summaryrefslogtreecommitdiff
path: root/sound
AgeCommit message (Collapse)Author
2010-10-22Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: (31 commits) driver core: Display error codes when class suspend fails Driver core: Add section count to memory_block struct Driver core: Add mutex for adding/removing memory blocks Driver core: Move find_memory_block routine hpilo: Despecificate driver from iLO generation driver core: Convert link_mem_sections to use find_memory_block_hinted. driver core: Introduce find_memory_block_hinted which utilizes kset_find_obj_hinted. kobject: Introduce kset_find_obj_hinted. driver core: fix build for CONFIG_BLOCK not enabled driver-core: base: change to new flag variable sysfs: only access bin file vm_ops with the active lock sysfs: Fail bin file mmap if vma close is implemented. FW_LOADER: fix kconfig dependency warning on HOTPLUG uio: Statically allocate uio_class and use class .dev_attrs. uio: Support 2^MINOR_BITS minors uio: Cleanup irq handling. uio: Don't clear driver data uio: Fix lack of locking in init_uio_class SYSFS: Allow boot time switching between deprecated and modern sysfs layout driver core: remove CONFIG_SYSFS_DEPRECATED_V2 but keep it for block devices ...
2010-10-22Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bklLinus Torvalds
* 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl: vfs: make no_llseek the default vfs: don't use BKL in default_llseek llseek: automatically add .llseek fop libfs: use generic_file_llseek for simple_attr mac80211: disallow seeks in minstrel debug code lirc: make chardev nonseekable viotape: use noop_llseek raw: use explicit llseek file operations ibmasmfs: use generic_file_llseek spufs: use llseek in all file operations arm/omap: use generic_file_llseek in iommu_debug lkdtm: use generic_file_llseek in debugfs net/wireless: use generic_file_llseek in debugfs drm: use noop_llseek
2010-10-22driver core: remove CONFIG_SYSFS_DEPRECATED_V2 but keep it for block devicesKay Sievers
This patch removes the old CONFIG_SYSFS_DEPRECATED_V2 config option, but it keeps the logic around to handle block devices in the old manner as some people like to run new kernel versions on old (pre 2007/2008) distros. Signed-off-by: Kay Sievers <kay.sievers@vrfy.org> Cc: Jens Axboe <axboe@kernel.dk> Cc: Stephen Hemminger <shemminger@vyatta.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Alan Stern <stern@rowland.harvard.edu> Cc: "James E.J. Bottomley" <James.Bottomley@suse.de> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Cc: Randy Dunlap <randy.dunlap@oracle.com> Cc: Tejun Heo <tj@kernel.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jaroslav Kysela <perex@perex.cz> Cc: Takashi Iwai <tiwai@suse.de> Cc: Ingo Molnar <mingo@elte.hu> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-10-21Merge git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: (22 commits) pcmcia: synclink_cs: fix information leak to userland pcmcia: don't call flush_scheduled_work() spuriously serial_cs: drop spurious flush_scheduled_work() call pcmcia/yenta: guide users in case of problems with O2-bridges pcmcia: fix unused function compile warning pcmcia: vrc4173_cardu: Fix error path for pci_release_regions and pci_disable_device pcmcia: add a few debug statements pcmcia: remove obsolete and wrong comments pcmcia: avoid messages on module (un)loading pcmcia: move driver name to struct pcmcia_driver pcmcia: remove the "Finally, report what we've done" message pcmcia: use autoconfiguration feature for ioports and iomem pcmcia: introduce autoconfiguration feature pcmcia: Documentation update pcmcia: convert pcmcia_request_configuration to pcmcia_enable_device pcmcia: move config_{base,index,regs} to struct pcmcia_device pcmcia: simplify IntType pcmcia: simplify Status, ExtStatus register access pcmcia: remove Pin, Copy configuration register access pcmcia: move Vpp setup to struct pcmcia_device ...
