user/sven/linux.git/include/uapi/sound, branch v5.16.17

ASoC: hdmi-codec: Fix OOB memory accesses

2022-02-08T17:35:07Z

commit 06feec6005c9d9500cd286ec440aabf8b2ddd94d upstream. Correct size of iec_status array by changing it to the size of status array of the struct snd_aes_iec958. This fixes out-of-bounds slab read accesses made by memcpy() of the hdmi-codec driver. This problem is reported by KASAN. Cc: stable@vger.kernel.org Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20220112195039.1329-1-digetx@gmail.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman

Merge tag 'sound-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

2021-11-03T14:49:25Z

Pull sound updates from Takashi Iwai: "Lots of code development have been see in ASoC side as usual, while the continued development on memalloc helper and USB-audio low- latency support are found in the rest. Note that a few changes in the unusual places like arch/sh are included, which are a part of ASoC DAI format cleanups. ALSA core: - Continued memalloc helper updates and cleanups, now supporting non-coherent and non-contiguous pages - Fixes for races in mixer OSS layer ASoC: - A new version of the audio graph card which supports a wider range of systems - Several conversions to YAML DT bindings - Continuing cleanups to the SOF and Intel code - Move of the Cirrus DSP framework into drivers/firmware to allow for future use by non-audio DSPs - An overhaul of the cs42l42 driver, correcting many problems - DAI format terminology conversions over many drivers for cleanups - Support for AMD Vangogh and Yelow Cap, Cirrus CS35L41, Maxim MAX98520 and MAX98360A, Mediatek MT8195, Nuvoton NAU8821, nVidia Tegra210, NXP i.MX8ULP, Qualcomm AudioReach, Realtek ALC5682I-VS, RT5682S, and RT9120 and Rockchip RV1126 and RK3568 USB-audio: - Continued improvements on low-latency playback - Quirks for Pioneer devices, Line6 HX-Stomp XL, Audient iD14 HD-audio: - Reduce excessive udelay() calls on Intel platforms; this should reduce the CPU load with PulseAudio - Quirks for HP and Clevo laptops FireWire: - Support for meter information on MOTU" * tag 'sound-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (513 commits) ALSA: usb-audio: Add quirk for Audient iD14 ALSA: hda/realtek: Add quirk for Clevo PC70HS ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk ALSA: usb-audio: Add registration quirk for JBL Quantum 400 ASoC: rsnd: Fix an error handling path in 'rsnd_node_count()' ASoC: tlv320aic3x: Make aic3x_remove() return void ASoC: Intel: soc-acpi: use const for all uses of snd_soc_acpi_codecs ASoC: Intel: soc-acpi-cht: shrink tables using compatible IDs ASoC: Intel: soc-acpi-byt: shrink tables using compatible IDs ASoC: Intel: sof_rt5682: use comp_ids to enumerate rt5682s ASoC: Intel: sof_rt5682: detect codec variant in probe function ASoC: soc-acpi: add comp_ids field for machine driver matching ASoC: mediatek: mt8195: add mt8195-mt6359-rt1011-rt5682 bindings document ASoC: mediatek: mt8195: add machine driver with mt6359, rt1011 and rt5682 ASoC: Stop dummy from overriding hwparams ASoC: topology: Change topology device to card device ASoC: topology: Use correct device for prints ASoC: topology: Check for dapm widget completeness ASoC: topology: Add header payload_size verification ASoC: core: Remove invalid snd_soc_component_set_jack call ...

