Commit graph

7925 commits

Author SHA1 Message Date
Clemens Ladisch
aa73aec6c3 ALSA: rawmidi: fix oops (use after free) when unloading a driver module
When a driver module is unloaded and the last still open file is a raw
MIDI device, the card and its devices will be actually freed in the
snd_card_file_remove() call when that file is closed.  Afterwards, rmidi
and rmidi->card point into freed memory, so the module pointer is likely
to be garbage.
(This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.)

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Reported-by: Krzysztof Foltman <wdev@foltman.com>
Cc: 2.6.30-2.6.35 <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-10-17 10:11:40 +02:00
Luke Yelavich
9b2167d59f ALSA: hda - Add another HP DV6 quirk
BugLink: https://bugs.launchpad.net/bugs/653420

Add another HP DV6 notebook (103c:363e) to use STAC_HP_DV5.

Signed-off-by: Luke Yelavich <luke.yelavich@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-10-11 13:49:04 +02:00
Dan Carpenter
d4cfa4d12f OSS: soundcard: locking bug in sound_ioctl()
We shouldn't return directly here because we're still holding the
&soundcard_mutex.

This bug goes all the way back to the start of git.  It's strange that
no one has complained about it as a runtime bug.

CC: stable@kernel.org
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-10-11 13:44:17 +02:00
Linus Torvalds
d9f73afcd3 Merge branch 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
* 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: i2c/other/ak4xx-adda: Fix a compile warning with CONFIG_PROCFS=n
  ALSA: prevent heap corruption in snd_ctl_new()
2010-10-04 11:15:59 -07:00
Takashi Iwai
e913b14649 ALSA: i2c/other/ak4xx-adda: Fix a compile warning with CONFIG_PROCFS=n
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-30 22:59:12 +02:00
Dan Rosenberg
5591bf0722 ALSA: prevent heap corruption in snd_ctl_new()
The snd_ctl_new() function in sound/core/control.c allocates space for a
snd_kcontrol struct by performing arithmetic operations on a
user-provided size without checking for integer overflow.  If a user
provides a large enough size, an overflow will occur, the allocated
chunk will be too small, and a second user-influenced value will be
written repeatedly past the bounds of this chunk.  This code is
reachable by unprivileged users who have permission to open
a /dev/snd/controlC* device (on many distros, this is group "audio") via
the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-28 21:33:16 +02:00
Takashi Iwai
3b23cd2875 Merge branch 'fix/hda' into for-linus 2010-09-25 17:57:53 +02:00
Takashi Iwai
b614e38e78 Merge branch 'fix/asoc' into for-linus 2010-09-25 17:57:49 +02:00
Dan Rosenberg
e68d3b316a ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory
The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
unprivileged users to read uninitialized kernel stack memory, because
several fields of the hdsp{m}_config_info structs declared on the stack
are not altered or zeroed before being copied back to the user.  This
patch takes care of it.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-25 17:46:22 +02:00
Takashi Iwai
01fdf1801e ALSA: hda - Fix auto-parse of SPDIF input of Realtek codecs
The SPDIF in audio widget must be searched through the list as the widget
that contains the given pin as the connection source.  The current code
was implemented in a reverse way.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-24 09:09:42 +02:00
Mark Brown
0077ca0b5c ASoC: Fix multi-componentism
Spot the build testing.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-09-22 18:47:40 +01:00
Dimitris Papastamos
d47372e852 ASoC: Fix soc-cache buffer overflow bug
Make sure we stay within the cache boundaries when updating the
register cache.

Signed-off-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-09-22 12:01:05 +01:00
Erik J. Staab
0873a5ae74 ALSA: oxygen: fix analog capture on Claro halo cards
On the HT-Omega Claro halo card, the ADC data must be captured from the
second I2S input.  Using the default first input, which isn't connected
to anything, would result in silence.