2010-10-17ALSA: rawmidi: fix oops (use after free) when unloading a driver moduleClemens Ladisch
When a driver module is unloaded and the last still open file is a raw MIDI device, the card and its devices will be actually freed in the snd_card_file_remove() call when that file is closed. Afterwards, rmidi and rmidi->card point into freed memory, so the module pointer is likely to be garbage. (This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.) Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Reported-by: Krzysztof Foltman <wdev@foltman.com> Cc: 2.6.30-2.6.35 <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-10-15llseek: automatically add .llseek fopArnd Bergmann
All file_operations should get a .llseek operation so we can make nonseekable_open the default for future file operations without a .llseek pointer. The three cases that we can automatically detect are no_llseek, seq_lseek and default_llseek. For cases where we can we can automatically prove that the file offset is always ignored, we use noop_llseek, which maintains the current behavior of not returning an error from a seek. New drivers should normally not use noop_llseek but instead use no_llseek and call nonseekable_open at open time. Existing drivers can be converted to do the same when the maintainer knows for certain that no user code relies on calling seek on the device file. The generated code is often incorrectly indented and right now contains comments that clarify for each added line why a specific variant was chosen. In the version that gets submitted upstream, the comments will be gone and I will manually fix the indentation, because there does not seem to be a way to do that using coccinelle. Some amount of new code is currently sitting in linux-next that should get the same modifications, which I will do at the end of the merge window. Many thanks to Julia Lawall for helping me learn to write a semantic patch that does all this. ===== begin semantic patch ===== // This adds an llseek= method to all file operations, // as a preparation for making no_llseek the default. // // The rules are // - use no_llseek explicitly if we do nonseekable_open // - use seq_lseek for sequential files // - use default_llseek if we know we access f_pos // - use noop_llseek if we know we don't access f_pos, // but we still want to allow users to call lseek // @ open1 exists @ identifier nested_open; @@ nested_open(...) { <+... nonseekable_open(...) ...+> } @ open exists@ identifier open_f; identifier i, f; identifier open1.nested_open; @@ int open_f(struct inode *i, struct file *f) { <+... ( nonseekable_open(...) | nested_open(...) ) ...+> } @ read disable optional_qualifier exists @ identifier read_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; expression E; identifier func; @@ ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off) { <+... ( *off = E | *off += E | func(..., off, ...) | E = *off ) ...+> } @ read_no_fpos disable optional_qualifier exists @ identifier read_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; @@ ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off) { ... when != off } @ write @ identifier write_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; expression E; identifier func; @@ ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off) { <+... ( *off = E | *off += E | func(..., off, ...) | E = *off ) ...+> } @ write_no_fpos @ identifier write_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; @@ ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off) { ... when != off } @ fops0 @ identifier fops; @@ struct file_operations fops = { ... }; @ has_llseek depends on fops0 @ identifier fops0.fops; identifier llseek_f; @@ struct file_operations fops = { ... .llseek = llseek_f, ... }; @ has_read depends on fops0 @ identifier fops0.fops; identifier read_f; @@ struct file_operations fops = { ... .read = read_f, ... }; @ has_write depends on fops0 @ identifier fops0.fops; identifier write_f; @@ struct file_operations fops = { ... .write = write_f, ... }; @ has_open depends on fops0 @ identifier fops0.fops; identifier open_f; @@ struct file_operations fops = { ... .open = open_f, ... }; // use no_llseek if we call nonseekable_open //////////////////////////////////////////// @ nonseekable1 depends on !has_llseek && has_open @ identifier fops0.fops; identifier