aboutsummaryrefslogtreecommitdiffstats
path: root/sound/core/control.c
Commit message (Collapse)AuthorAgeFilesLines
* UPSTREAM: ALSA: control: Fix replacing user controlsLars-Peter Clausen2016-10-191-17/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry pick from commit 82262a46627bebb0febcc26664746c25cef08563) There are two issues with the current implementation for replacing user controls. The first is that the code does not check if the control is actually a user control and neither does it check if the control is owned by the process that tries to remove it. That allows userspace applications to remove arbitrary controls, which can cause a user after free if a for example a driver does not expect a control to be removed from under its feed. The second issue is that on one hand when a control is replaced the user_ctl_count limit is not checked and on the other hand the user_ctl_count is increased (even though the number of user controls does not change). This allows userspace, once the user_ctl_count limit has been reached, to repeatedly replace a control until user_ctl_count overflows. Once that happens new controls can be added effectively bypassing the user_ctl_count limit. Both issues can be fixed by instead of open-coding the removal of the control that is to be replaced to use snd_ctl_remove_user_ctl(). This function does proper permission checks as well as decrements user_ctl_count after the control has been removed. Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at beginning of the function if the control already exists is removed. This is not a problem though since the check is quite useless, because the lock that is protecting the control list is released between the check and before adding the new control to the list, which means that it is possible that a different control with the same settings is added to the list after the check. Luckily there is another check that is done while holding the lock in snd_ctl_add(), so we'll rely on that to make sure that the same control is not added twice. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Acked-by: Jaroslav Kysela <perex@perex.cz> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Change-Id: I0b183e2d52afe8e747f59e1ecca6f6fbbac2d016 Bug: 29916012
* Merge remote-tracking branch 'kernelorg/linux-3.0.y' into 3_0_64Andrew Dodd2013-02-271-0/+5
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: arch/arm/Kconfig arch/arm/include/asm/hwcap.h arch/arm/kernel/smp.c arch/arm/plat-samsung/adc.c drivers/gpu/drm/i915/i915_reg.h drivers/gpu/drm/i915/intel_drv.h drivers/mmc/core/sd.c drivers/net/tun.c drivers/net/usb/usbnet.c drivers/regulator/max8997.c drivers/usb/core/hub.c drivers/usb/host/xhci.h drivers/usb/serial/qcserial.c fs/jbd2/transaction.c include/linux/migrate.h kernel/sys.c kernel/time/timekeeping.c lib/genalloc.c mm/memory-failure.c mm/memory_hotplug.c mm/mempolicy.c mm/page_alloc.c mm/vmalloc.c mm/vmscan.c mm/vmstat.c scripts/Kbuild.include Change-Id: I91e2d85c07320c7ccfc04cf98a448e89bed6ade6
| * ALSA: Avoid endless sleep after disconnectTakashi Iwai2012-11-171-0/+2
| | | | | | | | | | | | | | | | | | | | | | commit 0914f7961babbf28aaa2f19b453951fb4841c03f upstream. When disconnect callback is called, each component should wake up sleepers and check card->shutdown flag for avoiding the endless sleep blocking the proper resource release. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * ALSA: Add a reference counter to card instanceTakashi Iwai2012-11-171-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a0830dbd4e42b38aefdf3fb61ba5019a1a99ea85 upstream. For more strict protection for wild disconnections, a refcount is introduced to the card instance, and let it up/down when an object is referred via snd_lookup_*() in the open ops. The free-after-last-close check is also changed to check this refcount instead of the empty list, too. Reported-by: Matthieu CASTET <matthieu.castet@parrot.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | samsung update 1codeworkx2012-06-021-0/+2
|/
* ALSA: core: remove unused variables.Luca Tettamanti2011-05-261-2/+1
| | | | | | | Drop a few variables that are never read. Signed-off-by: Luca Tettamanti <kronos.it@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: Add snd_ctl_replace() to dynamically replace a controlDimitris Papastamos2011-03-221-0/+64
| | | | | | | | | | | | Add a function to dynamically replace a given control. If the control does not already exist, a third parameter is used to determine whether to actually add that control. This is useful in cases where downloadable firmware at runtime can add or replace existing controls. A separate patch needs to be made to allow ALSA Mixer to render the replaced controls on the fly. Signed-off-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Merge branch 'topic/misc' into for-linusTakashi Iwai2011-03-181-12/+10
