summaryrefslogtreecommitdiff
path: root/sound/core/control.c
AgeCommit message (Collapse)Author
2011-03-21ALSA: prevent heap corruption in snd_ctl_new()Dan Rosenberg
commit 5591bf07225523600450edd9e6ad258bb877b779 upstream. The snd_ctl_new() function in sound/core/control.c allocates space for a snd_kcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC* device (on many distros, this is group "audio") via the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-12-04Merge branch 'topic/misc' into for-linusTakashi Iwai
2009-11-18ALSA: remove unnecessary null checkDan Carpenter
This function is only called from snd_ctl_ioctl() and the file parameter can never be null so there is no need to check it here. We dereference file at the start of the function: struct snd_card *card = file->card; and it confuses static checkers to dereference a pointer before checking it. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-11-06control: use reference-counted pidClemens Ladisch
Instead of storing the PID number, take a reference to the task's pid structure. This protects against duplicates due to PID overflows, and using pid_vnr() ensures that the PID returned by snd_ctl_elem_info() is correct as seen from the current namespace. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-11-06control: remove snd_konctrol_volatile::owner_pid fieldClemens Ladisch
We do not need to save the ID of the process that locked a control because that information is already available in the owner's file data. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-08-17sound: snd_ctl_remove_user_ctl: prevent removal of kernel controlsClemens Ladisch
Ensure that userspace can remove only user controls. Controls created by kernel drivers must not be removed because they might be referenced in calls to snd_ctl_notify(). Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-08-17sound: snd_ctl_remove_unlocked_id: simplify user control countingClemens Ladisch
Move the decrementing of the user controls counter from snd_ctl_elem_remove to snd_ctl_remove_unlocked_id; this saves the separate locking of the controls semaphore, and therefore removes a harmless race. Since the purpose of the function is to operate on user controls (the control being unlocked is just a prerequisite), rename it to snd_ctl_remove_user_ctl. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-08-17sound: snd_ctl_remove_unlocked_id: simplify error pathsClemens Ladisch
Use a common exit path to release the mutex and to return a possible error. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-08-17sound: snd_ctl_elem_add: fix value count checkClemens Ladisch
Make sure that no user element that has no values can be added. The check for count>1024 is not needed because the count is checked later for the individual control types. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-04-14ALSA: sound/core: use memdup_user()Li Zefan
Remove open-coded memdup_user(). Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2009-03-16Rationalize fasync return valuesJonathan Corbet
Most fasync implementations do something like: return fasync_helper(...); But fasync_helper() will return a positive value at times - a feature used in at least one place. Thus, a number of other drivers do: err = fasync_helper(...); if (err < 0) return err; return 0; In the interests of consistency and more concise code, it makes sense to map positive return values onto zero where ->fasync() is called. Cc: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2008-11-01saner FASYNC handling on file closeAl Viro
As it is, all instances of ->release() for files that have ->fasync() need to remember to evict file from fasync lists; forgetting that creates a hole and we actually have a bunch that *does* forget. So let's keep our lives simple - let __fput() check FASYNC in file->f_flags and call ->fasync() there if it's been set. And lose that crap in ->release() instances - leaving it there is still valid, but we don't have to bother anymore. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-10-29ALSA: Warn when control names are truncatedMark Brown
This is likely to confuse user interfaces since the end of the control name is interpreted (eg, "Volume", "Switch"). Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2008-09-09ALSA: use correct lock in snd_ctl_dev_disconnect()Takashi Iwai
The lock used in snd_ctl_dev_disconnect() should be card->ctl_files_rwlock for protection of card->ctl_files entries, instead of card->controls_rwsem. Reported-by: Vegard Nossum <vegard.nossum@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2008-08-13ALSA: Kill snd_assert() in sound/core/*Takashi Iwai
Kill snd_assert() in sound/core/*, either removed or replaced with if () with snd_BUG_ON(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2008-06-13ALSA: make snd_ctl_elem_read() and snd_ctl_elem_write() staticTakashi Iwai
