From: Greg Kroah-Hartman Date: Sun, 17 Oct 2021 10:35:00 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.14.252~47 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cfa4bda21e8e2186a9de58cad81cd026f38a1487;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: alsa-hda-enable-headphone-mic-on-dell-latitude-laptops-with-alc3254.patch alsa-hda-realtek-add-quirk-for-clevo-x170km-g.patch alsa-hda-realtek-add-quirk-for-tongfang-phxtxx1.patch alsa-hda-realtek-alc236-headset-mic-recording-issue.patch alsa-hda-realtek-complete-partial-device-name-to-avoid-ambiguity.patch alsa-hda-realtek-enable-4-speaker-output-for-dell-precision-5560-laptop.patch alsa-hda-realtek-fix-for-quirk-to-enable-speaker-output-on-the-lenovo-13s-gen2.patch alsa-hda-realtek-fix-the-mic-type-detection-issue-for-asus-g551jw.patch alsa-pcm-workaround-for-a-wrong-offset-in-sync_ptr-compat-ioctl.patch alsa-seq-fix-a-potential-uaf-by-wrong-private_free-call-order.patch alsa-usb-audio-add-quirk-for-vf0770.patch --- diff --git a/queue-5.10/alsa-hda-enable-headphone-mic-on-dell-latitude-laptops-with-alc3254.patch b/queue-5.10/alsa-hda-enable-headphone-mic-on-dell-latitude-laptops-with-alc3254.patch new file mode 100644 index 00000000000..1a16b2bf11f --- /dev/null +++ b/queue-5.10/alsa-hda-enable-headphone-mic-on-dell-latitude-laptops-with-alc3254.patch @@ -0,0 +1,39 @@ +From 2b987fe84429361c7f189568c476d1bd00d2ff7e Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Fri, 1 Oct 2021 14:28:56 +0800 +Subject: ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254 + +From: Chris Chiu + +commit 2b987fe84429361c7f189568c476d1bd00d2ff7e upstream. + +The headphone mic is not working on Dell Latitude laptops with ALC3254. +The codec vendor id is 0x10ec0295 and share the same pincfg as defined +in ALC295_STANDARD_PINS. So the ALC269_FIXUP_DELL1_MIC_NO_PRESENCE will +be applied per alc269_pin_fixup_tbl[] but actually the headphone mic is +using NID 0x1b instead of 0x1a. The ALC269_FIXUP_DELL4_MIC_NO_PRESENCE +need to be applied instead. + +Use ALC269_FIXUP_DELL4_MIC_NO_PRESENCE for particular models before +a generic fixup comes out. + +Signed-off-by: Chris Chiu +Cc: +Link: https://lore.kernel.org/r/20211001062856.1037901-1-chris.chiu@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8392,6 +8392,8 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x0a58, "Dell", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0a61, "Dell XPS 15 9510", ALC289_FIXUP_DUAL_SPK), + SND_PCI_QUIRK(0x1028, 0x0a62, "Dell Precision 5560", ALC289_FIXUP_DUAL_SPK), ++ SND_PCI_QUIRK(0x1028, 0x0a9d, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1028, 0x0a9e, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), diff --git a/queue-5.10/alsa-hda-realtek-add-quirk-for-clevo-x170km-g.patch b/queue-5.10/alsa-hda-realtek-add-quirk-for-clevo-x170km-g.patch new file mode 100644 index 00000000000..a1eccb2541b --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-quirk-for-clevo-x170km-g.patch @@ -0,0 +1,31 @@ +From cc03069a397005da24f6783835c274d5aedf6043 Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Fri, 1 Oct 2021 15:31:11 +0200 +Subject: ALSA: hda/realtek: Add quirk for Clevo X170KM-G + +From: Werner Sembach + +commit cc03069a397005da24f6783835c274d5aedf6043 upstream. + +This applies a SND_PCI_QUIRK(...) to the Clevo X170KM-G barebone. This +fixes the issue of the devices internal Speaker not working. + +Signed-off-by: Werner Sembach +Cc: +Link: https://lore.kernel.org/r/20211001133111.428249-3-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2550,6 +2550,7 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS), ++ SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED), + SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x950a, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950), diff --git a/queue-5.10/alsa-hda-realtek-add-quirk-for-tongfang-phxtxx1.patch b/queue-5.10/alsa-hda-realtek-add-quirk-for-tongfang-phxtxx1.patch new file mode 100644 index 00000000000..7b147a54033 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-quirk-for-tongfang-phxtxx1.patch @@ -0,0 +1,87 @@ +From dd6dd6e3c791db7fdbc5433ec7e450717aa3a0ce Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Wed, 6 Oct 2021 15:04:15 +0200 +Subject: ALSA: hda/realtek: Add quirk for TongFang PHxTxX1 + +From: Werner Sembach + +commit dd6dd6e3c791db7fdbc5433ec7e450717aa3a0ce upstream. + +This applies a SND_PCI_QUIRK(...) to the TongFang PHxTxX1 barebone. This +fixes the issue of the internal Microphone not working after booting +another OS. + +When booting a certain another OS this barebone keeps some coeff settings +even after a cold shutdown. These coeffs prevent the microphone detection +from working in Linux, making the Laptop think that there is always an +external microphone plugged-in and therefore preventing the use of the +internal one. + +The relevant indexes and values where gathered by naively diff-ing and +reading a working and a non-working coeff dump. + +Signed-off-by: Werner Sembach +Cc: +Link: https://lore.kernel.org/r/20211006130415.538243-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6399,6 +6399,24 @@ static void alc287_fixup_legion_15imhg05 + /* for alc285_fixup_ideapad_s740_coef() */ + #include "ideapad_s740_helper.c" + ++static void alc256_fixup_tongfang_reset_persistent_settings(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ /* ++ * A certain other OS sets these coeffs to different values. On at least one TongFang ++ * barebone these settings might survive even a cold reboot. So to restore a clean slate the ++ * values are explicitly reset to default here. Without this, the external microphone is ++ * always in a plugged-in state, while the internal microphone is always in an unplugged ++ * state, breaking the ability to use the internal microphone. ++ */ ++ alc_write_coef_idx(codec, 0x24, 0x0000); ++ alc_write_coef_idx(codec, 0x26, 0x0000); ++ alc_write_coef_idx(codec, 0x29, 0x3000); ++ alc_write_coef_idx(codec, 0x37, 0xfe05); ++ alc_write_coef_idx(codec, 0x45, 0x5089); ++} ++ + enum { + ALC269_FIXUP_GPIO2, + ALC269_FIXUP_SONY_VAIO, +@@ -6612,7 +6630,8 @@ enum { + ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS, + ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE, + ALC287_FIXUP_YOGA7_14ITL_SPEAKERS, +- ALC287_FIXUP_13S_GEN2_SPEAKERS ++ ALC287_FIXUP_13S_GEN2_SPEAKERS, ++ ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -8304,6 +8323,10 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE, + }, ++ [ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc256_fixup_tongfang_reset_persistent_settings, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -8733,6 +8756,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */ + SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802), + SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X), ++ SND_PCI_QUIRK(0x1d05, 0x1132, "TongFang PHxTxX1", ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS), + SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), diff --git a/queue-5.10/alsa-hda-realtek-alc236-headset-mic-recording-issue.patch b/queue-5.10/alsa-hda-realtek-alc236-headset-mic-recording-issue.patch new file mode 100644 index 00000000000..8b03935c7a9 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-alc236-headset-mic-recording-issue.patch @@ -0,0 +1,45 @@ +From 5aec98913095ed3b4424ed6c5fdeb6964e9734da Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Tue, 5 Oct 2021 14:35:14 +0800 +Subject: ALSA: hda/realtek - ALC236 headset MIC recording issue + +From: Kailang Yang + +commit 5aec98913095ed3b4424ed6c5fdeb6964e9734da upstream. + +In power save mode, the recording voice from headset mic will 2s more delay. +Add this patch will solve this issue. + +[ minor coding style fix by tiwai ] + +Signed-off-by: Kailang Yang +Tested-by: Kai-Heng Feng +Cc: +Link: https://lore.kernel.org/r/ccb0cdd5bbd7486eabbd8d987d384cb0@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -527,6 +527,8 @@ static void alc_shutup_pins(struct hda_c + struct alc_spec *spec = codec->spec; + + switch (codec->core.vendor_id) { ++ case 0x10ec0236: ++ case 0x10ec0256: + case 0x10ec0283: + case 0x10ec0286: + case 0x10ec0288: +@@ -3532,7 +3534,8 @@ static void alc256_shutup(struct hda_cod + /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly + * when booting with headset plugged. So skip setting it for the codec alc257 + */ +- if (codec->core.vendor_id != 0x10ec0257) ++ if (spec->codec_variant != ALC269_TYPE_ALC257 && ++ spec->codec_variant != ALC269_TYPE_ALC256) + alc_update_coef_idx(codec, 0x46, 0, 3 << 12); + + if (!spec->no_shutup_pins) diff --git a/queue-5.10/alsa-hda-realtek-complete-partial-device-name-to-avoid-ambiguity.patch b/queue-5.10/alsa-hda-realtek-complete-partial-device-name-to-avoid-ambiguity.patch new file mode 100644 index 00000000000..7168bc80d48 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-complete-partial-device-name-to-avoid-ambiguity.patch @@ -0,0 +1,35 @@ +From 1f8d398e1cd8813f8ec16d55c086e8270a9c18ab Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Fri, 1 Oct 2021 15:31:10 +0200 +Subject: ALSA: hda/realtek: Complete partial device name to avoid ambiguity + +From: Werner Sembach + +commit 1f8d398e1cd8813f8ec16d55c086e8270a9c18ab upstream. + +The string "Clevo X170" is not enough to unambiguously identify the correct +device. + +Fixing it so another Clevo barebone name starting with "X170" can be added +without causing confusion. + +Signed-off-by: Werner Sembach +Cc: +Link: https://lore.kernel.org/r/20211001133111.428249-2-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2549,7 +2549,7 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), +- SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS), ++ SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x950a, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950), diff --git a/queue-5.10/alsa-hda-realtek-enable-4-speaker-output-for-dell-precision-5560-laptop.patch b/queue-5.10/alsa-hda-realtek-enable-4-speaker-output-for-dell-precision-5560-laptop.patch new file mode 100644 index 00000000000..82662937ffe --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-enable-4-speaker-output-for-dell-precision-5560-laptop.patch @@ -0,0 +1,32 @@ +From eb676622846b34a751e2ff9b5910a5322a4e0000 Mon Sep 17 00:00:00 2001 +From: John Liu +Date: Thu, 30 Sep 2021 13:53:16 +0200 +Subject: ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop + +From: John Liu + +commit eb676622846b34a751e2ff9b5910a5322a4e0000 upstream. + +The Dell Precision 5560 laptop appears to use the 4-speakers-on-ALC289 +audio just like its sibling product XPS 9510, so it requires the same +quirk to enable woofer output. Tested on my Dell Precision 5560. + +Signed-off-by: John Liu +Cc: +Link: https://lore.kernel.org/r/20210930115316.659-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8391,6 +8391,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x0a30, "Dell", ALC236_FIXUP_DELL_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0a58, "Dell", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0a61, "Dell XPS 15 9510", ALC289_FIXUP_DUAL_SPK), ++ SND_PCI_QUIRK(0x1028, 0x0a62, "Dell Precision 5560", ALC289_FIXUP_DUAL_SPK), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), diff --git a/queue-5.10/alsa-hda-realtek-fix-for-quirk-to-enable-speaker-output-on-the-lenovo-13s-gen2.patch b/queue-5.10/alsa-hda-realtek-fix-for-quirk-to-enable-speaker-output-on-the-lenovo-13s-gen2.patch new file mode 100644 index 00000000000..e0aeae900f4 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-fix-for-quirk-to-enable-speaker-output-on-the-lenovo-13s-gen2.patch @@ -0,0 +1,35 @@ +From 023a062f238129e8a542b5163c4350ceb076283e Mon Sep 17 00:00:00 2001 +From: Cameron Berkenpas +Date: Sun, 10 Oct 2021 15:54:11 -0700 +Subject: ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo 13s Gen2 + +From: Cameron Berkenpas + +commit 023a062f238129e8a542b5163c4350ceb076283e upstream. + +The previous patch's HDA verb initialization for the Lenovo 13s +sequence was slightly off. This updated verb sequence has been tested +and confirmed working. + +Fixes: ad7cc2d41b7a ("ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208555 +Cc: +Signed-off-by: Cameron Berkenpas +Link: https://lore.kernel.org/r/20211010225410.23423-1-cam@neo-zeon.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8306,7 +8306,7 @@ static const struct hda_fixup alc269_fix + .v.verbs = (const struct hda_verb[]) { + { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 }, + { 0x20, AC_VERB_SET_PROC_COEF, 0x41 }, +- { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 }, ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 }, + { 0x20, AC_VERB_SET_PROC_COEF, 0x2 }, + { 0x20, AC_VERB_SET_PROC_COEF, 0x0 }, + { 0x20, AC_VERB_SET_PROC_COEF, 0x0 }, diff --git a/queue-5.10/alsa-hda-realtek-fix-the-mic-type-detection-issue-for-asus-g551jw.patch b/queue-5.10/alsa-hda-realtek-fix-the-mic-type-detection-issue-for-asus-g551jw.patch new file mode 100644 index 00000000000..c4d569cf504 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-fix-the-mic-type-detection-issue-for-asus-g551jw.patch @@ -0,0 +1,82 @@ +From a3fd1a986e499a06ac5ef95c3a39aa4611e7444c Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Tue, 12 Oct 2021 19:47:48 +0800 +Subject: ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW + +From: Hui Wang + +commit a3fd1a986e499a06ac5ef95c3a39aa4611e7444c upstream. + +We need to define the codec pin 0x1b to be the mic, but somehow +the mic doesn't support hot plugging detection, and Windows also has +this issue, so we set it to phantom headset-mic. + +Also the determine_headset_type() often returns the omtp type by a +mistake when we plug a ctia headset, this makes the mic can't record +sound at all. Because most of the headset are ctia type nowadays and +some machines have the fixed ctia type audio jack, it is possible this +machine has the fixed ctia jack too. Here we set this mic jack to +fixed ctia type, this could avoid the mic type detection mistake and +make the ctia headset work stable. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214537 +Reported-and-tested-by: msd +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20211012114748.5238-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10129,6 +10129,9 @@ enum { + ALC671_FIXUP_HP_HEADSET_MIC2, + ALC662_FIXUP_ACER_X2660G_HEADSET_MODE, + ALC662_FIXUP_ACER_NITRO_HEADSET_MODE, ++ ALC668_FIXUP_ASUS_NO_HEADSET_MIC, ++ ALC668_FIXUP_HEADSET_MIC, ++ ALC668_FIXUP_MIC_DET_COEF, + }; + + static const struct hda_fixup alc662_fixups[] = { +@@ -10512,6 +10515,29 @@ static const struct hda_fixup alc662_fix + .chained = true, + .chain_id = ALC662_FIXUP_USI_FUNC + }, ++ [ALC668_FIXUP_ASUS_NO_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x1b, 0x04a1112c }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC668_FIXUP_HEADSET_MIC ++ }, ++ [ALC668_FIXUP_HEADSET_MIC] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc269_fixup_headset_mic, ++ .chained = true, ++ .chain_id = ALC668_FIXUP_MIC_DET_COEF ++ }, ++ [ALC668_FIXUP_MIC_DET_COEF] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x15 }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0d60 }, ++ {} ++ }, ++ }, + }; + + static const struct snd_pci_quirk alc662_fixup_tbl[] = { +@@ -10547,6 +10573,7 @@ static const struct snd_pci_quirk alc662 + SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16), + SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51), + SND_PCI_QUIRK(0x1043, 0x17bd, "ASUS N751", ALC668_FIXUP_ASUS_Nx51), ++ SND_PCI_QUIRK(0x1043, 0x185d, "ASUS G551JW", ALC668_FIXUP_ASUS_NO_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1963, "ASUS X71SL", ALC662_FIXUP_ASUS_MODE8), + SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16), + SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_BASS_MODE4_CHMAP), diff --git a/queue-5.10/alsa-pcm-workaround-for-a-wrong-offset-in-sync_ptr-compat-ioctl.patch b/queue-5.10/alsa-pcm-workaround-for-a-wrong-offset-in-sync_ptr-compat-ioctl.patch new file mode 100644 index 00000000000..5688c5047a7 --- /dev/null +++ b/queue-5.10/alsa-pcm-workaround-for-a-wrong-offset-in-sync_ptr-compat-ioctl.patch @@ -0,0 +1,152 @@ +From 228af5a4fa3a8293bd8b7ac5cf59548ee29627bf Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 10 Oct 2021 09:55:46 +0200 +Subject: ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl + +From: Takashi Iwai + +commit 228af5a4fa3a8293bd8b7ac5cf59548ee29627bf upstream. + +Michael Forney reported an incorrect padding type that was defined in +the commit 80fe7430c708 ("ALSA: add new 32-bit layout for +snd_pcm_mmap_status/control") for PCM control mmap data. +His analysis is correct, and this caused the misplacements of PCM +control data on 32bit arch and 32bit compat mode. + +The bug is that the __pad2 definition in __snd_pcm_mmap_control64 +struct was wrongly with __pad_before_uframe, which should have been +__pad_after_uframe instead. This struct is used in SYNC_PTR ioctl and +control mmap. Basically this bug leads to two problems: + +- The offset of avail_min field becomes wrong, it's placed right after + appl_ptr without padding on little-endian + +- When appl_ptr and avail_min are read as 64bit values in kernel side, + the values become either zero or corrupted (mixed up) + +One good news is that, because both user-space and kernel +misunderstand the wrong offset, at least, 32bit application running on +32bit kernel works as is. Also, 64bit applications are unaffected +because the padding size is zero. The remaining problem is the 32bit +compat mode; as mentioned in the above, avail_min is placed right +after appl_ptr on little-endian archs, 64bit kernel reads bogus values +for appl_ptr updates, which may lead to streaming bugs like jumping, +XRUN or whatever unexpected. +(However, we haven't heard any serious bug reports due to this over +years, so practically seen, it's fairly safe to assume that the impact +by this bug is limited.) + +Ideally speaking, we should correct the wrong mmap status control +definition. But this would cause again incompatibility with the +existing binaries, and fixing it (e.g. by renumbering ioctls) would be +really messy. + +So, as of this patch, we only correct the behavior of 32bit compat +mode and keep the rest as is. Namely, the SYNC_PTR ioctl is now +handled differently in compat mode to read/write the 32bit values at +the right offsets. The control mmap of 32bit apps on 64bit kernels +has been already disabled (which is likely rather an overlook, but +this worked fine at this time :), so covering SYNC_PTR ioctl should +suffice as a fallback. + +Fixes: 80fe7430c708 ("ALSA: add new 32-bit layout for snd_pcm_mmap_status/control") +Reported-by: Michael Forney +Reviewed-by: Arnd Bergmann +Cc: +Cc: Rich Felker +Link: https://lore.kernel.org/r/29QBMJU8DE71E.2YZSH8IHT5HMH@mforney.org +Link: https://lore.kernel.org/r/20211010075546.23220-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/pcm_compat.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 71 insertions(+), 1 deletion(-) + +--- a/sound/core/pcm_compat.c ++++ b/sound/core/pcm_compat.c +@@ -466,6 +466,76 @@ static int snd_pcm_ioctl_sync_ptr_x32(st + } + #endif /* CONFIG_X86_X32 */ + ++#ifdef __BIG_ENDIAN ++typedef char __pad_before_u32[4]; ++typedef char __pad_after_u32[0]; ++#else ++typedef char __pad_before_u32[0]; ++typedef char __pad_after_u32[4]; ++#endif ++ ++/* PCM 2.0.15 API definition had a bug in mmap control; it puts the avail_min ++ * at the wrong offset due to a typo in padding type. ++ * The bug hits only 32bit. ++ * A workaround for incorrect read/write is needed only in 32bit compat mode. ++ */ ++struct __snd_pcm_mmap_control64_buggy { ++ __pad_before_u32 __pad1; ++ __u32 appl_ptr; ++ __pad_before_u32 __pad2; /* SiC! here is the bug */ ++ __pad_before_u32 __pad3; ++ __u32 avail_min; ++ __pad_after_uframe __pad4; ++}; ++ ++static int snd_pcm_ioctl_sync_ptr_buggy(struct snd_pcm_substream *substream, ++ struct snd_pcm_sync_ptr __user *_sync_ptr) ++{ ++ struct snd_pcm_runtime *runtime = substream->runtime; ++ struct snd_pcm_sync_ptr sync_ptr; ++ struct __snd_pcm_mmap_control64_buggy *sync_cp; ++ volatile struct snd_pcm_mmap_status *status; ++ volatile struct snd_pcm_mmap_control *control; ++ int err; ++ ++ memset(&sync_ptr, 0, sizeof(sync_ptr)); ++ sync_cp = (struct __snd_pcm_mmap_control64_buggy *)&sync_ptr.c.control; ++ if (get_user(sync_ptr.flags, (unsigned __user *)&(_sync_ptr->flags))) ++ return -EFAULT; ++ if (copy_from_user(sync_cp, &(_sync_ptr->c.control), sizeof(*sync_cp))) ++ return -EFAULT; ++ status = runtime->status; ++ control = runtime->control; ++ if (sync_ptr.flags & SNDRV_PCM_SYNC_PTR_HWSYNC) { ++ err = snd_pcm_hwsync(substream); ++ if (err < 0) ++ return err; ++ } ++ snd_pcm_stream_lock_irq(substream); ++ if (!(sync_ptr.flags & SNDRV_PCM_SYNC_PTR_APPL)) { ++ err = pcm_lib_apply_appl_ptr(substream, sync_cp->appl_ptr); ++ if (err < 0) { ++ snd_pcm_stream_unlock_irq(substream); ++ return err; ++ } ++ } else { ++ sync_cp->appl_ptr = control->appl_ptr; ++ } ++ if (!(sync_ptr.flags & SNDRV_PCM_SYNC_PTR_AVAIL_MIN)) ++ control->avail_min = sync_cp->avail_min; ++ else ++ sync_cp->avail_min = control->avail_min; ++ sync_ptr.s.status.state = status->state; ++ sync_ptr.s.status.hw_ptr = status->hw_ptr; ++ sync_ptr.s.status.tstamp = status->tstamp; ++ sync_ptr.s.status.suspended_state = status->suspended_state; ++ sync_ptr.s.status.audio_tstamp = status->audio_tstamp; ++ snd_pcm_stream_unlock_irq(substream); ++ if (copy_to_user(_sync_ptr, &sync_ptr, sizeof(sync_ptr))) ++ return -EFAULT; ++ return 0; ++} ++ + /* + */ + enum { +@@ -535,7 +605,7 @@ static long snd_pcm_ioctl_compat(struct + if (in_x32_syscall()) + return snd_pcm_ioctl_sync_ptr_x32(substream, argp); + #endif /* CONFIG_X86_X32 */ +- return snd_pcm_common_ioctl(file, substream, cmd, argp); ++ return snd_pcm_ioctl_sync_ptr_buggy(substream, argp); + case SNDRV_PCM_IOCTL_HW_REFINE32: + return snd_pcm_ioctl_hw_params_compat(substream, 1, argp); + case SNDRV_PCM_IOCTL_HW_PARAMS32: diff --git a/queue-5.10/alsa-seq-fix-a-potential-uaf-by-wrong-private_free-call-order.patch b/queue-5.10/alsa-seq-fix-a-potential-uaf-by-wrong-private_free-call-order.patch new file mode 100644 index 00000000000..d9ccf926f6a --- /dev/null +++ b/queue-5.10/alsa-seq-fix-a-potential-uaf-by-wrong-private_free-call-order.patch @@ -0,0 +1,59 @@ +From 1f8763c59c4ec6254d629fe77c0a52220bd907aa Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 30 Sep 2021 13:41:14 +0200 +Subject: ALSA: seq: Fix a potential UAF by wrong private_free call order + +From: Takashi Iwai + +commit 1f8763c59c4ec6254d629fe77c0a52220bd907aa upstream. + +John Keeping reported and posted a patch for a potential UAF in +rawmidi sequencer destruction: the