The user-supplied index into the adapters array needs to be checked, or
an out-of-bounds kernel pointer could be accessed and used, leading to
potentially exploitable memory corruption.
Signed-off-by: NDan Rosenberg <drosenberg@vsecurity.com>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

loopback_pos_update() can be called in the timer callback, thus the lock
held should be irq-safe.  Otherwise you'll get AB/BA deadlock together
with substream->self_group.lock.
Reported-and-tested-by: NKnut Petersen <Knut_Petersen@t-online.de>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Merge list_del() + list_add_tail() to list_move_tail().
Signed-off-by: NNicolas Kaiser <nikai@nikai.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NKirill A. Shutemov <kirill@shutemov.name>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Clear input settings before initialization.
Signed-off-by: NPrzemyslaw Bruski <pbruskispam@op.pl>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

SDPIF status retrieval always returned the default settings instead of
the actual ones.
Signed-off-by: NPrzemyslaw Bruski <pbruskispam@op.pl>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

SPDIF status mask creation was incorrect.
Signed-off-by: NPrzemyslaw Bruski <pbruskispam@op.pl>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

microphone boost was set at +12dB, not +20dB (like in Windows driver
and in adc_conf structure declaration), some comments added.
Signed-off-by: NPrzemyslaw Bruski <pbruskispam@op.pl>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The time-out in snd_atiixp_aclink_reset() is wrongly checked, and
it resulted in exiting from the loop at the first iteration.
Reported-by: NAmir Shamsuddin <AmirS2+alsa@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Appending an 'm' will distinguish it from a similar struct in intel8x0.c
Signed-off-by: NPaul Bolle <pebolle@tiscali.nl>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Adding an 'm' will distinguish them from identical names in intel8x0.c.
Signed-off-by: NPaul Bolle <pebolle@tiscali.nl>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

At every resume a laptop I use prints this message (at KERN_ERR level):
    ALSA sound/pci/intel8x0m.c:904: AC'97 warm reset still in progress? [0x2]

The thing to note here is that 0x2 corresponds to ICH_AC97COLD. Ie, what
seems to be happening is that the register involved indicated a warm
reset for some time (as the ICH_AC97WARM bit was set) but by the time
the warning is printed, and that same register is checked again, that
bit is already cleared and only the ICH_AC97COLD bit is still set.

It turns out a warm reset needs some time to settle, but it is currently
checked right away. The test therefore fails the first time it is done
and schedule_timeout_uninterruptible() will be called. Once we return
from that jiffies is already (far) past end_time on this laptop, so we
exit the loop, print a warning, and exit the function while the warm
reset actually succeeded.

A way to fix this is to call usleep_range() after writing to the
register involved. A handful of tests suggest 500 usecs is a safe value.
(This might punish the "finish cold reset" case, but on this laptop such
a cold reset apparently never happens, so I can't say for sure.)

While we're at it drop the extra single tick from end_time, as it looks
rather silly.
Signed-off-by: NPaul Bolle <pebolle@tiscali.nl>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Devices are autosuspended if no pcm nor midi channel is open
Mixer devices may be opened. This way they are active when
in use to play or record sound, but can be suspended while
users have a mixer application running.

[Small clean-ups using static inline by tiwai]
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

- ESHUTDOWN must be correctly handled
- the optional interrupt endpoint's URB must be stopped and restarted
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

One more affected devices: Logitech Webcam C600 (046d:0808)

Volume range before quirk is 6400, after (also real) is 16.
Signed-off-by: NAlexey Fisher <bug-track@fisher-privat.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NAlexey Fisher <bug-track@fisher-privat.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Since OSS driver creates the device entries for /dev/audio* and
/dev/dspW* by itself without coping with sound_core, it leads to
conflicts with others and let sysfs spewing warnings.

This patch rewrites the registration part of OSS driver to use
the standard method also for additional minor devices.

