aboutsummaryrefslogtreecommitdiffstats
path: root/sound/core
Commit message (Collapse)AuthorAgeFilesLines
* UPSTREAM: ALSA: control: Fix replacing user controlsLars-Peter Clausen2016-10-191-17/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry pick from commit 82262a46627bebb0febcc26664746c25cef08563) There are two issues with the current implementation for replacing user controls. The first is that the code does not check if the control is actually a user control and neither does it check if the control is owned by the process that tries to remove it. That allows userspace applications to remove arbitrary controls, which can cause a user after free if a for example a driver does not expect a control to be removed from under its feed. The second issue is that on one hand when a control is replaced the user_ctl_count limit is not checked and on the other hand the user_ctl_count is increased (even though the number of user controls does not change). This allows userspace, once the user_ctl_count limit has been reached, to repeatedly replace a control until user_ctl_count overflows. Once that happens new controls can be added effectively bypassing the user_ctl_count limit. Both issues can be fixed by instead of open-coding the removal of the control that is to be replaced to use snd_ctl_remove_user_ctl(). This function does proper permission checks as well as decrements user_ctl_count after the control has been removed. Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at beginning of the function if the control already exists is removed. This is not a problem though since the check is quite useless, because the lock that is protecting the control list is released between the check and before adding the new control to the list, which means that it is possible that a different control with the same settings is added to the list after the check. Luckily there is another check that is done while holding the lock in snd_ctl_add(), so we'll rely on that to make sure that the same control is not added twice. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Acked-by: Jaroslav Kysela <perex@perex.cz> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Change-Id: I0b183e2d52afe8e747f59e1ecca6f6fbbac2d016 Bug: 29916012
* ALSA: timer: Fix leak in events via snd_timer_user_tinterruptKangjie Lu2016-05-171-0/+1
| | | | | | | | | | The stack object “r1” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Change-Id: Ie3dcdee7da8ad292712814e8402c571a717ab8d1 Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: timer: Fix leak in events via snd_timer_user_ccallbackKangjie Lu2016-05-171-0/+1
| | | | | | | | | | The stack object “r1” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Change-Id: I5ece63432f6ca6251fa31c046c211c8c03313a59 Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMSKangjie Lu2016-05-171-0/+1
| | | | | | | | | | The stack object “tread” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Change-Id: Ibf2868136a538eed0f2e75395a5f14a8608dd86d Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: hrtimer: Fix stall by hrtimer_cancel()Takashi Iwai2016-05-051-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | hrtimer_cancel() waits for the completion from the callback, thus it must not be called inside the callback itself. This was already a problem in the past with ALSA hrtimer driver, and the early commit [fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it. However, the previous fix is still insufficient: it may still cause a lockup when the ALSA timer instance reprograms itself in its callback. Then it invokes the start function even in snd_timer_interrupt() that is called in hrtimer callback itself, results in a CPU stall. This is no hypothetical problem but actually triggered by syzkaller fuzzer. This patch tries to fix the issue again. Now we call hrtimer_try_to_cancel() at both start and stop functions so that it won't fall into a deadlock, yet giving some chance to cancel the queue if the functions have been called outside the callback. The proper hrtimer_cancel() is called in anyway at closing, so this should be enough. Change-Id: Id6224b2a3ade0d217e891e6af09744df4d0b2e5c Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: timer: Harden slave timer list handlingTakashi Iwai2016-05-031-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A slave timer instance might be still accessible in a racy way while operating the master instance as it lacks of locking. Since the master operation is mostly protected with timer->lock, we should cope with it while changing the slave instance, too. Also, some linked lists (active_list and ack_list) of