Merge tag 'sound-5.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "The important fixes at this time are a couple fixes in ALSA core: a
  fix for PCM is about the OOB access in PCM OSS plugins that has been
  for long time, but hasn't hit so often until now just because we
  allocated a large buffer via vmalloc(), and surfaced more often after
  switching to kvmalloc(). Another fix is for a long-standing PCM
  problem wrt racy PM resume.

  Others are trivial nospec coverage and usual HD-audio quirks"

* tag 'sound-5.1-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/realtek - Fix speakers on Acer Predator Helios 500 Ryzen laptops
  ALSA: pcm: Don't suspend stream in unrecoverable PCM state
  ALSA: hda/ca0132 - Simplify alt firmware loading code
  ALSA: pcm: Fix possible OOB access in PCM oss plugins
  ALSA: hda/realtek: Enable headset MIC of ASUS X430UN and X512DK with ALC256
  ALSA: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256
  ALSA: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256
  ALSA: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic
  ALSA: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286
  ALSA: seq: oss: Fix Spectre v1 vulnerability
  ALSA: rawmidi: Fix potential Spectre v1 vulnerability

6 files changed, 77 insertions, 39 deletions

diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index d5b0d7ba83c4..f6ae68017608 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -940,6 +940,28 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
         oss_frame_size = snd_pcm_format_physical_width(params_format(params)) *
                          params_channels(params) / 8;
 
+        err = snd_pcm_oss_period_size(substream, params, sparams);
+        if (err < 0)
+                goto failure;
+
+        n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size);
+        err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
+        if (err < 0)
+                goto failure;
+
+        err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS,
+                                     runtime->oss.periods, NULL);
+        if (err < 0)
+                goto failure;
+
+        snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+
+        err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams);
+        if (err < 0) {
+                pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
+                goto failure;
+        }
+
 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
         snd_pcm_oss_plugin_clear(substream);
         if (!direct) {
@@ -974,27 +996,6 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
         }
 #endif
 
-        err = snd_pcm_oss_period_size(substream, params, sparams);
-        if (err < 0)
-                goto failure;
-
-        n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size);
-        err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL);
-        if (err < 0)
-                goto failure;
-
-        err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS,
-                                     runtime->oss.periods, NULL);
-        if (err < 0)
-                goto failure;
-
-        snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
-
-        if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams)) < 0) {
-                pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err);
-                goto failure;
-        }
-
         if (runtime->oss.trigger) {
                 sw_params->start_threshold = 1;
         } else {
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index f731f904e8cc..1d8452912b14 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1445,8 +1445,15 @@ static int snd_pcm_pause(struct snd_pcm_substream *substream, int push)
 static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
-        if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
+        switch (runtime->status->state) {
+        case SNDRV_PCM_STATE_SUSPENDED:
                 return -EBUSY;
+        /* unresumable PCM state; return -EBUSY for skipping suspend */
+        case SNDRV_PCM_STATE_OPEN:
+        case SNDRV_PCM_STATE_SETUP:
+        case SNDRV_PCM_STATE_DISCONNECTED:
+                return -EBUSY;
+        }
         runtime->trigger_master = substream;
         return 0;
 }
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index ee601d7f0926..c0690d1ecd55 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
+#include <linux/nospec.h>
 #include <sound/rawmidi.h>
 #include <sound/info.h>
 #include <sound/control.h>
@@ -601,6 +602,7 @@ static int __snd_rawmidi_info_select(struct snd_card *card,
                 return -ENXIO;
         if (info->stream < 0 || info->stream > 1)
                 return -EINVAL;
+        info->stream = array_index_nospec(info->stream, 2);
         pstr = &rmidi->streams[info->stream];
         if (pstr->substream_count == 0)
                 return -ENOENT;
diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
index 278ebb993122..c93945917235 100644
--- a/sound/core/seq/oss/seq_oss_synth.c
+++ b/sound/core/seq/oss/seq_oss_synth.c
@@ -617,13 +617,14 @@ int
 snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf)
 {
         struct seq_oss_synth *rec;
+        struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev);
 
-        if (dev < 0 || dev >= dp->max_synthdev)
+        if (!info)
                 return -ENXIO;
 