Merge tag 'overflow-v5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2021-11-02T00:12:56Z

Pull overflow updates from Kees Cook: "The end goal of the current buffer overflow detection work[0] is to gain full compile-time and run-time coverage of all detectable buffer overflows seen via array indexing or memcpy(), memmove(), and memset(). The str*() family of functions already have full coverage. While much of the work for these changes have been on-going for many releases (i.e. 0-element and 1-element array replacements, as well as avoiding false positives and fixing discovered overflows[1]), this series contains the foundational elements of several related buffer overflow detection improvements by providing new common helpers and FORTIFY_SOURCE changes needed to gain the introspection required for compiler visibility into array sizes. Also included are a handful of already Acked instances using the helpers (or related clean-ups), with many more waiting at the ready to be taken via subsystem-specific trees[2]. The new helpers are: - struct_group() for gaining struct member range introspection - memset_after() and memset_startat() for clearing to the end of structures - DECLARE_FLEX_ARRAY() for using flex arrays in unions or alone in structs Also included is the beginning of the refactoring of FORTIFY_SOURCE to support memcpy() introspection, fix missing and regressed coverage under GCC, and to prepare to fix the currently broken Clang support. Finishing this work is part of the larger series[0], but depends on all the false positives and buffer overflow bug fixes to have landed already and those that depend on this series to land. As part of the FORTIFY_SOURCE refactoring, a set of both a compile-time and run-time tests are added for FORTIFY_SOURCE and the mem*()-family functions respectively. The compile time tests have found a legitimate (though corner-case) bug[6] already. Please note that the appearance of "panic" and "BUG" in the FORTIFY_SOURCE refactoring are the result of relocating existing code, and no new use of those code-paths are expected nor desired. Finally, there are two tree-wide conversions for 0-element arrays and flexible array unions to gain sane compiler introspection coverage that result in no known object code differences. After this series (and the changes that have now landed via netdev and usb), we are very close to finally being able to build with -Warray-bounds and -Wzero-length-bounds. However, due corner cases in GCC[3] and Clang[4], I have not included the last two patches that turn on these options, as I don't want to introduce any known warnings to the build. Hopefully these can be solved soon" Link: https://lore.kernel.org/lkml/20210818060533.3569517-1-keescook@chromium.org/ [0] Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?qt=grep&q=FORTIFY_SOURCE [1] Link: https://lore.kernel.org/lkml/202108220107.3E26FE6C9C@keescook/ [2] Link: https://lore.kernel.org/lkml/3ab153ec-2798-da4c-f7b1-81b0ac8b0c5b@roeck-us.net/ [3] Link: https://bugs.llvm.org/show_bug.cgi?id=51682 [4] Link: https://lore.kernel.org/lkml/202109051257.29B29745C0@keescook/ [5] Link: https://lore.kernel.org/lkml/20211020200039.170424-1-keescook@chromium.org/ [6] * tag 'overflow-v5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (30 commits) fortify: strlen: Avoid shadowing previous locals compiler-gcc.h: Define __SANITIZE_ADDRESS__ under hwaddress sanitizer treewide: Replace 0-element memcpy() destinations with flexible arrays treewide: Replace open-coded flex arrays in unions stddef: Introduce DECLARE_FLEX_ARRAY() helper btrfs: Use memset_startat() to clear end of struct string.h: Introduce memset_startat() for wiping trailing members and padding xfrm: Use memset_after() to clear padding string.h: Introduce memset_after() for wiping trailing members/padding lib: Introduce CONFIG_MEMCPY_KUNIT_TEST fortify: Add compile-time FORTIFY_SOURCE tests fortify: Allow strlen() and strnlen() to pass compile-time known lengths fortify: Prepare to improve strnlen() and strlen() warnings fortify: Fix dropped strcpy() compile-time write overflow check fortify: Explicitly disable Clang support fortify: Move remaining fortify helpers into fortify-string.h lib/string: Move helper functions out of string.c compiler_types.h: Remove __compiletime_object_size() cm4000_cs: Use struct_group() to zero struct cm4000_dev region can: flexcan: Use struct_group() to zero struct flexcan_regs regions ...