Signed-off-by: Erik J. Staab <ejs@insightbb.com>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-22 10:04:08 +02:00
Luke Yelavich
0f9f1ee9d1 ALSA: hda - Add Dell Latitude E6400 model quirk
BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/643891

Set the Dell Latitude E6400 (1028:0233) SSID to use AD1984_DELL_DESKTOP

Cc: stable@kernel.org
Signed-off-by: Luke Yelavich <luke.yelavich@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-21 10:07:45 +02:00
Guennadi Liakhovetski
cbfa5184cc ASoC: fix clkdev API usage in sh/migor.c
The clkdev API doesn't use .name and .id members of struct clk for clock
lookup. Instead clocks should be added to a lookup list. Without this patch
audio om the Migo-R board fails silently.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-09-19 16:02:47 +01:00
Takashi Iwai
a1984f4999 Merge branch 'fix/hda' into for-linus 2010-09-17 17:44:20 +02:00
Takashi Iwai
901d46d5a8 ALSA: pcm - Fix race with proc files
The PCM proc files may open a race against substream close, which can
end up with an Oops.  Use the open_mutex to protect for it.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-16 23:06:50 +02:00
Takashi Iwai
8699a0b657 ALSA: pcm - Fix unbalanced pm_qos_request
The pm_qos_request isn't freed properly when OSS PCM emulation is used
because it skips snd_pcm_hw_free() call but directly releases the
stream.  This resulted in Oops later.

Tested-by: Simon Kirby <sim@hostway.ca>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-16 23:04:38 +02:00
David Henningsson
145a902bfe ALSA: HDA: Enable internal speaker on Dell M101z
BugLink: http://launchpad.net/bugs/640254

In some cases a magic processing coefficient is needed to enable
the internal speaker on Dell M101z. According to Realtek, this
processing coefficient is only present on ALC269vb.

Cc: stable@kernel.org
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-16 10:18:54 +02:00
Stephen Warren
3894335876 ALSA: patch_nvhdmi.c: Fix supported sample rate list.
22050 isn't a valid HDMI sample rate. 32000 is.

Signed-off-by: Stephen Warren <swarren@nvidia.com>
Acked-By: Wei Ni <wni@nvidia.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-14 23:28:18 +02:00
Joe Perches
147fcf1c21 sound: Remove pr_<level> uses of KERN_<level>
Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-13 23:40:29 +02:00
Anisse Astier
2ca9cac965 ALSA: hda - Add quirk for Toshiba C650D using a Conexant CX20585
Add a quirk for laptop Toshiba Satellite C650D to have proper external HP and
external Mic support.

Signed-off-by: Anisse Astier <anisse@astier.eu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-13 12:33:32 +02:00
Seth Heasley
cea310e8f8 ALSA: hda_intel: ALSA HD Audio patch for Intel Patsburg DeviceIDs
This patch adds the Intel Patsburg (PCH) HD Audio Controller DeviceIDs.

Signed-off-by: Seth Heasley <seth.heasley@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-13 08:37:27 +02:00
Takashi Iwai
5431427b1a Merge branch 'fix/hda' into for-linus 2010-09-10 08:27:00 +02:00
Dan Carpenter
a7a13d0676 ALSA: rawmidi: fix the get next midi device ioctl
If we pass in a device which is higher than SNDRV_RAWMIDI_DEVICES then
the "next device" should be -1.  This function just returns device + 1.

But the main thing is that "device + 1" can lead to a (harmless) integer
overflow and that annoys static analysis tools.

[fix the case for device == SNDRV_RAWMIDI_DEVICE by tiwai]

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-09 09:05:21 +02:00
Takashi Iwai
122661b678 ALSA: hda - Fix wrong HP pin detection in snd_hda_parse_pin_def_config()
snd_hda_parse_pin_def_config() has some workaround for re-assigning
some pins declared as headphones to line-outs.  This didn't work properly
for some cases because it used memmove() stupidly wrongly.

Reference: Novell bnc#637263
	https://bugzilla.novell.com/show_bug.cgi?id=637263

Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08 14:59:26 +02:00
Takashi Iwai
27f7ad5382 ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()
The error handling in snd_seq_oss_open() has several bad codes that
do dereferecing released pointers and double-free of kmalloc'ed data.
The object dp is release in free_devinfo() that is called via
private_free callback.  The rest shouldn't touch this object any more.

The patch changes delete_port() to call kfree() in any case, and gets
rid of unnecessary calls of destructors in snd_seq_oss_open().

