1. 23 Aug, 2024 3 commits
    • robelin's avatar
      ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object · b4a90b54
      robelin authored
      When using kernel with the following extra config,
      
        - CONFIG_KASAN=y
        - CONFIG_KASAN_GENERIC=y
        - CONFIG_KASAN_INLINE=y
        - CONFIG_KASAN_VMALLOC=y
        - CONFIG_FRAME_WARN=4096
      
      kernel detects that snd_pcm_suspend_all() access a freed
      'snd_soc_pcm_runtime' object when the system is suspended, which
      leads to a use-after-free bug:
      
      [   52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270
      [   52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330
      
      [   52.047785] Call trace:
      [   52.047787]  dump_backtrace+0x0/0x3c0
      [   52.047794]  show_stack+0x34/0x50
      [   52.047797]  dump_stack_lvl+0x68/0x8c
      [   52.047802]  print_address_description.constprop.0+0x74/0x2c0
      [   52.047809]  kasan_report+0x210/0x230
      [   52.047815]  __asan_report_load1_noabort+0x3c/0x50
      [   52.047820]  snd_pcm_suspend_all+0x1a8/0x270
      [   52.047824]  snd_soc_suspend+0x19c/0x4e0
      
      The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before
      making any access. So we need to always set 'substream->runtime' to NULL
      everytime we kfree() it.
      
      Fixes: a72706ed ("ASoC: codec2codec: remove ephemeral variables")
      Signed-off-by: default avatarrobelin <robelin@nvidia.com>
      Signed-off-by: default avatarSameer Pujar <spujar@nvidia.com>
      Link: https://patch.msgid.link/20240823144342.4123814-2-spujar@nvidia.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      b4a90b54
    • Hans de Goede's avatar
      ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict · 839a4ec0
      Hans de Goede authored
      There are 2G and 4G RAM versions of the Lenovo Yoga Tab 3 X90F and it
      turns out that the 2G version has a DMI product name of
      "CHERRYVIEW D1 PLATFORM" where as the 4G version has
      "CHERRYVIEW C0 PLATFORM". The sys-vendor + product-version check are
      unique enough that the product-name check is not necessary.
      
      Drop the product-name check so that the existing DMI match for the 4G
      RAM version also matches the 2G RAM version.
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Reviewed-by: default avatarPierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
      Link: https://patch.msgid.link/20240823074305.16873-1-hdegoede@redhat.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      839a4ec0
    • Hans de Goede's avatar
      ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder · 0cc65482
      Hans de Goede authored
      Since commit 13f58267 ("ASoC: soc.h: don't create dummy Component
      via COMP_DUMMY()") dummy codecs declared like this:
      
      SND_SOC_DAILINK_DEF(dummy,
              DAILINK_COMP_ARRAY(COMP_DUMMY()));
      
      expand to:
      
      static struct snd_soc_dai_link_component dummy[] = {
      };
      
      Which means that dummy is a zero sized array and thus dais[i].codecs should
      not be dereferenced *at all* since it points to the address of the next
      variable stored in the data section as the "dummy" variable has an address
      but no size, so even dereferencing dais[0] is already an out of bounds
      array reference.
      
      Which means that the if (dais[i].codecs->name) check added in
      commit 7d99a70b ("ASoC: Intel: Boards: Fix NULL pointer deref
      in BYT/CHT boards") relies on that the part of the next variable which
      the name member maps to just happens to be NULL.
      
      Which apparently so far it usually is, except when it isn't
      and then it results in crashes like this one:
      
      [   28.795659] BUG: unable to handle page fault for address: 0000000000030011
      ...
      [   28.795780] Call Trace:
      [   28.795787]  <TASK>
      ...
      [   28.795862]  ? strcmp+0x18/0x40
      [   28.795872]  0xffffffffc150c605
      [   28.795887]  platform_probe+0x40/0xa0
      ...
      [   28.795979]  ? __pfx_init_module+0x10/0x10 [snd_soc_sst_bytcr_wm5102]
      
      Really fix things this time around by checking dais.num_codecs != 0.
      
      Fixes: 7d99a70b ("ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Reviewed-by: default avatarPierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
      Link: https://patch.msgid.link/20240823074217.14653-1-hdegoede@redhat.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      0cc65482
  2. 22 Aug, 2024 2 commits
  3. 21 Aug, 2024 2 commits
  4. 16 Aug, 2024 1 commit
  5. 15 Aug, 2024 1 commit
  6. 14 Aug, 2024 2 commits
  7. 13 Aug, 2024 4 commits
  8. 08 Aug, 2024 11 commits
  9. 07 Aug, 2024 2 commits
  10. 06 Aug, 2024 1 commit
    • Mark Brown's avatar
      ASoC: Extend wm_adsp so cs35l56 can suppress controls · a44b7b57
      Mark Brown authored
      Merge series from Simon Trimmer <simont@opensource.cirrus.com>:
      
      This pair of patches extend wm_adsp to add a callback that can be used
      to control whether ALSA controls are added and then tweak cs35l56 to use
      it to suppress controls made from firmware coefficients.
      a44b7b57
  11. 05 Aug, 2024 5 commits
  12. 02 Aug, 2024 4 commits
  13. 01 Aug, 2024 1 commit
  14. 31 Jul, 2024 1 commit