- 18 Mar, 2011 2 commits
-
-
Dan Rosenberg authored
The user-supplied index into the adapters array needs to be checked, or an out-of-bounds kernel pointer could be accessed and used, leading to potentially exploitable memory corruption. Signed-off-by:
Dan Rosenberg <drosenberg@vsecurity.com> Cc: <stable@kernel.org> Signed-off-by:
Takashi Iwai <tiwai@suse.de>
-
Takashi Iwai authored
loopback_pos_update() can be called in the timer callback, thus the lock held should be irq-safe. Otherwise you'll get AB/BA deadlock together with substream->self_group.lock. Reported-and-tested-by:
Knut Petersen <Knut_Petersen@t-online.de> Cc: <stable@kernel.org> Signed-off-by:
-
- 16 Mar, 2011 2 commits
-
-
Nicolas Kaiser authored
Merge list_del() + list_add_tail() to list_move_tail(). Signed-off-by:
Nicolas Kaiser <nikai@nikai.net> Signed-off-by:
-
Kirill A. Shutemov authored
Signed-off-by:
Kirill A. Shutemov <kirill@shutemov.name> Signed-off-by:
-
- 14 Mar, 2011 4 commits
-
-
Przemyslaw Bruski authored
Clear input settings before initialization. Signed-off-by:
Przemyslaw Bruski <pbruskispam@op.pl> Cc: <stable@kernel.org> Signed-off-by:
-
Przemyslaw Bruski authored
SDPIF status retrieval always returned the default settings instead of the actual ones. Signed-off-by:
-
Przemyslaw Bruski authored
SPDIF status mask creation was incorrect. Signed-off-by:
-
Przemyslaw Bruski authored
microphone boost was set at +12dB, not +20dB (like in Windows driver and in adc_conf structure declaration), some comments added. Signed-off-by:
-
- 11 Mar, 2011 7 commits
-
-
Takashi Iwai authored
The time-out in snd_atiixp_aclink_reset() is wrongly checked, and it resulted in exiting from the loop at the first iteration. Reported-by:
Amir Shamsuddin <AmirS2+alsa@gmail.com> Signed-off-by:
-
Paul Bolle authored
Appending an 'm' will distinguish it from a similar struct in intel8x0.c Signed-off-by:
Paul Bolle <pebolle@tiscali.nl> Signed-off-by:
-
Paul Bolle authored
Adding an 'm' will distinguish them from identical names in intel8x0.c. Signed-off-by:
-
Paul Bolle authored
At every resume a laptop I use prints this message (at KERN_ERR level): ALSA sound/pci/intel8x0m.c:904: AC'97 warm reset still in progress? [0x2] The thing to note here is that 0x2 corresponds to ICH_AC97COLD. Ie, what seems to be happening is that the register involved indicated a warm reset for some time (as the ICH_AC97WARM bit was set) but by the time the warning is printed, and that same register is checked again, that bit is already cleared and only the ICH_AC97COLD bit is still set. It turns out a warm reset needs some time to settle, but it is currently checked right away. The test therefore fails the first time it is done and schedule_timeout_uninterruptible() will be called. Once we return from that jiffies is already (far) past end_time on this laptop, so we exit the loop, print a warning, and exit the function while the warm reset actually succeeded. A way to fix this is to call usleep_range() after writing to the register involved. A handful of tests suggest 500 usecs is a safe value. (This might punish the "finish cold reset" case, but on this laptop such a cold reset apparently never happens, so I can't say for sure.) While we're at it drop the extra single tick from end_time, as it looks rather silly. Signed-off-by: -
Oliver Neukum authored
Devices are autosuspended if no pcm nor midi channel is open Mixer devices may be opened. This way they are active when in use to play or record sound, but can be suspended while users have a mixer application running. [Small clean-ups using static inline by tiwai] Signed-off-by:
Oliver Neukum <oneukum@suse.de> Signed-off-by:
-
Oliver Neukum authored
- ESHUTDOWN must be correctly handled - the optional interrupt endpoint's URB must be stopped and restarted Signed-off-by:
-
Takashi Iwai authored
-
- 10 Mar, 2011 2 commits
-
-
Alexey Fisher authored
