From: Greg Kroah-Hartman Date: Mon, 3 Dec 2018 10:21:47 +0000 (+0100) Subject: 3.18-stable patches X-Git-Tag: v4.19.7~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=da2ab8483d255f2c39c39a83fcf1dbd9f2bf6141;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch --- diff --git a/queue-3.18/alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch b/queue-3.18/alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch new file mode 100644 index 00000000000..c6e8003237c --- /dev/null +++ b/queue-3.18/alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch @@ -0,0 +1,41 @@ +From 7194eda1ba0872d917faf3b322540b4f57f11ba5 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 23 Nov 2018 15:44:00 +0100 +Subject: ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write + +From: Takashi Iwai + +commit 7194eda1ba0872d917faf3b322540b4f57f11ba5 upstream. + +The function snd_ac97_put_spsa() gets the bit shift value from the +associated private_value, but it extracts too much; the current code +extracts 8 bit values in bits 8-15, but this is a combination of two +nibbles (bits 8-11 and bits 12-15) for left and right shifts. +Due to the incorrect bits extraction, the actual shift may go beyond +the 32bit value, as spotted recently by UBSAN check: + UBSAN: Undefined behaviour in sound/pci/ac97/ac97_codec.c:836:7 + shift exponent 68 is too large for 32-bit type 'int' + +This patch fixes the shift value extraction by masking the properly +with 0x0f instead of 0xff. + +Reported-and-tested-by: Meelis Roos +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ac97/ac97_codec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -829,7 +829,7 @@ static int snd_ac97_put_spsa(struct snd_ + { + struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol); + int reg = kcontrol->private_value & 0xff; +- int shift = (kcontrol->private_value >> 8) & 0xff; ++ int shift = (kcontrol->private_value >> 8) & 0x0f; + int mask = (kcontrol->private_value >> 16) & 0xff; + // int invert = (kcontrol->private_value >> 24) & 0xff; + unsigned short value, old, new; diff --git a/queue-3.18/alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch b/queue-3.18/alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch new file mode 100644 index 00000000000..4ecee9ba3bf --- /dev/null +++ b/queue-3.18/alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch @@ -0,0 +1,51 @@ +From 9a20332ab373b1f8f947e0a9c923652b32dab031 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 23 Nov 2018 18:18:30 +0100 +Subject: ALSA: sparc: Fix invalid snd_free_pages() at error path + +From: Takashi Iwai + +commit 9a20332ab373b1f8f947e0a9c923652b32dab031 upstream. + +Some spurious calls of snd_free_pages() have been overlooked and +remain in the error paths of sparc cs4231 driver code. Since +runtime->dma_area is managed by the PCM core helper, we shouldn't +release manually. + +Drop the superfluous calls. + +Reviewed-by: Takashi Sakamoto +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/sparc/cs4231.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/sound/sparc/cs4231.c ++++ b/sound/sparc/cs4231.c +@@ -1146,10 +1146,8 @@ static int snd_cs4231_playback_open(stru + runtime->hw = snd_cs4231_playback; + + err = snd_cs4231_open(chip, CS4231_MODE_PLAY); +- if (err < 0) { +- snd_free_pages(runtime->dma_area, runtime->dma_bytes); ++ if (err < 0) + return err; +- } + chip->playback_substream = substream; + chip->p_periods_sent = 0; + snd_pcm_set_sync(substream); +@@ -1167,10 +1165,8 @@ static int snd_cs4231_capture_open(struc + runtime->hw = snd_cs4231_capture; + + err = snd_cs4231_open(chip, CS4231_MODE_RECORD); +- if (err < 0) { +- snd_free_pages(runtime->dma_area, runtime->dma_bytes); ++ if (err < 0) + return err; +- } + chip->capture_substream = substream; + chip->c_periods_sent = 0; + snd_pcm_set_sync(substream); diff --git a/queue-3.18/alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch b/queue-3.18/alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch new file mode 100644 index 00000000000..6083a63bd58 --- /dev/null +++ b/queue-3.18/alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch @@ -0,0 +1,42 @@ +From 7b69154171b407844c273ab4c10b5f0ddcd6aa29 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 23 Nov 2018 18:16:33 +0100 +Subject: ALSA: wss: Fix invalid snd_free_pages() at error path + +From: Takashi Iwai + +commit 7b69154171b407844c273ab4c10b5f0ddcd6aa29 upstream. + +Some spurious calls of snd_free_pages() have been overlooked and +remain in the error paths of wss driver code. Since runtime->dma_area +is managed by the PCM core helper, we shouldn't release manually. + +Drop the superfluous calls. + +Reviewed-by: Takashi Sakamoto +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/isa/wss/wss_lib.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/sound/isa/wss/wss_lib.c ++++ b/sound/isa/wss/wss_lib.c +@@ -1531,7 +1531,6 @@ static int snd_wss_playback_open(struct + if (err < 0) { + if (chip->release_dma) + chip->release_dma(chip, chip->dma_private_data, chip->dma1); +- snd_free_pages(runtime->dma_area, runtime->dma_bytes); + return err; + } + chip->playback_substream = substream; +@@ -1572,7 +1571,6 @@ static int snd_wss_capture_open(struct s + if (err < 0) { + if (chip->release_dma) + chip->release_dma(chip, chip->dma_private_data, chip->dma2); +- snd_free_pages(runtime->dma_area, runtime->dma_bytes); + return err; + } + chip->capture_substream = substream; diff --git a/queue-3.18/series b/queue-3.18/series index 4142323930b..4733b735d60 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -2,3 +2,6 @@ revert-wlcore-add-missing-pm-call-for-wlcore_cmd_wai.patch rapidio-rionet-do-not-free-skb-before-reading-its-length.patch s390-qeth-fix-length-check-in-snmp-processing.patch usbnet-ipheth-fix-potential-recvmsg-bug-and-recvmsg-bug-2.patch +alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch +alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch +alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch