wait_for_avail() in pcm_lib.c has a race in it (observed in practice by an
Intel validation group).

The function is supposed to return once space in the buffer has become
available, or if some timeout happens.  The entity that creates space (irq
handler of sound driver and some such) will do a wake up on a waitqueue
that this function registers for.

However there are two races in the existing code

1) If space became available between the caller noticing there was no
   space and this function actually sleeping, the wakeup is missed and the
   timeout condition will happen instead

2) If a wakeup happened but not sufficient space became available, the
   code will loop again and wait for more space.  However, if the second
   wake comes in prior to hitting the schedule_timeout_interruptible(), it
   will be missed, and potentially you'll wait out until the timeout
   happens.

The fix consists of using more careful setting of the current state (so
that if a wakeup happens in the main loop window, the schedule_timeout()
falls through) and by checking for available space prior to going into the
schedule_timeout() loop, but after being on the waitqueue and having the
state set to interruptible.

[tiwai: the following changes have been added to Arjan's original patch:
 - merged akpm's fix for waitqueue adding order into a single patch
 - reduction of duplicated code of avail check
]

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Just to be sure.

Signed-off-by: Takashi Iwai <tiwai@suse.de>

A slave-timer instance has no timer reference, and this results in
NULL-dereference at stopping the timer, typically called at closing
the device.

Reference: https://bugzilla.kernel.org/show_bug.cgi?id=40682

Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: asihpi - Clarify adapter index validity check
  ALSA: asihpi - Don't leak firmware if mem alloc fails
  ALSA: rtctimer.c needs module.h
  ASoC: Fix txx9aclc.c build
  ALSA: hdspm - Add firmware revision 0xcc for RME MADI
  ALSA: hdspm - Fix reported external sample rate on RME MADI and MADIface
  ALSA: hdspm - Provide MADI speed mode selector on RME MADI and MADIface
  ALSA: sound/core/pcm_compat.c: adjust array index

rtctimer.c uses interfaces from linux/module.h, so it should
include that file.  This fixes build errors.

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Convert array index from the loop bound to the loop index.

A simplified version of the semantic patch that fixes this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression e1,e2,ar;
@@

for(e1 = 0; e1 < e2; e1++) { <...
  ar[
- e2
+ e1
  ]
  ...> }
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: (22 commits)
  ALSA: hda - Cirrus Logic CS421x support
  ALSA: Make pcm.h self-contained
  ALSA: hda - Allow codec-specific set_power_state ops
  ALSA: hda - Add post_suspend patch ops
  ALSA: hda - Make CONFIG_SND_HDA_POWER_SAVE depending on CONFIG_PM
  ALSA: hda - Make sure mute led reflects master mute state
  ALSA: hda - Fix invalid mute led state on resume of IDT codecs
  ASoC: Revert "ASoC: SAMSUNG: Add I2S0 internal dma driver"
  ALSA: hda - Add support of the 4 internal speakers on certain HP laptops
  ALSA: Make snd_pcm_debug_name usable outside pcm_lib
  ALSA: hda - Fix DAC filling for multi-connection pins in Realtek parser
  ASoC: dapm - Add methods to retrieve snd_card and soc_card from dapm context.
  ASoC: SAMSUNG: Add I2S0 internal dma driver
  ASoC: SAMSUNG: Modify I2S driver to support idma
  ASoC: davinci: add missing break statement
  ASoC: davinci: fix codec start and stop functions
  ASoC: dapm - add DAPM macro for external enum widgets
  ASoC: Acknowledge WM8962 interrupts before acting on them
  ASoC: sgtl5000: guide user when regulator support is needed
  ASoC: sgtl5000: refactor registering internal ldo
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
  fs: take the ACL checks to common code
  bury posix_acl_..._masq() variants
  kill boilerplates around posix_acl_create_masq()
  generic_acl: no need to clone acl just to push it to set_cached_acl()
  kill boilerplate around posix_acl_chmod_masq()
  reiserfs: cache negative ACLs for v1 stat format
  xfs: cache negative ACLs if there is no attribute fork
  9p: do no return 0 from ->check_acl without actually checking
  vfs: move ACL cache lookup into generic code
  CIFS: Fix oops while mounting with prefixpath
  xfs: Fix wrong return value of xfs_file_aio_write
  fix devtmpfs race
  caam: don't pass bogus S_IFCHR to debugfs_create_...()
  get rid of create_proc_entry() abuses - proc_mkdir() is there for purpose
  asus-wmi: ->is_visible() can't return negative
  fix jffs2 ACLs on big-endian with 16bit mode_t
  9p: close ACL leaks
  ocfs2_init_acl(): fix a leak
  VFS : mount lock scalability for internal mounts

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>