17 Oct, 2010
1 commit
-
When a driver module is unloaded and the last still open file is a raw
MIDI device, the card and its devices will be actually freed in the
snd_card_file_remove() call when that file is closed. Afterwards, rmidi
and rmidi->card point into freed memory, so the module pointer is likely
to be garbage.
(This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.)Signed-off-by: Clemens Ladisch
Reported-by: Krzysztof Foltman
Cc: 2.6.30-2.6.35
Signed-off-by: Takashi Iwai
11 Oct, 2010
2 commits
-
BugLink: https://bugs.launchpad.net/bugs/653420
Add another HP DV6 notebook (103c:363e) to use STAC_HP_DV5.
Signed-off-by: Luke Yelavich
Signed-off-by: Takashi Iwai -
We shouldn't return directly here because we're still holding the
&soundcard_mutex.This bug goes all the way back to the start of git. It's strange that
no one has complained about it as a runtime bug.CC: stable@kernel.org
Signed-off-by: Dan Carpenter
Acked-by: Arnd Bergmann
Signed-off-by: Takashi Iwai
05 Oct, 2010
1 commit
-
* 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: i2c/other/ak4xx-adda: Fix a compile warning with CONFIG_PROCFS=n
ALSA: prevent heap corruption in snd_ctl_new()
01 Oct, 2010
1 commit
-
Signed-off-by: Takashi Iwai
29 Sep, 2010
1 commit
-
The snd_ctl_new() function in sound/core/control.c allocates space for a
snd_kcontrol struct by performing arithmetic operations on a
user-provided size without checking for integer overflow. If a user
provides a large enough size, an overflow will occur, the allocated
chunk will be too small, and a second user-influenced value will be
written repeatedly past the bounds of this chunk. This code is
reachable by unprivileged users who have permission to open
a /dev/snd/controlC* device (on many distros, this is group "audio") via
the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls.Signed-off-by: Dan Rosenberg
Cc:
Signed-off-by: Takashi Iwai
25 Sep, 2010
3 commits
-
The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
unprivileged users to read uninitialized kernel stack memory, because
several fields of the hdsp{m}_config_info structs declared on the stack
are not altered or zeroed before being copied back to the user. This
patch takes care of it.Signed-off-by: Dan Rosenberg
Cc:
Signed-off-by: Takashi Iwai
24 Sep, 2010
1 commit
-
The SPDIF in audio widget must be searched through the list as the widget
that contains the given pin as the connection source. The current code
was implemented in a reverse way.Signed-off-by: Takashi Iwai
23 Sep, 2010
1 commit
-
Spot the build testing.
Signed-off-by: Mark Brown
22 Sep, 2010
2 commits
-
Make sure we stay within the cache boundaries when updating the
register cache.Signed-off-by: Dimitris Papastamos
Acked-by: Liam Girdwood
Signed-off-by: Mark Brown -
On the HT-Omega Claro halo card, the ADC data must be captured from the
second I2S input. Using the default first input, which isn't connected
to anything, would result in silence.Signed-off-by: Erik J. Staab
Signed-off-by: Clemens Ladisch
Cc:
Signed-off-by: Takashi Iwai
21 Sep, 2010
1 commit
-
BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/643891
Set the Dell Latitude E6400 (1028:0233) SSID to use AD1984_DELL_DESKTOP
Cc: stable@kernel.org
Signed-off-by: Luke Yelavich
Signed-off-by: Takashi Iwai
19 Sep, 2010
1 commit
-
The clkdev API doesn't use .name and .id members of struct clk for clock
lookup. Instead clocks should be added to a lookup list. Without this patch
audio om the Migo-R board fails silently.Signed-off-by: Guennadi Liakhovetski
Acked-by: Liam Girdwood
Signed-off-by: Mark Brown
17 Sep, 2010
3 commits
-
The PCM proc files may open a race against substream close, which can
end up with an Oops. Use the open_mutex to protect for it.Signed-off-by: Takashi Iwai
-
The pm_qos_request isn't freed properly when OSS PCM emulation is used
because it skips snd_pcm_hw_free() call but directly releases the
stream. This resulted in Oops later.Tested-by: Simon Kirby
Signed-off-by: Takashi Iwai
16 Sep, 2010
1 commit
-
BugLink: http://launchpad.net/bugs/640254
In some cases a magic processing coefficient is needed to enable
the internal speaker on Dell M101z. According to Realtek, this
processing coefficient is only present on ALC269vb.Cc: stable@kernel.org
Signed-off-by: David Henningsson
Signed-off-by: Takashi Iwai
15 Sep, 2010
1 commit
-
22050 isn't a valid HDMI sample rate. 32000 is.
Signed-off-by: Stephen Warren
Acked-By: Wei Ni
Signed-off-by: Takashi Iwai
14 Sep, 2010
1 commit
-
Signed-off-by: Joe Perches
Acked-by: Mark Brown
Acked-by: Geoff Levand
Signed-off-by: Takashi Iwai
13 Sep, 2010
2 commits
-
Add a quirk for laptop Toshiba Satellite C650D to have proper external HP and
external Mic support.Signed-off-by: Anisse Astier
Signed-off-by: Takashi Iwai -
This patch adds the Intel Patsburg (PCH) HD Audio Controller DeviceIDs.