Merge tag 'asoc-v5.16' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

2021-11-01T15:58:27Z

ASoC: Updates for v5.16 This is an unusually large set of updates, mostly a large crop of unusually big drivers coupled with extensive overhauls of existing code. There's a SH change here for the DAI format terminology, the change is straightforward and the SH maintainers don't seem very active. - A new version of the audio graph card which supports a wider range of systems. - Move of the Cirrus DSP framework into drivers/firmware to allow for future use by non-audio DSPs. - Several conversions to YAML DT bindings. - Continuing cleanups to the SOF and Intel code. - A very big overhaul of the cs42l42 driver, correcting many problems. - Support for AMD Vangogh and Yelow Cap, Cirrus CS35L41, Maxim MAX98520 and MAX98360A, Mediatek MT8195, Nuvoton NAU8821, nVidia Tegra210, NXP i.MX8ULP, Qualcomm AudioReach, Realtek ALC5682I-VS, RT5682S, and RT9120 and Rockchip RV1126 and RK3568

ALSA: firewire-motu: export meter information to userspace as float value

2021-10-28T07:10:41Z

In command DSP models, one meter information consists of 4 bytes for IEEE 764 floating point (binary32). In previous patch, it is exported to userspace as 32 bit storage since the storage is also handled in ALSA firewire-motu driver as well in kernel space in which floating point arithmetic is not preferable. On the other hand, ALSA firewire-motu driver doesn't perform floating point calculation. The driver just gather meter information from isochronous packets and fill structure fields for userspace. In 'header' target of Kbuild, UAPI headers are processed before installed. In this timing, #ifdef macro with __KERNEL__ is removed. This mechanism is useful in the case so that the 32 bit storage can be accessible as u32 type in kernel space and float type in user space. We can see the same usage in ''struct acct_v3' in 'include/uapi/linux/acct.h'. This commit is for the above idea. Additionally, due to message protocol, meter information is filled with 0xffffffff in the end of period but 0xffffffff is invalid as binary32. To avoid confusion in userspace application, the last two elements are left without any assignment. Suggested-by: Takashi Iwai Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20211027125529.54295-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai

ALSA: firewire-motu: refine parser for meter information in register DSP models

2021-10-28T07:10:34Z

After further investigation, I realize that the total number of elements in array is not enough to store all of related messages from device. This commit refines meter array and message parser. In terms of channel identifier, register DSP models are classified to two categories: 1. the target of output is selectable 828mk2, 896hd, and Traveler are in the category. They transfer messages with channel identifier between 0x00 and 0x13 for input meters, therefore 20 elements are needed to store. On the other hand, they transfer messages with channel identifier for one pair of output meters. The selection is done by asynchronous write transaction to offset 0x'ffff'f000'0b2c. The table for relationship between written value and available identifiers is below: ============= =============== written value identifier pair ============= =============== 0x00000b00 0x80/0x81 0x00000b01 0x82/0x83 ... ... 0x00000b0b 0x96/0x97 ... ... 0x00000b10 0xa0/0xa1 ... ... 0x00000b3f 0xfe/0xff ... ... greater 0xfe/0xff ============= =============== Actually in the above three models, 0x96/0x97 pair is the maximum. Thus the number of available output meter is 24. 2. all of output is available 8 pre, Ultralite, Audio Express, and 4 pre are in the category. They transfer messages for output meters without any selection. The table for available identifier for each direction is below: ============== ========= ========== model input output ============== ========= ========== 8 pre 0x00-0x0f 0x82-0x8d Ultralite 0x00-0x09 0x82-0x8f Audio Express 0x00-0x09 0x80-0x8d 4 pre 0x00-0x09 0x80-0x8d ============== ========= ========== Some of available identifiers might not be used for actual output meters. Anyway, 24 plus 24 elements accommodate the input/output meters. I note that isochronous packet from V3HD/V4HD deliver no message. Notification by asynchronous transaction to registered address seems to be used for the purpose as well as for change of mixer parameter. Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20211027125529.54295-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai

ASoC: qdsp6: audioreach: add topology support

2021-10-26T12:50:07Z

Add ASoC topology support in audioreach Signed-off-by: Srinivas Kandagatla Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20211026111655.1702-14-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown

treewide: Replace open-coded flex arrays in unions

2021-10-18T19:28:53Z

In support of enabling -Warray-bounds and -Wzero-length-bounds and correctly handling run-time memcpy() bounds checking, replace all open-coded flexible arrays (i.e. 0-element arrays) in unions with the DECLARE_FLEX_ARRAY() helper macro. This fixes warnings such as: fs/hpfs/anode.c: In function 'hpfs_add_sector_to_btree': fs/hpfs/anode.c:209:27: warning: array subscript 0 is outside the bounds of an interior zero-length array 'struct bplus_internal_node[0]' [-Wzero-length-bounds] 209 | anode->btree.u.internal[0].down = cpu_to_le32(a); | ~~~~~~~~~~~~~~~~~~~~~~~^~~ In file included from fs/hpfs/hpfs_fn.h:26, from fs/hpfs/anode.c:10: fs/hpfs/hpfs.h:412:32: note: while referencing 'internal' 412 | struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving | ^~~~~~~~ drivers/net/can/usb/etas_es58x/es58x_fd.c: In function 'es58x_fd_tx_can_msg': drivers/net/can/usb/etas_es58x/es58x_fd.c:360:35: warning: array subscript 65535 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[]'} [-Wzero-length-bounds] 360 | tx_can_msg = (typeof(tx_can_msg))&es58x_fd_urb_cmd->raw_msg[msg_len]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/can/usb/etas_es58x/es58x_core.h:22, from drivers/net/can/usb/etas_es58x/es58x_fd.c:17: drivers/net/can/usb/etas_es58x/es58x_fd.h:231:6: note: while referencing 'raw_msg' 231 | u8 raw_msg[0]; | ^~~~~~~ Cc: "Gustavo A. R. Silva" Cc: Arnd Bergmann Cc: Ayush Sawal Cc: Vinay Kumar Yadav Cc: Rohit Maheshwari Cc: Herbert Xu Cc: "David S. Miller" Cc: Kalle Valo Cc: Jakub Kicinski Cc: Stanislaw Gruszka Cc: Luca Coelho Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Andrii Nakryiko Cc: Martin KaFai Lau Cc: Song Liu Cc: Yonghong Song Cc: John Fastabend Cc: KP Singh Cc: Johannes Berg Cc: Mordechay Goodstein Cc: Lee Jones Cc: Wolfgang Grandegger Cc: Marc Kleine-Budde Cc: Arunachalam Santhanam Cc: Vincent Mailhol Cc: Mikulas Patocka Cc: linux-crypto@vger.kernel.org Cc: ath10k@lists.infradead.org Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-scsi@vger.kernel.org Cc: linux-can@vger.kernel.org Cc: bpf@vger.kernel.org Acked-by: Marc Kleine-Budde # drivers/net/can/usb/etas_es58x/* Signed-off-by: Kees Cook

ALSA: uapi: Fix a C++ style comment in asound.h

2021-10-18T12:58:28Z

UAPI header should have no C++ style comment but only in the traditional C style comment, but there is still one place we used it mistakenly. This patch corrects it. Fixes: 542283566679 ("ALSA: ctl: remove unused macro for timestamping of elem_value") Reviewed-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20211018114035.18433-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: firewire: Fix C++ style comments in uapi header

2021-10-18T12:58:00Z

UAPI headers are built with -std=c90 and C++ style comments are explicitly prohibited. The recent commit overlooked the rule and caused the error at header installation. This patch corrects those. Fixes: bea36afa102e ("ALSA: firewire-motu: add message parser to gather meter information in register DSP model") Fixes: 90b28f3bb85c ("ALSA: firewire-motu: add message parser for meter information in command DSP model") Fixes: 634ec0b2906e ("ALSA: firewire-motu: notify event for parameter change in register DSP model") Reported-by: Stephen Rothwell Acked-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20211018113812.0a16efb0@canb.auug.org.au Link: https://lore.kernel.org/r/20211018063700.30834-1-tiwai@suse.de Signed-off-by: Takashi Iwai