When a new timer instance is created and assigned to the active link
in snd_timer_open(), the caller still doesn't (can't) set its callback
and callback data.  In both the user-timer and the sequencer-timer
code, they do manually set up the callbacks after calling
snd_timer_open().  This has a potential risk of race when the timer
instance is added to the already running timer target, as the callback
might get triggered during setting up the callback itself.

This patch tries to address it by changing the API usage slightly:

- An empty timer instance is created at first via the new function
  snd_timer_instance_new().  This object isn't linked to the timer
  list yet.
- The caller sets up the callbacks and others stuff for the new timer
  instance.
- The caller invokes snd_timer_open() with this instance, so that it's
  linked to the target timer.

For closing, do similarly:

- Call snd_timer_close().  This unlinks the timer instance from the
  timer list.
- Free the timer instance via snd_timer_instance_free() after that.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20191107192008.32331-4-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The function doesn't return any useful value, so let's make it void to
be clearer.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20191107192008.32331-3-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The code in both snd_timer_check_master() and snd_timer_check_slave()
are almost identical, both check whether the master/slave link and
does linkage.  Factor out the common code and call it from both
functions for readability.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20191107192008.32331-2-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Merge 5.4-devel branch for applying the further ALSA timer fixes.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Merge tag 'asoc-v5.5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next

ASoC: Updates for v5.5

Some big changes in the core but more about cleanps and refactorings
than new features, plus a collection of new drivers and lots of small
fixes and improvements to existing ones.

 - Lots more cleanups from Morimoto-san.  Now that everything is a
   component this is mostly about refactorings to clarify and simplify
   the core, a combination of things that are no longer required due to
   refactorings and spotting similarities.
 - Many fixes to the Sound Open Firmware code.
 - Wake on voice support for Chromebooks.
 - SPI support for RT5677.
 - New drivers for Analog Devices ADAU7118, Intel Cannonlake systems
   with RT1011 and RT5682, Texas Instruments TAS2562 and TAS2770.

Merge tag 'asoc-fix-v5.4-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v5.4

These are a collection of fixes since v5.4-rc4 that have accumilated,
they're all driver specific and there's nothing major in here so it's
probably not essential to actually send them but I'll leave that call to
you.

When using the example SOF amp widget topology, KASAN dumps this
when the AMP bytes kcontrol gets loaded:

[ 9.579548] BUG: KASAN: slab-out-of-bounds in
sof_control_load+0x8cc/0xac0 [snd_sof]
[ 9.588194] Write of size 40 at addr ffff8882314559dc by task
systemd-udevd/2411

Fix that by rejecting the topology if the bytes data size > max_size

Fixes: 311ce4fe ("ASoC: SOF: Add support for loading topologies")
Reviewed-by: Jaska Uimonen <jaska.uimonen@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Dragos Tarcatu <dragos_tarcatu@mentor.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20191106145816.9367-1-pierre-louis.bossart@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

The clean up commit 41672c0c ("ALSA: timer: Simplify error path in
snd_timer_open()") unified the error handling code paths with the
standard goto, but it introduced a subtle bug: the timer instance is
stored in snd_timer_open() incorrectly even if it returns an error.
This may eventually lead to UAF, as spotted by fuzzer.

The culprit is the snd_timer_open() code checks the
SNDRV_TIMER_IFLG_EXCLUSIVE flag with the common variable timeri.
This variable is supposed to be the newly created instance, but we
(ab-)used it for a temporary check before the actual creation of a
timer instance.  After that point, there is another check for the max
number of instances, and it bails out if over the threshold.  Before
the refactoring above, it worked fine because the code returned
directly from that point.  After the refactoring, however, it jumps to
the unified error path that stores the timeri variable in return --
even if it returns an error.  Unfortunately this stored value is kept
in the caller side (snd_timer_user_tselect()) in tu->timeri.  This
causes inconsistency later, as if the timer was successfully
assigned.

In this patch, we fix it by not re-using timeri variable but a
temporary variable for testing the exclusive connection, so timeri
remains NULL at that point.

Fixes: 41672c0c ("ALSA: timer: Simplify error path in snd_timer_open()")
Reported-and-tested-by: Tristan Madani <tristmd@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191106165547.23518-1-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The fuzzer tries to open the timer instances as much as possible, and
this may cause a system hiccup easily.  We've already introduced the
cap for the max number of available instances for the h/w timers, and
we should put such a limit also to the slave timers, too.