Signed-off-by: Seth Heasley
Signed-off-by: Takashi Iwai
10 Sep, 2010
1 commit
09 Sep, 2010
1 commit
-
If we pass in a device which is higher than SNDRV_RAWMIDI_DEVICES then
the "next device" should be -1. This function just returns device + 1.But the main thing is that "device + 1" can lead to a (harmless) integer
overflow and that annoys static analysis tools.[fix the case for device == SNDRV_RAWMIDI_DEVICE by tiwai]
Signed-off-by: Dan Carpenter
Signed-off-by: Takashi Iwai
08 Sep, 2010
8 commits
-
snd_hda_parse_pin_def_config() has some workaround for re-assigning
some pins declared as headphones to line-outs. This didn't work properly
for some cases because it used memmove() stupidly wrongly.Reference: Novell bnc#637263
https://bugzilla.novell.com/show_bug.cgi?id=637263Cc:
Signed-off-by: Takashi Iwai -
The error handling in snd_seq_oss_open() has several bad codes that
do dereferecing released pointers and double-free of kmalloc'ed data.
The object dp is release in free_devinfo() that is called via
private_free callback. The rest shouldn't touch this object any more.The patch changes delete_port() to call kfree() in any case, and gets
rid of unnecessary calls of destructors in snd_seq_oss_open().Fixes CVE-2010-3080.
Reported-and-tested-by: Tavis Ormandy
Cc:
Signed-off-by: Takashi Iwai -
The driver doesn't probe the device properly because of left-over cfg[]
that isn't used at all for msnd-classic device. This is only for msnd-
pinnacle.Signed-off-by: Takashi Iwai
-
EeePC 1001HAG has a similar problem like other ASUS machine, which doesn't
set the codec SSID properly for indicating the beep capability.
To enable PC-beep again, put this to the whitelist.Signed-off-by: Takashi Iwai
-
Add init verb sequence for errata ER880C3
http://www.cirrus.com/en/pubs/errata/ER880C3.pdfSigned-off-by: Brian Austin
Cc:
Signed-off-by: Takashi Iwai -
Due to the wrong "return" in the loop, a capture substream won't be
released at disconnection properly if the device is capture only and has
no playback substream. This caused Oops occasionally at the device
reconnection.Reported-by: Kim Minhyoung
Cc:
Signed-off-by: Takashi Iwai -
The Line and Mic inputs cannot be used at the same time, so the driver
has to automatically disable one of them if both are set. However, it
forgot to notify userspace about this change, so the mixer state would
be inconsistent. To fix this, check if the other control gets muted,
and send a notification event in this case.Signed-off-by: Clemens Ladisch
Reported-and-tested-by: Nathan Schagen
Cc:
Signed-off-by: Takashi Iwai -
For the WM8776 chip, this driver uses a different sample format and
more features than the Windows driver. When rebooting from Linux into
Windows, the latter driver does not reset the chip but assumes all its
registers have their default settings, so we get garbled sound or, if
the output happened to be muted before rebooting, no sound.To make that driver happy, hook our driver's cleanup function into the
shutdown notifier and ensure that the chip gets reset.Signed-off-by: Clemens Ladisch
Reported-and-tested-by: Nathan Schagen
Cc:
Signed-off-by: Takashi Iwai
07 Sep, 2010
1 commit
-
Lenovo T400s requires the quirk to make automatic HP/mic switching working.
Reported-by: Frank Becker
Cc:
Signed-off-by: Takashi Iwai
04 Sep, 2010
1 commit
-
The Audio Class v2 support code in 2.6.35 added checks for the
bInterfaceProtocol field. However, there are devices (usually those
detected by vendor-specific quirks) that do not have one of the
predefined values in this field, which made the driver reject them.To fix this regression, restore the old behaviour, i.e., assume that
a device with an unknown bInterfaceProtocol field (other than
UAC_VERSION_2) has more or less UAC-v1-compatible descriptors.[compile warning fixes by tiwai]
Signed-off-by: Clemens Ladisch
Cc: Daniel Mack
Cc:
Signed-off-by: Takashi Iwai
02 Sep, 2010
2 commits
-
For devices with more than one control interface, let's assume the first
one contains the audio controls. Unfortunately, there is no field in any
of the descriptors to tell us whether a control interface is for audio
or MIDI controls, so a better check is not easy to implement.On a composite device with audio and MIDI functions, for example, the
code currently overwrites chip->ctrl_intf, causing operations on the
control interface to fail if they are issued after the device probe.Signed-off-by: Daniel Mack
Signed-off-by: Takashi Iwai -
This new model adds the following functionality to HP G60:
- Automute of internal speakers
- Autoswitch of internal/external mics
- Remove SPDIF not physically presentBugLink: http://launchpad.net/bugs/587388
Cc: stable@kernel.org
Signed-off-by: David Henningsson
Signed-off-by: Takashi Iwai
29 Aug, 2010
2 commits
28 Aug, 2010
1 commit
-
There were some new formats added in commit 15c0cee6c809 "ALSA: pcm:
Define G723 3-bit and 5-bit formats". That commit increased
SNDRV_PCM_FORMAT_LAST as well. My concern is that there are a couple
places which do:for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) {
if (dummy->pcm_hw.formats & (1ULL << i))
snd_iprintf(buffer, " %s", snd_pcm_format_name(i));
}I haven't tested these but it looks like if "i" were equal to
SNDRV_PCM_FORMAT_G723_24 or higher then we might read past the end of
the array.Signed-off-by: Dan Carpenter
Signed-off-by: Takashi Iwai