snd_rawmidi_dev_seq_free() may be +called after the associated rawmidi object got already freed. +After a deeper look, it turned out that the bug is rather the +incorrect private_free call order for a snd_seq_device. The +snd_seq_device private_free gets called at the release callback of the +sequencer device object, while this was rather expected to be executed +at the snd_device call chains that runs at the beginning of the whole +card-free procedure. It's been broken since the rewrite of +sequencer-device binding (although it hasn't surfaced because the +sequencer device release happens usually right along with the card +device release). + +This patch corrects the private_free call to be done in the right +place, at snd_seq_device_dev_free(). + +Fixes: 7c37ae5c625a ("ALSA: seq: Rewrite sequencer device binding with standard bus") +Reported-and-tested-by: John Keeping +Cc: +Link: https://lore.kernel.org/r/20210930114114.8645-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/seq_device.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/sound/core/seq_device.c ++++ b/sound/core/seq_device.c +@@ -147,6 +147,8 @@ static int snd_seq_device_dev_free(struc + struct snd_seq_device *dev = device->device_data; + + cancel_autoload_drivers(); ++ if (dev->private_free) ++ dev->private_free(dev); + put_device(&dev->dev); + return 0; + } +@@ -174,11 +176,7 @@ static int snd_seq_device_dev_disconnect + + static void snd_seq_dev_release(struct device *dev) + { +- struct snd_seq_device *sdev = to_seq_dev(dev); +- +- if (sdev->private_free) +- sdev->private_free(sdev); +- kfree(sdev); ++ kfree(to_seq_dev(dev)); + } + + /* diff --git a/queue-5.10/alsa-usb-audio-add-quirk-for-vf0770.patch b/queue-5.10/alsa-usb-audio-add-quirk-for-vf0770.patch new file mode 100644 index 00000000000..a65f9cfc089 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-add-quirk-for-vf0770.patch @@ -0,0 +1,75 @@ +From 48827e1d6af58f219e89c7ec08dccbca28c7694e Mon Sep 17 00:00:00 2001 +From: Jonas Hahnfeld +Date: Tue, 12 Oct 2021 22:09:07 +0200 +Subject: ALSA: usb-audio: Add quirk for VF0770 + +From: Jonas Hahnfeld + +commit 48827e1d6af58f219e89c7ec08dccbca28c7694e upstream. + +The device advertises 8 formats, but only a rate of 48kHz is honored +by the hardware and 24 bits give chopped audio, so only report the +one working combination. This fixes out-of-the-box audio experience +with PipeWire which otherwise attempts to choose S24_3LE (while +PulseAudio defaulted to S16_LE). + +Signed-off-by: Jonas Hahnfeld +Cc: +Link: https://lore.kernel.org/r/20211012200906.3492-1-hahnjo@hahnjo.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks-table.h | 42 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 42 insertions(+) + +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -78,6 +78,48 @@ + { USB_DEVICE_VENDOR_SPEC(0x041e, 0x3f19) }, + + /* ++ * Creative Technology, Ltd Live! Cam Sync HD [VF0770] ++ * The device advertises 8 formats, but only a rate of 48kHz is honored by the ++ * hardware and 24 bits give chopped audio, so only report the one working ++ * combination. ++ */ ++{ ++ USB_DEVICE(0x041e, 0x4095), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = &(const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_STANDARD_MIXER, ++ }, ++ { ++ .ifnum = 3, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S16_LE, ++ .channels = 2, ++ .fmt_bits = 16, ++ .iface = 3, ++ .altsetting = 4, ++ .altset_idx = 4, ++ .endpoint = 0x82, ++ .ep_attr = 0x05, ++ .rates = SNDRV_PCM_RATE_48000, ++ .rate_min = 48000, ++ .rate_max = 48000, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { 48000 }, ++ }, ++ }, ++ { ++ .ifnum = -1 ++ }, ++ }, ++ }, ++}, ++ ++/* + * HP Wireless Audio + * When not ignored, causes instability issues for some users, forcing them to + * skip the entire module.