nso ~= "nonseekable_open"; @@ struct file_operations fops = { ... .open = nso, ... +.llseek = no_llseek, /* nonseekable */ }; @ nonseekable2 depends on !has_llseek @ identifier fops0.fops; identifier open.open_f; @@ struct file_operations fops = { ... .open = open_f, ... +.llseek = no_llseek, /* open uses nonseekable */ }; // use seq_lseek for sequential files ///////////////////////////////////// @ seq depends on !has_llseek @ identifier fops0.fops; identifier sr ~= "seq_read"; @@ struct file_operations fops = { ... .read = sr, ... +.llseek = seq_lseek, /* we have seq_read */ }; // use default_llseek if there is a readdir /////////////////////////////////////////// @ fops1 depends on !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier readdir_e; @@ // any other fop is used that changes pos struct file_operations fops = { ... .readdir = readdir_e, ... +.llseek = default_llseek, /* readdir is present */ }; // use default_llseek if at least one of read/write touches f_pos ///////////////////////////////////////////////////////////////// @ fops2 depends on !fops1 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier read.read_f; @@ // read fops use offset struct file_operations fops = { ... .read = read_f, ... +.llseek = default_llseek, /* read accesses f_pos */ }; @ fops3 depends on !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier write.write_f; @@ // write fops use offset struct file_operations fops = { ... .write = write_f, ... + .llseek = default_llseek, /* write accesses f_pos */ }; // Use noop_llseek if neither read nor write accesses f_pos /////////////////////////////////////////////////////////// @ fops4 depends on !fops1 && !fops2 && !fops3 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier read_no_fpos.read_f; identifier write_no_fpos.write_f; @@ // write fops use offset struct file_operations fops = { ... .write = write_f, .read = read_f, ... +.llseek = noop_llseek, /* read and write both use no f_pos */ }; @ depends on has_write && !has_read && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier write_no_fpos.write_f; @@ struct file_operations fops = { ... .write = write_f, ... +.llseek = noop_llseek, /* write uses no f_pos */ }; @ depends on has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier read_no_fpos.read_f; @@ struct file_operations fops = { ... .read = read_f, ... +.llseek = noop_llseek, /* read uses no f_pos */ }; @ depends on !has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; @@ struct file_operations fops = { ... +.llseek = noop_llseek, /* no read or write fn */ }; ===== End semantic patch ===== Signed-off-by: Arnd Bergmann <arnd@arndb.de> Cc: Julia Lawall <julia@diku.dk> Cc: Christoph Hellwig <hch@infradead.org>
2010-10-11ALSA: hda - Add another HP DV6 quirkLuke Yelavich
BugLink: https://bugs.launchpad.net/bugs/653420 Add another HP DV6 notebook (103c:363e) to use STAC_HP_DV5. Signed-off-by: Luke Yelavich <luke.yelavich@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-10-11OSS: soundcard: locking bug in sound_ioctl()Dan Carpenter
We shouldn't return directly here because we're still holding the &soundcard_mutex. This bug goes all the way back to the start of git. It's strange that no one has complained about it as a runtime bug. CC: stable@kernel.org Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-10-04Merge branch 'fix/misc' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: i2c/other/ak4xx-adda: Fix a compile warning with CONFIG_PROCFS=n ALSA: prevent heap corruption in snd_ctl_new()
2010-09-30ALSA: i2c/other/ak4xx-adda: Fix a compile warning with CONFIG_PROCFS=nTakashi Iwai
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-29pcmcia: move driver name to struct pcmcia_driverDominik Brodowski
Tested-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2010-09-29pcmcia: convert pcmcia_request_configuration to pcmcia_enable_deviceDominik Brodowski
pcmcia_enable_device() now replaces pcmcia_request_configuration(). Instead of config_req_t, all necessary flags are either passed as a parameter to pcmcia_enable_device(), or (in rare circumstances) set in struct pcmcia_device -> flags. With the last remaining user of include/pcmcia/cs.h gone, remove all references. CC: netdev@vger.kernel.org CC: linux-wireless@vger.kernel.org CC: linux-ide@vger.kernel.org CC: linux-usb@vger.kernel.org CC: laforge@gnumonks.org CC: linux-mtd@lists.infradead.org CC: alsa-devel@alsa-project.org CC: linux-serial@vger.kernel.org CC: Jiri Kosina <jkosina@suse.cz> CC: linux-scsi@vger.kernel.org Acked-by: Gustavo F. Padovan <padovan@profusion.mobi> (for drivers/bluetooth) Tested-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2010-09-29pcmcia: move config_{base,index,regs} to struct pcmcia_deviceDominik Brodowski
