_CSR_RXRDY ? " RXRDY" : "", ^ sound/atmel/ac97c.c:480:30: style: Clarify calculation precedence for '&' and '?'. [clarifyCalculation] casr & AC97C_CSR_UNRUN ? " UNRUN" : "", ^ sound/atmel/ac97c.c:481:30: style: Clarify calculation precedence for '&' and '?'. [clarifyCalculation] casr & AC97C_CSR_TXEMPTY ? " TXEMPTY" : "", ^ sound/atmel/ac97c.c:482:30: style: Clarify calculation precedence for '&' and '?'. [clarifyCalculation] casr & AC97C_CSR_TXRDY ? " TXRDY" : "", ^ sound/atmel/ac97c.c:524:30: style: Clarify calculation precedence for '&' and '?'. [clarifyCalculation] cosr & AC97C_CSR_OVRUN ? " OVRUN" : "", ^ sound/atmel/ac97c.c:525:30: style: Clarify calculation precedence for '&' and '?'. [clarifyCalculation] cosr & AC97C_CSR_RXRDY ? " RXRDY" : "", ^ sound/atmel/ac97c.c:526:30: style: Clarify calculation precedence for '&' and '?'. [clarifyCalculation] cosr & AC97C_CSR_TXEMPTY ? " TXEMPTY" : "", ^ sound/atmel/ac97c.c:527:30: style: Clarify calculation precedence for '&' and '?'. [clarifyCalculation] cosr & AC97C_CSR_TXRDY ? " TXRDY" : "", ^ Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20200902212133.30964-15-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai <tiwai@suse.de> | 5 年前 | |
ALSA: timer: Fix UAF at snd_timer_user_params() mainline inclusion from mainline commit 92ad2d7f80cad43b046f093e808e11fe919d304a category: bugfix issue: #I8524 CVE: CVE-2026-53192 Signed-off-by: chenyang_w <wangchenyang65@huawei.com> ------------------------------- At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. SNDRV_TIMER_IOCTL_PARAMS isn't protected with register_mutex, hence the concurrent ioctl may lead to use-after-free. Add register_mutex protection to snd_timer_user_params(). The upstream fix uses guard(mutex) which requires linux/cleanup.h (backported to linux-5.10.y after v5.10.258). OH 5.10 is based on v5.10.210, so traditional mutex_lock/unlock is used instead for compatibility. Fixes: 053a401b5924 ("ALSA: timer: Fix UAF at snd_timer_user_params()") Change-Id: Ia62e8a9f15d174592ad4252c4e71b788a7ae1eb2 Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: chenyang_w <wangchenyang65@huawei.com> Change-Id: I9c08b897566f9a98bf1730e6bf575cc733e242b2 | 27 天前 | |
ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt stable inclusion from stable-5.10.163 commit 0649129359219ce6ff380ec401f87308485c6ae3 category: bugfix issue: #I79BZA CVE: NA Signed-off-by: wanxiaoqing40281 <wanxiaoqing@huawei.com> --------------------------------------- [ Upstream commit cf2ea3c86ad90d63d1c572b43e1ca9276b0357ad ] I got a null-ptr-defer error report when I do the following tests on the qemu platform: make defconfig and CONFIG_PARPORT=m, CONFIG_PARPORT_PC=m, CONFIG_SND_MTS64=m Then making test scripts: cat>test_mod1.sh<<EOF modprobe snd-mts64 modprobe snd-mts64 EOF Executing the script, perhaps several times, we will get a null-ptr-defer report, as follow: syzkaller:~# ./test_mod.sh snd_mts64: probe of snd_mts64.0 failed with error -5 modprobe: ERROR: could not insert 'snd_mts64': No such device BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 0 PID: 205 Comm: modprobe Not tainted 6.1.0-rc8-00588-g76dcd734eca2 #6 Call Trace: <IRQ> snd_mts64_interrupt+0x24/0xa0 [snd_mts64] parport_irq_handler+0x37/0x50 [parport] __handle_irq_event_percpu+0x39/0x190 handle_irq_event_percpu+0xa/0x30 handle_irq_event+0x2f/0x50 handle_edge_irq+0x99/0x1b0 __common_interrupt+0x5d/0x100 common_interrupt+0xa0/0xc0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP: 0010:_raw_write_unlock_irqrestore+0x11/0x30 parport_claim+0xbd/0x230 [parport] snd_mts64_probe+0x14a/0x465 [snd_mts64] platform_probe+0x3f/0xa0 really_probe+0x129/0x2c0 __driver_probe_device+0x6d/0xc0 driver_probe_device+0x1a/0xa0 __device_attach_driver+0x7a/0xb0 bus_for_each_drv+0x62/0xb0 __device_attach+0xe4/0x180 bus_probe_device+0x82/0xa0 device_add+0x550/0x920 platform_device_add+0x106/0x220 snd_mts64_attach+0x2e/0x80 [snd_mts64] port_check+0x14/0x20 [parport] bus_for_each_dev+0x6e/0xc0 __parport_register_driver+0x7c/0xb0 [parport] snd_mts64_module_init+0x31/0x1000 [snd_mts64] do_one_initcall+0x3c/0x1f0 do_init_module+0x46/0x1c6 load_module+0x1d8d/0x1e10 __do_sys_finit_module+0xa2/0xf0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Kernel panic - not syncing: Fatal exception in interrupt Rebooting in 1 seconds.. The mts wa not initialized during interrupt, we add check for mts to fix this bug. Fixes: 68ab801e32bb ("[ALSA] Add snd-mts64 driver for ESI Miditerminal 4140") Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Link: https://lore.kernel.org/r/20221206061004.1222966-1-cuigaosheng1@huawei.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: wanxiaoqing40281 <wanxiaoqing@huawei.com> | 3 年前 | |
