From 468778a09c8a0c0b495064745ece2c73f4b4d389 Mon Sep 17 00:00:00 2001 From: Markus Elfring Date: Wed, 6 Sep 2017 08:18:30 +0200 Subject: ALSA: maestro3: Use common error handling code in two functions Add jump targets so that a bit of exception handling can be better reused at the end of these functions. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai --- sound/pci/maestro3.c | 57 ++++++++++++++++++++++++++-------------------------- 1 file changed, 28 insertions(+), 29 deletions(-) (limited to 'sound') diff --git a/sound/pci/maestro3.c b/sound/pci/maestro3.c index 97ac80af4447..8f20dec97843 100644 --- a/sound/pci/maestro3.c +++ b/sound/pci/maestro3.c @@ -2622,22 +2622,18 @@ snd_m3_create(struct snd_card *card, struct pci_dev *pci, err = request_firmware(&chip->assp_kernel_image, "ess/maestro3_assp_kernel.fw", &pci->dev); - if (err < 0) { - snd_m3_free(chip); - return err; - } + if (err < 0) + goto free_chip; err = request_firmware(&chip->assp_minisrc_image, "ess/maestro3_assp_minisrc.fw", &pci->dev); - if (err < 0) { - snd_m3_free(chip); - return err; - } + if (err < 0) + goto free_chip; + + err = pci_request_regions(pci, card->driver); + if (err < 0) + goto free_chip; - if ((err = pci_request_regions(pci, card->driver)) < 0) { - snd_m3_free(chip); - return err; - } chip->iobase = pci_resource_start(pci, 0); /* just to be sure */ @@ -2655,8 +2651,8 @@ snd_m3_create(struct snd_card *card, struct pci_dev *pci, if (request_irq(pci->irq, snd_m3_interrupt, IRQF_SHARED, KBUILD_MODNAME, chip)) { dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq); - snd_m3_free(chip); - return -ENOMEM; + err = -ENOMEM; + goto free_chip; } chip->irq = pci->irq; @@ -2666,10 +2662,9 @@ snd_m3_create(struct snd_card *card, struct pci_dev *pci, dev_warn(card->dev, "can't allocate apm buffer\n"); #endif - if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) { - snd_m3_free(chip); - return err; - } + err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops); + if (err < 0) + goto free_chip; if ((err = snd_m3_mixer(chip)) < 0) return err; @@ -2699,6 +2694,10 @@ snd_m3_create(struct snd_card *card, struct pci_dev *pci, *chip_ret = chip; return 0; + +free_chip: + snd_m3_free(chip); + return err; } /* @@ -2741,23 +2740,19 @@ snd_m3_probe(struct pci_dev *pci, const struct pci_device_id *pci_id) break; } - if ((err = snd_m3_create(card, pci, - external_amp[dev], - amp_gpio[dev], - &chip)) < 0) { - snd_card_free(card); - return err; - } + err = snd_m3_create(card, pci, external_amp[dev], amp_gpio[dev], &chip); + if (err < 0) + goto free_card; + card->private_data = chip; sprintf(card->shortname, "ESS %s PCI", card->driver); sprintf(card->longname, "%s at 0x%lx, irq %d", card->shortname, chip->iobase, chip->irq); - if ((err = snd_card_register(card)) < 0) { - snd_card_free(card); - return err; - } + err = snd_card_register(card); + if (err < 0) + goto free_card; #if 0 /* TODO: not supported yet */ /* TODO enable MIDI IRQ and I/O */ @@ -2772,6 +2767,10 @@ snd_m3_probe(struct pci_dev *pci, const struct pci_device_id *pci_id) pci_set_drvdata(pci, card); dev++; return 0; + +free_card: + snd_card_free(card); + return err; } static void snd_m3_remove(struct pci_dev *pci) -- cgit v1.2.3 From 99dcad32376effb70bf466c70595edbbcbecd6d7 Mon Sep 17 00:00:00 2001 From: Markus Elfring Date: Tue, 5 Sep 2017 22:08:30 +0200 Subject: ALSA: rme9652: Use common code in hdsp_get_iobox_version() Add a jump target so that a bit of common code can be better reused at the end of this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai --- sound/pci/rme9652/hdsp.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) (limited to 'sound') diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c index 0ff41f9ab434..9f0f73875f01 100644 --- a/sound/pci/rme9652/hdsp.c +++ b/sound/pci/rme9652/hdsp.c @@ -793,11 +793,8 @@ static int hdsp_get_iobox_version (struct hdsp *hdsp) hdsp_write(hdsp, HDSP_control2Reg, HDSP_S200 | HDSP_PROGRAM); hdsp_write (hdsp, HDSP_fifoData, 0); - if (hdsp_fifo_wait(hdsp, 0, HDSP_SHORT_WAIT) < 0) { - hdsp->io_type = Multiface; - dev_info(hdsp->card->dev, "Multiface found\n"); - return 0; - } + if (hdsp_fifo_wait(hdsp, 0, HDSP_SHORT_WAIT) < 0) + goto set_multi; hdsp_write(hdsp, HDSP_control2Reg, HDSP_S_LOAD); hdsp_write(hdsp, HDSP_fifoData, 0); @@ -810,20 +807,14 @@ static int hdsp_get_iobox_version (struct hdsp *hdsp) hdsp_write(hdsp, HDSP_control2Reg, HDSP_S300); hdsp_write(hdsp, HDSP_control2Reg, HDSP_S_LOAD); hdsp_write(hdsp, HDSP_fifoData, 0); - if (hdsp_fifo_wait(hdsp, 0, HDSP_SHORT_WAIT) == 0) { - hdsp->io_type = Multiface; - dev_info(hdsp->card->dev, "Multiface found\n"); - return 0; - } + if (hdsp_fifo_wait(hdsp, 0, HDSP_SHORT_WAIT) == 0) + goto set_multi; hdsp_write(hdsp, HDSP_control2Reg, HDSP_S300); hdsp_write(hdsp, HDSP_control2Reg, HDSP_S_LOAD); hdsp_write(hdsp, HDSP_fifoData, 0); - if (hdsp_fifo_wait(hdsp, 0, HDSP_SHORT_WAIT) < 0) { - hdsp->io_type = Multiface; - dev_info(hdsp->card->dev, "Multiface found\n"); - return 0; - } + if (hdsp_fifo_wait(hdsp, 0, HDSP_SHORT_WAIT) < 0) + goto set_multi; hdsp->io_type = RPM; dev_info(hdsp->card->dev, "RPM found\n"); @@ -838,6 +829,11 @@ static int hdsp_get_iobox_version (struct hdsp *hdsp) hdsp->io_type = Digiface; } return 0; + +set_multi: + hdsp->io_type = Multiface; + dev_info(hdsp->card->dev, "Multiface found\n"); + return 0; } -- cgit v1.2.3 From e35e9ddfab7e6017b38b8b75cd13756530b3b2b6 Mon Sep 17 00:00:00 2001 From: Markus Elfring Date: Tue, 5 Sep 2017 22:22:21 +0200 Subject: ALSA: hdspm: Use common error handling code in snd_hdspm_probe() Add a jump target so that a bit of exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai --- sound/pci/rme9652/hdspm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'sound') diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c index 25284d8d9758..f20d42714e4d 100644 --- a/sound/pci/rme9652/hdspm.c +++ b/sound/pci/rme9652/hdspm.c @@ -6949,10 +6949,8 @@ static int snd_hdspm_probe(struct pci_dev *pci, hdspm->pci = pci; err = snd_hdspm_create(card, hdspm); - if (err < 0) { - snd_card_free(card); - return err; - } + if (err < 0) + goto free_card; if (hdspm->io_type != MADIface) { snprintf(card->shortname, sizeof(card->shortname), "%s_%x", @@ -6970,15 +6968,17 @@ static int snd_hdspm_probe(struct pci_dev *pci, } err = snd_card_register(card); - if (err < 0) { - snd_card_free(card); - return err; - } + if (err < 0) + goto free_card; pci_set_drvdata(pci, card); dev++; return 0; + +free_card: + snd_card_free(card); + return err; } static void snd_hdspm_remove(struct pci_dev *pci) -- cgit v1.2.3 From 80753cdfef2a16a71d7c6b5aafe9700a2650913c Mon Sep 17 00:00:00 2001 From: Markus Elfring Date: Wed, 6 Sep 2017 14:45:09 +0200 Subject: ALSA: us122l: Use common error handling code in us122l_create_card() Add a jump target so that a bit of exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai --- sound/usb/usx2y/us122l.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'sound') diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c index b49d6e953d52..159da1f3924e 100644 --- a/sound/usb/usx2y/us122l.c +++ b/sound/usb/usx2y/us122l.c @@ -508,8 +508,7 @@ static bool us122l_create_card(struct snd_card *card) err = us122l_create_usbmidi(card); if (err < 0) { snd_printk(KERN_ERR "us122l_create_usbmidi error %i \n", err); - us122l_stop(us122l); - return false; + goto stop; } err = usb_stream_hwdep_new(card); if (err < 0) { @@ -518,10 +517,13 @@ static bool us122l_create_card(struct snd_card *card) list_for_each(p, &us122l->midi_list) snd_usbmidi_disconnect(p); - us122l_stop(us122l); - return false; + goto stop; } return true; + +stop: + us122l_stop(us122l); + return false; } static void snd_us122l_free(struct snd_card *card) -- cgit v1.2.3 From d2d977087970526ac7c8b08a492081ea2e1f6c29 Mon Sep 17 00:00:00 2001 From: Markus Elfring Date: Wed, 6 Sep 2017 15:00:08 +0200 Subject: ALSA: usx2y: Use common error handling code in submit_urbs() Add a jump target so that a bit of exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai --- sound/usb/usx2y/usb_stream.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) (limited to 'sound') diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c index fe926cb9192e..4dab49080700 100644 --- a/sound/usb/usx2y/usb_stream.c +++ b/sound/usb/usx2y/usb_stream.c @@ -352,20 +352,22 @@ static int submit_urbs(struct usb_stream_kernel *sk, int err; prepare_inurb(sk->idle_outurb->number_of_packets, sk->idle_inurb); err = usb_submit_urb(sk->idle_inurb, GFP_ATOMIC); - if (err < 0) { - snd_printk(KERN_ERR "%i\n", err); - return err; - } + if (err < 0) + goto report_failure; + sk->idle_inurb = sk->completed_inurb; sk->completed_inurb = inurb; err = usb_submit_urb(sk->idle_outurb, GFP_ATOMIC); - if (err < 0) { - snd_printk(KERN_ERR "%i\n", err); - return err; - } + if (err < 0) + goto report_failure; + sk->idle_outurb = sk->completed_outurb; sk->completed_outurb = outurb; return 0; + +report_failure: + snd_printk(KERN_ERR "%i\n", err); + return err; } #ifdef DEBUG_LOOP_BACK -- cgit v1.2.3 From f804fff1361c9da30efc21721dc0ae5934413c4b Mon Sep 17 00:00:00 2001 From: Markus Elfring Date: Wed, 6 Sep 2017 16:26:29 +0200 Subject: ALSA: 6fire: Use common error handling code in usb6fire_chip_probe() Add a jump target so that a bit of exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai --- sound/usb/6fire/chip.c | 31 +++++++++++++------------------ 1 file changed, 13 insertions(+), 18 deletions(-) (limited to 'sound') diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c index bc2a24f7a791..c7641cb50616 100644 --- a/sound/usb/6fire/chip.c +++ b/sound/usb/6fire/chip.c @@ -143,37 +143,32 @@ static int usb6fire_chip_probe(struct usb_interface *intf, chip->card = card; ret = usb6fire_comm_init(chip); - if (ret < 0) { - usb6fire_chip_destroy(chip); - return ret; - } + if (ret < 0) + goto destroy_chip; ret = usb6fire_midi_init(chip); - if (ret < 0) { - usb6fire_chip_destroy(chip); - return ret; - } + if (ret < 0) + goto destroy_chip; ret = usb6fire_pcm_init(chip); - if (ret < 0) { - usb6fire_chip_destroy(chip); - return ret; - } + if (ret < 0) + goto destroy_chip; ret = usb6fire_control_init(chip); - if (ret < 0) { - usb6fire_chip_destroy(chip); - return ret; - } + if (ret < 0) + goto destroy_chip; ret = snd_card_register(card); if (ret < 0) { dev_err(&intf->dev, "cannot register card."); - usb6fire_chip_destroy(chip); - return ret; + goto destroy_chip; } usb_set_intfdata(intf, chip); return 0; + +destroy_chip: + usb6fire_chip_destroy(chip); + return ret; } static void usb6fire_chip_disconnect(struct usb_interface *intf) -- cgit v1.2.3 From 1f5ca8ec58eaa9d42a2474ecae335ead3f845ba1 Mon Sep 17 00:00:00 2001 From: Markus Elfring Date: Wed, 6 Sep 2017 20:45:11 +0200 Subject: ALSA: ymfpci: Use common error handling code in snd_card_ymfpci_probe() * Add a jump target so that a bit of exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. * The script "checkpatch.pl" pointed information out like the following. ERROR: do not use assignment in if condition Thus fix a few source code places. [ This also fixed a potential use-after-free at error path of snd_opl3_hwdep_new(), too -- tiwai ] Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai --- sound/pci/ymfpci/ymfpci.c | 62 +++++++++++++++++++++++------------------------ 1 file changed, 30 insertions(+), 32 deletions(-) (limited to 'sound') diff --git a/sound/pci/ymfpci/ymfpci.c b/sound/pci/ymfpci/ymfpci.c index 4faf3e1ed06a..eafdee384059 100644 --- a/sound/pci/ymfpci/ymfpci.c +++ b/sound/pci/ymfpci/ymfpci.c @@ -268,10 +268,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, if ((err = snd_ymfpci_create(card, pci, old_legacy_ctrl, &chip)) < 0) { - snd_card_free(card); release_and_free_resource(mpu_res); release_and_free_resource(fm_res); - return err; + goto free_card; } chip->fm_res = fm_res; chip->mpu_res = mpu_res; @@ -283,35 +282,31 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, card->shortname, chip->reg_area_phys, chip->irq); - if ((err = snd_ymfpci_pcm(chip, 0)) < 0) { - snd_card_free(card); - return err; - } - if ((err = snd_ymfpci_pcm_spdif(chip, 1)) < 0) { - snd_card_free(card); - return err; - } + err = snd_ymfpci_pcm(chip, 0); + if (err < 0) + goto free_card; + + err = snd_ymfpci_pcm_spdif(chip, 1); + if (err < 0) + goto free_card; + err = snd_ymfpci_mixer(chip, rear_switch[dev]); - if (err < 0) { - snd_card_free(card); - return err; - } + if (err < 0) + goto free_card; + if (chip->ac97->ext_id & AC97_EI_SDAC) { err = snd_ymfpci_pcm_4ch(chip, 2); - if (err < 0) { - snd_card_free(card); - return err; - } + if (err < 0) + goto free_card; + err = snd_ymfpci_pcm2(chip, 3); - if (err < 0) { - snd_card_free(card); - return err; - } - } - if ((err = snd_ymfpci_timer(chip, 0)) < 0) { - snd_card_free(card); - return err; + if (err < 0) + goto free_card; } + err = snd_ymfpci_timer(chip, 0); + if (err < 0) + goto free_card; + if (chip->mpu_res) { if ((err = snd_mpu401_uart_new(card, 0, MPU401_HW_YMFPCI, mpu_port[dev], @@ -336,21 +331,24 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, legacy_ctrl &= ~YMFPCI_LEGACY_FMEN; pci_write_config_word(pci, PCIR_DSXG_LEGACY, legacy_ctrl); } else if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) { - snd_card_free(card); dev_err(card->dev, "cannot create opl3 hwdep\n"); - return err; + goto free_card; } } snd_ymfpci_create_gameport(chip, dev, legacy_ctrl, legacy_ctrl2); - if ((err = snd_card_register(card)) < 0) { - snd_card_free(card); - return err; - } + err = snd_card_register(card); + if (err < 0) + goto free_card; + pci_set_drvdata(pci, card); dev++; return 0; + +free_card: + snd_card_free(card); + return err; } static void snd_card_ymfpci_remove(struct pci_dev *pci) -- cgit v1.2.3 From ba2186e40c9565b0a3ecd9e51ac1195cc501c182 Mon Sep 17 00:00:00 2001 From: Markus Elfring Date: Wed, 6 Sep 2017 21:12:51 +0200 Subject: ALSA: ymfpci: Use common error handling code in snd_ymfpci_create() * Add a jump target so that a bit of exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. * The script "checkpatch.pl" pointed information out like the following. ERROR: do not use assignment in if condition Thus fix a few source code places. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai --- sound/pci/ymfpci/ymfpci_main.c | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-) (limited to 'sound') diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c index edfd58248082..8ca2e41e5827 100644 --- a/sound/pci/ymfpci/ymfpci_main.c +++ b/sound/pci/ymfpci/ymfpci_main.c @@ -2399,59 +2399,60 @@ int snd_ymfpci_create(struct snd_card *card, dev_err(chip->card->dev, "unable to grab memory region 0x%lx-0x%lx\n", chip->reg_area_phys, chip->reg_area_phys + 0x8000 - 1); - snd_ymfpci_free(chip); - return -EBUSY; + err = -EBUSY; + goto free_chip; } if (request_irq(pci->irq, snd_ymfpci_interrupt, IRQF_SHARED, KBUILD_MODNAME, chip)) { dev_err(chip->card->dev, "unable to grab IRQ %d\n", pci->irq); - snd_ymfpci_free(chip); - return -EBUSY; + err = -EBUSY; + goto free_chip; } chip->irq = pci->irq; snd_ymfpci_aclink_reset(pci); if (snd_ymfpci_codec_ready(chip, 0) < 0) { - snd_ymfpci_free(chip); - return -EIO; + err = -EIO; + goto free_chip; } err = snd_ymfpci_request_firmware(chip); if (err < 0) { dev_err(chip->card->dev, "firmware request failed: %d\n", err); - snd_ymfpci_free(chip); - return err; + goto free_chip; } snd_ymfpci_download_image(chip); udelay(100); /* seems we need a delay after downloading image.. */ if (snd_ymfpci_memalloc(chip) < 0) { - snd_ymfpci_free(chip); - return -EIO; + err = -EIO; + goto free_chip; } - if ((err = snd_ymfpci_ac3_init(chip)) < 0) { - snd_ymfpci_free(chip); - return err; - } + err = snd_ymfpci_ac3_init(chip); + if (err < 0) + goto free_chip; #ifdef CONFIG_PM_SLEEP chip->saved_regs = kmalloc(YDSXGR_NUM_SAVED_REGS * sizeof(u32), GFP_KERNEL); if (chip->saved_regs == NULL) { - snd_ymfpci_free(chip); - return -ENOMEM; + err = -ENOMEM; + goto free_chip; } #endif - if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) { - snd_ymfpci_free(chip); - return err; - } + err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops); + if (err < 0) + goto free_chip; snd_ymfpci_proc_init(card, chip); *rchip = chip; return 0; + +free_chip: + snd_ymfpci_free(chip); + return err; } -- cgit v1.2.3 From c8445589450582a3d948779c0fc5106604ce89a1 Mon Sep 17 00:00:00 2001 From: Helge Deller Date: Wed, 6 Sep 2017 22:28:01 +0200 Subject: ALSA: core: Use %pS printk format for direct addresses The debug functions uses wrongly the %pF instead of the %pS printk format specifier for printing symbols for the address returned by _builtin_return_address(0). Fix it for the ia64, ppc64 and parisc64 architectures. Signed-off-by: Helge Deller Signed-off-by: Takashi Iwai --- sound/core/device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sound') diff --git a/sound/core/device.c b/sound/core/device.c index 8918838b1999..cb0e46f66cc9 100644 --- a/sound/core/device.c +++ b/sound/core/device.c @@ -128,7 +128,7 @@ void snd_device_disconnect(struct snd_card *card, void *device_data) if (dev) __snd_device_disconnect(dev); else - dev_dbg(card->dev, "device disconnect %p (from %pF), not found\n", + dev_dbg(card->dev, "device disconnect %p (from %pS), not found\n", device_data, __builtin_return_address(0)); } EXPORT_SYMBOL_GPL(snd_device_disconnect); @@ -152,7 +152,7 @@ void snd_device_free(struct snd_card *card, void *device_data) if (dev) __snd_device_free(dev); else - dev_dbg(card->dev, "device free %p (from %pF), not found\n", + dev_dbg(card->dev, "device free %p (from %pS), not found\n", device_data, __builtin_return_address(0)); } EXPORT_SYMBOL(snd_device_free); -- cgit v1.2.3 From 2a0d85d9add77bb7a4ddd61557ffb21ca5370d15 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Thu, 7 Sep 2017 10:51:54 +0200 Subject: ALSA: asihpi: Kill BUG_ON() usages BUG_ON() is the worst choice for a trivial sanity check. Either it should be removed or replaced with a softer one like WARN_ON() if still really needed. Signed-off-by: Takashi Iwai --- sound/pci/asihpi/asihpi.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'sound') diff --git a/sound/pci/asihpi/asihpi.c b/sound/pci/asihpi/asihpi.c index 976a3d23557e..70d023a85bf5 100644 --- a/sound/pci/asihpi/asihpi.c +++ b/sound/pci/asihpi/asihpi.c @@ -558,12 +558,10 @@ static void snd_card_asihpi_pcm_int_start(struct snd_pcm_substream *substream) struct snd_card_asihpi_pcm *dpcm; struct snd_card_asihpi *card; - BUG_ON(!substream); - dpcm = (struct snd_card_asihpi_pcm *)substream->runtime->private_data; card = snd_pcm_substream_chip(substream); - BUG_ON(in_interrupt()); + WARN_ON(in_interrupt()); tasklet_disable(&card->t); card->llmode_streampriv = dpcm; tasklet_enable(&card->t); @@ -578,8 +576,6 @@ static void snd_card_asihpi_pcm_int_stop(struct snd_pcm_substream *substream) struct snd_card_asihpi_pcm *dpcm; struct snd_card_asihpi *card; - BUG_ON(!substream); - dpcm = (struct snd_card_asihpi_pcm *)substream->runtime->private_data; card = snd_pcm_substream_chip(substream); -- cgit v1.2.3 From f16e666b9b7e07237ca0669df9b89ccf8dfc102c Mon Sep 17 00:00:00 2001 From: Markus Elfring Date: Wed, 6 Sep 2017 13:30:14 +0200 Subject: ALSA: firewire: Use common error handling code in snd_motu_stream_start_duplex() Add a jump target so that a bit of exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai --- sound/firewire/motu/motu-stream.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'sound') diff --git a/sound/firewire/motu/motu-stream.c b/sound/firewire/motu/motu-stream.c index dc5541c8b359..73e7a5e527fc 100644 --- a/sound/firewire/motu/motu-stream.c +++ b/sound/firewire/motu/motu-stream.c @@ -253,24 +253,21 @@ int snd_motu_stream_start_duplex(struct snd_motu *motu, unsigned int rate) if (err < 0) { dev_err(&motu->unit->device, "fail to start isochronous comm: %d\n", err); - stop_both_streams(motu); - return err; + goto stop_streams; } err = start_isoc_ctx(motu, &motu->rx_stream); if (err < 0) { dev_err(&motu->unit->device, "fail to start IT context: %d\n", err); - stop_both_streams(motu); - return err; + goto stop_streams; } err = protocol->switch_fetching_mode(motu, true); if (err < 0) { dev_err(&motu->unit->device, "fail to enable frame fetching: %d\n", err); - stop_both_streams(motu); - return err; + goto stop_streams; } } @@ -281,12 +278,15 @@ int snd_motu_stream_start_duplex(struct snd_motu *motu, unsigned int rate) dev_err(&motu->unit->device, "fail to start IR context: %d", err); amdtp_stream_stop(&motu->rx_stream); - stop_both_streams(motu); - return err; + goto stop_streams; } } return 0; + +stop_streams: + stop_both_streams(motu); + return err; } void snd_motu_stream_stop_duplex(struct snd_motu *motu) -- cgit v1.2.3 From fc27fe7e8deef2f37cba3f2be2d52b6ca5eb9d57 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Tue, 12 Sep 2017 12:41:20 +0200 Subject: ALSA: seq: Cancel pending autoload work at unbinding device ALSA sequencer core has a mechanism to load the enumerated devices automatically, and it's performed in an off-load work. This seems causing some race when a sequencer is removed while the pending autoload work is running. As syzkaller spotted, it may lead to some use-after-free: BUG: KASAN: use-after-free in snd_rawmidi_dev_seq_free+0x69/0x70 sound/core/rawmidi.c:1617 Write of size 8 at addr ffff88006c611d90 by task kworker/2:1/567 CPU: 2 PID: 567 Comm: kworker/2:1 Not tainted 4.13.0+ #29 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: events autoload_drivers Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x192/0x22c lib/dump_stack.c:52 print_address_description+0x78/0x280 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x230/0x340 mm/kasan/report.c:409 __asan_report_store8_noabort+0x1c/0x20 mm/kasan/report.c:435 snd_rawmidi_dev_seq_free+0x69/0x70 sound/core/rawmidi.c:1617 snd_seq_dev_release+0x4f/0x70 sound/core/seq_device.c:192 device_release+0x13f/0x210 drivers/base/core.c:814 kobject_cleanup lib/kobject.c:648 [inline] kobject_release lib/kobject.c:677 [inline] kref_put include/linux/kref.h:70 [inline] kobject_put+0x145/0x240 lib/kobject.c:694 put_device+0x25/0x30 drivers/base/core.c:1799 klist_devices_put+0x36/0x40 drivers/base/bus.c:827 klist_next+0x264/0x4a0 lib/klist.c:403 next_device drivers/base/bus.c:270 [inline] bus_for_each_dev+0x17e/0x210 drivers/base/bus.c:312 autoload_drivers+0x3b/0x50 sound/core/seq_device.c:117 process_one_work+0x9fb/0x1570 kernel/workqueue.c:2097 worker_thread+0x1e4/0x1350 kernel/workqueue.c:2231 kthread+0x324/0x3f0 kernel/kthread.c:231 ret_from_fork+0x25/0x30 arch/x86/entry/entry_64.S:425 The fix is simply to assure canceling the autoload work at removing the device. Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Cc: Signed-off-by: Takashi Iwai --- sound/core/seq_device.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'sound') diff --git a/sound/core/seq_device.c b/sound/core/seq_device.c index c4acf17e9f5e..e40a2cba5002 100644 --- a/sound/core/seq_device.c +++ b/sound/core/seq_device.c @@ -148,8 +148,10 @@ void snd_seq_device_load_drivers(void) flush_work(&autoload_work); } EXPORT_SYMBOL(snd_seq_device_load_drivers); +#define cancel_autoload_drivers() cancel_work_sync(&autoload_work) #else #define queue_autoload_drivers() /* NOP */ +#define cancel_autoload_drivers() /* NOP */ #endif /* @@ -159,6 +161,7 @@ static int snd_seq_device_dev_free(struct snd_device *device) { struct snd_seq_device *dev = device->device_data; + cancel_autoload_drivers(); put_device(&dev->dev); return 0; } -- cgit v1.2.3