Fixes CVE-2010-3080.

Reported-and-tested-by: Tavis Ormandy <taviso@cmpxchg8b.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08 10:45:34 +02:00
Takashi Iwai
e4ee8dd8af ALSA: msnd-classic: Fix invalid cfg parameter
The driver doesn't probe the device properly because of left-over cfg[]
that isn't used at all for msnd-classic device.  This is only for msnd-
pinnacle.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08 09:58:12 +02:00
Takashi Iwai
080dc7bc25 ALSA: hda - Enable PC-beep for EeePC with ALC269 codec
EeePC 1001HAG has a similar problem like other ASUS machine, which doesn't
set the codec SSID properly for indicating the beep capability.
To enable PC-beep again, put this to the whitelist.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08 08:38:41 +02:00
Brian Austin
a769cbcf60 ALSA: hda - Add errata initverb sequence for CS42xx codecs
Add init verb sequence for errata ER880C3
http://www.cirrus.com/en/pubs/errata/ER880C3.pdf

Signed-off-by: Brian Austin <brian.austin@cirrus.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08 08:35:56 +02:00
Takashi Iwai
76195fb096 ALSA: usb - Release capture substream URBs properly
Due to the wrong "return" in the loop, a capture substream won't be
released at disconnection properly if the device is capture only and has
no playback substream.  This caused Oops occasionally at the device
reconnection.

Reported-by: Kim Minhyoung <minhyoung.kim@lge.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08 08:27:02 +02:00
Clemens Ladisch
fe6ce80ae2 ALSA: virtuoso: fix setting of Xonar DS line-in/mic-in controls
The Line and Mic inputs cannot be used at the same time, so the driver
has to automatically disable one of them if both are set.  However, it
forgot to notify userspace about this change, so the mixer state would
be inconsistent.  To fix this, check if the other control gets muted,
and send a notification event in this case.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Reported-and-tested-by: Nathan Schagen
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08 08:26:15 +02:00
Clemens Ladisch
4c25b93223 ALSA: virtuoso: work around missing reset in the Xonar DS Windows driver
For the WM8776 chip, this driver uses a different sample format and
more features than the Windows driver.  When rebooting from Linux into
Windows, the latter driver does not reset the chip but assumes all its
registers have their default settings, so we get garbled sound or, if
the output happened to be muted before rebooting, no sound.

To make that driver happy, hook our driver's cleanup function into the
shutdown notifier and ensure that the chip gets reset.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Reported-and-tested-by: Nathan Schagen
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-08 08:26:13 +02:00
Takashi Iwai
4d155641c8 ALSA: hda - Add quirk for Lenovo T400s
Lenovo T400s requires the quirk to make automatic HP/mic switching working.

Reported-by: Frank Becker <fb@alien8.de>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-07 12:04:48 +02:00
Clemens Ladisch
a2acad8298 ALSA: usb-audio: fix detection of vendor-specific device protocol settings
The Audio Class v2 support code in 2.6.35 added checks for the
bInterfaceProtocol field.  However, there are devices (usually those
detected by vendor-specific quirks) that do not have one of the
predefined values in this field, which made the driver reject them.

To fix this regression, restore the old behaviour, i.e., assume that
a device with an unknown bInterfaceProtocol field (other than
UAC_VERSION_2) has more or less UAC-v1-compatible descriptors.

[compile warning fixes by tiwai]

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: Daniel Mack <daniel@caiaq.de>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-03 22:36:39 +02:00
Daniel Mack
7b6717e144 ALSA: usb-audio: Assume first control interface is for audio
For devices with more than one control interface, let's assume the first
one contains the audio controls. Unfortunately, there is no field in any
of the descriptors to tell us whether a control interface is for audio
or MIDI controls, so a better check is not easy to implement.

On a composite device with audio and MIDI functions, for example, the
code currently overwrites chip->ctrl_intf, causing operations on the
control interface to fail if they are issued after the device probe.

