The UAC3 clock parser codes lack of the sanity checks for malformed
descriptors like UAC2 parser does.  Without it, the driver may lead to
a potential crash.

Fixes: 9a2fe9b8 ("ALSA: usb: initial USB Audio Device Class 3.0 support")
Tested-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Reviewed-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The sanity checks introduced for malformed descriptors loosely check
the given descriptor size, although the size greater than the defined
description is invalid.  It was due to a concern of any funky firmware
in the actual products.  But this doesn't look hitting, and any sane
products must have the defined descriptors.

So in this patch, we make the validators more strict, allowing only
with the defined descriptor sizes.  The value in clock selector
validator is corrected from 5 to 7 to count the two unlisted fields
after baCSourceID[].
Suggested-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Reviewed-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

There are lots of open-coded functions to find a clock source,
selector and multiplier.  Now there are both v2 and v3, so six
variants.

This patch refactors the code to use a common helper for the main
loop, and define each validator function for each target.
There is no functional change.

Fixes: 9a2fe9b8 ("ALSA: usb: initial USB Audio Device Class 3.0 support")
Reviewed-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The PCM runtime object is created and freed dynamically at PCM stream
open / close time.  This is tracked via substream->runtime, and it's
cleared at snd_pcm_detach_substream().

The runtime object assignment is protected by PCM open_mutex, so for
all PCM operations, it's safely handled.  However, each PCM substream
provides also an ALSA timer interface, and user-space can access to
this while closing a PCM substream.  This may eventually lead to a
UAF, as snd_pcm_timer_resolution() tries to access the runtime while
clearing it in other side.

Fortunately, it's the only concurrent access from the PCM timer, and
it merely reads runtime->timer_resolution field.  So, we can avoid the
race by reordering kfree() and wrapping the substream->runtime
clearance with the corresponding timer lock.

Reported-by: syzbot+8e62ff4e07aa2ce87826@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Merge tag 'asoc-v4.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Updates for v4.17

This is a *very* big release for ASoC.  Not much change in the core but
there s the transition of all the individual drivers over to components
which is intended to support further core work.  The goal is to make it
easier to do further core work by removing the need to special case all
the different driver classes in the core, many of the devices end up
being used in multiple roles in modern systems.

We also have quite a lot of new drivers added this month of all kinds,
quite a few for simple devices but also some more advanced ones with
more substantial code.

 - The biggest thing is the huge series from Morimoto-san which
   converted everything over to components.  This is a huge change by
   code volume but was fairly mechanical
 - Many fixes for some of the Realtek based Baytrail systems covering
   both the CODECs and the CPUs, contributed by Hans de Goode.
 - Lots of cleanups for Samsung based Odroid systems from Sylwester
   Nawrocki.
 - The Freescale SSI driver also got a lot of cleanups from Nicolin
   Chen.
 - The Blackfin drivers have been removed as part of the removal of the
   architecture.
 - New drivers for AKM AK4458 and AK5558, several AMD based machines,
   several Intel based machines, Maxim MAX9759, Motorola CPCAP,
   Socionext Uniphier SoCs, and TI PCM1789 and TDA7419

Preparation for 4.17 merge.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

We recently made "format" a u64 variable so now static checkers complain
that this shift will wrap around if format is more than 31.  I don't
think it makes a difference for runtime, but it's simple to silence the
warning.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Merge remote-tracking branches 'asoc/topic/wm9090', 'asoc/topic/wm9712', 'asoc/topic/wm9713' and 'asoc/topic/wm_adsp' into asoc-next

Merge remote-tracking branches 'asoc/topic/wm8991', 'asoc/topic/wm8994', 'asoc/topic/wm8995', 'asoc/topic/wm8996' and 'asoc/topic/wm9081' into asoc-next

Merge remote-tracking branches 'asoc/topic/wm8978', 'asoc/topic/wm8983', 'asoc/topic/wm8985', 'asoc/topic/wm8988' and 'asoc/topic/wm8990' into asoc-next

Merge remote-tracking branches 'asoc/topic/wm8960', 'asoc/topic/wm8961', 'asoc/topic/wm8962', 'asoc/topic/wm8971' and 'asoc/topic/wm8974' into asoc-next

Merge remote-tracking branches 'asoc/topic/wm8900', 'asoc/topic/wm8903', 'asoc/topic/wm8904', 'asoc/topic/wm8940' and 'asoc/topic/wm8955' into asoc-next

Merge remote-tracking branches 'asoc/topic/wm8753', 'asoc/topic/wm8770', 'asoc/topic/wm8776', 'asoc/topic/wm8782' and 'asoc/topic/wm8804' into asoc-next

Merge remote-tracking branches 'asoc/topic/wm8728', 'asoc/topic/wm8731', 'asoc/topic/wm8737', 'asoc/topic/wm8741' and 'asoc/topic/wm8750' into asoc-next

Merge remote-tracking branches 'asoc/topic/wm8523', 'asoc/topic/wm8524', 'asoc/topic/wm8580', 'asoc/topic/wm8711' and 'asoc/topic/wm8727' into asoc-next

Merge remote-tracking branches 'asoc/topic/wm2200', 'asoc/topic/wm5100', 'asoc/topic/wm8350', 'asoc/topic/wm8400' and 'asoc/topic/wm8510' into asoc-next