Several drivers prefer to explicitly set config_{base,index,regs}, formerly known as ConfigBase, ConfigIndex and Present. Instead of passing these values inside config_req_t, store it in struct pcmcia_device. CC: netdev@vger.kernel.org CC: linux-wireless@vger.kernel.org CC: linux-ide@vger.kernel.org CC: linux-usb@vger.kernel.org CC: laforge@gnumonks.org CC: linux-mtd@lists.infradead.org CC: alsa-devel@alsa-project.org CC: linux-serial@vger.kernel.org CC: Jiri Kosina <jkosina@suse.cz> CC: linux-scsi@vger.kernel.org Acked-by: Gustavo F. Padovan <padovan@profusion.mobi> (for drivers/bluetooth) Tested-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2010-09-29pcmcia: simplify IntTypeDominik Brodowski
IntType was only set to INT_MEMORY (driver pcmciamtd) or INT_MEMORY_AND_IO (all other drivers). As this flags seems to relate to ioport access, make it conditional to the driver having requested IO port access. There are two drivers which do not request IO ports, but did set INT_MEMORY_AND_IO: ray_cs and b43. For those, we consistently only set INT_MEMORY in future. CC: netdev@vger.kernel.org CC: linux-wireless@vger.kernel.org CC: linux-ide@vger.kernel.org CC: linux-usb@vger.kernel.org CC: laforge@gnumonks.org CC: linux-mtd@lists.infradead.org CC: alsa-devel@alsa-project.org CC: linux-serial@vger.kernel.org CC: Jiri Kosina <jkosina@suse.cz> CC: linux-scsi@vger.kernel.org Acked-by: Gustavo F. Padovan <padovan@profusion.mobi> (for drivers/bluetooth) Tested-by: Wolfram Sang <w.sang@pengutronix.de> Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2010-09-28ALSA: prevent heap corruption in snd_ctl_new()Dan Rosenberg
The snd_ctl_new() function in sound/core/control.c allocates space for a snd_kcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC* device (on many distros, this is group "audio") via the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-25Merge branch 'fix/hda' into for-linusTakashi Iwai
2010-09-25Merge branch 'fix/asoc' into for-linusTakashi Iwai
2010-09-25ALSA: sound/pci/rme9652: prevent reading uninitialized stack memoryDan Rosenberg
The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow unprivileged users to read uninitialized kernel stack memory, because several fields of the hdsp{m}_config_info structs declared on the stack are not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-24ALSA: hda - Fix auto-parse of SPDIF input of Realtek codecsTakashi Iwai
The SPDIF in audio widget must be searched through the list as the widget that contains the given pin as the connection source. The current code was implemented in a reverse way. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-22ASoC: Fix multi-componentismMark Brown
Spot the build testing. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-09-22ASoC: Fix soc-cache buffer overflow bugDimitris Papastamos
Make sure we stay within the cache boundaries when updating the register cache. Signed-off-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-09-22ALSA: oxygen: fix analog capture on Claro halo cardsErik J. Staab
On the HT-Omega Claro halo card, the ADC data must be captured from the second I2S input. Using the default first input, which isn't connected to anything, would result in silence. Signed-off-by: Erik J. Staab <ejs@insightbb.com> Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-21ALSA: hda - Add Dell Latitude E6400 model quirkLuke Yelavich
BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/643891 Set the Dell Latitude E6400 (1028:0233) SSID to use AD1984_DELL_DESKTOP Cc: stable@kernel.org Signed-off-by: Luke Yelavich <luke.yelavich@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-19ASoC: fix clkdev API usage in sh/migor.cGuennadi Liakhovetski
The clkdev API doesn't use .name and .id members of struct clk for clock lookup. Instead clocks should be added to a lookup list. Without this patch audio om the Migo-R board fails silently. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-09-17Merge branch 'fix/hda' into for-linusTakashi Iwai
