From e9c2f3ba8948f0e6256cde4e79cbbd2eaac7b1f2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 13 Jan 2023 16:50:59 +0100 Subject: [PATCH] 6.1-stable patches added patches: alsa-hda-cs35l41-check-runtime-suspend-capability-at-runtime_idle.patch alsa-hda-cs35l41-don-t-return-einval-from-system-suspend-resume.patch alsa-hda-enable-headset-mic-on-another-dell-laptop-with-alc3254.patch alsa-hda-hdmi-add-a-hp-device-0x8715-to-force-connect-list.patch alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-a-hp-platform.patch alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch --- ...e-suspend-capability-at-runtime_idle.patch | 56 +++++++++ ...rn-einval-from-system-suspend-resume.patch | 53 +++++++++ ...-on-another-dell-laptop-with-alc3254.patch | 33 ++++++ ...-device-0x8715-to-force-connect-list.patch | 31 +++++ ...te-leds-don-t-work-for-a-hp-platform.patch | 32 ++++++ ...ide-snd_ctl_elem_read-to-prevent-uaf.patch | 107 ++++++++++++++++++ queue-6.1/series | 6 + 7 files changed, 318 insertions(+) create mode 100644 queue-6.1/alsa-hda-cs35l41-check-runtime-suspend-capability-at-runtime_idle.patch create mode 100644 queue-6.1/alsa-hda-cs35l41-don-t-return-einval-from-system-suspend-resume.patch create mode 100644 queue-6.1/alsa-hda-enable-headset-mic-on-another-dell-laptop-with-alc3254.patch create mode 100644 queue-6.1/alsa-hda-hdmi-add-a-hp-device-0x8715-to-force-connect-list.patch create mode 100644 queue-6.1/alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-a-hp-platform.patch create mode 100644 queue-6.1/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch diff --git a/queue-6.1/alsa-hda-cs35l41-check-runtime-suspend-capability-at-runtime_idle.patch b/queue-6.1/alsa-hda-cs35l41-check-runtime-suspend-capability-at-runtime_idle.patch new file mode 100644 index 00000000000..bca067478d4 --- /dev/null +++ b/queue-6.1/alsa-hda-cs35l41-check-runtime-suspend-capability-at-runtime_idle.patch @@ -0,0 +1,56 @@ +From ae50e2ab122cef68f46b7799fb9deffe3334f5e2 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 5 Jan 2023 10:35:31 +0100 +Subject: ALSA: hda: cs35l41: Check runtime suspend capability at runtime_idle + +From: Takashi Iwai + +commit ae50e2ab122cef68f46b7799fb9deffe3334f5e2 upstream. + +The runtime PM core checks with runtime_idle callback whether it can +goes to the runtime suspend or not, and we can put the boost type +check there instead of runtime_suspend and _resume calls. This will +reduce the unnecessary runtime_suspend() calls. + +Fixes: 1873ebd30cc8 ("ALSA: hda: cs35l41: Support Hibernation during Suspend") +Cc: +Link: https://lore.kernel.org/r/20230105093531.16960-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/cs35l41_hda.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/cs35l41_hda.c b/sound/pci/hda/cs35l41_hda.c +index 0a5cee730268..f7815ee24f83 100644 +--- a/sound/pci/hda/cs35l41_hda.c ++++ b/sound/pci/hda/cs35l41_hda.c +@@ -647,6 +647,15 @@ static int cs35l41_system_resume(struct device *dev) + return ret; + } + ++static int cs35l41_runtime_idle(struct device *dev) ++{ ++ struct cs35l41_hda *cs35l41 = dev_get_drvdata(dev); ++ ++ if (cs35l41->hw_cfg.bst_type == CS35L41_EXT_BOOST_NO_VSPK_SWITCH) ++ return -EBUSY; /* suspend not supported yet on this model */ ++ return 0; ++} ++ + static int cs35l41_runtime_suspend(struct device *dev) + { + struct cs35l41_hda *cs35l41 = dev_get_drvdata(dev); +@@ -1536,7 +1545,8 @@ void cs35l41_hda_remove(struct device *dev) + EXPORT_SYMBOL_NS_GPL(cs35l41_hda_remove, SND_HDA_SCODEC_CS35L41); + + const struct dev_pm_ops cs35l41_hda_pm_ops = { +- RUNTIME_PM_OPS(cs35l41_runtime_suspend, cs35l41_runtime_resume, NULL) ++ RUNTIME_PM_OPS(cs35l41_runtime_suspend, cs35l41_runtime_resume, ++ cs35l41_runtime_idle) + SYSTEM_SLEEP_PM_OPS(cs35l41_system_suspend, cs35l41_system_resume) + }; + EXPORT_SYMBOL_NS_GPL(cs35l41_hda_pm_ops, SND_HDA_SCODEC_CS35L41); +-- +2.39.0 + diff --git a/queue-6.1/alsa-hda-cs35l41-don-t-return-einval-from-system-suspend-resume.patch b/queue-6.1/alsa-hda-cs35l41-don-t-return-einval-from-system-suspend-resume.patch new file mode 100644 index 00000000000..db45d8ba895 --- /dev/null +++ b/queue-6.1/alsa-hda-cs35l41-don-t-return-einval-from-system-suspend-resume.patch @@ -0,0 +1,53 @@ +From 15a59cb0a3d6ddf2cb79f8dc3081b3130aad3767 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 5 Jan 2023 10:35:30 +0100 +Subject: ALSA: hda: cs35l41: Don't return -EINVAL from system suspend/resume + +From: Takashi Iwai + +commit 15a59cb0a3d6ddf2cb79f8dc3081b3130aad3767 upstream. + +The recent commit to support the system suspend for CS35L41 caused a +regression on the models with CS35L41_EXT_BOOST_NO_VSPK_SWITC boost +type, as the suspend/resume callbacks just return -EINVAL. This is +eventually handled as a fatal error and blocks the whole system +suspend/resume. + +For avoiding the problem, this patch corrects the return code from +cs35l41_system_suspend() and _resume() to 0, and replace dev_err() +with dev_err_once() for stop spamming too much. + +Fixes: 88672826e2a4 ("ALSA: hda: cs35l41: Support System Suspend") +Cc: +Link: https://lore.kernel.org/all/e6751ac2-34f3-d13f-13db-8174fade8308@pm.me +Link: https://lore.kernel.org/r/20230105093531.16960-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/cs35l41_hda.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/pci/hda/cs35l41_hda.c ++++ b/sound/pci/hda/cs35l41_hda.c +@@ -598,8 +598,8 @@ static int cs35l41_system_suspend(struct + dev_dbg(cs35l41->dev, "System Suspend\n"); + + if (cs35l41->hw_cfg.bst_type == CS35L41_EXT_BOOST_NO_VSPK_SWITCH) { +- dev_err(cs35l41->dev, "System Suspend not supported\n"); +- return -EINVAL; ++ dev_err_once(cs35l41->dev, "System Suspend not supported\n"); ++ return 0; /* don't block the whole system suspend */ + } + + ret = pm_runtime_force_suspend(dev); +@@ -624,8 +624,8 @@ static int cs35l41_system_resume(struct + dev_dbg(cs35l41->dev, "System Resume\n"); + + if (cs35l41->hw_cfg.bst_type == CS35L41_EXT_BOOST_NO_VSPK_SWITCH) { +- dev_err(cs35l41->dev, "System Resume not supported\n"); +- return -EINVAL; ++ dev_err_once(cs35l41->dev, "System Resume not supported\n"); ++ return 0; /* don't block the whole system resume */ + } + + if (cs35l41->reset_gpio) { diff --git a/queue-6.1/alsa-hda-enable-headset-mic-on-another-dell-laptop-with-alc3254.patch b/queue-6.1/alsa-hda-enable-headset-mic-on-another-dell-laptop-with-alc3254.patch new file mode 100644 index 00000000000..0735719bcf2 --- /dev/null +++ b/queue-6.1/alsa-hda-enable-headset-mic-on-another-dell-laptop-with-alc3254.patch @@ -0,0 +1,33 @@ +From a5751933a7f6abbdad90d98f25a25bb4b133a9e6 Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Tue, 3 Jan 2023 17:53:32 +0800 +Subject: ALSA: hda - Enable headset mic on another Dell laptop with ALC3254 + +From: Chris Chiu + +commit a5751933a7f6abbdad90d98f25a25bb4b133a9e6 upstream. + +There is another Dell Latitude laptop (1028:0c03) with Realtek +codec ALC3254 which needs the ALC269_FIXUP_DELL4_MIC_NO_PRESENCE +instead of the default matched ALC269_FIXUP_DELL1_MIC_NO_PRESENCE. +Apply correct fixup for this particular model to enable headset mic. + +Signed-off-by: Chris Chiu +Cc: +Link: https://lore.kernel.org/r/20230103095332.730677-1-chris.chiu@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9239,6 +9239,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x0b1a, "Dell Precision 5570", ALC289_FIXUP_DUAL_SPK), + SND_PCI_QUIRK(0x1028, 0x0b37, "Dell Inspiron 16 Plus 7620 2-in-1", ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS), + SND_PCI_QUIRK(0x1028, 0x0b71, "Dell Inspiron 16 Plus 7620", ALC295_FIXUP_DELL_INSPIRON_TOP_SPEAKERS), ++ SND_PCI_QUIRK(0x1028, 0x0c03, "Dell Precision 5340", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0c19, "Dell Precision 3340", ALC236_FIXUP_DELL_DUAL_CODECS), + SND_PCI_QUIRK(0x1028, 0x0c1a, "Dell Precision 3340", ALC236_FIXUP_DELL_DUAL_CODECS), + SND_PCI_QUIRK(0x1028, 0x0c1b, "Dell Precision 3440", ALC236_FIXUP_DELL_DUAL_CODECS), diff --git a/queue-6.1/alsa-hda-hdmi-add-a-hp-device-0x8715-to-force-connect-list.patch b/queue-6.1/alsa-hda-hdmi-add-a-hp-device-0x8715-to-force-connect-list.patch new file mode 100644 index 00000000000..4b247e31b83 --- /dev/null +++ b/queue-6.1/alsa-hda-hdmi-add-a-hp-device-0x8715-to-force-connect-list.patch @@ -0,0 +1,31 @@ +From de1ccb9e61728dd941fe0e955a7a129418657267 Mon Sep 17 00:00:00 2001 +From: Adrian Chan +Date: Mon, 9 Jan 2023 16:05:20 -0500 +Subject: ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list + +From: Adrian Chan + +commit de1ccb9e61728dd941fe0e955a7a129418657267 upstream. + +Add the 'HP Engage Flex Mini' device to the force connect list to +enable audio through HDMI. + +Signed-off-by: Adrian Chan +Cc: +Link: https://lore.kernel.org/r/20230109210520.16060-1-adchan@google.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1981,6 +1981,7 @@ static const struct snd_pci_quirk force_ + SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1), + SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1), + SND_PCI_QUIRK(0x103c, 0x8711, "HP", 1), ++ SND_PCI_QUIRK(0x103c, 0x8715, "HP", 1), + SND_PCI_QUIRK(0x1462, 0xec94, "MS-7C94", 1), + SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", 1), + {} diff --git a/queue-6.1/alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-a-hp-platform.patch b/queue-6.1/alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-a-hp-platform.patch new file mode 100644 index 00000000000..c9239814e85 --- /dev/null +++ b/queue-6.1/alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-a-hp-platform.patch @@ -0,0 +1,32 @@ +From 9c694fbfe6f36017b060ad74c7565cb379852e40 Mon Sep 17 00:00:00 2001 +From: Jeremy Szu +Date: Thu, 5 Jan 2023 12:41:53 +0800 +Subject: ALSA: hda/realtek: fix mute/micmute LEDs don't work for a HP platform + +From: Jeremy Szu + +commit 9c694fbfe6f36017b060ad74c7565cb379852e40 upstream. + +There is a HP platform uses ALC236 codec which using GPIO2 to control +mute LED and GPIO1 to control micmute LED. +Thus, add a quirk to make them work. + +Signed-off-by: Jeremy Szu +Cc: +Link: https://lore.kernel.org/r/20230105044154.8242-1-jeremy.szu@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9406,6 +9406,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b5d, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8b5e, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), ++ SND_PCI_QUIRK(0x103c, 0x8bf0, "HP", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), diff --git a/queue-6.1/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch b/queue-6.1/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch new file mode 100644 index 00000000000..dcfbe391ef3 --- /dev/null +++ b/queue-6.1/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch @@ -0,0 +1,107 @@ +From 56b88b50565cd8b946a2d00b0c83927b7ebb055e Mon Sep 17 00:00:00 2001 +From: Clement Lecigne +Date: Fri, 13 Jan 2023 13:07:45 +0100 +Subject: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF + +From: Clement Lecigne + +commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e upstream. + +Takes rwsem lock inside snd_ctl_elem_read instead of snd_ctl_elem_read_user +like it was done for write in commit 1fa4445f9adf1 ("ALSA: control - introduce +snd_ctl_notify_one() helper"). Doing this way we are also fixing the following +locking issue happening in the compat path which can be easily triggered and +turned into an use-after-free. + +64-bits: +snd_ctl_ioctl + snd_ctl_elem_read_user + [takes controls_rwsem] + snd_ctl_elem_read [lock properly held, all good] + [drops controls_rwsem] + +32-bits: +snd_ctl_ioctl_compat + snd_ctl_elem_write_read_compat + ctl_elem_write_read + snd_ctl_elem_read [missing lock, not good] + +CVE-2023-0266 was assigned for this issue. + +Cc: stable@kernel.org # 5.13+ +Signed-off-by: Clement Lecigne +Reviewed-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20230113120745.25464-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/control.c | 24 +++++++++++++++--------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -1203,14 +1203,19 @@ static int snd_ctl_elem_read(struct snd_ + const u32 pattern = 0xdeadbeef; + int ret; + ++ down_read(&card->controls_rwsem); + kctl = snd_ctl_find_id(card, &control->id); +- if (kctl == NULL) +- return -ENOENT; ++ if (kctl == NULL) { ++ ret = -ENOENT; ++ goto unlock; ++ } + + index_offset = snd_ctl_get_ioff(kctl, &control->id); + vd = &kctl->vd[index_offset]; +- if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) +- return -EPERM; ++ if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) { ++ ret = -EPERM; ++ goto unlock; ++ } + + snd_ctl_build_ioff(&control->id, kctl, index_offset); + +@@ -1220,7 +1225,7 @@ static int snd_ctl_elem_read(struct snd_ + info.id = control->id; + ret = __snd_ctl_elem_info(card, kctl, &info, NULL); + if (ret < 0) +- return ret; ++ goto unlock; + #endif + + if (!snd_ctl_skip_validation(&info)) +@@ -1230,7 +1235,7 @@ static int snd_ctl_elem_read(struct snd_ + ret = kctl->get(kctl, control); + snd_power_unref(card); + if (ret < 0) +- return ret; ++ goto unlock; + if (!snd_ctl_skip_validation(&info) && + sanity_check_elem_value(card, control, &info, pattern) < 0) { + dev_err(card->dev, +@@ -1238,8 +1243,11 @@ static int snd_ctl_elem_read(struct snd_ + control->id.iface, control->id.device, + control->id.subdevice, control->id.name, + control->id.index); +- return -EINVAL; ++ ret = -EINVAL; ++ goto unlock; + } ++unlock: ++ up_read(&card->controls_rwsem); + return ret; + } + +@@ -1253,9 +1261,7 @@ static int snd_ctl_elem_read_user(struct + if (IS_ERR(control)) + return PTR_ERR(control); + +- down_read(&card->controls_rwsem); + result = snd_ctl_elem_read(card, control); +- up_read(&card->controls_rwsem); + if (result < 0) + goto error; + diff --git a/queue-6.1/series b/queue-6.1/series index 5d0ad6265d8..86ad348c3c2 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -8,3 +8,9 @@ selftests-vm-pkeys-add-a-regression-test-for-setting-pkru-through-ptrace.patch revert-sunrpc-use-rmw-bitops-in-single-threaded-hot-paths.patch gcc-disable-warray-bounds-for-gcc-11-too.patch net-sched-disallow-noqueue-for-qdisc-classes.patch +alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch +alsa-hda-hdmi-add-a-hp-device-0x8715-to-force-connect-list.patch +alsa-hda-realtek-fix-mute-micmute-leds-don-t-work-for-a-hp-platform.patch +alsa-hda-cs35l41-don-t-return-einval-from-system-suspend-resume.patch +alsa-hda-enable-headset-mic-on-another-dell-laptop-with-alc3254.patch +alsa-hda-cs35l41-check-runtime-suspend-capability-at-runtime_idle.patch -- 2.47.3