Merge remote-tracking branches 'asoc/topic/vc4_hdmi', 'asoc/topic/wl1273', 'asoc/topic/wm0010', 'asoc/topic/wm1250-ev1' and 'asoc/topic/wm2000' into asoc-next

Merge remote-tracking branches 'asoc/topic/twl4030', 'asoc/topic/twl6040', 'asoc/topic/uda134x', 'asoc/topic/uda1380' and 'asoc/topic/uniphier' into asoc-next

Merge remote-tracking branches 'asoc/topic/tlv320aic32x4', 'asoc/topic/tlv320aic3x', 'asoc/topic/tlv320dac33', 'asoc/topic/topology' and 'asoc/topic/tscs42xx' into asoc-next

Merge remote-tracking branches 'asoc/topic/tda7419', 'asoc/topic/tfa9879', 'asoc/topic/tlv320aic23', 'asoc/topic/tlv320aic26' and 'asoc/topic/tlv320aic31xx' into asoc-next

Merge remote-tracking branches 'asoc/topic/tas2552', 'asoc/topic/tas5086', 'asoc/topic/tas571x', 'asoc/topic/tas5720' and 'asoc/topic/tas6424' into asoc-next

Merge remote-tracking branches 'asoc/topic/sta529', 'asoc/topic/sti-sas', 'asoc/topic/stm32', 'asoc/topic/sun4i' and 'asoc/topic/sun8i' into asoc-next

Merge remote-tracking branches 'asoc/topic/ssm2518', 'asoc/topic/ssm2602', 'asoc/topic/ssm4567', 'asoc/topic/sta32x' and 'asoc/topic/sta350' into asoc-next

Merge remote-tracking branches 'asoc/topic/sirf-audio', 'asoc/topic/sn95031', 'asoc/topic/soc-dapm', 'asoc/topic/spdif_receiver' and 'asoc/topic/spdif_transmitter' into asoc-next

Merge remote-tracking branches 'asoc/topic/rt5670', 'asoc/topic/sgtl5000', 'asoc/topic/si476x' and 'asoc/topic/sirf' into asoc-next

Merge remote-tracking branches 'asoc/topic/rt5645', 'asoc/topic/rt5651', 'asoc/topic/rt5659' and 'asoc/topic/rt5660' into asoc-next

Merge remote-tracking branches 'asoc/topic/rt298', 'asoc/topic/rt5514', 'asoc/topic/rt5616', 'asoc/topic/rt5631' and 'asoc/topic/rt5640' into asoc-next

Merge remote-tracking branches 'asoc/topic/pistachio', 'asoc/topic/pxa', 'asoc/topic/rsnd', 'asoc/topic/rt274' and 'asoc/topic/rt286' into asoc-next

Merge remote-tracking branches 'asoc/topic/msm8916-wcd-digital', 'asoc/topic/mtk', 'asoc/topic/nau8540', 'asoc/topic/nau8810' and 'asoc/topic/nau8824' into asoc-next

Merge remote-tracking branches 'asoc/topic/max98927', 'asoc/topic/mc13783', 'asoc/topic/mediatek', 'asoc/topic/ml26124' and 'asoc/topic/msm8916-wcd-analog' into asoc-next

Merge remote-tracking branches 'asoc/topic/max9850', 'asoc/topic/max9860', 'asoc/topic/max9867', 'asoc/topic/max98925' and 'asoc/topic/max98926' into asoc-next

Merge remote-tracking branches 'asoc/topic/max98090', 'asoc/topic/max98095', 'asoc/topic/max98357a', 'asoc/topic/max98371' and 'asoc/topic/max98373' into asoc-next

Merge remote-tracking branches 'asoc/topic/isabelle', 'asoc/topic/jz4740', 'asoc/topic/lm49453', 'asoc/topic/max9759' and 'asoc/topic/max98088' into asoc-next

Merge remote-tracking branches 'asoc/topic/hdmi-codec', 'asoc/topic/ics43432', 'asoc/topic/imx-wm8962' and 'asoc/topic/inno_rk3036' into asoc-next

Merge remote-tracking branches 'asoc/topic/fsl_esai', 'asoc/topic/fsl_ssi', 'asoc/topic/fsl_utils', 'asoc/topic/generic-dmaengine' and 'asoc/topic/gtm601' into asoc-next

Merge remote-tracking branches 'asoc/topic/dwc', 'asoc/topic/es7134', 'asoc/topic/es8316', 'asoc/topic/es8328' and 'asoc/topic/fsl' into asoc-next

Merge remote-tracking branches 'asoc/topic/da7219', 'asoc/topic/da732x', 'asoc/topic/da9055' and 'asoc/topic/dmic' into asoc-next

Merge remote-tracking branches 'asoc/topic/cx20442', 'asoc/topic/cygnus', 'asoc/topic/da7210', 'asoc/topic/da7213' and 'asoc/topic/da7218' into asoc-next

Merge remote-tracking branches 'asoc/topic/cs42l73', 'asoc/topic/cs42xx8', 'asoc/topic/cs43130', 'asoc/topic/cs4349' and 'asoc/topic/cs53l30' into asoc-next