Suppose the ALSA card already has a number of MAX_USER_CONTROLS controls, and
the user wants to replace one, it should not fail at this condition check.
Signed-off-by: NLu Guanqun <guanqun.lu@intel.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

remove trailing tab on the line.
Signed-off-by: NLu Guanqun <guanqun.lu@intel.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Drop a few variables that are never read.
Signed-off-by: NLuca Tettamanti <kronos.it@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add a function to dynamically replace a given control.  If the
control does not already exist, a third parameter is used to determine
whether to actually add that control.  This is useful in cases where
downloadable firmware at runtime can add or replace existing controls.
A separate patch needs to be made to allow ALSA Mixer to render the
replaced controls on the fly.
Signed-off-by: NDimitris Papastamos <dp@opensource.wolfsonmicro.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Added a new API function snd_ctl_activate_id() for activate / inactivate
the control element dynamically.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The return value of snd_ctl_hole_check() is used only to detect whether
to continue the loop in snd_ctl_find_hole() or not, so we can simplify
the code by changing this return type to a boolean.  Also rename this
function to better show what it actually does.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The purpose of the snd_ctl_hole_check() function is to find conflicts
between the numerical IDs of the new control and those of any existing
controls.  However, it would fail to detect an existing control whose
count is smaller than the new control's count and whose interval of IDs
is entirely contained in the interval of the new control's IDs.

To fix this, use the correct formula to detect overlapping intervals,
which happens to simplify the condition.

This problem was not encountered so far because ALSA does not yet allow
drivers to allocate specific control IDs.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Introduce the helper function snd_ctl_enum_info() to fill out the
elem_info fields for an enumerated control.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The snd_ctl_new() function in sound/core/control.c allocates space for a
snd_kcontrol struct by performing arithmetic operations on a
user-provided size without checking for integer overflow.  If a user
provides a large enough size, an overflow will occur, the allocated
chunk will be too small, and a second user-influenced value will be
written repeatedly past the bounds of this chunk.  This code is
reachable by unprivileged users who have permission to open
a /dev/snd/controlC* device (on many distros, this is group "audio") via
the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls.
Signed-off-by: NDan Rosenberg <drosenberg@vsecurity.com>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Set no_llseek to llseek file ops of each sound component (but for hwdep).
This avoids the implicit BKL invocation via generic_file_llseek() used
as default when fops.llseek is NULL.

Also call nonseekable_open() at each open ops to ensure the file flags
have no seek bit.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Allow TLV blocks that do not have any values; the smallest possible TLV
is an empty container or one where the information is only in the tag.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NJaroslav Kysela <perex@perex.cz>

Creating a control with TLV_COMMAND access was not possible because
snd_ctl_new1() forgot to include it in the mask of allowable access
bits.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NJaroslav Kysela <perex@perex.cz>

This function is only called from snd_ctl_ioctl() and the file parameter
can never be null so there is no need to check it here.

We dereference file at the start of the function:
        struct snd_card *card = file->card;
and it confuses static checkers to dereference a pointer before
checking it.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Instead of storing the PID number, take a reference to the task's pid
structure.  This protects against duplicates due to PID overflows, and
using pid_vnr() ensures that the PID returned by snd_ctl_elem_info() is
correct as seen from the current namespace.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

We do not need to save the ID of the process that locked a control
because that information is already available in the owner's file data.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Ensure that userspace can remove only user controls.  Controls created
by kernel drivers must not be removed because they might be referenced
in calls to snd_ctl_notify().
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Move the decrementing of the user controls counter from
snd_ctl_elem_remove to snd_ctl_remove_unlocked_id; this saves the
separate locking of the controls semaphore, and therefore removes
a harmless race.

Since the purpose of the function is to operate on user controls (the
control being unlocked is just a prerequisite), rename it to
snd_ctl_remove_user_ctl.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Use a common exit path to release the mutex and to return a possible
error.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Make sure that no user element that has no values can be added.