snd_ctl_elem_read() and snd_ctl_elem_write() are no longer used by any other drivers. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2008-01-31[ALSA] Remove sound/driver.hTakashi Iwai
This header file exists only for some hacks to adapt alsa-driver tree. It's useless for building in the kernel. Let's move a few lines in it to sound/core.h and remove it. With this patch, sound/driver.h isn't removed but has just a single compile warning to include it. This should be really killed in future. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2008-01-31[ALSA] Remove indirect control accessTakashi Iwai
This patch removes the indirect control access to the control elements. The indirect access has never been used and is even broken on 32bit ioctl wrapper. Let's clean it up. The pointers still remain in snd_ctl_elem_* structs just to make sure that the struct size won't change. Once after checking the size consistency, we can get rid of them, too. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-10-23[ALSA] sound/core/control.c: hard-irq-safe -> hard-irq-unsafe lock warningBorislav Petkov
The lock grabbed in snd_ctl_empty_read_queue() is hardirq-unsafe but we hold an hardirq-safe one already, so make the &ctl->read_lock also hard-irq-safe. Signed-off-by: Borislav Petkov <bbpetkov@yahoo.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-10-16[ALSA] Changed Jaroslav Kysela's e-mail from perex@suse.cz to perex@perex.czJaroslav Kysela
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
2007-10-16[ALSA] unexport snd_ctl_elem_{read,write}Adrian Bunk
snd_ctl_elem_{read,write} no longer have any modular users Signed-off-by: Adrian Bunk <bunk@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2007-10-16[ALSA] Add helper functions for frequently used callbacksTakashi Iwai
Added helper functions for frequenty used callbacks: snd_ctl_boolean_mono_info() and snd_ctl_boolean_stereo_info() Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2007-05-08header cleaning: don't include smp_lock.h when not usedRandy Dunlap
Remove includes of <linux/smp_lock.h> where it is not used/needed. Suggested by Al Viro. Builds cleanly on x86_64, i386, alpha, ia64, powerpc, sparc, sparc64, and arm (all 59 defconfigs). Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-02-12[PATCH] mark struct file_operations const 9Arjan van de Ven
Many struct file_operations in the kernel can be "const". Marking them const moves these to the .rodata section, which avoids false sharing with potential dirty data. In addition it'll catch accidental writes at compile time to these shared resources. Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-02-09[ALSA] make sound/core/control.c:snd_ctl_new() staticAdrian Bunk
Now that everyone uses snd_ctl_new1() and noone is using snd_ctl_new() anymore, we can make it static. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2007-02-09[ALSA] alsa core: convert to list_for_each_entry*Johannes Berg
This patch converts most uses of list_for_each to list_for_each_entry all across alsa. In some place apparently an item can be on a list with different pointers so of course that isn't compatible with list_for_each, I therefore didn't touch those places. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-12-20[ALSA] sound/core/control.c: remove dead codeAdrian Bunk
This patch removes some obviously dead code spotted by the Coverity checker. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-10-22[ALSA] Fix addition of user-defined boolean controlsTakashi Iwai
Fixed the addition of user-defined boolean controls, the private data size is corrected to be handled properly. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-09-23[ALSA] Return error if no user TLV is definedTakashi Iwai
Retrun error to user TLV_READ ioctl if no TLV is defined. (Until now, nothing was written and rerunred successfully.) Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-09-23[ALSA] Fix errors with user TLV_WRITETakashi Iwai
Fixed the errors at checking info.access field during user TLV_WRITE call. It should have been zero-initialized. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-09-23[ALSA] Fix substream selection in PCM and rawmidiTakashi Iwai
The PCM and rawmidi substreams can be selected explicitly by opening control handle and set via *_PREFER_SUBDEVICE ioctl. But, when multiple controls are opened, the driver gets confused. The patch fixes the initialization of prefer_*_subdevice and the check of multiple controls. The first set subdevice is picked up as the valid one. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-09-23[ALSA] Control API - more robust TLV implementationJaroslav Kysela