|\
| * ALSA: control: clean up snd_ctl_hole_check()Clemens Ladisch2011-03-081-9/+9
| | | | | | | | | | | | | | | | | | | | The return value of snd_ctl_hole_check() is used only to detect whether to continue the loop in snd_ctl_find_hole() or not, so we can simplify the code by changing this return type to a boolean. Also rename this function to better show what it actually does. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: control: fix numid conflict check for new controlsClemens Ladisch2011-03-081-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The purpose of the snd_ctl_hole_check() function is to find conflicts between the numerical IDs of the new control and those of any existing controls. However, it would fail to detect an existing control whose count is smaller than the new control's count and whose interval of IDs is entirely contained in the interval of the new control's IDs. To fix this, use the correct formula to detect overlapping intervals, which happens to simplify the condition. This problem was not encountered so far because ALSA does not yet allow drivers to allocate specific control IDs. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: Add snd_ctl_activate_id()Takashi Iwai2011-03-111-0/+46
|/ | | | | | | | Added a new API function snd_ctl_activate_id() for activate / inactivate the control element dynamically. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* ALSA: core, oxygen, virtuoso: add an enum control info helperClemens Ladisch2011-01-101-1/+27
| | | | | | | | Introduce the helper function snd_ctl_enum_info() to fill out the elem_info fields for an enumerated control. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: prevent heap corruption in snd_ctl_new()Dan Rosenberg2010-09-281-0/+5
| | | | | | | | | | | | | | | | The snd_ctl_new() function in sound/core/control.c allocates space for a snd_kcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC* device (on many distros, this is group "audio") via the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: core - Define llseek fopsTakashi Iwai2010-04-131-0/+5
| | | | | | | | | | | Set no_llseek to llseek file ops of each sound component (but for hwdep). This avoids the implicit BKL invocation via generic_file_llseek() used as default when fops.llseek is NULL. Also call nonseekable_open() at each open ops to ensure the file flags have no seek bit. Signed-off-by: Takashi Iwai <tiwai@suse.de>
* sound: control: fix minimum TLV lengthClemens Ladisch2010-02-011-1/+1
| | | | | | | | Allow TLV blocks that do not have any values; the smallest possible TLV is an empty container or one where the information is only in the tag. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
* sound: control: actually allow TLV command accessClemens Ladisch2010-02-011-2/+3
| | | | | | | | | Creating a control with TLV_COMMAND access was not possible because snd_ctl_new1() forgot to include it in the mask of allowable access bits. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
* Merge branch 'topic/misc' into for-linusTakashi Iwai2009-12-041-1/+1
|\
| * ALSA: remove unnecessary null checkDan Carpenter2009-11-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This function is only called from snd_ctl_ioctl() and the file parameter can never be null so there is no need to check it here. We dereference file at the start of the function: struct snd_card *card = file->card; and it confuses static checkers to dereference a pointer before checking it. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | control: use reference-counted pidClemens Ladisch2009-11-061-2/+3
| | | | | | | | | | | | | | | | | | | | Instead of storing the PID number, take a reference to the task's pid structure. This protects against duplicates due to PID overflows, and using pid_vnr() ensures that the PID returned by snd_ctl_elem_info() is correct as seen from the current namespace. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | control: remove snd_konctrol_volatile::owner_pid fieldClemens Ladisch2009-11-061-3/+1
|/ | | | | | | | We do not need to save the ID of the process that locked a control because that information is already available in the owner's file data. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* sound: snd_ctl_remove_user_ctl: prevent removal of kernel controlsClemens Ladisch2009-08-171-0/+4
| | | | | | | | | Ensure that userspace can remove only user controls. Controls created by kernel drivers must not be removed because they might be referenced in calls to snd_ctl_notify(). Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* sound: snd_ctl_remove_unlocked_id: simplify user control countingClemens Ladisch2009-08-171-12/+7