slave instances aren't unlinked immediately at stopping or closing, and this may lead to unexpected accesses. This patch tries to address these issues. It adds spin lock of timer->lock (either from master or slave, which is equivalent) in a few places. For avoiding a deadlock, we ensure that the global slave_active_lock is always locked at first before each timer lock. Also, ack and active_list of slave instances are properly unlinked at snd_timer_stop() and snd_timer_close(). Last but not least, remove the superfluous call of _snd_timer_stop() at removing slave links. This is a noop, and calling it may confuse readers wrt locking. Further cleanup will follow in a later patch. Actually we've got reports of use-after-free by syzkaller fuzzer, and this hopefully fixes these issues. Change-Id: I572878b909dda522dbedc84633414185802bc974 Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: timer: Fix race among timer ioctlsTakashi Iwai2016-05-031-13/+19
| | | | | | | | | | | | | | | | | ALSA timer ioctls have an open race and this may lead to a use-after-free of timer instance object. A simplistic fix is to make each ioctl exclusive. We have already tread_sem for controlling the tread, and extend this as a global mutex to be applied to each ioctl. The downside is, of course, the worse concurrency. But these ioctls aren't to be parallel accessible, in anyway, so it should be fine to serialize there. Change-Id: Iaa21b00f62e02cc58e346a29846e0fce6536e860 Reported-by: Dmitry Vyukov <dvyukov@google.com> Tested-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: timer: Fix double unlink of active_listTakashi Iwai2016-05-031-1/+1
| | | | | | | | | | | | | | | | ALSA timer instance object has a couple of linked lists and they are unlinked unconditionally at snd_timer_stop(). Meanwhile snd_timer_interrupt() unlinks it, but it calls list_del() which leaves the element list itself unchanged. This ends up with unlinking twice, and it was caught by syzkaller fuzzer. The fix is to use list_del_init() variant properly there, too. Change-Id: I95e2ab06180dfe43fb6b7c2875a866b53ca245ce Reported-by: Dmitry Vyukov <dvyukov@google.com> Tested-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Merge remote-tracking branch 'korg/linux-3.0.y' into cm-13.0rogersb112015-11-103-15/+10
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: crypto/algapi.c drivers/gpu/drm/i915/i915_debugfs.c drivers/gpu/drm/i915/intel_display.c drivers/video/fbmem.c include/linux/nls.h kernel/cgroup.c kernel/signal.c kernel/timeconst.pl net/ipv4/ping.c Change-Id: I1f532925d1743df74d66bcdd6fc92f05c72ee0dd
| * vm: convert snd_pcm_lib_mmap_iomem() to vm_iomap_memory() helperLinus Torvalds2013-04-251-10/+2
| | | | | | | | | | | | | | | | | | | | | | | | commit 0fe09a45c4848b5b5607b968d959fdc1821c161d upstream. This is my example conversion of a few existing mmap users. The pcm mmap case is one of the more straightforward ones. Acked-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * ALSA: seq: Fix missing error handling in snd_seq_timer_open()Takashi Iwai2013-03-201-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 66efdc71d95887b652a742a5dae51fa834d71465 upstream. snd_seq_timer_open() didn't catch the whole error path but let through if the timer id is a slave. This may lead to Oops by accessing the uninitialized pointer. BUG: unable to handle kernel NULL pointer dereference at 00000000000002ae IP: [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130 PGD 785cd067 PUD 76964067 PMD 0 Oops: 0002 [#4] SMP CPU 0 Pid: 4288, comm: trinity-child7 Tainted: G D W 3.9.0-rc1+ #100 Bochs Bochs RIP: 0010:[<ffffffff819b3477>] [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130 RSP: 0018:ffff88006ece7d38 EFLAGS: 00010246 RAX: 0000000000000286 RBX: ffff88007851b400 RCX: 0000000000000000 RDX: 000000000000ffff RSI: ffff88006ece7d58 RDI: ffff88006ece7d38 RBP: ffff88006ece7d98 R08: 000000000000000a R09: 000000000000fffe R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8800792c5400 R14: 0000000000e8f000 R15: 0000000000000007 FS: 00007f7aaa650700(0000) GS:ffff88007f800000(0000) GS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000002ae CR3: 000000006efec000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process trinity-child7 (pid: 4288, threadinfo ffff88006ece6000, task ffff880076a8a290) Stack: 0000000000000286 ffffffff828f2be0 ffff88006ece7d58 ffffffff810f354d 65636e6575716573 2065756575712072 ffff8800792c0030 0000000000000000 ffff88006ece7d98 ffff8800792c5400 ffff88007851b400 ffff8800792c5520 Call Trace: [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff819b17e9>] snd_seq_queue_timer_open+0x29/0x70 [<ffffffff819ae01a>] snd_seq_ioctl_set_queue_timer+0xda/0x120 [<ffffffff819acb9b>] snd_seq_do_ioctl+0x9b/0xd0 [<ffffffff819acbe0>] snd_seq_ioctl+0x10/0x20 [<ffffffff811b9542>] do_vfs_ioctl+0x522/0x570 [<ffffffff8130a4b3>] ? file_has_perm+0x83/0xa0 [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff811b95ed>] sys_ioctl+0x5d/0xa0 [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f [<ffffffff81faed69>] system_call_fastpath+0x16/0x1b Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * ALSA: vmaster: Fix slave change notificationTakashi Iwai2013-03-141-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 2069d483b39a603a5f3428a19d3b4ac89aa97f48 upstream. When a value of a vmaster slave control is changed, the ctl change notification is sometimes ignored. This happens when the master control overrides, e.g. when the corresponding master control is muted. The reason is that slave_put() returns the value of the actual slave put callback, and it doesn't reflect the virtual slave value change. This patch fixes the function just to return 1 whenever a slave value is changed. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | d710: initial support for the Epic 4G Touch (SPH-D710)Dorian Snyder2013-06-201-1/+4
| | | | | | | | Change-Id: Iafbd9fb45253b02d539ac0ba114f57b3bf9eeed4
* | Merge remote-tracking branch 'kernelorg/linux-3.0.y' into 3_0_64Andrew Dodd2013-02-2710-36/+144
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: arch/arm/Kconfig arch/arm/include/asm/hwcap.h arch/arm/kernel/smp.c arch/arm/plat-samsung/adc.c drivers/gpu/drm/i915/i915_reg.h drivers/gpu/drm/i915/intel_drv.h drivers/mmc/core/sd.c drivers/net/tun.c drivers/net/usb/usbnet.c drivers/regulator/max8997.c drivers/usb/core/hub.c drivers/usb/host/xhci.h drivers/usb/serial/qcserial.c fs/jbd2/transaction.c include/linux/migrate.h kernel/sys.c kernel/time/timekeeping.c lib/genalloc.c mm/memory-failure.c mm/memory_hotplug.c mm/mempolicy.c mm/page_alloc.c mm/vmalloc.c mm/vmscan.c mm/vmstat.c scripts/Kbuild.include Change-Id: I91e2d85c07320c7ccfc04cf98a448e89bed6ade6
| * ALSA: Fix card refcount unbalanceTakashi Iwai2012-11-175-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 8bb4d9ce08b0a92ca174e41d92c180328f86173f upstream. There are uncovered cases whether the card refcount introduced by the commit a0830dbd isn't properly increased or decreased: - OSS PCM and mixer success paths - When lookup function gets NULL This patch fixes these places. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=50251 Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * ALSA: Avoid endless sleep after disconnectTakashi Iwai2012-11-176-1/+46
| | | | | | | | | | | | | | | | | | | | | | commit 0914f7961babbf28aaa2f19b453951fb4841c03f upstream. When disconnect callback is called, each component should wake up sleepers and check card->shutdown flag for avoiding the endless sleep blocking the proper resource release. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * ALSA: Add a reference counter to card instanceTakashi Iwai2012-11-179-30/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit a0830dbd4e42b38aefdf3fb61ba5019a1a99ea85 upstream. For more strict protection for wild disconnections, a refcount is introduced to the card instance, and let it up/down when an object is referred via snd_lookup_*() in the open ops. The free-after-last-close check is also changed to check this refcount instead of the empty list, too. Reported-by: Matthieu CASTET <matthieu.castet@parrot.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * ALSA: PCM: Fix some races at disconnectionTakashi Iwai2012-11-172-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | commit 9b0573c07f278e9888c352aa9724035c75784ea0 upstream. Fix races at PCM disconnection: - while a PCM device is being opened or closed - while the PCM state is being changed without lock in prepare, hw_params, hw_free ops Reported-by: Matthieu CASTET <matthieu.castet@parrot.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | samsung update 1codeworkx2012-06-022-2/+6
|/