One more affected devices: Logitech Webcam C600 (046d:0808) Volume range before quirk is 6400, after (also real) is 16. Signed-off-by:
Alexey Fisher <bug-track@fisher-privat.net> Signed-off-by:
-
Alexey Fisher authored
Signed-off-by:
-
- 09 Mar, 2011 1 commit
-
-
Takashi Iwai authored
Since OSS driver creates the device entries for /dev/audio* and /dev/dspW* by itself without coping with sound_core, it leads to conflicts with others and let sysfs spewing warnings. This patch rewrites the registration part of OSS driver to use the standard method also for additional minor devices. Reported-by: Steven Rostedt <rostedt@goodmis.org> (with ktest.pl) Tested-by: Steven Rostedt <rostedt@goodmis.org> (with ktest.pl) Signed-off-by:
-
- 08 Mar, 2011 4 commits
-
-
Takashi Iwai authored
Signed-off-by: -
Clemens Ladisch authored
The return value of snd_ctl_hole_check() is used only to detect whether to continue the loop in snd_ctl_find_hole() or not, so we can simplify the code by changing this return type to a boolean. Also rename this function to better show what it actually does. Signed-off-by:
Clemens Ladisch <clemens@ladisch.de> Signed-off-by:
-
Clemens Ladisch authored
The purpose of the snd_ctl_hole_check() function is to find conflicts between the numerical IDs of the new control and those of any existing controls. However, it would fail to detect an existing control whose count is smaller than the new control's count and whose interval of IDs is entirely contained in the interval of the new control's IDs. To fix this, use the correct formula to detect overlapping intervals, which happens to simplify the condition. This problem was not encountered so far because ALSA does not yet allow drivers to allocate specific control IDs. Signed-off-by:
-
Adrian Knoth authored
The current AES32 firmware revision ID is 234, however, a user confirmed that everything works fine with the previous revision, too. Signed-off-by:
Adrian Knoth <adi@drcomp.erfurt.thur.de> Signed-off-by:
-
- 28 Feb, 2011 5 commits
-
-
Adrian Knoth authored
Depending on the model and the presence of a TCO module, the number of midi ports varies. Some have 1 port (MADIface), some have 2 (default), with TCO, there are 3. Don't hardcode the number of midi ports to initialize. This patch also fixes a boot lockup on MADIface. [Coding-style fixes by tiwai] Signed-off-by:
-
Adrian Knoth authored
Don't continue if we cannot detect the real card type, otherwise, all subsequent functions, especially strcpy(), would fail, leaving the whole driver in an unusable state. Without such a protection, dmesg would look like this: Pid: 1525, comm: modprobe Not tainted 2.6.38-rc6 #1 MSI MS-7250/MS-7250 EIP: 0060:[<c114e700>] EFLAGS: 00010296 CPU: 1 EIP is at strcpy+0x10/0x30 EAX: f4d33e58 EBX: f5990800 ECX: f4d33e58 EDX: 00000000 ESI: 00000000 EDI: f4d33e58 EBP: f5990930 ESP: f3dd3e0c DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 f53d4204 00000000 f90bfc03 00000001 00000001 f3dd3e64 c10fedff f3dd3e7c f3d854e4 f53d4000 c10307b8 00000001 c10307b8 f5990860 c10307b8 00000001 c10332e5 f59908bc c12f4339 f59908bc f5990860 c11ef207 f4d33e00 f53d4000 [<f90bfc03>] ? snd_hdspm_probe+0x7e7/0x1166 [snd_hdspm] [<c10fedff>] ? __sysfs_add_one+0x1f/0xf0 [<c10307b8>] ? get_parent_ip+0x8/0x20 [<c10307b8>] ? get_parent_ip+0x8/0x20 [<c10307b8>] ? get_parent_ip+0x8/0x20 [<c10332e5>] ? add_preempt_count+0xa5/0xd0 [<c12f4339>] ? _raw_spin_lock_irqsave+0x19/0x40 [<c11ef207>] ? pm_runtime_enable+0x17/0x80 [<c1160172>] ? local_pci_probe+0x42/0xb0 [<c1161091>] ? pci_device_probe+0x61/0x80 [<c11e9587>] ? driver_probe_device+0x77/0x180 [<c11600f0>] ? pci_match_device+0xa0/0xc0 [<c11e9709>] ? __driver_attach+0x79/0x80 [<c11e9690>] ? __driver_attach+0x0/0x80 [<c11e8e32>] ? bus_for_each_dev+0x52/0x80 [<c11e9416>] ? driver_attach+0x16/0x20 [<c11e9690>] ? __driver_attach+0x0/0x80 [<c11e8771>] ? bus_add_driver+0xa1/0x220 [<c1160f20>] ? pci_device_remove+0x0/0xf0 [<c11e99a3>] ? driver_register+0x63/0x120 [<c11612bd>] ? __pci_register_driver+0x3d/0xb0 [<c1001132>] ? do_one_initcall+0x32/0x160 [<f90d6000>] ? alsa_card_hdspm_init+0x0/0x14 [snd_hdspm] [<c10676a9>] ? sys_init_module+0x99/0x1e0 [<c10ade3d>] ? sys_close+0x6d/0xc0 [<c1002c90>] ? sysenter_do_call+0x12/0x26 ---[ end trace 239f0661c558378b ]--- Signed-off-by:
-
Adrian Knoth authored
In contrast to the PCIe version (RME AES), the PCI version (RME AES32) has a different firmware revision. This patch adds the missing PCI revision. Signed-off-by:
-
Adrian Knoth authored
Signed-off-by:
-
Risto Suominen authored
Allow input from microphone on remaining PowerBooks and iBooks with Tumbler. Tested only with PowerBook G4 Gigabit Ethernet (PowerBook3,3). [Fixed to use of_machine_is_compatible by tiwai] Signed-off-by:
Risto Suominen <Risto.Suominen@gmail.com> Signed-off-by:
-
- 27 Feb, 2011 1 commit
-
-
Justin P. Mattock authored
The Patch below removes one to many "n's" in a word.. Signed-off-by:
Justin P. Mattock <justinmattock@gmail.com> Signed-off-by:
-
- 25 Feb, 2011 2 commits
-
-
Justin P. Mattock authored
The patch below removes an extra "l" in the word. Signed-off-by:
-
Justin P. Mattock authored
The patch below removes an extra "l" in the word. Signed-off-by:
-
- 23 Feb, 2011 9 commits
-
-
Adrian Knoth authored
Signed-off-by:
-
Adrian Knoth authored
Original patch by Dan Rosenberg <drosenberg@vsecurity.com> under commit e68d3b31. I'm copying his text here: The SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl in hdspm.c allow unprivileged users to read uninitialized kernel stack memory, because several fields of the hdspm_config struct declared on the stack are not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by:
-
Adrian Knoth authored
Fredrik Lingvall <fredrik.lingvall@gmail.com> has discovered wrong frequency and sync detection on AES32. According to him, the provided patch fixes these issues. Signed-off-by:
-
Adrian Knoth authored
In contrast to the RME MADI card, coax/optical selection on the MADIface is done via a physical switch located at the breakout box. Obviously, the driver cannot switch ports in software. Signed-off-by:
-
Adrian Knoth authored
Caused by two typos, no output channel mappings were assigned for MADI/MADIface at double/quad speed. The channel mapping is indeed identical to the single speed mapping, the cards will simply use the first N channels. Signed-off-by:
Florian Faber <faber@faberman.de> Signed-off-by:
Fredrik Lingvall <fredrik.lingvall@gmail.com> Signed-off-by:
-
Adrian Knoth authored
Without calling an appropriate rule, AES/AES32 cards would announce a theoretical channel count of 64 (HDSPM_MAX_CHANNELS), leading to the already known bug: [37422.640481] ------------[ cut here ]------------ [37422.640487] WARNING: at sound/pci/rme9652/hdspm.c:5449 snd_hdspm_ioctl+0x18f/0x202 [snd_hdspm]() [37422.640489] Hardware name: PRIMERGY RX100 S6 [37422.640490] BUG? (info->channel >= hdspm->max_channels_in) [37422.640492] Modules linked in: snd_hdspm snd_seq_midi ipmi_watchdog ipmi_poweroff ipmi_si ipmi_devintf ipmi_msghandler i2c_i801 e1000e snd_rawmidi power_meter [last unloaded: snd_hdspm] [37422.640501] Pid: 22231, comm: jackd Tainted: G D W 2.6.36-gentoo-r5 #5 [37422.640502] Call Trace: [37422.640508] [<ffffffff8103db3a>] warn_slowpath_common+0x80/0x98 [37422.640511] [<ffffffff8103dbe6>] warn_slowpath_fmt+0x41/0x43 [37422.640514] [<ffffffff81034306>] ? get_parent_ip+0x11/0x42 [37422.640518] [<ffffffffa0055763>] snd_hdspm_ioctl+0x18f/0x202 [snd_hdspm] [37422.640522] [<ffffffff813fd626>] snd_pcm_channel_info+0x73/0x7c [37422.640525] [<ffffffff814001e9>] snd_pcm_common_ioctl1+0x326/0xb01 [37422.640527] [<ffffffff81034306>] ? get_parent_ip+0x11/0x42 [37422.640531] [<ffffffff8105be6c>] ? __srcu_read_unlock+0x3b/0x59 [37422.640533] [<ffffffff81400bce>] snd_pcm_capture_ioctl1+0x20a/0x227 [37422.640537] [<ffffffff811e599c>] ? file_has_perm+0x90/0x9e [37422.640540] [<ffffffff81400c15>] snd_pcm_capture_ioctl+0x2a/0x2e [37422.640543] [<ffffffff810f2c69>] do_vfs_ioctl+0x404/0x453 [37422.640546] [<ffffffff810f2d09>] sys_ioctl+0x51/0x74 [37422.640549] [<ffffffff81002aab>] system_call_fastpath+0x16/0x1b [37422.640552] ---[ end trace 0cd919cd68118082 ]--- We already have all the right values in place, we simply have to inform the upper layers about this restriction. Note that snd_hdspm_hw_rule_rate_out_channels and snd_hdspm_hw_rule_rate_in_channels must not be called on AES32, because the channel count is always 16, no matter of the samplerate in use. Signed-off-by:
-
Adrian Knoth authored
Only RayDAT and AIO provide sane buffer pointers that can be used with HDSPM_BufferPositionMask, on all other cards, this would result in a wrong HW pointer leading to xruns and these messages: [260808.916788] BUG: pcmC0D0p:0, pos = 2976, buffer size = 1024, period size = 512 [260808.961124] BUG: pcmC0D0c:0, pos = 4944, buffer size = 1024, period size = 512 Signed-off-by:
-
Adrian Knoth authored
On RME AES and AES(32), none of the required information (max_channels_in, max_channels_out, channel mappings, port names) was set, leading to the BUG below. This patch adds the missing bits, thus fixing the bug. 125.058768] ------------[ cut here ]------------ [ 125.058773] WARNING: at sound/pci/rme9652/hdspm.c:5389 snd_hdspm_ioctl+0x10c/0x1d8 [snd_hdspm]() [ 125.058775] Hardware name: PRIMERGY RX100 S6 [ 125.058777] BUG? (info->channel >= hdspm->max_channels_out) [ 125.058778] Modules linked in: ipmi_watchdog ipmi_poweroff ipmi_si ipmi_devintf ipmi_msghandler snd_hdspm power_meter e1000e snd_rawmidi i2c_i801 [ 125.058787] Pid: 3652, comm: audacity Tainted: G W 2.6.36-gentoo-r5 #5 [ 125.058788] Call Trace: [ 125.058792] [<ffffffff8103db3a>] warn_slowpath_common+0x80/0x98 [ 125.058796] [<ffffffff8103dbe6>] warn_slowpath_fmt+0x41/0x43 [ 125.058800] [<ffffffffa006761a>] snd_hdspm_ioctl+0x10c/0x1d8 [snd_hdspm] [ 125.058803] [<ffffffff813fd626>] snd_pcm_channel_info+0x73/0x7c [ 125.058806] [<ffffffff814001e9>] snd_pcm_common_ioctl1+0x326/0xb01 [ 125.058809] [<ffffffff810c604c>] ? __do_fault+0x361/0x3a6 [ 125.058812] [<ffffffff81400e23>] snd_pcm_playback_ioctl1+0x20a/0x227 [ 125.058815] [<ffffffff811e599c>] ? file_has_perm+0x90/0x9e [ 125.058818] [<ffffffff81400e6a>] snd_pcm_playback_ioctl+0x2a/0x2e [ 125.058821] [<ffffffff810f2c69>] do_vfs_ioctl+0x404/0x453 [ 125.058824] [<ffffffff810f2d09>] sys_ioctl+0x51/0x74 [ 125.058827] [<ffffffff81002aab>] system_call_fastpath+0x16/0x1b [ 125.058830] ---[ end trace 5bddb08e5d4cbeb1 ]--- Signed-off-by:
-
Takashi Iwai authored
When a USB audio device is disconnected, snd_usb_audio_disconnect() kills all audio URBs. At the same time, the application, after being notified of the disconnection, might close the device, in which case ALSA calls the .hw_free callback, which should free the URBs too. Commit de1b8b93 "[ALSA] Fix hang-up at disconnection of usb-audio" prevented snd_usb_hw_free() from freeing the URBs to avoid a hang that resulted from this race, but this introduced another race because the URB callbacks could now be executed after snd_usb_hw_free() has returned, and try to access already freed data. Fix the first race by introducing a mutex to serialize the disconnect callback and all PCM callbacks that manage URBs (hw_free and hw_params). Reported-and-tested-by:
Pierre-Louis Bossart <pierre-louis.bossart@intel.com> Cc: <stable@kernel.org> [CL: also serialize hw_params callback] Signed-off-by:
-
- 22 Feb, 2011 1 commit
-
-
David Henningsson authored
This typo caused some microphone inputs not to be correctly initialized on VIA codecs. Reported-By:
Mark Goldstein <goldstein.mark@gmail.com> Cc: stable@kernel.org Signed-off-by:
David Henningsson <david.henningsson@canonical.com> Signed-off-by:
-