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-02 11:58:37 +02:00
David Henningsson
048e78a5bc ALSA: hda - Add a new hp-laptop model for Conexant 5066, tested on HP G60
This new model adds the following functionality to HP G60:
- Automute of internal speakers
- Autoswitch of internal/external mics
- Remove SPDIF not physically present

BugLink: http://launchpad.net/bugs/587388
Cc: stable@kernel.org
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-02 11:49:17 +02:00
Takashi Iwai
9dde3f92a7 Merge branch 'fix/asoc' into for-linus 2010-08-28 21:44:15 +02:00
Takashi Iwai
6a36672502 Merge branch 'fix/hda' into for-linus 2010-08-28 21:44:12 +02:00
Dan Carpenter
7a28826ac7 ALSA: pcm: add more format names
There were some new formats added in commit 15c0cee6c8 "ALSA: pcm:
Define G723 3-bit and 5-bit formats".  That commit increased
SNDRV_PCM_FORMAT_LAST as well.  My concern is that there are a couple
places which do:

        for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) {
                if (dummy->pcm_hw.formats & (1ULL << i))
                        snd_iprintf(buffer, " %s", snd_pcm_format_name(i));
        }

I haven't tested these but it looks like if "i" were equal to
SNDRV_PCM_FORMAT_G723_24 or higher then we might read past the end of
the array.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-28 11:59:33 +02:00
Akinobu Mita
3182c8a72b sound: oss: fix uninitialized spinlock
The spinlock lock in sound_timer.c is used without initialization.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-28 11:57:54 +02:00
Eliot Blennerhassett
60f1deb595 ALSA: asihpi - Return hw error directly from oustream_write.
If hw error is ignored, status is updated with invalid info.

Signed-off-by: Eliot Blennerhassett <eblennerhassett@audioscience.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-28 11:55:07 +02:00
Axel Lin
708fafb3c5 ASoC: soc-core: fix debugfs_pop_time file permissions
I think this is a typo, debugfs_pop_time should not be executable.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Liam Girdwood <lrg@slimloogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-08-27 19:58:40 +01:00
David Henningsson
dbbcbc073a ALSA: hda - Add Sony VAIO quirk for ALC269
The attached patch enables playback on a Sony VAIO machine.

BugLink: http://launchpad.net/bugs/618271

Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-26 08:36:46 +02:00
Takashi Iwai
e9a8a85d9f Merge branch 'fix/asoc' into for-linus 2010-08-23 15:09:52 +02:00
Sascha Hauer
70bf043b13 ASoC: i.MX ssi: use SSI_STCCR in synchronous mode
In synchronous mode the SSI_SRCCR values are ignored. Instead
SSI_STCCR must be used for both receiving and transmitting.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
2010-08-23 13:33:05 +01:00
Takashi Iwai
d2f927d42a Merge branch 'fix/hda' into for-linus 2010-08-23 08:47:06 +02:00
Jerone Young
6f0ef6ea1d ALSA: hda - Add support for Lenovo S10-3t
This patch adds quirk for the Lenovo S10-3t so the headphone &
microphone jacks will now work.

Signed-off-by: Jerone Young <jerone.young@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-23 08:35:52 +02:00
Takashi Iwai
3f50ac6a0e ALSA: hda - Fix stream and channel-ids codec-bus wide
The new sticky PCM parameter introduced the delayed clean-ups of
stream- and channel-id tags.  In the current implementation, this check
(adding dirty flag) and actual clean-ups are done only for the codec
chip.  However, with HD-audio architecture, multiple codecs can be
on a single bus, and the controller assign stream- and channel-ids in
the bus-wide.

In this patch, the stream-id and channel-id are checked over all codecs
connected to the corresponding bus.  Together with it, the mutex is
moved to struct hda_bus, as this becomes also bus-wide.

Reported-and-tested-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-20 09:49:42 +02:00
Takashi Iwai
4f34760787 ALSA: hda - Fix conflict of sticky PCM parameter in HDMI codecs
Intel and Nvidia HDMI codec drivers have own implementations of
sticky PCM parameters.  Now HD-audio core part already has it,
thus both setups conflict.  The fix is simply remove the part in
patch_intelhdmi.c and patch_nvhdmi.c and simply call
snd_hda_codec_setup_stream() as usual.

Reported-and-tested-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-20 09:49:18 +02:00