* ALSA: pcm - fix race condition in wait_for_avail()Arjan van de Ven2011-10-031-9/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 763437a9e7737535b2fc72175ad4974048769be6 upstream. wait_for_avail() in pcm_lib.c has a race in it (observed in practice by an Intel validation group). The function is supposed to return once space in the buffer has become available, or if some timeout happens. The entity that creates space (irq handler of sound driver and some such) will do a wake up on a waitqueue that this function registers for. However there are two races in the existing code 1) If space became available between the caller noticing there was no space and this function actually sleeping, the wakeup is missed and the timeout condition will happen instead 2) If a wakeup happened but not sufficient space became available, the code will loop again and wait for more space. However, if the second wake comes in prior to hitting the schedule_timeout_interruptible(), it will be missed, and potentially you'll wait out until the timeout happens. The fix consists of using more careful setting of the current state (so that if a wakeup happens in the main loop window, the schedule_timeout() falls through) and by checking for available space prior to going into the schedule_timeout() loop, but after being on the waitqueue and having the state set to interruptible. [tiwai: the following changes have been added to Arjan's original patch: - merged akpm's fix for waitqueue adding order into a single patch - reduction of duplicated code of avail check ] Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* ALSA: timer - Fix Oops at closing slave timerTakashi Iwai2011-08-151-0/+2
| | | | | | | | | | | | | | commit 0584ffa548b6e59aceb027112f23a55f0133400e upstream. A slave-timer instance has no timer reference, and this results in NULL-dereference at stopping the timer, typically called at closing the device. Reference: https://bugzilla.kernel.org/show_bug.cgi?id=40682 Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* ALSA: sound/core/pcm_compat.c: adjust array indexJulia Lawall2011-08-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | commit ca9380fd68514c7bc952282c1b4fc70607e9fe43 upstream. Convert array index from the loop bound to the loop index. A simplified version of the semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression e1,e2,ar; @@ for(e1 = 0; e1 < e2; e1++) { <... ar[ - e2 + e1 ] ...> } // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* ALSA: Use %pV for snd_printk()Takashi Iwai2011-06-101-23/+17
| | | | | | | | Clean up snd_printk() helper using the %pV prefix for recursive printks. This also automagically fixes an Oops with RO/NX-enabled modules. Tested-by: Maarten Lankhorst <m.b.lankhorst@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: core: remove unused variables.Luca Tettamanti2011-05-265-18/+1
| | | | | | | Drop a few variables that are never read. Signed-off-by: Luca Tettamanti <kronos.it@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: PCM - Don't check DMA time-out too shortlyTakashi Iwai2011-05-262-6/+24
| | | | | | | | | | | | | When the PCM period size is set larger than 10 seconds, currently the PCM core may abort the operation with DMA-error due to the fixed timeout for 10 seconds. A similar problem is seen in the drain operation that has a fixed timeout of 10 seconds, too. This patch fixes the timeout length depending on the period size and rate, also including the consideration of no_period_wakeup flag. Reported-by: Raymond Yau <superquad.vortex2@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Merge branch 'topic/misc' into for-linusTakashi Iwai2011-05-223-6/+74
|\
| * ALSA: sound, core, pcm_lib: fix xrun_logBen Gardiner2011-05-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | The xrun_log function was augmented with the in_interrupt parameter whereas the empty macro definition used when xrun logging is disabled was not. Add a third parameter to the empty macro definition so as to not cause compiler errors when xrun logging (CONFIG_SND_PCM_XRUN_DEBUG) is disabled. Signed-off-by: Ben Gardiner <bengardiner@nanometrics.ca> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: sound, core, pcm_lib: xrun_log: log also in_interruptBen Gardiner2011-05-181-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When debugging pcm drivers I found the "period" or "hw" prefix printed by either XRUN_DEBUG_PERIODUPDATE or XRUN_DEBUG_PERIODUPDATE events, respectively to be very useful is observing the interplay between interrupt-context updates and syscall-context updates. Similarly, when debugging overruns with XRUN_DEBUG_LOG it is useful to see the context of the last 10 positions. Add an in_interrupt member to hwptr_log_entry which stores the value of the in_interrupt parameter of snd_pcm_update_hw_ptr0 when the log entry is created. Print a "[Q]" prefix when dumping the log entries if in_interrupt was true. Signed-off-by: Ben Gardiner <bengardiner@nanometrics.ca> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: core - Don't use "default' for defaultTakashi Iwai2011-04-041-1/+1
