Merge tag 'sound-4.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A few small fixes:

   - a fix for the NULL-dereference in rawmidi compat ioctls, triggered
     by fuzzer

   - HD-audio Realtek codec quirks, a VIA controller fixup

   - a long-standing bug fix in LINE6 MIDI"

* tag 'sound-4.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: rawmidi: Fix missing input substream checks in compat ioctls
  ALSA: hda/realtek - adjust the location of one mic
  ALSA: hda/realtek - set PINCFG_HEADSET_MIC to parse_flags
  ALSA: hda - New VIA controller suppor no-snoop path
  ALSA: line6: Use correct endpoint type for midi output

4 files changed, 18 insertions, 8 deletions

diff --git a/sound/core/rawmidi_compat.c b/sound/core/rawmidi_compat.c
index f69764d7cdd7..e30e30ba6e39 100644
--- a/sound/core/rawmidi_compat.c
+++ b/sound/core/rawmidi_compat.c
@@ -36,8 +36,6 @@ static int snd_rawmidi_ioctl_params_compat(struct snd_rawmidi_file *rfile,
         struct snd_rawmidi_params params;
         unsigned int val;
 
-        if (rfile->output == NULL)
-                return -EINVAL;
         if (get_user(params.stream, &src->stream) ||
             get_user(params.buffer_size, &src->buffer_size) ||
             get_user(params.avail_min, &src->avail_min) ||
@@ -46,8 +44,12 @@ static int snd_rawmidi_ioctl_params_compat(struct snd_rawmidi_file *rfile,
         params.no_active_sensing = val;
         switch (params.stream) {
         case SNDRV_RAWMIDI_STREAM_OUTPUT:
+                if (!rfile->output)
+                        return -EINVAL;
                 return snd_rawmidi_output_params(rfile->output, &params);
         case SNDRV_RAWMIDI_STREAM_INPUT:
+                if (!rfile->input)
+                        return -EINVAL;
                 return snd_rawmidi_input_params(rfile->input, &params);
         }
         return -EINVAL;
@@ -67,16 +69,18 @@ static int snd_rawmidi_ioctl_status_compat(struct snd_rawmidi_file *rfile,
         int err;
         struct snd_rawmidi_status status;
 
-        if (rfile->output == NULL)
-                return -EINVAL;
         if (get_user(status.stream, &src->stream))
                 return -EFAULT;
 
         switch (status.stream) {
         case SNDRV_RAWMIDI_STREAM_OUTPUT:
+                if (!rfile->output)
+                        return -EINVAL;
                 err = snd_rawmidi_output_status(rfile->output, &status);
                 break;
         case SNDRV_RAWMIDI_STREAM_INPUT:
+                if (!rfile->input)
+                        return -EINVAL;
                 err = snd_rawmidi_input_status(rfile->input, &status);
                 break;
         default:
@@ -112,16 +116,18 @@ static int snd_rawmidi_ioctl_status_x32(struct snd_rawmidi_file *rfile,
         int err;
         struct snd_rawmidi_status status;
 
-        if (rfile->output == NULL)
-                return -EINVAL;
         if (get_user(status.stream, &src->stream))
                 return -EFAULT;
 
         switch (status.stream) {
         case SNDRV_RAWMIDI_STREAM_OUTPUT:
+                if (!rfile->output)
+                        return -EINVAL;
                 err = snd_rawmidi_output_status(rfile->output, &status);
                 break;
         case SNDRV_RAWMIDI_STREAM_INPUT:
+                if (!rfile->input)
+                        return -EINVAL;
                 err = snd_rawmidi_input_status(rfile->input, &status);
                 break;
         default:
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 7a111a1b5836..b0c8c79848a9 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1647,7 +1647,8 @@ static void azx_check_snoop_available(struct azx *chip)
                  */
                 u8 val;
                 pci_read_config_byte(chip->pci, 0x42, &val);
-                if (!(val & 0x80) && chip->pci->revision == 0x30)
+                if (!(val & 0x80) && (chip->pci->revision == 0x30 ||
+                                      chip->pci->revision == 0x20))
                         snoop = false;
         }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index aef1f52db7d9..fc77bf7a1544 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6370,6 +6370,8 @@ static const struct hda_fixup alc269_fixups[] = {
                         { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
                         { }
                 },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MIC
         },
 };
 
@@ -6573,6 +6575,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+        SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c
index 6d7cde56a355..e2cf55c53ea8 100644
--- a/sound/usb/line6/midi.c
+++ b/sound/usb/line6/midi.c
@@ -125,7 +125,7 @@ static int send_midi_async(struct usb_line6 *line6, unsigned char *data,
         }
 
         usb_fill_int_urb(urb, line6->usbdev,
-                         usb_sndbulkpipe(line6->usbdev,
+                         usb_sndintpipe(line6->usbdev,
                                          line6->properties->ep_ctrl_w),
                          transfer_buffer, length, midi_sent, line6,
                          line6->interval);