Was: [PATCH] sound/oss/midi_synth: prevent underflow, use of
uninitialized value, and signedness issue

The offset passed to midi_synth_load_patch() can be essentially
arbitrary.  If it's greater than the header length, this will result in
a copy_from_user(dst, src, negative_val).  While this will just return
-EFAULT on x86, on other architectures this may cause memory corruption.
Additionally, the length field of the sysex_info structure may not be
initialized prior to its use.  Finally, a signed comparison may result
in an unintentionally large loop.

On suggestion by Takashi Iwai, version two removes the offset argument
from the load_patch callbacks entirely, which also resolves similar
issues in opl3.  Compile tested only.

v3 adjusts comments and hopefully gets copy offsets right.
Signed-off-by: NDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Similar to commit 7e59e097, this patch
avoids unnecessary volume control indices for more
Realtek auto-parsers, e g the ALC66x family, on the "Surround" and "Side"
controls.
These indices cause these volume controls to be ignored by PulseAudio and
vmaster and should be removed whenever possible.

Cc: stable@kernel.org
Reported-by: NJan Losinski <losinski@wh2.tu-dresden.de>
Signed-off-by: NDavid Henningsson <david.henningsson@canonical.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The regulator is optional depending on board design.
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: NLiam Girdwood <lrg@slimlogic.co.uk>

Since VT1708 didn't support the control of getting connection number,
building of headphone control will fail in via_hp_build() function.
Signed-off-by: NLydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Correct stream names of analog playback and capture streams
for VT1818S.
Signed-off-by: NLydia Wang <lydiawang@viatech.com.cn>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add get_codec_type() in via_new_spec() function to make sure getting
correct codec type before building mixer controls.
Signed-off-by: NLydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Modify vt_auto_create_analog_input_ctls() function to fix invalid a-a path
volume adjust issue for VT1708S, VT1702 and VT1716S codecs.
Signed-off-by: NLydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Modify mute_aa_path() function to support VT1718S codec.
Signed-off-by: NLydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Modify via_independent_hp_put() function to support VT1718S and VT1812
codecs, and fix independent headphone no sound issue.
Signed-off-by: NLydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Modify function via_mux_enum_put() to fix stereo mixer recording
no sound issue.
Signed-off-by: NLydia Wang <lydiawang@viatech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Set EAPD for Realtek ALC665 (Vendor Id: 0x10eSet EAPD for Realtek
ALC665 (Vendor Id: 0x10ec0665).
Signed-off-by: NAndres Mejia <mcitadel@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Some USB devices give trailing spaces in strings returned from
usb_string().  This confuses the automatic card-id creation, resulting
always in "default".
This patch fixes the behavior by removing trailing spaces.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Convert direct read of inode->i_size to using i_size_read().
i_size_read is guaranteed to return a valid value and
its caller does not need to use addtional locking.
Signed-off-by: NXiaochen Wang <wangxiaochen0@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Since not all registers need to be cached and the cache is entirely
optional anyway we shouldn't be checking that a register is in the
cached range. If the register is invalid then the actual I/O code
can determine that and report an error.

Similarly, the step size can and should be enforced by the lower level
code if it's important.
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: NLiam Girdwood <lrg@slimlogic.co.uk>

Merge branch 'topic/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 into for-2.6.39

The user-supplied index into the adapters array needs to be checked, or
an out-of-bounds kernel pointer could be accessed and used, leading to
potentially exploitable memory corruption.
Signed-off-by: NDan Rosenberg <drosenberg@vsecurity.com>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

loopback_pos_update() can be called in the timer callback, thus the lock
held should be irq-safe.  Otherwise you'll get AB/BA deadlock together
with substream->self_group.lock.
Reported-and-tested-by: NKnut Petersen <Knut_Petersen@t-online.de>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Merge list_del() + list_add_tail() to list_move_tail().
Signed-off-by: NNicolas Kaiser <nikai@nikai.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Merge branch 'for-2.6.39' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/asoc-2.6 into topic/asoc

Signed-off-by: NKirill A. Shutemov <kirill@shutemov.name>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

fixes this error:

sound/firewire/fcp.c: In function 'fcp_avc_transaction':
sound/firewire/fcp.c:103: error: implicit declaration of function 'msleep'
Signed-off-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add an AMDTP stream error state that occurs when we fail to queue
another packet.  In this case, the stream is stopped, and the error can
be reported when the application tries to restart the PCM stream.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

For correct cache coherency on some architectures, DMA buffers must be
allocated in a different cache line than data that is concurrently used
by the CPU.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

In non-blocking mode, the SYT_INTERVAL is larger than the number of
audio frames in each packet, so there are packets that do not contain
any frame to which the SYT could be applied.  For these packets, the
SYT must not be the timestamp of the next valid SYT frame, but the
special no-info SYT value.

This fixes broken playback on the FireWave at 44.1 kHz.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add a driver for two playback-only FireWire devices based on the OXFW970
chip.

v2: better AMDTP API abstraction; fix fw_unit leak; small fixes
v3: cache the iPCR value
v4: FireWave constraints; fix fw_device reference counting;
    fix PCR caching; small changes and fixes
v5: volume/mute support; fix crashing due to pcm stop races
v6: fix build; one-channel volume for LaCie
v7: use signed values to make volume (range checks) work; fix function
    block IDs for volume/mute; always use channel 0 for LaCie volume
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Acked-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Tested-by: NJay Fenlason <fenlason@redhat.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This patch replaces use of the harcoded arrays of pins, muxes, digital
mics and adcs with the auto-generated ones using codec parsing and
auto-discovers all actually connected digital mic pins on 92HD8X-like
codecs

This patch also adds the support for d-mic on pin 0x20.
Signed-off-by: NVitaliy Kulikov <Vitaliy.Kulikov@idt.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

When the mux for digital mic is different from the mux for other mics,
the current auto-parser doesn't handle them in a right way but provides
only one mic.  This patch fixes the issue.
Signed-off-by: NVitaliy Kulikov <Vitaliy.Kulikov@idt.com>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Move the default input-src selection code for alc268/269 to the init
part instead of the parser.  The input-src selection might be overwritten
by init verbs.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Currently some special handling for the unusual case like dual-ADCs
or a single-input-src is done in the tree-parse time in
set_capture_mixer().  But this setup could be overwritten by static
init verbs.

This patch moves the initialization into the init phase so that
such input-src setup won't be lost.

Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Clear input settings before initialization.
Signed-off-by: NPrzemyslaw Bruski <pbruskispam@op.pl>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

SDPIF status retrieval always returned the default settings instead of
the actual ones.
Signed-off-by: NPrzemyslaw Bruski <pbruskispam@op.pl>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

SPDIF status mask creation was incorrect.
Signed-off-by: NPrzemyslaw Bruski <pbruskispam@op.pl>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

microphone boost was set at +12dB, not +20dB (like in Windows driver
and in adc_conf structure declaration), some comments added.
Signed-off-by: NPrzemyslaw Bruski <pbruskispam@op.pl>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The time-out in snd_atiixp_aclink_reset() is wrongly checked, and
it resulted in exiting from the loop at the first iteration.
Reported-by: NAmir Shamsuddin <AmirS2+alsa@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Appending an 'm' will distinguish it from a similar struct in intel8x0.c
Signed-off-by: NPaul Bolle <pebolle@tiscali.nl>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>