| | | | | | | | | | | | | | | | The card-id parser assigns the string "default" when no appropriate word is found in the card name. But this string may confuse the alsa-lib, so better to avoid. Use "Default" now instead. Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * Merge branch 'fix/misc' into topic/miscTakashi Iwai2011-04-041-1/+3
| |\
| * \ Merge branch 'fix/misc' into topic/miscTakashi Iwai2011-03-282-9/+4
| |\ \
| * | | ALSA: Add snd_ctl_replace() to dynamically replace a controlDimitris Papastamos2011-03-221-0/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a function to dynamically replace a given control. If the control does not already exist, a third parameter is used to determine whether to actually add that control. This is useful in cases where downloadable firmware at runtime can add or replace existing controls. A separate patch needs to be made to allow ALSA Mixer to render the replaced controls on the fly. Signed-off-by: Dimitris Papastamos <dp@opensource.wolfsonmicro.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | | | Merge branch 'for-linus2' of git://git.profusion.mobi/users/lucas/linux-2.6Linus Torvalds2011-04-074-6/+6
|\ \ \ \ | |_|_|/ |/| | | | | | | | | | | * 'for-linus2' of git://git.profusion.mobi/users/lucas/linux-2.6: Fix common misspellings
| * | | Fix common misspellingsLucas De Marchi2011-03-314-6/+6
| | |/ | |/| | | | | | | | | | | | | Fixes generated by 'codespell' and manually reviewed. Signed-off-by: Lucas De Marchi <lucas.demarchi@profusion.mobi>
* | | ALSA: pcm: fix infinite loop in snd_pcm_update_hw_ptr0()Kelly Anderson2011-04-011-1/+3
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When period interrupts are disabled, snd_pcm_update_hw_ptr0() compares the current time against the time estimated for the current hardware pointer to detect xruns. The somewhat fuzzy threshold in the while loop makes it possible that hdelta becomes negative; the comparison being done with unsigned types then makes the loop go through the entire 263 negative range, and, depending on the value, never reach an unsigned value that is small enough to stop the loop. Doing this with interrupts disabled results in the machine locking up. To prevent this, ensure that the loop condition uses signed types for both operands so that the comparison is correctly done. Many thanks to Kelly Anderson for debugging this. Reported-by: Nix <nix@esperi.org.uk> Reported-by: "Christopher K." <c.krooss@googlemail.com> Reported-and-tested-by: Kelly Anderson <kelly@silka.with-linux.com> Signed-off-by: Kelly Anderson <kelly@silka.with-linux.com> [cl: remove unneeded casts; use a temp variable] Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Cc: 2.6.38 <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: Fix yet another race in disconnectionTakashi Iwai2011-03-251-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a race between snd_card_file_remove() and snd_card_disconnect(). When the card is added to shutdown_files list in snd_card_disconnect(), but it's freed in snd_card_file_remove() at the same time, the shutdown_files list gets corrupted. The list member must be freed in snd_card_file_remove() as well. Reported-and-tested-by: Russ Dill <russ.dill@gmail.com> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: vmalloc buffers should use normal mmapBenjamin Herrenschmidt2011-03-251-9/+0
|/ | | | | | | | | | | | | | | | | | | | It's a big no-no to use pgprot_noncached() when mmap'ing such buffers into userspace since they are mapped cachable in kernel space. This can cause all sort of interesting things ranging from to garbled sound to lockups on various architectures. I've observed that usb-audio is broken on powerpc 4xx for example because of that. Also remove the now unused snd_pcm_lib_mmap_noncached(). It's an arch business to know when to use uncached mappings, there's already hacks for MIPS inside snd_pcm_default_mmap() and other archs are supposed to use dma_mmap_coherent(). (See my separate patch that adds dma_mmap_coherent() to powerpc) Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> CC: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Merge branch 'topic/misc' into for-linusTakashi Iwai2011-03-1819-110/+125
|\
| * ALSA: sound/core: merge list_del()/list_add_tail() to list_move_tail()Nicolas Kaiser2011-03-161-5/+3
| | | | | | | | | | | | | | Merge list_del() + list_add_tail() to list_move_tail(). Signed-off-by: Nicolas Kaiser <nikai@nikai.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * Merge branch 'fix/misc' into topic/miscTakashi Iwai2011-03-112-3/+5
| |\
