Patch "ALSA: hda - Fix bad dereference of jack object" has been added to the 4.4-stable tree

Patch "ALSA: hda - Fix bad dereference of jack object" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    ALSA: hda - Fix bad dereference of jack object

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-hda-fix-bad-dereference-of-jack-object.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 2ebab40eb74a0225d5dfba72bfae317dd948fa2d Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 9 Feb 2016 10:23:52 +0100
Subject: ALSA: hda - Fix bad dereference of jack object

From: Takashi Iwai <tiwai@suse.de>

commit 2ebab40eb74a0225d5dfba72bfae317dd948fa2d upstream.

The hda_jack_tbl entries are managed by snd_array for allowing
multiple jacks.  It's good per se, but the problem is that struct
hda_jack_callback keeps the hda_jack_tbl pointer.  Since snd_array
doesn't preserve each pointer at resizing the array, we can't keep the
original pointer but have to deduce the pointer at each time via
snd_array_entry() instead.  Actually, this resulted in the deference
to the wrong pointer on codecs that have many pins such as CS4208.

This patch replaces the pointer to the NID value as the search key.
As an unexpected good side effect, this even simplifies the code, as
only NID is needed in most cases.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/hda_generic.c    |    4 ++--
 sound/pci/hda/hda_jack.c       |    2 +-
 sound/pci/hda/hda_jack.h       |    2 +-
 sound/pci/hda/patch_ca0132.c   |    5 ++++-
 sound/pci/hda/patch_hdmi.c     |    2 +-
 sound/pci/hda/patch_realtek.c  |    2 +-
 sound/pci/hda/patch_sigmatel.c |    6 +++---
 7 files changed, 13 insertions(+), 10 deletions(-)

--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -4045,9 +4045,9 @@ static void pin_power_callback(struct hd
 			       struct hda_jack_callback *jack,
 			       bool on)
 {
-	if (jack && jack->tbl->nid)
+	if (jack && jack->nid)
 		sync_power_state_change(codec,
-					set_pin_power_jack(codec, jack->tbl->nid, on));
+					set_pin_power_jack(codec, jack->nid, on));
 }
 
 /* callback only doing power up -- called at first */
--- a/sound/pci/hda/hda_jack.c
+++ b/sound/pci/hda/hda_jack.c
@@ -259,7 +259,7 @@ snd_hda_jack_detect_enable_callback(stru
 		if (!callback)
 			return ERR_PTR(-ENOMEM);
 		callback->func = func;
-		callback->tbl = jack;
+		callback->nid = jack->nid;
 		callback->next = jack->callback;
 		jack->callback = callback;
 	}
--- a/sound/pci/hda/hda_jack.h
+++ b/sound/pci/hda/hda_jack.h
@@ -21,7 +21,7 @@ struct hda_jack_callback;
 typedef void (*hda_jack_callback_fn) (struct hda_codec *, struct hda_jack_callback *);
 
 struct hda_jack_callback {
-	struct hda_jack_tbl *tbl;
+	hda_nid_t nid;
 	hda_jack_callback_fn func;
 	unsigned int private_data;	/* arbitrary data */
 	struct hda_jack_callback *next;
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -4427,13 +4427,16 @@ static void ca0132_process_dsp_response(
 static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
 {
 	struct ca0132_spec *spec = codec->spec;
+	struct hda_jack_tbl *tbl;
 
 	/* Delay enabling the HP amp, to let the mic-detection
 	 * state machine run.
 	 */
 	cancel_delayed_work_sync(&spec->unsol_hp_work);
 	schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
-	cb->tbl->block_report = 1;
+	tbl = snd_hda_jack_tbl_get(codec, cb->nid);
+	if (tbl)
+		tbl->block_report = 1;
 }
 
 static void amic_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1184,7 +1184,7 @@ static void check_presence_and_report(st
 static void jack_callback(struct hda_codec *codec,
 			  struct hda_jack_callback *jack)
 {
-	check_presence_and_report(codec, jack->tbl->nid);
+	check_presence_and_report(codec, jack->nid);
 }
 
 static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -282,7 +282,7 @@ static void alc_update_knob_master(struc
 	uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
 	if (!uctl)
 		return;
-	val = snd_hda_codec_read(codec, jack->tbl->nid, 0,
+	val = snd_hda_codec_read(codec, jack->nid, 0,
 				 AC_VERB_GET_VOLUME_KNOB_CONTROL, 0);
 	val &= HDA_AMP_VOLMASK;
 	uctl->value.integer.value[0] = val;
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -493,9 +493,9 @@ static void jack_update_power(struct hda
 	if (!spec->num_pwrs)
 		return;
 
-	if (jack && jack->tbl->nid) {
-		stac_toggle_power_map(codec, jack->tbl->nid,
-				      snd_hda_jack_detect(codec, jack->tbl->nid),
+	if (jack && jack->nid) {
+		stac_toggle_power_map(codec, jack->nid,
+				      snd_hda_jack_detect(codec, jack->nid),
 				      true);
 		return;
 	}


Patches currently in stable-queue which might be from tiwai@suse.de are

queue-4.4/alsa-seq-fix-race-at-closing-in-virmidi-driver.patch
queue-4.4/alsa-hda-fix-bad-dereference-of-jack-object.patch
queue-4.4/alsa-usb-audio-add-quirk-for-microsoft-lifecam-hd-6000.patch
queue-4.4/alsa-rawmidi-remove-kernel-warning-for-null-user-space-buffer-check.patch
queue-4.4/alsa-usb-audio-fix-oppo-ha-1-vendor-id.patch
queue-4.4/alsa-timer-fix-race-at-concurrent-reads.patch
queue-4.4/alsa-hda-realtek-support-dell-headset-mode-for-alc225.patch
queue-4.4/alsa-hda-fix-static-checker-warning-in-patch_hdmi.c.patch
queue-4.4/alsa-seq-fix-lockdep-warnings-due-to-double-mutex-locks.patch
queue-4.4/alsa-usb-audio-fix-teac-ud-501-ud-503-nt-503-usb-delay.patch
queue-4.4/alsa-timer-fix-wrong-instance-passed-to-slave-callbacks.patch
queue-4.4/alsa-hda-disable-dynamic-clock-gating-on-broxton-before-reset.patch
queue-4.4/alsa-hda-realtek-support-headset-mode-for-alc225.patch
queue-4.4/alsa-hda-implement-loopback-control-switch-for-realtek-and-other-codecs.patch
queue-4.4/alsa-hda-realtek-new-codec-support-of-alc225.patch
queue-4.4/alsa-seq-degrade-the-error-message-for-too-many-opens.patch
queue-4.4/alsa-compress-disable-get_codec_caps-ioctl-for-some-architectures.patch
queue-4.4/alsa-rawmidi-make-snd_rawmidi_transmit-race-free.patch
queue-4.4/alsa-hda-fix-speaker-output-from-vaio-aio-machines.patch
queue-4.4/alsa-bebob-use-a-signed-return-type-for-get_formation_index.patch
queue-4.4/alsa-add-missing-dependency-on-config_snd_timer.patch
queue-4.4/alsa-dummy-implement-timer-backend-switching-more-safely.patch
queue-4.4/alsa-dummy-disable-switching-timer-backend-via-sysfs.patch
queue-4.4/alsa-seq-fix-incorrect-sanity-check-at-snd_seq_oss_synth_cleanup.patch
queue-4.4/alsa-seq-fix-yet-another-races-among-alsa-timer-accesses.patch
queue-4.4/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
queue-4.4/revert-alsa-hda-fix-noise-on-gigabyte-z170x-mobo.patch
queue-4.4/alsa-hda-add-fixup-for-mac-mini-7-1-model.patch
queue-4.4/alsa-usb-audio-add-native-dsd-support-for-ps-audio-nuwave-dac.patch
queue-4.4/alsa-timer-fix-leftover-link-at-closing.patch
queue-4.4/alsa-rawmidi-fix-race-at-copying-updating-the-position.patch
queue-4.4/alsa-pcm-fix-potential-deadlock-in-oss-emulation.patch
queue-4.4/alsa-timer-fix-link-corruption-due-to-double-start-or-stop.patch