The check for count>1024 is not needed because the count is checked
later for the individual control types.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Remove open-coded memdup_user().
Signed-off-by: NLi Zefan <lizf@cn.fujitsu.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Most fasync implementations do something like:

     return fasync_helper(...);

But fasync_helper() will return a positive value at times - a feature used
in at least one place.  Thus, a number of other drivers do:

     err = fasync_helper(...);
     if (err < 0)
             return err;
     return 0;

In the interests of consistency and more concise code, it makes sense to
map positive return values onto zero where ->fasync() is called.

Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: NJonathan Corbet <corbet@lwn.net>

As it is, all instances of ->release() for files that have ->fasync()
need to remember to evict file from fasync lists; forgetting that
creates a hole and we actually have a bunch that *does* forget.

So let's keep our lives simple - let __fput() check FASYNC in
file->f_flags and call ->fasync() there if it's been set.  And lose that
crap in ->release() instances - leaving it there is still valid, but we
don't have to bother anymore.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This is likely to confuse user interfaces since the end of the control
name is interpreted (eg, "Volume", "Switch").
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The lock used in snd_ctl_dev_disconnect() should be card->ctl_files_rwlock
for protection of card->ctl_files entries, instead of card->controls_rwsem.
Reported-by: NVegard Nossum <vegard.nossum@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@perex.cz>

Kill snd_assert() in sound/core/*, either removed or replaced with
if () with snd_BUG_ON().
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@perex.cz>

snd_ctl_elem_read() and snd_ctl_elem_write() are no longer used by
any other drivers.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@perex.cz>

This header file exists only for some hacks to adapt alsa-driver
tree.  It's useless for building in the kernel.  Let's move a few
lines in it to sound/core.h and remove it.
With this patch, sound/driver.h isn't removed but has just a single
compile warning to include it.  This should be really killed in
future.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@perex.cz>

This patch removes the indirect control access to the control elements.
The indirect access has never been used and is even broken on 32bit
ioctl wrapper.  Let's clean it up.
The pointers still remain in snd_ctl_elem_* structs just to make sure
that the struct size won't change.  Once after checking the size
consistency, we can get rid of them, too.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@perex.cz>

The lock grabbed in snd_ctl_empty_read_queue() is hardirq-unsafe but we hold
an hardirq-safe one already, so make the &ctl->read_lock also hard-irq-safe.
Signed-off-by: NBorislav Petkov <bbpetkov@yahoo.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@perex.cz>

Signed-off-by: NJaroslav Kysela <perex@perex.cz>

snd_ctl_elem_{read,write} no longer have any modular users
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Added helper functions for frequenty used callbacks:
  snd_ctl_boolean_mono_info() and snd_ctl_boolean_stereo_info()
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Remove includes of <linux/smp_lock.h> where it is not used/needed.
Suggested by Al Viro.

Builds cleanly on x86_64, i386, alpha, ia64, powerpc, sparc,
sparc64, and arm (all 59 defconfigs).
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Many struct file_operations in the kernel can be "const".  Marking them const
moves these to the .rodata section, which avoids false sharing with potential
dirty data.  In addition it'll catch accidental writes at compile time to
these shared resources.
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Now that everyone uses snd_ctl_new1() and noone is using snd_ctl_new()
anymore, we can make it static.
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

This patch converts most uses of list_for_each to list_for_each_entry all
across alsa. In some place apparently an item can be on a list with
different pointers so of course that isn't compatible with list_for_each, I
therefore didn't touch those places.
Signed-off-by: NJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

This patch removes some obviously dead code spotted by the Coverity
checker.
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Fixed the addition of user-defined boolean controls, the private
data size is corrected to be handled properly.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Retrun error to user TLV_READ ioctl if no TLV is defined.
(Until now, nothing was written and rerunred successfully.)
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>

Fixed the errors at checking info.access field during user TLV_WRITE
call.  It should have been zero-initialized.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NJaroslav Kysela <perex@suse.cz>