This patch introduces the limit to the multiple opened slave timers.
The upper limit is hard-coded to 1000 for now, which should suffice
for any practical usages up to now.

Link: https://lore.kernel.org/r/20191106154257.5853-1-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Merge branch 'for-5.4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into asoc-5.5

snd_soc_unregister_component() is calling snd_soc_lookup_component()
under mutex_lock(). But, snd_soc_lookup_component() itself is using
mutex_lock(), thus it will be dead-lock.
This patch adds _nolocked version of it, and avoid dead-lock issue.

Fixes: ac6a4dd3("ASoC: soc-core: use snd_soc_lookup_component() at snd_soc_unregister_component()")
Reported-by: "kernelci.org bot" <bot@kernelci.org>"
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87bltph4da.wl-kuninori.morimoto.gx@renesas.comSigned-off-by: Mark Brown <broonie@kernel.org>

SOF module load/unload tests show nasty recurring warnings:

WARNING: CPU: 5 PID: 1339 at sound/core/control.c:466
snd_ctl_remove+0xf0/0x100 [snd]
RIP: 0010:snd_ctl_remove+0xf0/0x100 [snd]

This regression was introduced by the removal of the call to
soc_remove_link_components() before soc_card_free() is invoked.

Go back to the initial order but only call
soc_remove_link_components() once.
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Fixes: 5a4c9f05 ("ASoC: soc-core: snd_soc_unbind_card() cleanup")
GitHub issue: https://github.com/thesofproject/linux/issues/1424Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20191106145801.9316-1-pierre-louis.bossart@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

When using the example SOF amp widget topology, KASAN dumps this
when the AMP bytes kcontrol gets loaded:

[ 9.579548] BUG: KASAN: slab-out-of-bounds in
sof_control_load+0x8cc/0xac0 [snd_sof]
[ 9.588194] Write of size 40 at addr ffff8882314559dc by task
systemd-udevd/2411

Fix that by rejecting the topology if the bytes data size > max_size

Fixes: 311ce4fe ("ASoC: SOF: Add support for loading topologies")
Reviewed-by: Jaska Uimonen <jaska.uimonen@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Dragos Tarcatu <dragos_tarcatu@mentor.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20191106145816.9367-1-pierre-louis.bossart@linux.intel.comSigned-off-by: Mark Brown <broonie@kernel.org>

The macro will be removed soon later, so update the documentation to
reflect that as well.

Link: https://lore.kernel.org/r/20191105151856.10785-25-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Pass the device pointer from the PCI pointer directly, instead of a
non-standard macro.  The macro didn't give any better readability.

Link: https://lore.kernel.org/r/20191105151856.10785-24-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Pass the device pointer from the PCI pointer directly, instead of a
non-standard macro.  The macro didn't give any better readability.

Along with it, drop the unnecessary assignment before the
snd_dma_alloc_pages() call and simplify by returning the error code
directly.

Link: https://lore.kernel.org/r/20191105151856.10785-23-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Pass the device pointer from the PCI pointer directly, instead of a
non-standard macro.  The macro didn't give any better readability.

Along with it, the unneeded assignment before snd_dma_alloc_pages*()
call is dropped.

Link: https://lore.kernel.org/r/20191105151856.10785-22-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Pass the device pointer from the PCI pointer directly, instead of a
non-standard macro.  The macro didn't give any better readability.

Also slightly refactor the code (drop the return value check from the
preallocation) as it never returns an error.

Link: https://lore.kernel.org/r/20191105151856.10785-21-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Pass the device pointer from the PCI pointer directly, instead of a
non-standard macro.  The macro didn't give any better readability.

Link: https://lore.kernel.org/r/20191105151856.10785-20-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

snd_pcm_sgbuf_ops_page is no longer needed to be set explicitly to PCM
page ops since the recent change in the PCM core (*).  Leaving it NULL
should work as long as the preallocation has been done properly.

This patch drops the redundant lines.

(*) 7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Link: https://lore.kernel.org/r/20191105151856.10785-19-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Link: https://lore.kernel.org/r/20191105151856.10785-18-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Since the driver requires the DMA32 allocation, it passes the
specially encoded device to snd_pcm_lib_preallocate_pages().

