13 Apr, 2015

1 commit

  • An element instance can have several elements with the same feature.
    Some userspace applications can add such an element instance by add
    operation with the number of elements. Then, the element instance
    gets a memory object to keep states of these elements.

    But the element instance has just one memory object for the elements.
    This causes the same result to each read/write operations to the
    different elements.

    This commit fixes this bug by allocating enough memory objects to the
    element instance for each of elements.

    Signed-off-by: Takashi Sakamoto
    Signed-off-by: Takashi Iwai

    Takashi Sakamoto
     

12 Apr, 2015

1 commit


11 Apr, 2015

3 commits


10 Apr, 2015

1 commit


13 Mar, 2015

1 commit

  • In the commit [2225e79b9b03: 'ALSA: core: reduce stack usage related
    to snd_ctl_new()'], the id field of the newly added kctl is untouched,
    thus all attribute like name string remain empty. The fix is just to
    add the forgotten memcpy of the id field.

    Fixes: 2225e79b9b03 ('ALSA: core: reduce stack usage related to snd_ctl_new()')
    Reviewed-by: Takashi Sakamoto
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

12 Mar, 2015

2 commits


10 Mar, 2015

3 commits


09 Feb, 2015

1 commit


08 Feb, 2015

1 commit


03 Feb, 2015

1 commit

  • Now that all callers have been replaced with
    snd_device_register_for_dev(), let's drop the obsolete device
    registration code and concentrate only on the code handling struct
    device directly. That said,

    - remove the old snd_device_register(),
    - rename snd_device_register_for_dev() with snd_device_register(),
    - drop superfluous arguments from snd_device_register(),
    - change snd_unregister_device() to pass the device pointer directly

    Reviewed-by: Jaroslav Kysela
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

02 Feb, 2015

2 commits


07 Nov, 2014

1 commit


30 Oct, 2014

1 commit


21 Oct, 2014

2 commits


15 Jul, 2014

1 commit


18 Jun, 2014

5 commits

  • The ALSA control code expects that the range of assigned indices to a control is
    continuous and does not overflow. Currently there are no checks to enforce this.
    If a control with a overflowing index range is created that control becomes
    effectively inaccessible and unremovable since snd_ctl_find_id() will not be
    able to find it. This patch adds a check that makes sure that controls with a
    overflowing index range can not be created.

    Signed-off-by: Lars-Peter Clausen
    Acked-by: Jaroslav Kysela
    Cc:
    Signed-off-by: Takashi Iwai

    Lars-Peter Clausen
     
  • Each control gets automatically assigned its numids when the control is created.
    The allocation is done by incrementing the numid by the amount of allocated
    numids per allocation. This means that excessive creation and destruction of
    controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to
    eventually overflow. Currently when this happens for the control that caused the
    overflow kctl->id.numid + kctl->count will also over flow causing it to be
    smaller than kctl->id.numid. Most of the code assumes that this is something
    that can not happen, so we need to make sure that it won't happen

    Signed-off-by: Lars-Peter Clausen
    Acked-by: Jaroslav Kysela
    Cc:
    Signed-off-by: Takashi Iwai

    Lars-Peter Clausen
     
  • A control that is visible on the card->controls list can be freed at any time.
    This means we must not access any of its memory while not holding the
    controls_rw_lock. Otherwise we risk a use after free access.

    Signed-off-by: Lars-Peter Clausen
    Acked-by: Jaroslav Kysela
    Cc:
    Signed-off-by: Takashi Iwai

    Lars-Peter Clausen
     
  • There are two issues with the current implementation for replacing user
    controls. The first is that the code does not check if the control is actually a
    user control and neither does it check if the control is owned by the process
    that tries to remove it. That allows userspace applications to remove arbitrary
    controls, which can cause a user after free if a for example a driver does not
    expect a control to be removed from under its feed.

    The second issue is that on one hand when a control is replaced the
    user_ctl_count limit is not checked and on the other hand the user_ctl_count is
    increased (even though the number of user controls does not change). This allows
    userspace, once the user_ctl_count limit as been reached, to repeatedly replace
    a control until user_ctl_count overflows. Once that happens new controls can be
    added effectively bypassing the user_ctl_count limit.

    Both issues can be fixed by instead of open-coding the removal of the control
    that is to be replaced to use snd_ctl_remove_user_ctl(). This function does
    proper permission checks as well as decrements user_ctl_count after the control
    has been removed.

    Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at
    beginning of the function if the control already exists is removed. This is not
    a problem though since the check is quite useless, because the lock that is
    protecting the control list is released between the check and before adding the
    new control to the list, which means that it is possible that a different
    control with the same settings is added to the list after the check. Luckily
    there is another check that is done while holding the lock in snd_ctl_add(), so
    we'll rely on that to make sure that the same control is not added twice.