ALSA: fireworks: bound device-supplied status before string array lookup mainline inclusion from mainline-5.10.101 commit 07704bbf36f57e4379e4cadf96410dab14621e3b category: bugfix issue: #8196 CVE: CVE-2026-31619 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- ALSA: fireworks: bound device-supplied status before string array lookup The status field in an EFW response is a 32-bit value supplied by the firewire device. efr_status_names[] has 17 entries so a status value outside that range goes off into the weeds when looking at the %s value. Even worse, the status could return EFR_STATUS_INCOMPLETE which is 0x80000000, and is obviously not in that array of potential strings. Fix this up by properly bounding the index against the array size and printing "unknown" if it's not recognized. Cc: Clemens Ladisch <clemens@ladisch.de> Cc: Takashi Sakamoto <o-takashi@sakamocchi.jp> Cc: Jaroslav Kysela <perex@perex.cz> Cc: Takashi Iwai <tiwai@suse.com> Fixes: bde8a8f23bbe ("ALSA: fireworks: Add transaction and some commands") Cc: stable <stable@kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Link: https://patch.msgid.link/2026040953-astute-camera-1aa1@gregkh Signed-off-by: Takashi Iwai <tiwai@suse.de> Change-Id: I3dea43e9011d608ee05b7d6e13c54eb1820ef01c Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> | 3 个月前 | |
ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL stable inclusion from stable-5.10.210 commit 1eeca000f26871522c52fc9b76eb375453fc08d2 category: bugfix issue: #IALRIK CVE: NA Signed-off-by: yaowenrui <yaowenrui2@huawei.com> --------------------------------------- [ Upstream commit 7a9d6bbe8a663c817080be55d9fecf19a4a8fd8f ] Same usual filters, SOF is required for DMIC and/or SoundWire support. Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com> Acked-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/20231204212710.185976-4-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: yaowenrui <yaowenrui2@huawei.com> | 1 年前 | |
ALSA: i2c/cs8427: fix iec958 mixer control deactivation stable inclusion from stable-5.10.178 commit 69108a8a45c61461bddca06e084ad5b2e7111612 category: bugfix issue: #I8JM1V CVE: NA Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> --------------------------------------- commit e98e7a82bca2b6dce3e03719cff800ec913f9af7 upstream. snd_cs8427_iec958_active() would always delete SNDRV_CTL_ELEM_ACCESS_INACTIVE, even though the function has an argument active. Signed-off-by: Oswald Buddenhagen <oswald.buddenhagen@gmx.de> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20230405201219.2197811-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> | 2 年前 | |
ALSA: wavefront: Proper check of get_user() error stable inclusion from stable-5.10.118 commit 3eaf770163b771ca218482614a1c84281254bb54 category: bugfix issue: #I4UU4A CVE: NA Signed-off-by: gaochao <gaochao49@huawei.com> --------------------------------------- commit a34ae6c0660d3b96b0055f68ef74dc9478852245 upstream. The antient ISA wavefront driver reads its sample patch data (uploaded over an ioctl) via __get_user() with no good reason; likely just for some performance optimizations in the past. Let's change this to the standard get_user() and the error check for handling the fault case properly. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220510103626.16635-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: gc1202 <gaochao49@huawei.com> | 3 年前 | |
hal2: convert to dma_alloc_noncoherent Use the new non-coherent DMA API including proper ownership transfers. This also means we can allocate the buffer memory with the proper direction instead of bidirectional. Signed-off-by: Christoph Hellwig <hch@lst.de> Tested-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> | 5 年前 | |
