1. 14 Mar, 2023 2 commits
    • Kuninori Morimoto's avatar
      ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() · 98e5eb11
      Kuninori Morimoto authored
      tuning_ctl_set() might have buffer overrun at (X) if it didn't break
      from loop by matching (A).
      
      	static int tuning_ctl_set(...)
      	{
      		for (i = 0; i < TUNING_CTLS_COUNT; i++)
      (A)			if (nid == ca0132_tuning_ctls[i].nid)
      				break;
      
      		snd_hda_power_up(...);
      (X)		dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...);
      		snd_hda_power_down(...);                ^
      
      		return 1;
      	}
      
      We will get below error by cppcheck
      
      	sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12
      	 for (i = 0; i < TUNING_CTLS_COUNT; i++)
      	 ^
      	sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds
      	 dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
      	                                           ^
      This patch cares non match case.
      Signed-off-by: default avatarKuninori Morimoto <kuninori.morimoto.gx@renesas.com>
      Link: https://lore.kernel.org/r/87sfe9eap7.wl-kuninori.morimoto.gx@renesas.comSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      98e5eb11
    • Kuninori Morimoto's avatar
      ALSA: asihpi: check pao in control_message() · 9026c0bf
      Kuninori Morimoto authored
      control_message() might be called with pao = NULL.
      Here indicates control_message() as sample.
      
      (B)	static void control_message(struct hpi_adapter_obj *pao, ...)
      	{                                                   ^^^
      		struct hpi_hw_obj *phw = pao->priv;
      		...                      ^^^
      	}
      
      (A)	void _HPI_6205(struct hpi_adapter_obj *pao, ...)
      	{                                      ^^^
      		...
      		case HPI_OBJ_CONTROL:
      (B)			control_message(pao, phm, phr);
      			break;          ^^^
      		...
      	}
      
      	void HPI_6205(...)
      	{
      		...
      (A)		_HPI_6205(NULL, phm, phr);
      		...       ^^^^
      	}
      
      Therefore, We will get too many warning via cppcheck, like below
      
      	sound/pci/asihpi/hpi6205.c:238:27: warning: Possible null pointer dereference: pao [nullPointer]
      		 struct hpi_hw_obj *phw = pao->priv;
      		                          ^
      	sound/pci/asihpi/hpi6205.c:433:13: note: Calling function '_HPI_6205', 1st argument 'NULL' value is 0
      		  _HPI_6205(NULL, phm, phr);
      		            ^
      	sound/pci/asihpi/hpi6205.c:401:20: note: Calling function 'control_message', 1st argument 'pao' value is 0
      	   control_message(pao, phm, phr);
      	                   ^
      Set phr->error like many functions doing, and don't call _HPI_6205()
      with NULL.
      Signed-off-by: default avatarKuninori Morimoto <kuninori.morimoto.gx@renesas.com>
      Link: https://lore.kernel.org/r/87ttypeaqz.wl-kuninori.morimoto.gx@renesas.comSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
      9026c0bf
  2. 10 Mar, 2023 1 commit
  3. 09 Mar, 2023 1 commit
  4. 08 Mar, 2023 5 commits
  5. 07 Mar, 2023 16 commits
  6. 06 Mar, 2023 6 commits
  7. 05 Mar, 2023 9 commits
    • Ravulapati Vishnu Vardhan Rao's avatar
      ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds · e5e7e398
      Ravulapati Vishnu Vardhan Rao authored
      When we run syzkaller we get below Out of Bound.
          "KASAN: slab-out-of-bounds Read in regcache_flat_read"
      
          Below is the backtrace of the issue:
      
          dump_backtrace+0x0/0x4c8
          show_stack+0x34/0x44
          dump_stack_lvl+0xd8/0x118
          print_address_description+0x30/0x2d8
          kasan_report+0x158/0x198
          __asan_report_load4_noabort+0x44/0x50
          regcache_flat_read+0x10c/0x110
          regcache_read+0xf4/0x180
          _regmap_read+0xc4/0x278
          _regmap_update_bits+0x130/0x290
          regmap_update_bits_base+0xc0/0x15c
          snd_soc_component_update_bits+0xa8/0x22c
          snd_soc_component_write_field+0x68/0xd4
          tx_macro_digital_mute+0xec/0x140
      