2010-09-16ALSA: pcm - Fix race with proc filesTakashi Iwai
The PCM proc files may open a race against substream close, which can end up with an Oops. Use the open_mutex to protect for it. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-16ALSA: pcm - Fix unbalanced pm_qos_requestTakashi Iwai
The pm_qos_request isn't freed properly when OSS PCM emulation is used because it skips snd_pcm_hw_free() call but directly releases the stream. This resulted in Oops later. Tested-by: Simon Kirby <sim@hostway.ca> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-16ALSA: HDA: Enable internal speaker on Dell M101zDavid Henningsson
BugLink: http://launchpad.net/bugs/640254 In some cases a magic processing coefficient is needed to enable the internal speaker on Dell M101z. According to Realtek, this processing coefficient is only present on ALC269vb. Cc: stable@kernel.org Signed-off-by: David Henningsson <david.henningsson@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-14ALSA: patch_nvhdmi.c: Fix supported sample rate list.Stephen Warren
22050 isn't a valid HDMI sample rate. 32000 is. Signed-off-by: Stephen Warren <swarren@nvidia.com> Acked-By: Wei Ni <wni@nvidia.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-13sound: Remove pr_<level> uses of KERN_<level>Joe Perches
Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-13ALSA: hda - Add quirk for Toshiba C650D using a Conexant CX20585Anisse Astier
Add a quirk for laptop Toshiba Satellite C650D to have proper external HP and external Mic support. Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-13ALSA: hda_intel: ALSA HD Audio patch for Intel Patsburg DeviceIDsSeth Heasley
This patch adds the Intel Patsburg (PCH) HD Audio Controller DeviceIDs. Signed-off-by: Seth Heasley <seth.heasley@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-10Merge branch 'fix/hda' into for-linusTakashi Iwai
2010-09-09ALSA: rawmidi: fix the get next midi device ioctlDan Carpenter
If we pass in a device which is higher than SNDRV_RAWMIDI_DEVICES then the "next device" should be -1. This function just returns device + 1. But the main thing is that "device + 1" can lead to a (harmless) integer overflow and that annoys static analysis tools. [fix the case for device == SNDRV_RAWMIDI_DEVICE by tiwai] Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: hda - Fix wrong HP pin detection in snd_hda_parse_pin_def_config()Takashi Iwai
snd_hda_parse_pin_def_config() has some workaround for re-assigning some pins declared as headphones to line-outs. This didn't work properly for some cases because it used memmove() stupidly wrongly. Reference: Novell bnc#637263 https://bugzilla.novell.com/show_bug.cgi?id=637263 Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()Takashi Iwai
The error handling in snd_seq_oss_open() has several bad codes that do dereferecing released pointers and double-free of kmalloc'ed data. The object dp is release in free_devinfo() that is called via private_free callback. The rest shouldn't touch this object any more. The patch changes delete_port() to call kfree() in any case, and gets rid of unnecessary calls of destructors in snd_seq_oss_open(). Fixes CVE-2010-3080. Reported-and-tested-by: Tavis Ormandy <taviso@cmpxchg8b.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: msnd-classic: Fix invalid cfg parameterTakashi Iwai
The driver doesn't probe the device properly because of left-over cfg[] that isn't used at all for msnd-classic device. This is only for msnd- pinnacle. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: hda - Enable PC-beep for EeePC with ALC269 codecTakashi Iwai
EeePC 1001HAG has a similar problem like other ASUS machine, which doesn't set the codec SSID properly for indicating the beep capability. To enable PC-beep again, put this to the whitelist. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: hda - Add errata initverb sequence for CS42xx codecsBrian Austin
Add init verb sequence for errata ER880C3 http://www.cirrus.com/en/pubs/errata/ER880C3.pdf Signed-off-by: Brian Austin <brian.austin@cirrus.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: usb - Release capture substream URBs properlyTakashi Iwai
Due to the wrong "return" in the loop, a capture substream won't be released at disconnection properly if the device is capture only and has no playback substream. This caused Oops occasionally at the device reconnection. Reported-by: Kim Minhyoung <minhyoung.kim@lge.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: virtuoso: fix setting of Xonar DS line-in/mic-in controlsClemens Ladisch
The Line and Mic inputs cannot be used at the same time, so the driver has to automatically disable one of them if both are set. However, it forgot to notify userspace about this change, so the mixer state would be inconsistent. To fix this, check if the other control gets muted, and send a notification event in this case. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Reported-and-tested-by: Nathan Schagen Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: virtuoso: work around missing reset in the Xonar DS Windows driverClemens Ladisch
For the WM8776 chip, this driver uses a different sample format and more features than the Windows driver. When rebooting from Linux into Windows, the latter driver does not reset the chip but assumes all its registers have their default settings, so we get garbled sound or, if the output happened to be muted before rebooting, no sound. To make that driver happy, hook our driver's cleanup function into the shutdown notifier and ensure that the chip gets reset. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Reported-and-tested-by: Nathan Schagen Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-07ALSA: hda - Add quirk for Lenovo T400sTakashi Iwai
Lenovo T400s requires the quirk to make automatic HP/mic switching working. Reported-by: Frank Becker <fb@alien8.de> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-03ALSA: usb-audio: fix detection of vendor-specific device protocol settingsClemens Ladisch
The Audio Class v2 support code in 2.6.35 added checks for the bInterfaceProtocol field. However, there are devices (usually those detected by vendor-specific quirks) that do not have one of the predefined values in this field, which made the driver reject them. To fix this regression, restore the old behaviour, i.e., assume that a device with an unknown bInterfaceProtocol field (other than UAC_VERSION_2) has more or less UAC-v1-compatible descriptors. [compile warning fixes by tiwai] Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Cc: Daniel Mack <daniel@caiaq.de> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-02ALSA: usb-audio: Assume first control interface is for audioDaniel Mack
For devices with more than one control interface, let's assume the first one contains the audio controls. Unfortunately, there is no field in any of the descriptors to tell us whether a control interface is for audio or MIDI controls, so a better check is not easy to implement. On a composite device with audio and MIDI functions, for example, the code currently overwrites chip->ctrl_intf, causing operations on the control interface to fail if they are issued after the device probe. Signed-off-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-02ALSA: hda - Add a new hp-laptop model for Conexant 5066, tested on HP G60David Henningsson
This new model adds the following functionality to HP G60: - Automute of internal speakers - Autoswitch of internal/external mics - Remove SPDIF not physically present BugLink: http://launchpad.net/bugs/587388 Cc: stable@kernel.org Signed-off-by: David Henningsson <david.henningsson@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-28Merge branch 'fix/asoc' into for-linusTakashi Iwai
2010-08-28Merge branch 'fix/hda' into for-linusTakashi Iwai
2010-08-28ALSA: pcm: add more format namesDan Carpenter
There were some new formats added in commit 15c0cee6c809 "ALSA: pcm: Define G723 3-bit and 5-bit formats". That commit increased SNDRV_PCM_FORMAT_LAST as well. My concern is that there are a couple places which do: for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) { if (dummy->pcm_hw.formats & (1ULL << i)) snd_iprintf(buffer, " %s", snd_pcm_format_name(i)); } I haven't tested these but it looks like if "i" were equal to SNDRV_PCM_FORMAT_G723_24 or higher then we might read past the end of the array. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-28sound: oss: fix uninitialized spinlockAkinobu Mita
The spinlock lock in sound_timer.c is used without initialization. Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>