| | | | | | | | | | | | | | Move the decrementing of the user controls counter from snd_ctl_elem_remove to snd_ctl_remove_unlocked_id; this saves the separate locking of the controls semaphore, and therefore removes a harmless race. Since the purpose of the function is to operate on user controls (the control being unlocked is just a prerequisite), rename it to snd_ctl_remove_user_ctl. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* sound: snd_ctl_remove_unlocked_id: simplify error pathsClemens Ladisch2009-08-171-4/+5
| | | | | | | | Use a common exit path to release the mutex and to return a possible error. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* sound: snd_ctl_elem_add: fix value count checkClemens Ladisch2009-08-171-1/+1
| | | | | | | | | | Make sure that no user element that has no values can be added. The check for count>1024 is not needed because the count is checked later for the individual control types. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: sound/core: use memdup_user()Li Zefan2009-04-141-22/+13
| | | | | | | Remove open-coded memdup_user(). Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Rationalize fasync return valuesJonathan Corbet2009-03-161-5/+2
| | | | | | | | | | | | | | | | | | | | Most fasync implementations do something like: return fasync_helper(...); But fasync_helper() will return a positive value at times - a feature used in at least one place. Thus, a number of other drivers do: err = fasync_helper(...); if (err < 0) return err; return 0; In the interests of consistency and more concise code, it makes sense to map positive return values onto zero where ->fasync() is called. Cc: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
* saner FASYNC handling on file closeAl Viro2008-11-011-1/+0
| | | | | | | | | | | | | | As it is, all instances of ->release() for files that have ->fasync() need to remember to evict file from fasync lists; forgetting that creates a hole and we actually have a bunch that *does* forget. So let's keep our lives simple - let __fput() check FASYNC in file->f_flags and call ->fasync() there if it's been set. And lose that crap in ->release() instances - leaving it there is still valid, but we don't have to bother anymore. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* ALSA: Warn when control names are truncatedMark Brown2008-10-291-1/+6
| | | | | | | | This is likely to confuse user interfaces since the end of the control name is interpreted (eg, "Volume", "Switch"). Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: use correct lock in snd_ctl_dev_disconnect()Takashi Iwai2008-09-091-2/+2
| | | | | | | | | The lock used in snd_ctl_dev_disconnect() should be card->ctl_files_rwlock for protection of card->ctl_files entries, instead of card->controls_rwsem. Reported-by: Vegard Nossum <vegard.nossum@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
* ALSA: Kill snd_assert() in sound/core/*Takashi Iwai2008-08-131-19/+31
| | | | | | | | Kill snd_assert() in sound/core/*, either removed or replaced with if () with snd_BUG_ON(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
* ALSA: make snd_ctl_elem_read() and snd_ctl_elem_write() staticTakashi Iwai2008-06-131-3/+4
| | | | | | | | snd_ctl_elem_read() and snd_ctl_elem_write() are no longer used by any other drivers. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
* [ALSA] Remove sound/driver.hTakashi Iwai2008-01-311-1/+0
| | | | | | | | | | | | This header file exists only for some hacks to adapt alsa-driver tree. It's useless for building in the kernel. Let's move a few lines in it to sound/core.h and remove it. With this patch, sound/driver.h isn't removed but has just a single compile warning to include it. This should be really killed in future. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
* [ALSA] Remove indirect control accessTakashi Iwai2008-01-311-31/+20
| | | | | | | | | | | | This patch removes the indirect control access to the control elements. The indirect access has never been used and is even broken on 32bit ioctl wrapper. Let's clean it up. The pointers still remain in snd_ctl_elem_* structs just to make sure that the struct size won't change. Once after checking the size consistency, we can get rid of them, too. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
* [ALSA] sound/core/control.c: hard-irq-safe -> hard-irq-unsafe lock warningBorislav Petkov2007-10-231-2/+3
| | | | | | | | | The lock grabbed in snd_ctl_empty_read_queue() is hardirq-unsafe but we hold an hardirq-safe one already, so make the &ctl->read_lock also hard-irq-safe. Signed-off-by: Borislav Petkov <bbpetkov@yahoo.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
* [ALSA] Changed Jaroslav Kysela's e-mail from perex@suse.cz to perex@perex.czJaroslav Kysela2007-10-161-1/+1