          Actually There is no need to have decimator with 32 bits.
          By limiting the variable with short type u8 issue is resolved.
      Signed-off-by: default avatarRavulapati Vishnu Vardhan Rao <quic_visr@quicinc.com>
      Link: https://lore.kernel.org/r/20230304080702.609-1-quic_visr@quicinc.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      e5e7e398
    • Krzysztof Kozlowski's avatar
      ASoC: qcom: q6prm: fix incorrect clk_root passed to ADSP · 65882134
      Krzysztof Kozlowski authored
      The second to last argument is clk_root (root of the clock), however the
      code called q6prm_request_lpass_clock() with clk_attr instead
      (copy-paste error).  This effectively was passing value of 1 as root
      clock which worked on some of the SoCs (e.g. SM8450) but fails on
      others, depending on the ADSP.  For example on SM8550 this "1" as root
      clock is not accepted and results in errors coming from ADSP.
      
      Fixes: 2f206404 ("ASoC: qdsp6: qdsp6: q6prm: handle clk disable correctly")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
      Reviewed-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
      Tested-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
      Link: https://lore.kernel.org/r/20230302122908.221398-1-krzysztof.kozlowski@linaro.orgSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      65882134
    • Luca Ceresoli's avatar
      ASoC: clarify that SND_SOC_IMX_SGTL5000 is the old driver · 03d0f97f
      Luca Ceresoli authored
      Both SND_SOC_IMX_SGTL5000 and SND_SOC_FSL_ASOC_CARD implement the
      fsl,imx-audio-sgtl5000 compatible string, which is confusing. It took a
      little research to find out that the latter is much newer and it is
      supposed to be the preferred choice since several years.
      
      Add a clarification note to avoid wasting time for future readers.
      Signed-off-by: default avatarLuca Ceresoli <luca.ceresoli@bootlin.com>
      Link: https://lore.kernel.org/r/20230303093410.357621-1-luca.ceresoli@bootlin.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      03d0f97f
    • Linus Torvalds's avatar
      Linux 6.3-rc1 · fe15c26e
      Linus Torvalds authored
      fe15c26e
    • Linus Torvalds's avatar
      cpumask: re-introduce constant-sized cpumask optimizations · 596ff4a0
      Linus Torvalds authored
      Commit aa47a7c2 ("lib/cpumask: deprecate nr_cpumask_bits") resulted
      in the cpumask operations potentially becoming hugely less efficient,
      because suddenly the cpumask was always considered to be variable-sized.
      
      The optimization was then later added back in a limited form by commit
      6f9c07be ("lib/cpumask: add FORCE_NR_CPUS config option"), but that
      FORCE_NR_CPUS option is not useful in a generic kernel and more of a
      special case for embedded situations with fixed hardware.
      
      Instead, just re-introduce the optimization, with some changes.
      
      Instead of depending on CPUMASK_OFFSTACK being false, and then always
      using the full constant cpumask width, this introduces three different
      cpumask "sizes":
      
       - the exact size (nr_cpumask_bits) remains identical to nr_cpu_ids.
      
         This is used for situations where we should use the exact size.
      
       - the "small" size (small_cpumask_bits) is the NR_CPUS constant if it
         fits in a single word and the bitmap operations thus end up able
         to trigger the "small_const_nbits()" optimizations.
      
         This is used for the operations that have optimized single-word
         cases that get inlined, notably the bit find and scanning functions.
      
       - the "large" size (large_cpumask_bits) is the NR_CPUS constant if it
         is an sufficiently small constant that makes simple "copy" and
         "clear" operations more efficient.
      
         This is arbitrarily set at four words or less.
      