-        if (dp->synths[dev].is_midi) {
+        if (info->is_midi) {
                 struct midi_info minf;
-                snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf);
+                snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);
                 inf->synth_type = SYNTH_TYPE_MIDI;
                 inf->synth_subtype = 0;
                 inf->nr_voices = 16;
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
index 29882bda7632..e1ebc6d5f382 100644
--- a/sound/pci/hda/patch_ca0132.c
+++ b/sound/pci/hda/patch_ca0132.c
@@ -1005,7 +1005,6 @@ struct ca0132_spec {
         unsigned int scp_resp_header;
         unsigned int scp_resp_data[4];
         unsigned int scp_resp_count;
-        bool alt_firmware_present;
         bool startup_check_entered;
         bool dsp_reload;
 
@@ -7518,7 +7517,7 @@ static bool ca0132_download_dsp_images(struct hda_codec *codec)
         bool dsp_loaded = false;
         struct ca0132_spec *spec = codec->spec;
         const struct dsp_image_seg *dsp_os_image;
-        const struct firmware *fw_entry;
+        const struct firmware *fw_entry = NULL;
         /*
          * Alternate firmwares for different variants. The Recon3Di apparently
          * can use the default firmware, but I'll leave the option in case
@@ -7529,33 +7528,26 @@ static bool ca0132_download_dsp_images(struct hda_codec *codec)
         case QUIRK_R3D:
         case QUIRK_AE5:
                 if (request_firmware(&fw_entry, DESKTOP_EFX_FILE,
-                                        codec->card->dev) != 0) {
+                                        codec->card->dev) != 0)
                         codec_dbg(codec, "Desktop firmware not found.");
-                        spec->alt_firmware_present = false;
-                } else {
+                else
                         codec_dbg(codec, "Desktop firmware selected.");
-                        spec->alt_firmware_present = true;
-                }
                 break;
         case QUIRK_R3DI:
                 if (request_firmware(&fw_entry, R3DI_EFX_FILE,
-                                        codec->card->dev) != 0) {
+                                        codec->card->dev) != 0)
                         codec_dbg(codec, "Recon3Di alt firmware not detected.");
-                        spec->alt_firmware_present = false;
-                } else {
+                else
                         codec_dbg(codec, "Recon3Di firmware selected.");
-                        spec->alt_firmware_present = true;
-                }
                 break;
         default:
-                spec->alt_firmware_present = false;
                 break;
         }
         /*
          * Use default ctefx.bin if no alt firmware is detected, or if none
          * exists for your particular codec.
          */
-        if (!spec->alt_firmware_present) {
+        if (!fw_entry) {
                 codec_dbg(codec, "Default firmware selected.");
                 if (request_firmware(&fw_entry, EFX_FILE,
                                         codec->card->dev) != 0)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 191830d4fa40..a3fb3d4c5730 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5688,6 +5688,8 @@ enum {
         ALC225_FIXUP_WYSE_AUTO_MUTE,
         ALC225_FIXUP_WYSE_DISABLE_MIC_VREF,
         ALC286_FIXUP_ACER_AIO_HEADSET_MIC,
+        ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+        ALC299_FIXUP_PREDATOR_SPK,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -6696,6 +6698,22 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE
         },
+        [ALC256_FIXUP_ASUS_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x19, 0x04a11120 }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
+        },
+        [ALC299_FIXUP_PREDATOR_SPK] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x21, 0x90170150 }, /* use as headset mic, without its own jack detect */
+                        { }
+                }
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6712,9 +6730,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
         SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
+        SND_PCI_QUIRK(0x1025, 0x1099, "Acer Aspire E5-523G", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK),
         SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
         SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
@@ -7111,6 +7133,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"},
         {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"},
         {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-sense-combo"},
+        {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"},
         {}
 };
 #define ALC225_STANDARD_PINS \
@@ -7331,6 +7354,18 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x14, 0x90170110},
                 {0x1b, 0x90a70130},
                 {0x21, 0x03211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x21, 0x03211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x21, 0x04211020}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+                {0x1a, 0x90a70130},
+                {0x1b, 0x90170110},
+                {0x21, 0x03211020}),
         SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
                 {0x12, 0xb7a60130},
                 {0x13, 0xb8a61140},