1. 23 Aug, 2024 1 commit
    • Hans de Goede's avatar
      ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder · 0cc65482
      Hans de Goede authored
      Since commit 13f58267 ("ASoC: soc.h: don't create dummy Component
      via COMP_DUMMY()") dummy codecs declared like this:
      
      SND_SOC_DAILINK_DEF(dummy,
              DAILINK_COMP_ARRAY(COMP_DUMMY()));
      
      expand to:
      
      static struct snd_soc_dai_link_component dummy[] = {
      };
      
      Which means that dummy is a zero sized array and thus dais[i].codecs should
      not be dereferenced *at all* since it points to the address of the next
      variable stored in the data section as the "dummy" variable has an address
      but no size, so even dereferencing dais[0] is already an out of bounds
      array reference.
      
      Which means that the if (dais[i].codecs->name) check added in
      commit 7d99a70b ("ASoC: Intel: Boards: Fix NULL pointer deref
      in BYT/CHT boards") relies on that the part of the next variable which
      the name member maps to just happens to be NULL.
      
      Which apparently so far it usually is, except when it isn't
      and then it results in crashes like this one:
      
      [   28.795659] BUG: unable to handle page fault for address: 0000000000030011
      ...
      [   28.795780] Call Trace:
      [   28.795787]  <TASK>
      ...
      [   28.795862]  ? strcmp+0x18/0x40
      [   28.795872]  0xffffffffc150c605
      [   28.795887]  platform_probe+0x40/0xa0
      ...
      [   28.795979]  ? __pfx_init_module+0x10/0x10 [snd_soc_sst_bytcr_wm5102]
      
      Really fix things this time around by checking dais.num_codecs != 0.
      
      Fixes: 7d99a70b ("ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
      Reviewed-by: default avatarPierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
      Link: https://patch.msgid.link/20240823074217.14653-1-hdegoede@redhat.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
      0cc65482
  2. 22 Aug, 2024 2 commits
  3. 21 Aug, 2024 2 commits
  4. 16 Aug, 2024 1 commit
  5. 15 Aug, 2024 1 commit
  6. 14 Aug, 2024 2 commits
  7. 13 Aug, 2024 4 commits
  8. 08 Aug, 2024 11 commits
  9. 07 Aug, 2024 2 commits
  10. 06 Aug, 2024 1 commit
    • Mark Brown's avatar
      ASoC: Extend wm_adsp so cs35l56 can suppress controls · a44b7b57
      Mark Brown authored
      Merge series from Simon Trimmer <simont@opensource.cirrus.com>:
      
      This pair of patches extend wm_adsp to add a callback that can be used
      to control whether ALSA controls are added and then tweak cs35l56 to use
      it to suppress controls made from firmware coefficients.
      a44b7b57
  11. 05 Aug, 2024 5 commits
  12. 02 Aug, 2024 4 commits
  13. 01 Aug, 2024 1 commit
  14. 31 Jul, 2024 1 commit
  15. 30 Jul, 2024 1 commit
    • Mark Brown's avatar
      ASoC: fsl_micfil: Check the difference for i.MX8 and · af441750
      Mark Brown authored
      Merge series from Shengjiu Wang <shengjiu.wang@nxp.com>:
      
      There are some register difference for i.MX8 and i.MX9
      REG_MICFIL_FIFO_CTRL definition is updated.
      REG_MICFIL_FSYNC_CTRL, REG_MICFIL_VERID, REG_MICFIL_PARAM are added from
      i.MX9.
      af441750
  16. 29 Jul, 2024 1 commit
    • Mark Brown's avatar
      ASoC: codecs: wcd93xx/wsa88xx: Correct Soundwire ports · e2d124de
      Mark Brown authored
      Merge series from Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>:
      
      Incorrect mask of Soundwire ports - one bit too long/big - was passed.
      
      Theoretically, too wide mask could cause an out of bounds read in
      sdw_get_slave_dpn_prop() in stream.c, however only in the case of buggy
      driver, e.g. adding incorrect number of ports via
      sdw_stream_add_slave().
      
      Not adding Cc-stable because I don't think the issue can lead to real
      out-of-bounds read.
      e2d124de