- added callback option - added READ/WRITE/COMMAND flags to access member - added WRITE/COMMAND ioctls - added SNDRV_CTL_EVENT_MASK_TLV for TLV change notifications - added TLV support to ELEM_ADD ioctl Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-09-23[ALSA] Unregister device files at disconnectionTakashi Iwai
Orignally proposed by Sam Revitch <sam.revitch@gmail.com>. Unregister device files at disconnection to avoid the futher accesses. Also, the dev_unregister callback is removed and replaced with the combination of disconnect + free. A new function snd_card_free_when_closed() is introduced, which is used in USB disconnect callback. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-09-23[ALSA] Control API - TLV implementation for additional information like dB scaleJaroslav Kysela
This patch implements a TLV mechanism to transfer an additional information like dB scale to the user space. The types might be extended in future. Acked-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
2006-06-22[ALSA] Clean up EXPORT_SYMBOL()s in snd moduleTakashi Iwai
Move EXPORT_SYMBOL()s to places adjacent to functions/variables. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2006-03-31[ALSA] Cleanup unused argument for snd_power_wait()Takashi Iwai
Removed the unused file argument of snd_power_wait(). Signed-off-by: Takashi Iwai <tiwai@suse.de>
2006-03-22[ALSA] Fix memory leaks in error path of control.cTakashi Iwai
Modules: Control Midlevel Fix memory leaks in error path of control.c (only with CONFIG_SND_DEBUG=y). Signed-off-by: Takashi Iwai <tiwai@suse.de>
2006-03-22[ALSA] make control.c suspend awareGiuliano Pochini
Modules: Control Midlevel This patch prevents user-space apps from accessing the hardware via control interface while the soundcard is suspended. Signed-off-by: Giuliano Pochini <pochini@shiny.it> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2006-03-06[PATCH] alsa: fix error paths in snd_ctl_elem_add()Takashi Iwai
Fix bugs in error paths of snd_ctl_elem_add() - NULL reference - double free (already freed in snd_ctl_add()) Signed-off-by: Takashi Iwai <tiwai@suse.de> Cc: Jaroslav Kysela <perex@suse.cz> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-01-03[ALSA] dynamic minors (3/6): store device-specific object pointers dynamicallyClemens Ladisch
Instead of storing the pointers to the device-specific structures in an array, put them into the struct snd_minor, and look them up dynamically. This makes the device type modules independent of the minor number encoding. Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
2006-01-03[ALSA] dynamic minors (1/6): store device type in struct snd_minorClemens Ladisch
Instead of a comment string, store the device type in the snd_minor structure. This makes snd_minor more flexible, and has the nice side effect that we don't need anymore to create a separate snd_minor template for registering a device but can pass the file_operations directly to snd_register_device(). Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
2006-01-03[ALSA] Add error messagesTakashi Iwai
Add error messages in the critial error path to be more verbose. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2006-01-03[ALSA] Decentralize PM controlTakashi Iwai
Modules: ALSA Core,Control Midlevel,/oss/Makefile Remove the centralized PM control in the sound core. Each driver is responsible to get callbacks from bus/driver now. SND_GENERIC_DRIVER is removed together with this action. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2006-01-03[ALSA] Remove xxx_t typedefs: ControlsTakashi Iwai
Modules: Control Midlevel Remove xxx_t typedefs from the core controls. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2005-11-04[ALSA] Remove snd_runtime_check() macroTakashi Iwai
Remove snd_runtime_check() macro. This macro worsens the readability of codes. They should be either normal if() or removable asserts. Also, the assert displays stack-dump, instead of only the last caller pointer. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2005-09-12[ALSA] Replace with kzalloc() - core stuffTakashi Iwai
Control Midlevel,ALSA Core,HWDEP Midlevel,PCM Midlevel,RawMidi Midlevel Timer Midlevel,ALSA<-OSS emulation Replace kcalloc(1,..) with kzalloc(). Signed-off-by: Takashi Iwai <tiwai@suse.de>
2005-06-22[ALSA] Add const prefixTakashi Iwai
Control Midlevel Add const prefix to snd_kcontrol_new_t pointer for better protection. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2005-05-29[ALSA] Suppress debug messageTakashi Iwai
Control Midlevel Suppress 'unknown ioctl' debug message (replaced with snd_printdd). Signed-off-by: Takashi Iwai <tiwai@suse.de>
2005-04-16Linux-2.6.12-rc2v2.6.12-rc2Linus Torvalds
Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!
generated by cgit v1.2.3 (git 2.0.4) at 2024-11-20 06:21:55 +0000