| | | | Signed-off-by: Jaroslav Kysela <perex@perex.cz>
* [ALSA] unexport snd_ctl_elem_{read,write}Adrian Bunk2007-10-161-4/+0
| | | | | | | | snd_ctl_elem_{read,write} no longer have any modular users Signed-off-by: Adrian Bunk <bunk@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] Add helper functions for frequently used callbacksTakashi Iwai2007-10-161-0/+27
| | | | | | | | Added helper functions for frequenty used callbacks: snd_ctl_boolean_mono_info() and snd_ctl_boolean_stereo_info() Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* header cleaning: don't include smp_lock.h when not usedRandy Dunlap2007-05-081-1/+0
| | | | | | | | | | | | Remove includes of <linux/smp_lock.h> where it is not used/needed. Suggested by Al Viro. Builds cleanly on x86_64, i386, alpha, ia64, powerpc, sparc, sparc64, and arm (all 59 defconfigs). Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* [PATCH] mark struct file_operations const 9Arjan van de Ven2007-02-121-1/+1
| | | | | | | | | | | Many struct file_operations in the kernel can be "const". Marking them const moves these to the .rodata section, which avoids false sharing with potential dirty data. In addition it'll catch accidental writes at compile time to these shared resources. Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* [ALSA] make sound/core/control.c:snd_ctl_new() staticAdrian Bunk2007-02-091-3/+2
| | | | | | | | | Now that everyone uses snd_ctl_new1() and noone is using snd_ctl_new() anymore, we can make it static. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] alsa core: convert to list_for_each_entry*Johannes Berg2007-02-091-28/+9
| | | | | | | | | | | This patch converts most uses of list_for_each to list_for_each_entry all across alsa. In some place apparently an item can be on a list with different pointers so of course that isn't compatible with list_for_each, I therefore didn't touch those places. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] sound/core/control.c: remove dead codeAdrian Bunk2006-12-201-1/+1
| | | | | | | | | This patch removes some obviously dead code spotted by the Coverity checker. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] Fix addition of user-defined boolean controlsTakashi Iwai2006-10-221-4/+0
| | | | | | | | Fixed the addition of user-defined boolean controls, the private data size is corrected to be handled properly. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] Return error if no user TLV is definedTakashi Iwai2006-09-231-0/+2
| | | | | | | | Retrun error to user TLV_READ ioctl if no TLV is defined. (Until now, nothing was written and rerunred successfully.) Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] Fix errors with user TLV_WRITETakashi Iwai2006-09-231-0/+1
| | | | | | | | Fixed the errors at checking info.access field during user TLV_WRITE call. It should have been zero-initialized. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] Fix substream selection in PCM and rawmidiTakashi Iwai2006-09-231-0/+2
| | | | | | | | | | | | The PCM and rawmidi substreams can be selected explicitly by opening control handle and set via *_PREFER_SUBDEVICE ioctl. But, when multiple controls are opened, the driver gets confused. The patch fixes the initialization of prefer_*_subdevice and the check of multiple controls. The first set subdevice is picked up as the valid one. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] Control API - more robust TLV implementationJaroslav Kysela2006-09-231-30/+109
| | | | | | | | | | - added callback option - added READ/WRITE/COMMAND flags to access member - added WRITE/COMMAND ioctls - added SNDRV_CTL_EVENT_MASK_TLV for TLV change notifications - added TLV support to ELEM_ADD ioctl Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] Unregister device files at disconnectionTakashi Iwai2006-09-231-18/+9
| | | | | | | | | | | | Orignally proposed by Sam Revitch <sam.revitch@gmail.com>. Unregister device files at disconnection to avoid the futher accesses. Also, the dev_unregister callback is removed and replaced with the combination of disconnect + free. A new function snd_card_free_when_closed() is introduced, which is used in USB disconnect callback. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] Control API - TLV implementation for additional information like dB scaleJaroslav Kysela2006-09-231-2/+39
| | | | | | | | This patch implements a TLV mechanism to transfer an additional information like dB scale to the user space. The types might be extended in future. Acked-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
* [ALSA] Clean up EXPORT_SYMBOL()s in snd moduleTakashi Iwai2006-06-221-0/+31
| | | | | | Move EXPORT_SYMBOL()s to places adjacent to functions/variables. Signed-off-by: Takashi Iwai <tiwai@suse.de>
generated by cgit v1.1 at 2024-05-30 10:37:22 +0000