summaryrefslogtreecommitdiff
path: root/sound
AgeCommit message (Collapse)Author
2010-10-17ALSA: rawmidi: fix oops (use after free) when unloading a driver moduleClemens Ladisch
When a driver module is unloaded and the last still open file is a raw MIDI device, the card and its devices will be actually freed in the snd_card_file_remove() call when that file is closed. Afterwards, rmidi and rmidi->card point into freed memory, so the module pointer is likely to be garbage. (This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.) Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Reported-by: Krzysztof Foltman <wdev@foltman.com> Cc: 2.6.30-2.6.35 <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-10-11ALSA: hda - Add another HP DV6 quirkLuke Yelavich
BugLink: https://bugs.launchpad.net/bugs/653420 Add another HP DV6 notebook (103c:363e) to use STAC_HP_DV5. Signed-off-by: Luke Yelavich <luke.yelavich@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-10-11OSS: soundcard: locking bug in sound_ioctl()Dan Carpenter
We shouldn't return directly here because we're still holding the &soundcard_mutex. This bug goes all the way back to the start of git. It's strange that no one has complained about it as a runtime bug. CC: stable@kernel.org Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-10-04Merge branch 'fix/misc' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: i2c/other/ak4xx-adda: Fix a compile warning with CONFIG_PROCFS=n ALSA: prevent heap corruption in snd_ctl_new()
2010-09-30ALSA: i2c/other/ak4xx-adda: Fix a compile warning with CONFIG_PROCFS=nTakashi Iwai
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-28ALSA: prevent heap corruption in snd_ctl_new()Dan Rosenberg
The snd_ctl_new() function in sound/core/control.c allocates space for a snd_kcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC* device (on many distros, this is group "audio") via the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-25Merge branch 'fix/hda' into for-linusTakashi Iwai
2010-09-25Merge branch 'fix/asoc' into for-linusTakashi Iwai
2010-09-25ALSA: sound/pci/rme9652: prevent reading uninitialized stack memoryDan Rosenberg
The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow unprivileged users to read uninitialized kernel stack memory, because several fields of the hdsp{m}_config_info structs declared on the stack are not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-24ALSA: hda - Fix auto-parse of SPDIF input of Realtek codecsTakashi Iwai
The SPDIF in audio widget must be searched through the list as the widget that contains the given pin as the connection source. The current code was implemented in a reverse way. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-22ASoC: Fix multi-componentismMark Brown
Spot the build testing. Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-09-22ASoC: Fix soc-cache buffer overflow bugDimitris Papastamos
Make sure we stay within the cache boundaries when updating the register cache. Signed-off-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-09-22ALSA: oxygen: fix analog capture on Claro halo cardsErik J. Staab
On the HT-Omega Claro halo card, the ADC data must be captured from the second I2S input. Using the default first input, which isn't connected to anything, would result in silence. Signed-off-by: Erik J. Staab <ejs@insightbb.com> Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-21ALSA: hda - Add Dell Latitude E6400 model quirkLuke Yelavich
BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/643891 Set the Dell Latitude E6400 (1028:0233) SSID to use AD1984_DELL_DESKTOP Cc: stable@kernel.org Signed-off-by: Luke Yelavich <luke.yelavich@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-19ASoC: fix clkdev API usage in sh/migor.cGuennadi Liakhovetski
The clkdev API doesn't use .name and .id members of struct clk for clock lookup. Instead clocks should be added to a lookup list. Without this patch audio om the Migo-R board fails silently. Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-09-17Merge branch 'fix/hda' into for-linusTakashi Iwai
2010-09-16ALSA: pcm - Fix race with proc filesTakashi Iwai
The PCM proc files may open a race against substream close, which can end up with an Oops. Use the open_mutex to protect for it. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-16ALSA: pcm - Fix unbalanced pm_qos_requestTakashi Iwai
The pm_qos_request isn't freed properly when OSS PCM emulation is used because it skips snd_pcm_hw_free() call but directly releases the stream. This resulted in Oops later. Tested-by: Simon Kirby <sim@hostway.ca> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-16ALSA: HDA: Enable internal speaker on Dell M101zDavid Henningsson
BugLink: http://launchpad.net/bugs/640254 In some cases a magic processing coefficient is needed to enable the internal speaker on Dell M101z. According to Realtek, this processing coefficient is only present on ALC269vb. Cc: stable@kernel.org Signed-off-by: David Henningsson <david.henningsson@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-14ALSA: patch_nvhdmi.c: Fix supported sample rate list.Stephen Warren
22050 isn't a valid HDMI sample rate. 32000 is. Signed-off-by: Stephen Warren <swarren@nvidia.com> Acked-By: Wei Ni <wni@nvidia.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-13sound: Remove pr_<level> uses of KERN_<level>Joe Perches
Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Acked-by: Geoff Levand <geoff@infradead.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-13ALSA: hda - Add quirk for Toshiba C650D using a Conexant CX20585Anisse Astier
Add a quirk for laptop Toshiba Satellite C650D to have proper external HP and external Mic support. Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-13ALSA: hda_intel: ALSA HD Audio patch for Intel Patsburg DeviceIDsSeth Heasley
This patch adds the Intel Patsburg (PCH) HD Audio Controller DeviceIDs. Signed-off-by: Seth Heasley <seth.heasley@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-10Merge branch 'fix/hda' into for-linusTakashi Iwai
2010-09-09ALSA: rawmidi: fix the get next midi device ioctlDan Carpenter
If we pass in a device which is higher than SNDRV_RAWMIDI_DEVICES then the "next device" should be -1. This function just returns device + 1. But the main thing is that "device + 1" can lead to a (harmless) integer overflow and that annoys static analysis tools. [fix the case for device == SNDRV_RAWMIDI_DEVICE by tiwai] Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: hda - Fix wrong HP pin detection in snd_hda_parse_pin_def_config()Takashi Iwai
snd_hda_parse_pin_def_config() has some workaround for re-assigning some pins declared as headphones to line-outs. This didn't work properly for some cases because it used memmove() stupidly wrongly. Reference: Novell bnc#637263 https://bugzilla.novell.com/show_bug.cgi?id=637263 Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()Takashi Iwai
The error handling in snd_seq_oss_open() has several bad codes that do dereferecing released pointers and double-free of kmalloc'ed data. The object dp is release in free_devinfo() that is called via private_free callback. The rest shouldn't touch this object any more. The patch changes delete_port() to call kfree() in any case, and gets rid of unnecessary calls of destructors in snd_seq_oss_open(). Fixes CVE-2010-3080. Reported-and-tested-by: Tavis Ormandy <taviso@cmpxchg8b.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: msnd-classic: Fix invalid cfg parameterTakashi Iwai
The driver doesn't probe the device properly because of left-over cfg[] that isn't used at all for msnd-classic device. This is only for msnd- pinnacle. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: hda - Enable PC-beep for EeePC with ALC269 codecTakashi Iwai
EeePC 1001HAG has a similar problem like other ASUS machine, which doesn't set the codec SSID properly for indicating the beep capability. To enable PC-beep again, put this to the whitelist. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: hda - Add errata initverb sequence for CS42xx codecsBrian Austin
Add init verb sequence for errata ER880C3 http://www.cirrus.com/en/pubs/errata/ER880C3.pdf Signed-off-by: Brian Austin <brian.austin@cirrus.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: usb - Release capture substream URBs properlyTakashi Iwai
Due to the wrong "return" in the loop, a capture substream won't be released at disconnection properly if the device is capture only and has no playback substream. This caused Oops occasionally at the device reconnection. Reported-by: Kim Minhyoung <minhyoung.kim@lge.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: virtuoso: fix setting of Xonar DS line-in/mic-in controlsClemens Ladisch
The Line and Mic inputs cannot be used at the same time, so the driver has to automatically disable one of them if both are set. However, it forgot to notify userspace about this change, so the mixer state would be inconsistent. To fix this, check if the other control gets muted, and send a notification event in this case. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Reported-and-tested-by: Nathan Schagen Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08ALSA: virtuoso: work around missing reset in the Xonar DS Windows driverClemens Ladisch
For the WM8776 chip, this driver uses a different sample format and more features than the Windows driver. When rebooting from Linux into Windows, the latter driver does not reset the chip but assumes all its registers have their default settings, so we get garbled sound or, if the output happened to be muted before rebooting, no sound. To make that driver happy, hook our driver's cleanup function into the shutdown notifier and ensure that the chip gets reset. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Reported-and-tested-by: Nathan Schagen Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-07ALSA: hda - Add quirk for Lenovo T400sTakashi Iwai
Lenovo T400s requires the quirk to make automatic HP/mic switching working. Reported-by: Frank Becker <fb@alien8.de> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-03ALSA: usb-audio: fix detection of vendor-specific device protocol settingsClemens Ladisch