    Signed-off-by: Lars-Peter Clausen
    Acked-by: Jaroslav Kysela
    Cc:
    Signed-off-by: Takashi Iwai

    Lars-Peter Clausen
     
  • The user-control put and get handlers as well as the tlv do not protect against
    concurrent access from multiple threads. Since the state of the control is not
    updated atomically it is possible that either two write operations or a write
    and a read operation race against each other. Both can lead to arbitrary memory
    disclosure. This patch introduces a new lock that protects user-controls from
    concurrent access. Since applications typically access controls sequentially
    than in parallel a single lock per card should be fine.

    Signed-off-by: Lars-Peter Clausen
    Acked-by: Jaroslav Kysela
    Cc:
    Signed-off-by: Takashi Iwai

    Lars-Peter Clausen
     

14 Feb, 2014

1 commit


10 Feb, 2014

1 commit

  • Replace the lengthy #if defined(XXX) || defined(XXX_MODULE) with the
    new IS_ENABLED() macro.

    The patch still doesn't cover all ifdefs. For example, the dependency
    on CONFIG_GAMEPORT is still open-coded because this also has an extra
    dependency on MODULE. Similarly, an open-coded ifdef in pcm_oss.c and
    some sequencer-related stuff are left untouched.

    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

12 Mar, 2013

1 commit

  • script/kernel-doc reports the following type of warnings (when run in verbose
    mode):

    Warning(sound/core/init.c:152): No description found for return value of
    'snd_card_create'

    To fix that:
    - add missing descriptions of function return values
    - use "Return:" sections to describe those return values

    Along the way:
    - complete some descriptions
    - fix some typos

    Signed-off-by: Yacine Belkadi
    Signed-off-by: Takashi Iwai

    Yacine Belkadi
     

30 Oct, 2012

2 commits

  • When disconnect callback is called, each component should wake up
    sleepers and check card->shutdown flag for avoiding the endless sleep
    blocking the proper resource release.

    Cc:
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     
  • For more strict protection for wild disconnections, a refcount is
    introduced to the card instance, and let it up/down when an object is
    referred via snd_lookup_*() in the open ops.

    The free-after-last-close check is also changed to check this refcount
    instead of the empty list, too.

    Reported-by: Matthieu CASTET
    Cc:
    Signed-off-by: Takashi Iwai

    Takashi Iwai
     

07 Sep, 2012

1 commit


13 Mar, 2012

1 commit


07 Nov, 2011

1 commit

  • * 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (230 commits)
    Revert "tracing: Include module.h in define_trace.h"
    irq: don't put module.h into irq.h for tracking irqgen modules.
    bluetooth: macroize two small inlines to avoid module.h
    ip_vs.h: fix implicit use of module_get/module_put from module.h
    nf_conntrack.h: fix up fallout from implicit moduleparam.h presence
    include: replace linux/module.h with "struct module" wherever possible
    include: convert various register fcns to macros to avoid include chaining
    crypto.h: remove unused crypto_tfm_alg_modname() inline
    uwb.h: fix implicit use of asm/page.h for PAGE_SIZE
    pm_runtime.h: explicitly requires notifier.h
    linux/dmaengine.h: fix implicit use of bitmap.h and asm/page.h
    miscdevice.h: fix up implicit use of lists and types
    stop_machine.h: fix implicit use of smp.h for smp_processor_id
    of: fix implicit use of errno.h in include/linux/of.h
    of_platform.h: delete needless include
    acpi: remove module.h include from platform/aclinux.h
    miscdevice.h: delete unnecessary inclusion of module.h
    device_cgroup.h: delete needless include
    net: sch_generic remove redundant use of
    net: inet_timewait_sock doesnt need
    ...

    Fix up trivial conflicts (other header files, and removal of the ab3550 mfd driver) in
    - drivers/media/dvb/frontends/dibx000_common.c
    - drivers/media/video/{mt9m111.c,ov6650.c}
    - drivers/mfd/ab3550-core.c
    - include/linux/dmaengine.h

    Linus Torvalds
     

06 Nov, 2011

1 commit

  • This was introduced by 'ALSA: control: add support for ENUMERATED user
    space controls' which adds a u64 variable that gets cast to a pointer:

    sound/core/control.c: In function 'snd_ctl_elem_init_enum_names':
    sound/core/control.c:1089: warning: cast to pointer from integer of different size

    Cast to uintptr_t before casting to pointer to avoid the warning.

    Signed-off-by: Olof Johansson
    [cl: replace long with uintptr_t]
    Signed-off-by: Clemens Ladisch
    Signed-off-by: Takashi Iwai

    Olof Johansson
     

01 Nov, 2011

1 commit


09 Oct, 2011

1 commit


24 Aug, 2011

2 commits