commit 82e68f7ffec3800425f2391c8c86277606860442 upstream

snd_seq_oss_synth_make_info() incorrectly reports information
to userspace without first checking for the validity of the
device number, leading to possible information leak (CVE-2008-3272).

Reported-By: Tobias Klein <tk@trapkit.de>
Acked-and-tested-by: Takashi Iwai <tiwai@suse.de>
Cc: stable@kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 43785eaeb1cfb8aed3cf8027f298b242f88fdc45 upstream

Don't create mixer volume elements for Headphone and Speaker if they
use the same DAC as normal line-outs on AD1988.  Otherwise the amp
value gets screwed up, e.g.
	https://bugzilla.novell.com/show_bug.cgi?id=398255

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 470eaf6be78424fc499a5039e5d5fe58bace2bc3 upstream

Added the missing SSID of Thinkpad Z60m for model=thinkpad with
AD1981HD.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Backport fixes for usb-audio Oops at reconnection.

9eb70e6... [ALSA] usb-audio - Fix race in reconnection
f18638d... [ALSA] Clean up snd_card_free*()
73d38b1... [ALSA] Fix the race of card instance unregistration

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d2cd74b158d7214a556226e3312f9fb1de64d7ae upstream

On Audigy2 Platinum, the Analog/Digital mixer switch is inverted.
	https://bugzilla.novell.com/show_bug.cgi?id=396204

The patch adds a simple workaround.

There might be another device requiring a similar fix, too (or fix for
audigy2 generically), but right now I fix only the known broken one.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6c4cc3a8ed15aacc06a5fd369639fef633cee2bc upstream

Added more fallbacks to OSS PHONEOUT mixer mapping.  This corresponds
to the speaker output in general, so now "Mono" and "Speaker" are
assigned.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e48d6d97bb6bd8c008045ea0522ea8278fdccc55 upstream

ASUS A9T laptop uses line-out pin as the real front-output while
other devices use it as the surround.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Commit 981bcead3f2279a1ec6fb5f2c57aff79ed61a700 upstream.

Stop the S/PDIF DMA engine and output when the device is told to pause.
It will keep on looping the current buffer contents if this isn't done.

Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>
Tested-by: Rene Herman <rene.herman@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

[ALSA] hda - Fix "alc262_sony_unsol[]" hda_verb array

commit 7b1e8795ebfe1705153d1001f2a899119f4d9012 upstream

I think that hda_verb array must have "terminator (empty array)".
But alc262_sony_unsol[] does not have it.
And it causes gcc-4.3's buggy behavior
with snd_hda_sequence_write().

Signed-off-by: Akio Idehara <zbe64533@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

upstream commit: 868e15dbd2940f9453b4399117686f408dc77299

When the Linux kernel is compiled with CONFIG_DEBUG_SHIRQ=y,
the Soundblaster Audigy2 ZS Notebook PCMCIA card causes the
system hang during boot (udev stage) or when the card is hot-plug.
The CONFIG_DEBUG_SHIRQ flag is by default 'y' with all Fedora
kernels since 2.6.23. The problem was reported as
https://bugzilla.redhat.com/show_bug.cgi?id=326411

The issue was hunted down to the snd_emu10k1_create() routine:

/* pseudo-code */
snd_emu10k1_create(...) {
	...
	request_irq(... IRQF_SHARED ...) {
		register the irq handler
		#ifdef CONFIG_DEBUG_SHIRQ
		call the irq handler: snd_emu10k1_interrupt() {
			poll I/O port   // <---- !! system hangs
			...
		}
		#endif
	}
	...
	snd_emu10k1_cardbus_init(...) {
		initialize I/O ports
	}
	...
}

The early access to I/O port in the interrupt handler causes
the freeze. Obviously it is necessary to init the I/O ports
before accessing them. This patch moves the registration of
the irq handler after the initialization of the I/O ports.

Signed-off-by: Jaroslav Franek <jarin.franek@post.cz>
Acked-by: James Courtier-Dutton <James@superbug.co.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>