sound/oss/dmasound: fix 'dmasound_setup' defined but not used stable inclusion from stable-5.10.180 commit c820c05c5ff6613ad424dce1cddc459ffd2fb96b category: bugfix issue: #I8UQTM CVE: NA Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> --------------------------------------- commit 357ad4d898286b94aaae0cb7e3f573459e5b98b9 upstream. We observed: 'dmasound_setup' defined but not used error with COMPILER=gcc ARCH=m68k DEFCONFIG=allmodconfig build. Fix it by adding __maybe_unused to dmasound_setup. Error(s): sound/oss/dmasound/dmasound_core.c:1431:12: error: 'dmasound_setup' defined but not used [-Werror=unused-function] Fixes: 9dd7c46346ca ("sound/oss/dmasound: fix build when drivers are mixed =y/=m") Signed-off-by: Miles Chen <miles.chen@mediatek.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Link: https://lore.kernel.org/r/20220414091940.2216-1-miles.chen@mediatek.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> | 2 年前 | |
Merge tag 'sound-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "As the diffstat shows we've had again a lot of works done for this cycle: the majority of changes are the continued componentization and code refactoring in ASoC, the tree-wide PCM API updates and cleanups and SOF updates while a few ASoC driver updates are seen, too. Here we go, some highlights: Core: - Finally y2038 support landed to ALSA ABI; some ioctls have been extended and lots of tricks were applied - Applying the new managed PCM buffer API to all drivers; the API itself was already merged in 5.5 - The already deprecated dimension support in ALSA control API is dropped completely now - Verification of ALSA control elements to catch API misuses ASoC: - Further code refactorings and moving things to the component level - Lots of updates and improvements on SOF / Intel drivers; now including common HDMI driver and SoundWire support - New driver support for Ingenic JZ4770, Mediatek MT6660, Qualcomm WCD934x and WSA881x, and Realtek RT700, RT711, RT715, RT1011, RT1015 and RT1308 HD-audio: - Improved ring-buffer communications using waitqueue - Drop the superfluous buffer preallocation on x86 Others: - Many code cleanups, mostly constifications over the whole tree - USB-audio: quirks for MOTU, Corsair Virtuoso, Line6 Helix - FireWire: code refactoring for oxfw and dice drivers" * tag 'sound-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (638 commits) ALSA: usb-audio: add quirks for Line6 Helix devices fw>=2.82 ALSA: hda: Add Clevo W65_67SB the power_save blacklist ASoC: soc-core: remove null_snd_soc_ops ASoC: soc-pcm: add soc_rtd_trigger() ASoC: soc-pcm: add soc_rtd_hw_free() ASoC: soc-pcm: add soc_rtd_hw_params() ASoC: soc-pcm: add soc_rtd_prepare() ASoC: soc-pcm: add soc_rtd_shutdown() ASoC: soc-pcm: add soc_rtd_startup() ASoC: rt1015: add rt1015 amplifier driver ASoC: madera: Correct some kernel doc ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj initialization order ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug ASoC: madera: Correct DMIC only input hook ups ALSA: cs46xx: fix spelling mistake "to" -> "too" ALSA: hda - Add docking station support for Lenovo Thinkpad T420s ASoC: Add MediaTek MT6660 Speaker Amp Driver ASoC: dt-bindings: rt5645: add suppliers ASoC: max98090: fix deadlock in max98090_dapm_put_enum_double() ASoC: dapm: add snd_soc_dapm_put_enum_double_locked ... | 6 年前 | |
ALSA: ctxfi: Limit PTP to a single page mainline inclusion from mainline-5.10.101 commit e9418da50d9e5c496c22fe392e4ad74c038a94eb category: bugfix issue: #8196 CVE: CVE-2026-31602 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic. ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault: BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged. Fixes: 391e69143d0a ("ALSA: ctxfi: Bump playback substreams to 256") Cc: stable@vger.kernel.org Signed-off-by: Harin Lee <me@harin.net> Link: https://patch.msgid.link/20260406074857.216034-1-me@harin.net Signed-off-by: Takashi Iwai <tiwai@suse.de> Change-Id: I8e085a2856f326d8f902efab402091f0d44f0fbe Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> | 3 个月前 | |
ALSA: Use fallthrough pseudo-keyword Replace the existing /* fall through */ comments and its variants with the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary fall-through markings when it is the case. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/20200708203236.GA5112@embeddedor Signed-off-by: Takashi Iwai <tiwai@suse.de> | 6 年前 | |
ALSA: ppc: fix error return code in snd_pmac_probe() [ Upstream commit 80b9c1be567c3c6bbe0d4b290af578e630485b5d ] If snd_pmac_tumbler_init() or snd_pmac_tumbler_post_init() fails, snd_pmac_probe() need return error code. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20210616021121.1991502-1-yangyingliang@huawei.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> | 4 年前 | |