| * | ALSA: control: clean up snd_ctl_hole_check()Clemens Ladisch2011-03-081-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The return value of snd_ctl_hole_check() is used only to detect whether to continue the loop in snd_ctl_find_hole() or not, so we can simplify the code by changing this return type to a boolean. Also rename this function to better show what it actually does. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | ALSA: control: fix numid conflict check for new controlsClemens Ladisch2011-03-081-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The purpose of the snd_ctl_hole_check() function is to find conflicts between the numerical IDs of the new control and those of any existing controls. However, it would fail to detect an existing control whose count is smaller than the new control's count and whose interval of IDs is entirely contained in the interval of the new control's IDs. To fix this, use the correct formula to detect overlapping intervals, which happens to simplify the condition. This problem was not encountered so far because ALSA does not yet allow drivers to allocate specific control IDs. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | sound:core:seq:seq_ports.c Remove one to many n's in a word.Justin P. Mattock2011-02-271-1/+1
| | | | | | | | | | | | | | | | | | | | | The Patch below removes one to many "n's" in a word.. Signed-off-by: Justin P. Mattock <justinmattock@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | ALSA: core: sparse cleanupsClemens Ladisch2011-02-1416-92/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | Change the core code where sparse complains. In most cases, this means just adding annotations to confirm that we indeed want to do the dirty things we're doing. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | | Merge branch 'topic/asoc' into for-linusTakashi Iwai2011-03-161-0/+46
|\ \ \ | |_|/ |/| |
| * | ALSA: Add snd_ctl_activate_id()Takashi Iwai2011-03-111-0/+46
| |/ | | | | | | | | | | | | | | Added a new API function snd_ctl_activate_id() for activate / inactivate the control element dynamically. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
* | ALSA: fix one memory leak in sound jackLu Guanqun2011-02-211-0/+1
| | | | | | | | | | | | Signed-off-by: Lu Guanqun <guanqun.lu@intel.com> Reviewed-by: Wu Fengguang <fengguang.wu@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: hrtimer: remove superfluous tasklet invocationClemens Ladisch2011-02-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Commit bb758e9637e5ddc removed snd_hrtimer_callback() from the hardware interrupt handler, thus moving it into a tasklet, but did not tell the ALSA timer framework about this, so the timer handling would now be done in the ALSA timer tasklet scheduled from another tasklet. To fix this, add the flag to tell the ALSA timer framework that the timer handler is already being invoked in a tasklet. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: hrtimer: handle delayed timer interruptsClemens Ladisch2011-02-101-2/+3
|/ | | | | | | | | | | | | | | If a timer interrupt was delayed too much, hrtimer_forward_now() will forward the timer expiry more than once. When this happens, the additional number of elapsed ALSA timer ticks must be passed to snd_timer_interrupt() to prevent the ALSA timer from falling behind. This mostly fixes MIDI slowdown problems on highly-loaded systems with badly behaved interrupt handlers. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Reported-and-tested-by: Arthur Marsh <arthur.marsh@internode.on.net> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Merge branch 'for-linus' of ↵Linus Torvalds2011-01-137-9/+77
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: (348 commits) ALSA: hda - Fix NULL-derefence with a single mic in STAC auto-mic detection ALSA: hda - Add missing NID 0x19 fixup for Sony VAIO ALSA: hda - Fix ALC275 enable hardware EQ for SONY VAIO ALSA: oxygen: fix Xonar DG input ALSA: hda - Fix EAPD on Lenovo NB ALC269 to low ALSA: hda - Fix missing EAPD for Acer 4930G ALSA: hda: Disable 4/6 channels on some NVIDIA GPUs. ALSA: hda - Add static_hdmi_pcm option to HDMI codec parser ALSA: hda - Don't refer ELD when unplugged ASoC: tpa6130a2: Fix compiler warning ASoC: tlv320dac33: Add DAPM selection for LOM invert ASoC: DMIC codec: Adding a generic DMIC codec ALSA: snd-usb-us122l: Fix missing NULL checks ALSA: snd-usb-us122l: Fix MIDI output ASoC: soc-cache: Fix invalid memory access during snd_soc_lzo_cache_sync() ASoC: Fix section mismatch in wm8995.c ALSA: oxygen: add S/PDIF source selection for Claro cards ALSA: oxygen: fix CD/MIDI for X-Meridian (2G) ASoC: fix migor audio build ALSA: include delay.h for msleep in Xonar DG support ...
generated by cgit v1.1 at 2024-05-26 09:52:23 +0000