User-controllable indexes for voice and channel values may cause reading
and writing beyond the bounds of their respective arrays, leading to
potentially exploitable memory corruption.  Validate these indexes.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Was: [PATCH] sound/oss/midi_synth: prevent underflow, use of
uninitialized value, and signedness issue

The offset passed to midi_synth_load_patch() can be essentially
arbitrary.  If it's greater than the header length, this will result in
a copy_from_user(dst, src, negative_val).  While this will just return
-EFAULT on x86, on other architectures this may cause memory corruption.
Additionally, the length field of the sysex_info structure may not be
initialized prior to its use.  Finally, a signed comparison may result
in an unintentionally large loop.

On suggestion by Takashi Iwai, version two removes the offset argument
from the load_patch callbacks entirely, which also resolves similar
issues in opl3.  Compile tested only.

v3 adjusts comments and hopefully gets copy offsets right.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Similar to commit 7e59e097, this patch
avoids unnecessary volume control indices for more
Realtek auto-parsers, e g the ALC66x family, on the "Surround" and "Side"
controls.
These indices cause these volume controls to be ignored by PulseAudio and
vmaster and should be removed whenever possible.

Cc: stable@kernel.org
Reported-by: Jan Losinski <losinski@wh2.tu-dresden.de>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The regulator is optional depending on board design.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>

Since VT1708 didn't support the control of getting connection number,
building of headphone control will fail in via_hp_build() function.
Signed-off-by: Lydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Correct stream names of analog playback and capture streams
for VT1818S.
Signed-off-by: Lydia Wang <lydiawang@viatech.com.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Add get_codec_type() in via_new_spec() function to make sure getting
correct codec type before building mixer controls.
Signed-off-by: Lydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Modify vt_auto_create_analog_input_ctls() function to fix invalid a-a path
volume adjust issue for VT1708S, VT1702 and VT1716S codecs.
Signed-off-by: Lydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Modify mute_aa_path() function to support VT1718S codec.
Signed-off-by: Lydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Modify via_independent_hp_put() function to support VT1718S and VT1812
codecs, and fix independent headphone no sound issue.
Signed-off-by: Lydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Modify function via_mux_enum_put() to fix stereo mixer recording
no sound issue.
Signed-off-by: Lydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Set EAPD for Realtek ALC665 (Vendor Id: 0x10eSet EAPD for Realtek
ALC665 (Vendor Id: 0x10ec0665).
Signed-off-by: Andres Mejia <mcitadel@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Some USB devices give trailing spaces in strings returned from
usb_string().  This confuses the automatic card-id creation, resulting
always in "default".
This patch fixes the behavior by removing trailing spaces.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Convert direct read of inode->i_size to using i_size_read().
i_size_read is guaranteed to return a valid value and
its caller does not need to use addtional locking.
Signed-off-by: Xiaochen Wang <wangxiaochen0@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Since not all registers need to be cached and the cache is entirely
optional anyway we shouldn't be checking that a register is in the
cached range. If the register is invalid then the actual I/O code
can determine that and report an error.

Similarly, the step size can and should be enforced by the lower level
code if it's important.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>

Merge branch 'topic/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 into for-2.6.39

The user-supplied index into the adapters array needs to be checked, or
an out-of-bounds kernel pointer could be accessed and used, leading to
potentially exploitable memory corruption.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

loopback_pos_update() can be called in the timer callback, thus the lock
held should be irq-safe.  Otherwise you'll get AB/BA deadlock together
with substream->self_group.lock.
Reported-and-tested-by: Knut Petersen <Knut_Petersen@t-online.de>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Merge list_del() + list_add_tail() to list_move_tail().
Signed-off-by: Nicolas Kaiser <nikai@nikai.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Merge branch 'for-2.6.39' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/asoc-2.6 into topic/asoc

Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

fixes this error:

sound/firewire/fcp.c: In function 'fcp_avc_transaction':
sound/firewire/fcp.c:103: error: implicit declaration of function 'msleep'
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Add an AMDTP stream error state that occurs when we fail to queue
another packet.  In this case, the stream is stopped, and the error can
be reported when the application tries to restart the PCM stream.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

For correct cache coherency on some architectures, DMA buffers must be
allocated in a different cache line than data that is concurrently used
by the CPU.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

In non-blocking mode, the SYT_INTERVAL is larger than the number of
audio frames in each packet, so there are packets that do not contain
any frame to which the SYT could be applied.  For these packets, the
SYT must not be the timestamp of the next valid SYT frame, but the
special no-info SYT value.

This fixes broken playback on the FireWave at 44.1 kHz.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Add a driver for two playback-only FireWire devices based on the OXFW970
chip.

v2: better AMDTP API abstraction; fix fw_unit leak; small fixes
v3: cache the iPCR value
v4: FireWave constraints; fix fw_device reference counting;
    fix PCR caching; small changes and fixes
v5: volume/mute support; fix crashing due to pcm stop races
v6: fix build; one-channel volume for LaCie
v7: use signed values to make volume (range checks) work; fix function
    block IDs for volume/mute; always use channel 0 for LaCie volume
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Tested-by: Jay Fenlason <fenlason@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Signed-off-by: Takashi Iwai <tiwai@suse.de>

This patch replaces use of the harcoded arrays of pins, muxes, digital
mics and adcs with the auto-generated ones using codec parsing and
auto-discovers all actually connected digital mic pins on 92HD8X-like
codecs

This patch also adds the support for d-mic on pin 0x20.
Signed-off-by: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

When the mux for digital mic is different from the mux for other mics,
the current auto-parser doesn't handle them in a right way but provides
only one mic.  This patch fixes the issue.
Signed-off-by: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Move the default input-src selection code for alc268/269 to the init
part instead of the parser.  The input-src selection might be overwritten
by init verbs.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Currently some special handling for the unusual case like dual-ADCs
or a single-input-src is done in the tree-parse time in
set_capture_mixer().  But this setup could be overwritten by static
init verbs.

This patch moves the initialization into the init phase so that
such input-src setup won't be lost.

Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Clear input settings before initialization.
Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

SDPIF status retrieval always returned the default settings instead of
the actual ones.
Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

SPDIF status mask creation was incorrect.
Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

microphone boost was set at +12dB, not +20dB (like in Windows driver
and in adc_conf structure declaration), some comments added.
Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The time-out in snd_atiixp_aclink_reset() is wrongly checked, and
it resulted in exiting from the loop at the first iteration.
Reported-by: Amir Shamsuddin <AmirS2+alsa@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>