Merge tag 'sound-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "There have been continuous flux but most of them are device-specific
  small fixes, while we see a few core fixes at this time (minor PCM fix
  for linked streams and a few ASoC core fixes for delayed work, etc)

  Core:
   - PCM: Fix use-after-free in linked stream drain

  ASoC:
   - core: Fixes for delayed works, empty DMI string handling and DT overlay
   - qcom: qdsp6: Fix ADSP stop/start crash via component removal ordering
   - tegra: Add support for Tegra238 audio graph card
   - amd: Fix missing error checks for clock acquisition
   - rt1011: Fix incorrect DAPM context retrieval helper

  HD-audio:
   - Add quirk for Gigabyte H610M, ASUS UM6702RC, HP 14s-dr5xxx, and
     ThinkPad X390

  USB-audio:
   - Scarlett2: Fix NULL dereference for malformed endpoint descriptors
   - Add quirk for SPACETOUCH"

* tag 'sound-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
  ASoC: detect empty DMI strings
  ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
  ALSA: usb-audio: Add iface reset and delay quirk for SPACETOUCH USB Audio
  ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put
  ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
  ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
  ASoC: soc-core: flush delayed work before removing DAIs and widgets
  ASoC: soc-core: drop delayed_work_pending() check before flush
  ASoC: tegra: Add support for Tegra238 soundcard
  ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
  ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
  ALSA: hda/realtek: add quirk for ASUS UM6702RC
  ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
  ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone
  firmware: cs_dsp: Fix fragmentation regression in firmware download
  ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start

1 files changed, 18 insertions, 6 deletions

diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c
index b4f1c01e3b5b..5d8be0ac7c5e 100644
--- a/drivers/firmware/cirrus/cs_dsp.c
+++ b/drivers/firmware/cirrus/cs_dsp.c
@@ -1610,11 +1610,17 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware,
 			   region_name);
 
 		if (reg) {
+			/*
+			 * Although we expect the underlying bus does not require
+			 * physically-contiguous buffers, we pessimistically use
+			 * a temporary buffer instead of trusting that the
+			 * alignment of region->data is ok.
+			 */
 			region_len = le32_to_cpu(region->len);
 			if (region_len > buf_len) {
 				buf_len = round_up(region_len, PAGE_SIZE);
-				kfree(buf);
-				buf = kmalloc(buf_len, GFP_KERNEL | GFP_DMA);
+				vfree(buf);
+				buf = vmalloc(buf_len);
 				if (!buf) {
 					ret = -ENOMEM;
 					goto out_fw;
@@ -1643,7 +1649,7 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware,
 
 	ret = 0;
 out_fw:
-	kfree(buf);
+	vfree(buf);
 
 	if (ret == -EOVERFLOW)
 		cs_dsp_err(dsp, "%s: file content overflows file data\n", file);
@@ -2331,11 +2337,17 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware
 		}
 
 		if (reg) {
+			/*
+			 * Although we expect the underlying bus does not require
+			 * physically-contiguous buffers, we pessimistically use
+			 * a temporary buffer instead of trusting that the
+			 * alignment of blk->data is ok.
+			 */
 			region_len = le32_to_cpu(blk->len);
 			if (region_len > buf_len) {
 				buf_len = round_up(region_len, PAGE_SIZE);
-				kfree(buf);
-				buf = kmalloc(buf_len, GFP_KERNEL | GFP_DMA);
+				vfree(buf);
+				buf = vmalloc(buf_len);
 				if (!buf) {
 					ret = -ENOMEM;
 					goto out_fw;
@@ -2366,7 +2378,7 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware
 
 	ret = 0;
 out_fw:
-	kfree(buf);
+	vfree(buf);
 
 	if (ret == -EOVERFLOW)
 		cs_dsp_err(dsp, "%s: file content overflows file data\n", file);