Reported-by: Steven Rostedt <rostedt@goodmis.org> (with ktest.pl)
Tested-by: Steven Rostedt <rostedt@goodmis.org> (with ktest.pl)
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The return value of snd_ctl_hole_check() is used only to detect whether
to continue the loop in snd_ctl_find_hole() or not, so we can simplify
the code by changing this return type to a boolean.  Also rename this
function to better show what it actually does.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The purpose of the snd_ctl_hole_check() function is to find conflicts
between the numerical IDs of the new control and those of any existing
controls.  However, it would fail to detect an existing control whose
count is smaller than the new control's count and whose interval of IDs
is entirely contained in the interval of the new control's IDs.

To fix this, use the correct formula to detect overlapping intervals,
which happens to simplify the condition.

This problem was not encountered so far because ALSA does not yet allow
drivers to allocate specific control IDs.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The current AES32 firmware revision ID is 234, however, a user confirmed
that everything works fine with the previous revision, too.
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Depending on the model and the presence of a TCO module, the number of
midi ports varies. Some have 1 port (MADIface), some have 2 (default),
with TCO, there are 3.

Don't hardcode the number of midi ports to initialize.

This patch also fixes a boot lockup on MADIface.

[Coding-style fixes by tiwai]
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Don't continue if we cannot detect the real card type, otherwise, all
subsequent functions, especially strcpy(), would fail, leaving the whole
driver in an unusable state.

Without such a protection, dmesg would look like this:

Pid: 1525, comm: modprobe Not tainted 2.6.38-rc6 #1 MSI MS-7250/MS-7250
EIP: 0060:[<c114e700>] EFLAGS: 00010296 CPU: 1
EIP is at strcpy+0x10/0x30
EAX: f4d33e58 EBX: f5990800 ECX: f4d33e58 EDX: 00000000
ESI: 00000000 EDI: f4d33e58 EBP: f5990930 ESP: f3dd3e0c
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
f53d4204 00000000 f90bfc03 00000001 00000001 f3dd3e64 c10fedff f3dd3e7c
f3d854e4 f53d4000 c10307b8 00000001 c10307b8 f5990860 c10307b8 00000001
c10332e5 f59908bc c12f4339 f59908bc f5990860 c11ef207 f4d33e00 f53d4000
[<f90bfc03>] ? snd_hdspm_probe+0x7e7/0x1166 [snd_hdspm]
[<c10fedff>] ? __sysfs_add_one+0x1f/0xf0
[<c10307b8>] ? get_parent_ip+0x8/0x20
[<c10307b8>] ? get_parent_ip+0x8/0x20
[<c10307b8>] ? get_parent_ip+0x8/0x20
[<c10332e5>] ? add_preempt_count+0xa5/0xd0
[<c12f4339>] ? _raw_spin_lock_irqsave+0x19/0x40
[<c11ef207>] ? pm_runtime_enable+0x17/0x80
[<c1160172>] ? local_pci_probe+0x42/0xb0
[<c1161091>] ? pci_device_probe+0x61/0x80
[<c11e9587>] ? driver_probe_device+0x77/0x180
[<c11600f0>] ? pci_match_device+0xa0/0xc0
[<c11e9709>] ? __driver_attach+0x79/0x80
[<c11e9690>] ? __driver_attach+0x0/0x80
[<c11e8e32>] ? bus_for_each_dev+0x52/0x80
[<c11e9416>] ? driver_attach+0x16/0x20
[<c11e9690>] ? __driver_attach+0x0/0x80
[<c11e8771>] ? bus_add_driver+0xa1/0x220
[<c1160f20>] ? pci_device_remove+0x0/0xf0
[<c11e99a3>] ? driver_register+0x63/0x120
[<c11612bd>] ? __pci_register_driver+0x3d/0xb0
[<c1001132>] ? do_one_initcall+0x32/0x160
[<f90d6000>] ? alsa_card_hdspm_init+0x0/0x14 [snd_hdspm]
[<c10676a9>] ? sys_init_module+0x99/0x1e0
[<c10ade3d>] ? sys_close+0x6d/0xc0
[<c1002c90>] ? sysenter_do_call+0x12/0x26
---[ end trace 239f0661c558378b ]---
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

In contrast to the PCIe version (RME AES), the PCI version (RME AES32)
has a different firmware revision.

This patch adds the missing PCI revision.
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Allow input from microphone on remaining PowerBooks and iBooks with Tumbler.
Tested only with PowerBook G4 Gigabit Ethernet (PowerBook3,3).

