Commit f9efc944 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'sound-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound 

Pull sound fixes from Takashi Iwai:
 "All fixes are small and for stable:

   - a PCM ioctl race fix

   - yet another USB-audio hardening for malicious descriptors

   - Realtek ALC257 codec support"

* tag 'sound-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: pcm: prevent UAF in snd_pcm_info
  ALSA: hda/realtek - New codec support for ALC257
  ALSA: usb-audio: Add check return value for usb_string()
  ALSA: usb-audio: Fix out-of-bound error
  ALSA: seq: Remove spurious WARN_ON() at timer check
parents 328b4ed9 362bca57

sound/core/pcm.c

+2 −0
Original line number Diff line number Diff line
@@ -153,7 +153,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card, 
				err = -ENXIO;

				goto _error;

			}

			mutex_lock(&pcm->open_mutex);

			err = snd_pcm_info_user(substream, info);

			mutex_unlock(&pcm->open_mutex);

		_error:

			mutex_unlock(&register_mutex);

			return err;

sound/core/seq/seq_timer.c

+1 −1
Original line number Diff line number Diff line
@@ -355,7 +355,7 @@ static int initialize_timer(struct snd_seq_timer *tmr) 
	unsigned long freq;



	t = tmr->timeri->timer;

	if (snd_BUG_ON(!t))

	if (!t)

		return -EINVAL;



	freq = tmr->preferred_resolution;

sound/pci/hda/patch_realtek.c

+8 −0
Original line number Diff line number Diff line
@@ -330,6 +330,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) 
	case 0x10ec0236:

	case 0x10ec0255:

	case 0x10ec0256:

	case 0x10ec0257:

	case 0x10ec0282:

	case 0x10ec0283:

	case 0x10ec0286:
@@ -2772,6 +2773,7 @@ enum { 
	ALC269_TYPE_ALC298,

	ALC269_TYPE_ALC255,

	ALC269_TYPE_ALC256,

	ALC269_TYPE_ALC257,

	ALC269_TYPE_ALC215,

	ALC269_TYPE_ALC225,

	ALC269_TYPE_ALC294,
@@ -2805,6 +2807,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec) 
	case ALC269_TYPE_ALC298:

	case ALC269_TYPE_ALC255:

	case ALC269_TYPE_ALC256:

	case ALC269_TYPE_ALC257:

	case ALC269_TYPE_ALC215:

	case ALC269_TYPE_ALC225:

	case ALC269_TYPE_ALC294:
@@ -6867,6 +6870,10 @@ static int patch_alc269(struct hda_codec *codec) 
		spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */

		alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/

		break;

	case 0x10ec0257:

		spec->codec_variant = ALC269_TYPE_ALC257;

		spec->gen.mixer_nid = 0;

		break;

	case 0x10ec0215:

	case 0x10ec0285:

	case 0x10ec0289:
@@ -7914,6 +7921,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { 
	HDA_CODEC_ENTRY(0x10ec0236, "ALC236", patch_alc269),

	HDA_CODEC_ENTRY(0x10ec0255, "ALC255", patch_alc269),

	HDA_CODEC_ENTRY(0x10ec0256, "ALC256", patch_alc269),

	HDA_CODEC_ENTRY(0x10ec0257, "ALC257", patch_alc269),

	HDA_CODEC_ENTRY(0x10ec0260, "ALC260", patch_alc260),

	HDA_CODEC_ENTRY(0x10ec0262, "ALC262", patch_alc262),

	HDA_CODEC_ENTRY(0x10ec0267, "ALC267", patch_alc268),

sound/usb/mixer.c

+9 −4
Original line number Diff line number Diff line
@@ -204,6 +204,10 @@ static int snd_usb_copy_string_desc(struct mixer_build *state, 
				    int index, char *buf, int maxlen)

{

	int len = usb_string(state->chip->dev, index, buf, maxlen - 1);



	if (len < 0)

		return 0;



	buf[len] = 0;

	return len;

}
@@ -2174,12 +2178,13 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, 
	if (len)

		;

	else if (nameid)

		snd_usb_copy_string_desc(state, nameid, kctl->id.name,

		len = snd_usb_copy_string_desc(state, nameid, kctl->id.name,

					 sizeof(kctl->id.name));

	else {

	else

		len = get_term_name(state, &state->oterm,

				    kctl->id.name, sizeof(kctl->id.name), 0);

		if (!len)



	if (!len) {

		strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name));



		if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR)

CRA Git | Maintained and supported by SUSTech CRA and CCSE