linux-toradex.git/sound/core, branch v2.6.32.22

ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()

2010-09-20T20:17:50+00:00

commit 27f7ad53829f79e799a253285318bff79ece15bd upstream.

The error handling in snd_seq_oss_open() has several bad codes that
do dereferecing released pointers and double-free of kmalloc'ed data.
The object dp is release in free_devinfo() that is called via
private_free callback.  The rest shouldn't touch this object any more.

The patch changes delete_port() to call kfree() in any case, and gets
rid of unnecessary calls of destructors in snd_seq_oss_open().

Fixes CVE-2010-3080.

Reported-and-tested-by: Tavis Ormandy 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: emu10k1 - delay the PCM interrupts (add pcm_irq_delay parameter)

2010-08-26T23:41:34+00:00

commit 56385a12d9bb9e173751f74b6c430742018cafc0 upstream.

With some hardware combinations, the PCM interrupts are acknowledged
before the period boundary from the emu10k1 chip. The midlevel PCM code
gets confused and the playback stream is interrupted.

It seems that the interrupt processing shift by 2 samples is enough
to fix this issue. This default value does not harm other,
non-affected hardware.

More information: Kernel bugzilla bug#16300

[A copmile warning fixed by tiwai]

Signed-off-by: Jaroslav Kysela 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: pcm core - fix fifo_size channels interval check

2010-03-15T15:49:48+00:00

commit 3be522a9514f58e0596db34898a514df206cadc5 upstream.

Signed-off-by: Jaroslav Kysela 
Signed-off-by: Greg Kroah-Hartman

ALSA: hrtimer - Fix lock-up

2009-12-18T22:03:29+00:00

commit fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 upstream.

The timer stop callback can be called from snd_timer_interrupt(), which
is called from the hrtimer callback.  Since hrtimer_cancel() waits for
the callback completion, this eventually results in a lock-up.

This patch fixes the problem by just toggling a flag at stop callback
and call hrtimer_cancel() later.

Reported-and-tested-by: Wojtek Zabolotny 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

sound: rawmidi: fix MIDI device O_APPEND error handling

2009-11-10T15:22:59+00:00

Commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a in 2.6.30 broke the
error handling code in rawmidi_open_priv().

If only the output substream of a RawMIDI device has been opened and
if this device is then opened with O_RDWR | O_APPEND and if the
initialization of the input substream fails (either because of low
memory or because the device driver's open callback fails), then the
runtime structure of the already open output substream will be freed
and all following writes through the first handle will cause
snd_rawmidi_write() to use the NULL runtime pointer.

Signed-off-by: Clemens Ladisch 
Cc: 
Signed-off-by: Takashi Iwai

sound: rawmidi: fix checking of O_APPEND when opening MIDI device

2009-11-10T15:21:30+00:00

Commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a in 2.6.30 dropped the
check that a substream must already have been opened with O_APPEND to be
able to open it a second time.

This would make it possible for a substream to be switched to append
mode, which would mean that non-atomic writes would fail unexpectedly.

Signed-off-by: Clemens Ladisch 
Cc: 
Signed-off-by: Takashi Iwai

sound: rawmidi: fix double init when opening MIDI device with O_APPEND

2009-11-10T15:20:43+00:00

Commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a in 2.6.30 moved the
substream initialization code to where it would be executed every time
the substream is opened.

This had the consequence that any further opening would drop and leak
the data in the existing buffer, and that the device driver's open
callback would be called multiple times, unexpectedly.

Signed-off-by: Clemens Ladisch 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: sound: Move dereference after NULL test and drop unnecessary NULL tests

2009-10-30T11:01:27+00:00

In pcm.c, if the NULL test on pcm is needed, then the dereference should be
after the NULL test.

In dummy.c and ali5451.c, the context of the calls to
snd_card_dummy_new_mixer and snd_ali_free_voice show that dummy and pvoice,
respectively cannot be NULL.

A simplified version of the semantic match that detects this problem is as
follows (http://coccinelle.lip6.fr/):

// 
@match exists@
expression x, E;
identifier fld;
@@

* x->fld
  ... when != \(x = E\|&x\)
* x == NULL
// 

Signed-off-by: Julia Lawall 
Signed-off-by: Takashi Iwai

const: mark struct vm_struct_operations

2009-09-27T18:39:25+00:00

* mark struct vm_area_struct::vm_ops as const
* mark vm_ops in AGP code

But leave TTM code alone, something is fishy there with global vm_ops
being used.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Linus Torvalds

ALSA: pcm - Simplify snd_pcm_drain() implementation

2009-09-21T13:13:09+00:00

Simplify snd_pcm_drain() implementation and avoid unneeded array-
allocation for waitqueues.  Instead, one waitqueue is used for the
first draining stream, and wait until all streams finished.

Signed-off-by: Takashi Iwai