ALSA: sh: Fix compile warning wrt const A long-standing compile warning was seen during build test: sound/sh/aica.c: In function 'load_aica_firmware': sound/sh/aica.c:521:25: warning: passing argument 2 of 'spu_memload' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] Fixes: 198de43d758c ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device") Link: https://lore.kernel.org/r/20200105144823.29547-69-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> | 6 年前 | |
ASoC: amd: fix memory leak in acp3x pdm dma ops stable inclusion from stable-5.10.250 commit 9f23800c7eed06cb8ccae8a225f5e3d421b0d4cc category: bugfix issue: #8294 CVE: CVE-2026-23190 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- [ Upstream commit 7f67ba5413f98d93116a756e7f17cd2c1d6c2bd6 ] Fixes: 4a767b1d039a8 ("ASoC: amd: add acp3x pdm driver dma ops") Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com> Link: https://patch.msgid.link/20260202205034.7697-1-chris.bainbridge@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> | 2 个月前 | |
ALSA: sparc: dbri: fix repeated word 'the' Change the duplicated word "the" to "Then the". Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://lore.kernel.org/r/20201016174405.17745-1-rdunlap@infradead.org Signed-off-by: Takashi Iwai <tiwai@suse.de> | 5 年前 | |
ALSA: spi: Add check for clk_enable() stable inclusion from stable-5.10.110 commit 5d6a0dc6bad495817efcaa32ef209a6b4f86485d category: bugfix issue: #I4UU4A CVE: NA Signed-off-by: gaochao <gaochao49@huawei.com> --------------------------------------- [ Upstream commit ca1697eb09208f0168d94b88b72f57505339cbe5 ] As the potential failure of the clk_enable(), it should be better to check it and return error if fails. Fixes: 3568459a5113 ("ALSA: at73c213: manage SSC clock") Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Link: https://lore.kernel.org/r/20220228022839.3547266-1-jiasheng@iscas.ac.cn Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: gc1202 <gaochao49@huawei.com> | 3 年前 | |
ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control() stable inclusion from stable-5.10.168 commit e1646e2be9561469ff26c11295ad14b6c32e670f category: bugfix issue: #I81K3I CVE: NA Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> --------------------------------------- commit 6a32425f953b955b4ff82f339d01df0b713caa5d upstream. snd_emux_xg_control() can be called with an argument 'param' greater than size of 'control' array. It may lead to accessing 'control' array at a wrong index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Artemii Karasev <karasev@ispras.ru> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20230207132026.2870-1-karasev@ispras.ru Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> | 2 年前 | |
ALSA: usb-audio: Bound MIDI endpoint descriptor scans stable inclusion from stable-5.10.257 commit e2f1260a056eb3215c13c48c5378f3e4112dc3af category: bugfix issue: #8664 CVE: CVE-2026-52963 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- commit d6854daa67be623860f4e1873fd3d3c275aba4ed upstream. snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan. That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan. Stop walking when bLength is zero or extends past the remaining endpoint-extra scan. Fixes: 5c6cd7021a05 ("ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint descriptor") Cc: stable@vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260507-usb-midi-endpoint-scan-bounds-v1-1-329d7348160e@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Change-Id: I8333c78991f4aa7545ba7dd70eb9244aedf9517d | 27 天前 | |
ALSA: intel_hdmi: Fix reference to PCM buffer address stable inclusion from stable-5.10.104 commit 336872601cb8eb2b09bccbae81b7354d5fbd1cca category: bugfix issue: #I4UU4A CVE: NA Signed-off-by: gaochao <gaochao49@huawei.com> --------------------------------------- commit 0aa6b294b312d9710804679abd2c0c8ca52cc2bc upstream. PCM buffers might be allocated dynamically when the buffer preallocation failed or a larger buffer is requested, and it's not guaranteed that substream->dma_buffer points to the actually used buffer. The driver needs to refer to substream->runtime->dma_addr instead for the buffer address. Signed-off-by: Zhen Ni <nizhen@uniontech.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220302074241.30469-1-nizhen@uniontech.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: gc1202 <gaochao49@huawei.com> | 3 年前 | |
