kernel.git/sound/core, branch linux-2.6.33.y

ALSA: timer - Fix Oops at closing slave timer

2011-08-16T02:01:54Z

commit 0584ffa548b6e59aceb027112f23a55f0133400e upstream. A slave-timer instance has no timer reference, and this results in NULL-dereference at stopping the timer, typically called at closing the device. Reference: https://bugzilla.kernel.org/show_bug.cgi?id=40682 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ALSA: sound/core/pcm_compat.c: adjust array index

2011-08-08T17:36:09Z

commit ca9380fd68514c7bc952282c1b4fc70607e9fe43 upstream. Convert array index from the loop bound to the loop index. A simplified version of the semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression e1,e2,ar; @@ for(e1 = 0; e1 < e2; e1++) { <... ar[ - e2 + e1 ] ...> } // Signed-off-by: Julia Lawall Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ALSA: Fix yet another race in disconnection

2011-04-14T23:52:46Z

commit a45e3d6b13e97506b616980c0f122c3389bcefa4 upstream. This patch fixes a race between snd_card_file_remove() and snd_card_disconnect(). When the card is added to shutdown_files list in snd_card_disconnect(), but it's freed in snd_card_file_remove() at the same time, the shutdown_files list gets corrupted. The list member must be freed in snd_card_file_remove() as well. Reported-and-tested-by: Russ Dill Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ALSA: hrtimer: handle delayed timer interrupts

2011-03-21T19:44:51Z

commit b1d4f7f4bdcf9915c41ff8cfc4425c84dabb1fde upstream. If a timer interrupt was delayed too much, hrtimer_forward_now() will forward the timer expiry more than once. When this happens, the additional number of elapsed ALSA timer ticks must be passed to snd_timer_interrupt() to prevent the ALSA timer from falling behind. This mostly fixes MIDI slowdown problems on highly-loaded systems with badly behaved interrupt handlers. Signed-off-by: Clemens Ladisch Reported-and-tested-by: Arthur Marsh Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ALSA: rawmidi: fix oops (use after free) when unloading a driver module

2011-03-21T19:43:11Z

commit aa73aec6c385e2c797ac25cc7ccf0318031de7c8 upstream. When a driver module is unloaded and the last still open file is a raw MIDI device, the card and its devices will be actually freed in the snd_card_file_remove() call when that file is closed. Afterwards, rmidi and rmidi->card point into freed memory, so the module pointer is likely to be garbage. (This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.) Signed-off-by: Clemens Ladisch Reported-by: Krzysztof Foltman Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ALSA: prevent heap corruption in snd_ctl_new()

2011-03-21T19:43:11Z

commit 5591bf07225523600450edd9e6ad258bb877b779 upstream. The snd_ctl_new() function in sound/core/control.c allocates space for a snd_kcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC* device (on many distros, this is group "audio") via the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls. Signed-off-by: Dan Rosenberg Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ALSA: pcm core - fix fifo_size channels interval check

2010-03-15T16:06:20Z

commit 3be522a9514f58e0596db34898a514df206cadc5 upstream. Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman

ALSA: Remove warning message for invalid OSS minor ranges

2010-01-18T13:18:55Z

When a card instance with a higher card number is registered, warning messages are spewed eventually with stack traces due to the invalid minor number for OSS device registration. For example, thinkpad-acpi registers the card number 29 as default, and you'll see always these messages. This is rather confusing (and worries users), thus better to return simply the error code. Signed-off-by: Takashi Iwai

ALSA: use subsys_initcall for sound core instead of module_init

2010-01-14T20:21:47Z

This is needed for built-in drivers which are built before the sound directory, like thinkpad_acpi. Otherwise, registering a card fails. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Takashi Iwai

ALSA: Fix indentation in pcm_native.c

2009-12-25T13:12:52Z

Signed-off-by: Guennadi Liakhovetski Signed-off-by: Takashi Iwai