      As a an example of this situation, without this fixed size optimization,
      cpumask_clear() will generate code like
      
              movl    nr_cpu_ids(%rip), %edx
              addq    $63, %rdx
              shrq    $3, %rdx
              andl    $-8, %edx
              callq   memset@PLT
      
      on x86-64, because it would calculate the "exact" number of longwords
      that need to be cleared.
      
      In contrast, with this patch, using a MAX_CPU of 64 (which is quite a
      reasonable value to use), the above becomes a single
      
      	movq $0,cpumask
      
      instruction instead, because instead of caring to figure out exactly how
      many CPU's the system has, it just knows that the cpumask will be a
      single word and can just clear it all.
      
      Note that this does end up tightening the rules a bit from the original
      version in another way: operations that set bits in the cpumask are now
      limited to the actual nr_cpu_ids limit, whereas we used to do the
      nr_cpumask_bits thing almost everywhere in the cpumask code.
      
      But if you just clear bits, or scan for bits, we can use the simpler
      compile-time constants.
      
      In the process, remove 'cpumask_complement()' and 'for_each_cpu_not()'
      which were not useful, and which fundamentally have to be limited to
      'nr_cpu_ids'.  Better remove them now than have somebody introduce use
      of them later.
      
      Of course, on x86-64 with MAXSMP there is no sane small compile-time
      constant for the cpumask sizes, and we end up using the actual CPU bits,
      and will generate the above kind of horrors regardless.  Please don't
      use MAXSMP unless you really expect to have machines with thousands of
      cores.
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      596ff4a0
    • Linus Torvalds's avatar
      Merge tag 'v6.3-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · f915322f
      Linus Torvalds authored
      Pull crypto fix from Herbert Xu:
       "Fix a regression in the caam driver"
      
      * tag 'v6.3-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: caam - Fix edesc/iv ordering mixup
      f915322f
    • Linus Torvalds's avatar
      Merge tag 'x86-urgent-2023-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 7f9ec7d8
      Linus Torvalds authored
      Pull x86 updates from Thomas Gleixner:
       "A small set of updates for x86:
      
         - Return -EIO instead of success when the certificate buffer for SEV
           guests is not large enough
      
         - Allow STIPB to be enabled with legacy IBSR. Legacy IBRS is cleared
           on return to userspace for performance reasons, but the leaves user
           space vulnerable to cross-thread attacks which STIBP prevents.
           Update the documentation accordingly"
      
      * tag 'x86-urgent-2023-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        virt/sev-guest: Return -EIO if certificate buffer is not large enough
        Documentation/hw-vuln: Document the interaction between IBRS and STIBP
        x86/speculation: Allow enabling STIBP with legacy IBRS
      7f9ec7d8
    • Linus Torvalds's avatar
      Merge tag 'irq-urgent-2023-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 4e9c542c
      Linus Torvalds authored
      Pull irq updates from Thomas Gleixner:
       "A set of updates for the interrupt susbsystem:
      
         - Prevent possible NULL pointer derefences in
           irq_data_get_affinity_mask() and irq_domain_create_hierarchy()
      
         - Take the per device MSI lock before invoking code which relies on
           it being hold
      
         - Make sure that MSI descriptors are unreferenced before freeing
           them. This was overlooked when the platform MSI code was converted
           to use core infrastructure and results in a fals positive warning
      
         - Remove dead code in the MSI subsystem
      
         - Clarify the documentation for pci_msix_free_irq()
      
         - More kobj_type constification"
      
      * tag 'irq-urgent-2023-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced
        genirq/msi: Drop dead domain name assignment
        irqdomain: Add missing NULL pointer check in irq_domain_create_hierarchy()
        genirq/irqdesc: Make kobj_type structures constant
        PCI/MSI: Clarify usage of pci_msix_free_irq()
        genirq/msi: Take the per-device MSI lock before validating the control structure
        genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
      4e9c542c
    • Linus Torvalds's avatar
      Merge tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · 1a90673e
      Linus Torvalds authored
      Pull vfs update from Al Viro:
       "Adding Christian Brauner as VFS co-maintainer"
      
      * tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        Adding VFS co-maintainer
      1a90673e