Link: https://lore.kernel.org/r/20191105151856.10785-17-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Since the driver requires the DMA32 allocation, it passes the
specially encoded device to snd_pcm_lib_preallocate_pages().

Link: https://lore.kernel.org/r/20191105151856.10785-16-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Link: https://lore.kernel.org/r/20191105151856.10785-15-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Link: https://lore.kernel.org/r/20191105151856.10785-14-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Link: https://lore.kernel.org/r/20191105151856.10785-13-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Link: https://lore.kernel.org/r/20191105151856.10785-12-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Link: https://lore.kernel.org/r/20191105151856.10785-11-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page
                  mapping in the default mmap handler

Link: https://lore.kernel.org/r/20191105151856.10785-10-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (*) in the ALSA memalloc core allows us to drop the
special vmalloc-specific allocation and page handling.  This patch
coverts to the common code.
(*) 1fe7f397: ALSA: memalloc: Add vmalloc buffer allocation
                  support
    7e8edae3: ALSA: pcm: Handle special page mapping in the
                  default mmap handler

Also, since the SG-buffer-specific PCM ops becomes identical with the
normal PCM ops, unify them again to the single ops, too.

Link: https://lore.kernel.org/r/20191105151856.10785-9-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

A few error handling code was forgotten where it never reaches.
Drop it.

Link: https://lore.kernel.org/r/20191105151856.10785-8-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (commit 08422d2c: "ALSA: memalloc: Allow NULL
device for SNDRV_DMA_TYPE_CONTINUOUS type") made the PCM preallocation
helper accepting NULL as the device pointer for the default usage.
Drop the snd_dma_continuous_data() usage that became superfluous from
the callers.

Link: https://lore.kernel.org/r/20191105151856.10785-7-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (commit 08422d2c: "ALSA: memalloc: Allow NULL
device for SNDRV_DMA_TYPE_CONTINUOUS type") made the PCM preallocation
helper accepting NULL as the device pointer for the default usage.
Drop the snd_dma_continuous_data() usage that became superfluous from
the callers.

Link: https://lore.kernel.org/r/20191105151856.10785-6-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (commit 08422d2c: "ALSA: memalloc: Allow NULL
device for SNDRV_DMA_TYPE_CONTINUOUS type") made the PCM preallocation
helper accepting NULL as the device pointer for the default usage.
Drop the snd_dma_continuous_data() usage that became superfluous from
the callers.

Link: https://lore.kernel.org/r/20191105151856.10785-5-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (commit 08422d2c: "ALSA: memalloc: Allow NULL
device for SNDRV_DMA_TYPE_CONTINUOUS type") made the PCM preallocation
helper accepting NULL as the device pointer for the default usage.
Drop the snd_dma_continuous_data() usage that became superfluous from
the callers.

Link: https://lore.kernel.org/r/20191105151856.10785-4-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (commit 08422d2c: "ALSA: memalloc: Allow NULL
device for SNDRV_DMA_TYPE_CONTINUOUS type") made the PCM preallocation
helper accepting NULL as the device pointer for the default usage.
Drop the snd_dma_continuous_data() usage that became superfluous from
the callers.

Link: https://lore.kernel.org/r/20191105151856.10785-3-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent change (commit 08422d2c: "ALSA: memalloc: Allow NULL
device for SNDRV_DMA_TYPE_CONTINUOUS type") made the PCM preallocation
helper accepting NULL as the device pointer for the default usage.
Drop the snd_dma_continuous_data() usage that became superfluous from
the callers.

Link: https://lore.kernel.org/r/20191105151856.10785-2-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

It makes little sense to create prealloc proc files for streams that
have the zero max size, which is a typical case for vmalloc buffers.
Skip the proc file creations to save resources in such a case.

Link: https://lore.kernel.org/r/20191105191007.18150-3-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

Warn if snd_pcm_lib_preallocate_pages*() is applied to the stream that
has already the preallocated buffers and skip the allocation.  It's a
clearly a driver bug.

Link: https://lore.kernel.org/r/20191105191007.18150-2-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>

The recent changes simplified the required setup for SG- and vmalloc-
buffers.  Update the documentation accordingly.

Link: https://lore.kernel.org/r/20191105080138.1260-5-tiwai@suse.deSigned-off-by: Takashi Iwai <tiwai@suse.de>