[Fixed to use of_machine_is_compatible by tiwai]
Signed-off-by: NRisto Suominen <Risto.Suominen@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The Patch below removes one to many "n's" in a word..
Signed-off-by: NJustin P. Mattock <justinmattock@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The patch below removes an extra "l" in the word.
Signed-off-by: NJustin P. Mattock <justinmattock@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The patch below removes an extra "l" in the word.
Signed-off-by: NJustin P. Mattock <justinmattock@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Original patch by Dan Rosenberg <drosenberg@vsecurity.com> under commit
e68d3b31. I'm copying his text here:

The SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl in hdspm.c allow unprivileged
users to read uninitialized kernel stack memory, because several fields
of the hdspm_config struct declared on the stack are not altered
or zeroed before being copied back to the user.  This patch takes care
of it.
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Fredrik Lingvall <fredrik.lingvall@gmail.com> has discovered wrong
frequency and sync detection on AES32. According to him, the provided
patch fixes these issues.
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

In contrast to the RME MADI card, coax/optical selection on the MADIface
is done via a physical switch located at the breakout box. Obviously,
the driver cannot switch ports in software.
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Caused by two typos, no output channel mappings were assigned for
MADI/MADIface at double/quad speed.

The channel mapping is indeed identical to the single speed mapping, the
cards will simply use the first N channels.
Signed-off-by: NFlorian Faber <faber@faberman.de>
Signed-off-by: NFredrik Lingvall <fredrik.lingvall@gmail.com>
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Without calling an appropriate rule, AES/AES32 cards would announce a
theoretical channel count of 64 (HDSPM_MAX_CHANNELS), leading to the
already known bug:

[37422.640481] ------------[ cut here ]------------
[37422.640487] WARNING: at sound/pci/rme9652/hdspm.c:5449
snd_hdspm_ioctl+0x18f/0x202 [snd_hdspm]()
[37422.640489] Hardware name: PRIMERGY RX100 S6
[37422.640490] BUG? (info->channel >= hdspm->max_channels_in)
[37422.640492] Modules linked in: snd_hdspm snd_seq_midi ipmi_watchdog
ipmi_poweroff ipmi_si ipmi_devintf ipmi_msghandler i2c_i801 e1000e
snd_rawmidi power_meter [last unloaded: snd_hdspm]
[37422.640501] Pid: 22231, comm: jackd Tainted: G      D W
2.6.36-gentoo-r5 #5
[37422.640502] Call Trace:
[37422.640508]  [<ffffffff8103db3a>] warn_slowpath_common+0x80/0x98
[37422.640511]  [<ffffffff8103dbe6>] warn_slowpath_fmt+0x41/0x43
[37422.640514]  [<ffffffff81034306>] ? get_parent_ip+0x11/0x42
[37422.640518]  [<ffffffffa0055763>] snd_hdspm_ioctl+0x18f/0x202
[snd_hdspm]
[37422.640522]  [<ffffffff813fd626>] snd_pcm_channel_info+0x73/0x7c
[37422.640525]  [<ffffffff814001e9>] snd_pcm_common_ioctl1+0x326/0xb01
[37422.640527]  [<ffffffff81034306>] ? get_parent_ip+0x11/0x42
[37422.640531]  [<ffffffff8105be6c>] ? __srcu_read_unlock+0x3b/0x59
[37422.640533]  [<ffffffff81400bce>] snd_pcm_capture_ioctl1+0x20a/0x227
[37422.640537]  [<ffffffff811e599c>] ? file_has_perm+0x90/0x9e
[37422.640540]  [<ffffffff81400c15>] snd_pcm_capture_ioctl+0x2a/0x2e
[37422.640543]  [<ffffffff810f2c69>] do_vfs_ioctl+0x404/0x453
[37422.640546]  [<ffffffff810f2d09>] sys_ioctl+0x51/0x74
[37422.640549]  [<ffffffff81002aab>] system_call_fastpath+0x16/0x1b
[37422.640552] ---[ end trace 0cd919cd68118082 ]---

We already have all the right values in place, we simply have to inform
the upper layers about this restriction.

