3.18-stable patches

added patches:
	alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch
	alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch
	alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch

diff --git a/queue-3.18/alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch b/queue-3.18/alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch
new file mode 100644 (file)
index 0000000..c6e8003
--- /dev/null
+++ b/queue-3.18/alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch
@@ -0,0 +1,41 @@
+From 7194eda1ba0872d917faf3b322540b4f57f11ba5 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 23 Nov 2018 15:44:00 +0100
+Subject: ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 7194eda1ba0872d917faf3b322540b4f57f11ba5 upstream.
+
+The function snd_ac97_put_spsa() gets the bit shift value from the
+associated private_value, but it extracts too much; the current code
+extracts 8 bit values in bits 8-15, but this is a combination of two
+nibbles (bits 8-11 and bits 12-15) for left and right shifts.
+Due to the incorrect bits extraction, the actual shift may go beyond
+the 32bit value, as spotted recently by UBSAN check:
+ UBSAN: Undefined behaviour in sound/pci/ac97/ac97_codec.c:836:7
+ shift exponent 68 is too large for 32-bit type 'int'
+
+This patch fixes the shift value extraction by masking the properly
+with 0x0f instead of 0xff.
+
+Reported-and-tested-by: Meelis Roos <mroos@linux.ee>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/ac97/ac97_codec.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -829,7 +829,7 @@ static int snd_ac97_put_spsa(struct snd_
+ {
+       struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
+       int reg = kcontrol->private_value & 0xff;
+-      int shift = (kcontrol->private_value >> 8) & 0xff;
++      int shift = (kcontrol->private_value >> 8) & 0x0f;
+       int mask = (kcontrol->private_value >> 16) & 0xff;
+       // int invert = (kcontrol->private_value >> 24) & 0xff;
+       unsigned short value, old, new;

diff --git a/queue-3.18/alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch b/queue-3.18/alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch
new file mode 100644 (file)
index 0000000..4ecee9b
--- /dev/null
+++ b/queue-3.18/alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch
@@ -0,0 +1,51 @@
+From 9a20332ab373b1f8f947e0a9c923652b32dab031 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 23 Nov 2018 18:18:30 +0100
+Subject: ALSA: sparc: Fix invalid snd_free_pages() at error path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 9a20332ab373b1f8f947e0a9c923652b32dab031 upstream.
+
+Some spurious calls of snd_free_pages() have been overlooked and
+remain in the error paths of sparc cs4231 driver code.  Since
+runtime->dma_area is managed by the PCM core helper, we shouldn't
+release manually.
+
+Drop the superfluous calls.
+
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/sparc/cs4231.c |    8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/sound/sparc/cs4231.c
++++ b/sound/sparc/cs4231.c
+@@ -1146,10 +1146,8 @@ static int snd_cs4231_playback_open(stru
+       runtime->hw = snd_cs4231_playback;
+ 
+       err = snd_cs4231_open(chip, CS4231_MODE_PLAY);
+-      if (err < 0) {
+-              snd_free_pages(runtime->dma_area, runtime->dma_bytes);
++      if (err < 0)
+               return err;
+-      }
+       chip->playback_substream = substream;
+       chip->p_periods_sent = 0;
+       snd_pcm_set_sync(substream);
+@@ -1167,10 +1165,8 @@ static int snd_cs4231_capture_open(struc
+       runtime->hw = snd_cs4231_capture;
+ 
+       err = snd_cs4231_open(chip, CS4231_MODE_RECORD);
+-      if (err < 0) {
+-              snd_free_pages(runtime->dma_area, runtime->dma_bytes);
++      if (err < 0)
+               return err;
+-      }
+       chip->capture_substream = substream;
+       chip->c_periods_sent = 0;
+       snd_pcm_set_sync(substream);

diff --git a/queue-3.18/alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch b/queue-3.18/alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch
new file mode 100644 (file)
index 0000000..6083a63
--- /dev/null
+++ b/queue-3.18/alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch
@@ -0,0 +1,42 @@
+From 7b69154171b407844c273ab4c10b5f0ddcd6aa29 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 23 Nov 2018 18:16:33 +0100
+Subject: ALSA: wss: Fix invalid snd_free_pages() at error path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 7b69154171b407844c273ab4c10b5f0ddcd6aa29 upstream.
+
+Some spurious calls of snd_free_pages() have been overlooked and
+remain in the error paths of wss driver code.  Since runtime->dma_area
+is managed by the PCM core helper, we shouldn't release manually.
+
+Drop the superfluous calls.
+
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/isa/wss/wss_lib.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/sound/isa/wss/wss_lib.c
++++ b/sound/isa/wss/wss_lib.c
+@@ -1531,7 +1531,6 @@ static int snd_wss_playback_open(struct
+       if (err < 0) {
+               if (chip->release_dma)
+                       chip->release_dma(chip, chip->dma_private_data, chip->dma1);
+-              snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+               return err;
+       }
+       chip->playback_substream = substream;
+@@ -1572,7 +1571,6 @@ static int snd_wss_capture_open(struct s
+       if (err < 0) {
+               if (chip->release_dma)
+                       chip->release_dma(chip, chip->dma_private_data, chip->dma2);
+-              snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+               return err;
+       }
+       chip->capture_substream = substream;

diff --git a/queue-3.18/series b/queue-3.18/series
index 4142323930b33cb47d2d55569bb9cd071f87edd9..4733b735d607644941d2b8ce65c5951e8a63c8ae 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -2,3 +2,6 @@ revert-wlcore-add-missing-pm-call-for-wlcore_cmd_wai.patch
 rapidio-rionet-do-not-free-skb-before-reading-its-length.patch
 s390-qeth-fix-length-check-in-snmp-processing.patch
 usbnet-ipheth-fix-potential-recvmsg-bug-and-recvmsg-bug-2.patch
+alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch
+alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch
+alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch