From patchwork Thu Feb 18 05:25:02 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: libin.yang@linux.intel.com X-Patchwork-Id: 8345981 Return-Path: X-Original-To: patchwork-alsa-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 9E12AC0553 for ; Thu, 18 Feb 2016 05:29:31 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id ED1AD20380 for ; Thu, 18 Feb 2016 05:29:27 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.kernel.org (Postfix) with ESMTP id A7C26201BB for ; Thu, 18 Feb 2016 05:29:23 +0000 (UTC) Received: by alsa0.perex.cz (Postfix, from userid 1000) id 94810265A39; Thu, 18 Feb 2016 06:29:22 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from alsa0.perex.cz (localhost [127.0.0.1]) by alsa0.perex.cz (Postfix) with ESMTP id D4DC82606BA; Thu, 18 Feb 2016 06:29:13 +0100 (CET) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 407F42606F4; Thu, 18 Feb 2016 06:29:13 +0100 (CET) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by alsa0.perex.cz (Postfix) with ESMTP id 2AD3426067A for ; Thu, 18 Feb 2016 06:29:05 +0100 (CET) Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga102.fm.intel.com with ESMTP; 17 Feb 2016 21:29:05 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.22,464,1449561600"; d="scan'208";a="748460008" Received: from younglee-grantley.sh.intel.com ([10.239.159.22]) by orsmga003.jf.intel.com with ESMTP; 17 Feb 2016 21:29:03 -0800 From: libin.yang@linux.intel.com To: alsa-devel@alsa-project.org, tiwai@suse.de Date: Thu, 18 Feb 2016 13:25:02 +0800 Message-Id: <1455773102-135817-1-git-send-email-libin.yang@linux.intel.com> X-Mailer: git-send-email 1.9.1 Cc: libin.yang@intel.com, mengdong.lin@intel.com, Libin Yang Subject: [alsa-devel] [PATCH] ALSA: hda - hdmi get jack from hda_jack_tbl when not dyn_pcm_assign X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP From: Libin Yang On Intel platform, if !dyn_pcm_assign, spec->pcm_rec[].jack is not NULL even after snd_hda_jack_tbl_clear() is called to free snd_jack. This may cause access invalid memory when calling snd_jack_report. Please see more detail from: https://bugs.freedesktop.org/show_bug.cgi?id=94079 Signed-off-by: Libin Yang --- sound/pci/hda/patch_hdmi.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c index f4443b5..3b47101 100644 --- a/sound/pci/hda/patch_hdmi.c +++ b/sound/pci/hda/patch_hdmi.c @@ -1962,6 +1962,7 @@ static void sync_eld_via_acomp(struct hda_codec *codec, { struct hdmi_spec *spec = codec->spec; struct hdmi_eld *eld = &spec->temp_eld; + struct hda_jack_tbl *jack_tbl; struct snd_jack *jack = NULL; int size; @@ -1989,10 +1990,21 @@ static void sync_eld_via_acomp(struct hda_codec *codec, /* pcm_idx >=0 before update_eld() means it is in monitor * disconnected event. Jack must be fetched before update_eld() */ - if (per_pin->pcm_idx >= 0) + /* if !dyn_pcm_assign, get jack from hda_jack_tbl + * in !dyn_pcm_assign case, spec->pcm_rec[].jack is not + * NULL even after snd_hda_jack_tbl_clear() is called to + * free snd_jack. This may cause access invalid memory + * when calling snd_jack_report + */ + if (per_pin->pcm_idx >= 0 && spec->dyn_pcm_assign) jack = spec->pcm_rec[per_pin->pcm_idx].jack; + else { + jack_tbl = snd_hda_jack_tbl_get(codec, per_pin->pin_nid); + if (jack_tbl) + jack = jack_tbl->jack; + } update_eld(codec, per_pin, eld); - if (jack == NULL && per_pin->pcm_idx >= 0) + if (jack == NULL && per_pin->pcm_idx >= 0 && spec->dyn_pcm_assign) jack = spec->pcm_rec[per_pin->pcm_idx].jack; if (jack == NULL) goto unlock;