Note that snd_hdspm_hw_rule_rate_out_channels and
snd_hdspm_hw_rule_rate_in_channels must not be called on AES32, because
the channel count is always 16, no matter of the samplerate in use.
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Only RayDAT and AIO provide sane buffer pointers that can be used with
HDSPM_BufferPositionMask, on all other cards, this would result in a
wrong HW pointer leading to xruns and these messages:

[260808.916788] BUG: pcmC0D0p:0, pos = 2976, buffer size = 1024, period size = 512
[260808.961124] BUG: pcmC0D0c:0, pos = 4944, buffer size = 1024, period size = 512
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

On RME AES and AES(32), none of the required information
(max_channels_in, max_channels_out, channel mappings, port names) was
set, leading to the BUG below.

This patch adds the missing bits, thus fixing the bug.

125.058768] ------------[ cut here ]------------
[  125.058773] WARNING: at sound/pci/rme9652/hdspm.c:5389
snd_hdspm_ioctl+0x10c/0x1d8 [snd_hdspm]()
[  125.058775] Hardware name: PRIMERGY RX100 S6
[  125.058777] BUG? (info->channel >= hdspm->max_channels_out)
[  125.058778] Modules linked in: ipmi_watchdog ipmi_poweroff ipmi_si
ipmi_devintf ipmi_msghandler snd_hdspm power_meter e1000e snd_rawmidi
i2c_i801
[  125.058787] Pid: 3652, comm: audacity Tainted: G        W
2.6.36-gentoo-r5 #5
[  125.058788] Call Trace:
[  125.058792]  [<ffffffff8103db3a>] warn_slowpath_common+0x80/0x98
[  125.058796]  [<ffffffff8103dbe6>] warn_slowpath_fmt+0x41/0x43
[  125.058800]  [<ffffffffa006761a>] snd_hdspm_ioctl+0x10c/0x1d8
[snd_hdspm]
[  125.058803]  [<ffffffff813fd626>] snd_pcm_channel_info+0x73/0x7c
[  125.058806]  [<ffffffff814001e9>] snd_pcm_common_ioctl1+0x326/0xb01
[  125.058809]  [<ffffffff810c604c>] ? __do_fault+0x361/0x3a6
[  125.058812]  [<ffffffff81400e23>] snd_pcm_playback_ioctl1+0x20a/0x227
[  125.058815]  [<ffffffff811e599c>] ? file_has_perm+0x90/0x9e
[  125.058818]  [<ffffffff81400e6a>] snd_pcm_playback_ioctl+0x2a/0x2e
[  125.058821]  [<ffffffff810f2c69>] do_vfs_ioctl+0x404/0x453
[  125.058824]  [<ffffffff810f2d09>] sys_ioctl+0x51/0x74
[  125.058827]  [<ffffffff81002aab>] system_call_fastpath+0x16/0x1b
[  125.058830] ---[ end trace 5bddb08e5d4cbeb1 ]---
Signed-off-by: NAdrian Knoth <adi@drcomp.erfurt.thur.de>
Signed-off-by: NFlorian Faber <faber@faberman.de>
Signed-off-by: NFredrik Lingvall <fredrik.lingvall@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

When a USB audio device is disconnected, snd_usb_audio_disconnect()
kills all audio URBs.  At the same time, the application, after being
notified of the disconnection, might close the device, in which case
ALSA calls the .hw_free callback, which should free the URBs too.

Commit de1b8b93 "[ALSA] Fix hang-up at disconnection of usb-audio"
prevented snd_usb_hw_free() from freeing the URBs to avoid a hang that
resulted from this race, but this introduced another race because the
URB callbacks could now be executed after snd_usb_hw_free() has
returned, and try to access already freed data.

Fix the first race by introducing a mutex to serialize the disconnect
callback and all PCM callbacks that manage URBs (hw_free and hw_params).
Reported-and-tested-by: NPierre-Louis Bossart <pierre-louis.bossart@intel.com>
Cc: <stable@kernel.org>
[CL: also serialize hw_params callback]
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This typo caused some microphone inputs not to be correctly
initialized on VIA codecs.
Reported-By: NMark Goldstein <goldstein.mark@gmail.com>
Cc: stable@kernel.org
Signed-off-by: NDavid Henningsson <david.henningsson@canonical.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>