ALSA: xen: Remove superfluous fall through comments The "fall through" comments found in switch-cases in ALSA xen driver are all superfluous. The kernel coding style allows the multiple cases in a row. Let's remove them. Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/20200709111750.8337-3-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> | 6 年前 | |
um: Fix hostaudio build errors stable inclusion from stable-5.10.195 commit cfe215a04a21edb1166bca4a0053f9456a0c06db category: bugfix issue: #I9HO7R CVE: NA Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> --------------------------------------- [ Upstream commit db4bfcba7bb8d10f00bba2a3da6b9a9c2a1d7b71 ] Use "select" to ensure that the required kconfig symbols are set as expected. Drop HOSTAUDIO since it is now equivalent to UML_SOUND. Set CONFIG_SOUND=m in ARCH=um defconfig files to maintain the status quo of the default configs. Allow SOUND with UML regardless of HAS_IOMEM. Otherwise there is a kconfig warning for unmet dependencies. (This was not an issue when SOUND was defined in arch/um/drivers/Kconfig. I have done 50 randconfig builds and didn't find any issues.) This fixes build errors when CONFIG_SOUND is not set: ld: arch/um/drivers/hostaudio_kern.o: in function hostaudio_cleanup_module': hostaudio_kern.c:(.exit.text+0xa): undefined reference to unregister_sound_mixer' ld: hostaudio_kern.c:(.exit.text+0x15): undefined reference to unregister_sound_dsp' ld: arch/um/drivers/hostaudio_kern.o: in function hostaudio_init_module': hostaudio_kern.c:(.init.text+0x19): undefined reference to register_sound_dsp' ld: hostaudio_kern.c:(.init.text+0x31): undefined reference to register_sound_mixer' ld: hostaudio_kern.c:(.init.text+0x49): undefined reference to `unregister_sound_dsp' and this kconfig warning: WARNING: unmet direct dependencies detected for SOUND Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: d886e87cb82b ("sound: make OSS sound core optional") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: kernel test robot <lkp@intel.com> Closes: lore.kernel.org/r/202307141416.vxuRVpFv-lkp@intel.com Cc: Richard Weinberger <richard@nod.at> Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com> Cc: Johannes Berg <johannes@sipsolutions.net> Cc: linux-um@lists.infradead.org Cc: Tejun Heo <tj@kernel.org> Cc: Takashi Iwai <tiwai@suse.de> Cc: Jaroslav Kysela <perex@perex.cz> Cc: Masahiro Yamada <masahiroy@kernel.org> Cc: Nathan Chancellor <nathan@kernel.org> Cc: Nick Desaulniers <ndesaulniers@google.com> Cc: Nicolas Schier <nicolas@fjasle.eu> Cc: linux-kbuild@vger.kernel.org Cc: alsa-devel@alsa-project.org Reviewed-by: Masahiro Yamada <masahiroy@kernel.org> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> | 2 年前 | |
ALSA: xen-front: Introduce Xen para-virtualized sound frontend driver Introduce skeleton of the para-virtualized Xen sound frontend driver. Initial handling for Xen bus states: implement Xen bus state machine for the frontend driver according to the state diagram and recovery flow from sound para-virtualized protocol: xen/interface/io/sndif.h. Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> | 8 年前 | |
ALSA: ac97: Treat snd_ac97_bus_ops as const This is a preliminary patch to allow const for snd_ac97_bus_ops definitions in each driver's code. The ops reference is read-only, hence it can be declared as const for further optimization. There should be no functional changes by this patch. Link: https://lore.kernel.org/r/20200103081714.9560-23-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> | 6 年前 | |
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details you should have received a copy of the gnu general public license along with this program if not write to the free software foundation inc 59 temple place suite 330 boston ma 02111 1307 usa extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 1334 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Reviewed-by: Richard Fontana <rfontana@redhat.com> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 7 年前 | |
sound: fix a memory leak bug In sound_insert_unit(), the controlling structure 's' is allocated through kmalloc(). Then it is added to the sound driver list by invoking __sound_insert_unit(). Later on, if __register_chrdev() fails, 's' is removed from the list through __sound_remove_unit(). If 'index' is not less than 0, -EBUSY is returned to indicate the error. However, 's' is not deallocated on this execution path, leading to a memory leak bug. To fix the above issue, free 's' before -EBUSY is returned. Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> | 6 年前 |