The Audio Class v2 support code in 2.6.35 added checks for the bInterfaceProtocol field. However, there are devices (usually those detected by vendor-specific quirks) that do not have one of the predefined values in this field, which made the driver reject them. To fix this regression, restore the old behaviour, i.e., assume that a device with an unknown bInterfaceProtocol field (other than UAC_VERSION_2) has more or less UAC-v1-compatible descriptors. [compile warning fixes by tiwai] Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Cc: Daniel Mack <daniel@caiaq.de> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-02ALSA: usb-audio: Assume first control interface is for audioDaniel Mack
For devices with more than one control interface, let's assume the first one contains the audio controls. Unfortunately, there is no field in any of the descriptors to tell us whether a control interface is for audio or MIDI controls, so a better check is not easy to implement. On a composite device with audio and MIDI functions, for example, the code currently overwrites chip->ctrl_intf, causing operations on the control interface to fail if they are issued after the device probe. Signed-off-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-02ALSA: hda - Add a new hp-laptop model for Conexant 5066, tested on HP G60David Henningsson
This new model adds the following functionality to HP G60: - Automute of internal speakers - Autoswitch of internal/external mics - Remove SPDIF not physically present BugLink: http://launchpad.net/bugs/587388 Cc: stable@kernel.org Signed-off-by: David Henningsson <david.henningsson@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-28Merge branch 'fix/asoc' into for-linusTakashi Iwai
2010-08-28Merge branch 'fix/hda' into for-linusTakashi Iwai
2010-08-28ALSA: pcm: add more format namesDan Carpenter
There were some new formats added in commit 15c0cee6c809 "ALSA: pcm: Define G723 3-bit and 5-bit formats". That commit increased SNDRV_PCM_FORMAT_LAST as well. My concern is that there are a couple places which do: for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) { if (dummy->pcm_hw.formats & (1ULL << i)) snd_iprintf(buffer, " %s", snd_pcm_format_name(i)); } I haven't tested these but it looks like if "i" were equal to SNDRV_PCM_FORMAT_G723_24 or higher then we might read past the end of the array. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-28sound: oss: fix uninitialized spinlockAkinobu Mita
The spinlock lock in sound_timer.c is used without initialization. Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-28ALSA: asihpi - Return hw error directly from oustream_write.Eliot Blennerhassett
If hw error is ignored, status is updated with invalid info. Signed-off-by: Eliot Blennerhassett <eblennerhassett@audioscience.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-27ASoC: soc-core: fix debugfs_pop_time file permissionsAxel Lin
I think this is a typo, debugfs_pop_time should not be executable. Signed-off-by: Axel Lin <axel.lin@gmail.com> Acked-by: Liam Girdwood <lrg@slimloogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-08-26ALSA: hda - Add Sony VAIO quirk for ALC269David Henningsson
The attached patch enables playback on a Sony VAIO machine. BugLink: http://launchpad.net/bugs/618271 Signed-off-by: David Henningsson <david.henningsson@canonical.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-23Merge branch 'fix/asoc' into for-linusTakashi Iwai
2010-08-23ASoC: i.MX ssi: use SSI_STCCR in synchronous modeSascha Hauer
In synchronous mode the SSI_SRCCR values are ignored. Instead SSI_STCCR must be used for both receiving and transmitting. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Acked-by: Liam Girdwood <lrg@slimlogic.co.uk> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-08-23Merge branch 'fix/hda' into for-linusTakashi Iwai
2010-08-23ALSA: hda - Add support for Lenovo S10-3tJerone Young
This patch adds quirk for the Lenovo S10-3t so the headphone & microphone jacks will now work. Signed-off-by: Jerone Young <jerone.young@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-20ALSA: hda - Fix stream and channel-ids codec-bus wideTakashi Iwai
The new sticky PCM parameter introduced the delayed clean-ups of stream- and channel-id tags. In the current implementation, this check (adding dirty flag) and actual clean-ups are done only for the codec chip. However, with HD-audio architecture, multiple codecs can be on a single bus, and the controller assign stream- and channel-ids in the bus-wide. In this patch, the stream-id and channel-id are checked over all codecs connected to the corresponding bus. Together with it, the mutex is moved to struct hda_bus, as this becomes also bus-wide. Reported-and-tested-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-20ALSA: hda - Fix conflict of sticky PCM parameter in HDMI codecsTakashi Iwai
Intel and Nvidia HDMI codec drivers have own implementations of sticky PCM parameters. Now HD-audio core part already has it, thus both setups conflict. The fix is simply remove the part in patch_intelhdmi.c and patch_nvhdmi.c and simply call snd_hda_codec_setup_stream() as usual. Reported-and-tested-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-13 17:45:41 +0000