From 7b42176a2969bc913cd2949e7edd935466745b11 Mon Sep 17 00:00:00 2001 From: Markus Pietrek Date: Wed, 4 Aug 2010 15:59:50 +0900 Subject: sound/soc/sh/siu: Fixed undefined dma_length of scatter gather list Without this patch, an undefined/random sg->dma_length is used and the sound will be played/captured wrongly. Signed-off-by: Markus Pietrek Signed-off-by: Paul Mundt --- sound/soc/sh/siu_pcm.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'sound') diff --git a/sound/soc/sh/siu_pcm.c b/sound/soc/sh/siu_pcm.c index 36170be15aa7..b0ccd0b862fc 100644 --- a/sound/soc/sh/siu_pcm.c +++ b/sound/soc/sh/siu_pcm.c @@ -127,6 +127,7 @@ static int siu_pcm_wr_set(struct siu_port *port_info, sg_init_table(&sg, 1); sg_set_page(&sg, pfn_to_page(PFN_DOWN(buff)), size, offset_in_page(buff)); + sg_dma_len(&sg) = size; sg_dma_address(&sg) = buff; desc = siu_stream->chan->device->device_prep_slave_sg(siu_stream->chan, @@ -176,6 +177,7 @@ static int siu_pcm_rd_set(struct siu_port *port_info, sg_init_table(&sg, 1); sg_set_page(&sg, pfn_to_page(PFN_DOWN(buff)), size, offset_in_page(buff)); + sg_dma_len(&sg) = size; sg_dma_address(&sg) = buff; desc = siu_stream->chan->device->device_prep_slave_sg(siu_stream->chan, -- cgit v1.2.3 From b42e17963c20ecb80905083ceaecc79fd9bd30f1 Mon Sep 17 00:00:00 2001 From: Thomas Weber Date: Thu, 23 Sep 2010 11:46:50 +0200 Subject: Fix typo configue => configure in comments Signed-off-by: Thomas Weber Acked-by: David S. Miller Signed-off-by: Jiri Kosina --- sound/soc/s3c24xx/neo1973_gta02_wm8753.c | 2 +- sound/soc/s3c24xx/neo1973_wm8753.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'sound') diff --git a/sound/soc/s3c24xx/neo1973_gta02_wm8753.c b/sound/soc/s3c24xx/neo1973_gta02_wm8753.c index 209c25994c7e..4719558289d4 100644 --- a/sound/soc/s3c24xx/neo1973_gta02_wm8753.c +++ b/sound/soc/s3c24xx/neo1973_gta02_wm8753.c @@ -182,7 +182,7 @@ static int neo1973_gta02_voice_hw_params( if (ret < 0) return ret; - /* configue and enable PLL for 12.288MHz output */ + /* configure and enable PLL for 12.288MHz output */ ret = snd_soc_dai_set_pll(codec_dai, WM8753_PLL2, 0, iis_clkrate / 4, 12288000); if (ret < 0) diff --git a/sound/soc/s3c24xx/neo1973_wm8753.c b/sound/soc/s3c24xx/neo1973_wm8753.c index 0cb4f86f6d1e..4ac620988e7c 100644 --- a/sound/soc/s3c24xx/neo1973_wm8753.c +++ b/sound/soc/s3c24xx/neo1973_wm8753.c @@ -201,7 +201,7 @@ static int neo1973_voice_hw_params(struct snd_pcm_substream *substream, if (ret < 0) return ret; - /* configue and enable PLL for 12.288MHz output */ + /* configure and enable PLL for 12.288MHz output */ ret = snd_soc_dai_set_pll(codec_dai, WM8753_PLL2, 0, iis_clkrate / 4, 12288000); if (ret < 0) -- cgit v1.2.3 From 5591bf07225523600450edd9e6ad258bb877b779 Mon Sep 17 00:00:00 2001 From: Dan Rosenberg Date: Tue, 28 Sep 2010 14:18:20 -0400 Subject: ALSA: prevent heap corruption in snd_ctl_new() The snd_ctl_new() function in sound/core/control.c allocates space for a snd_kcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC* device (on many distros, this is group "audio") via the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls. Signed-off-by: Dan Rosenberg Cc: Signed-off-by: Takashi Iwai --- sound/core/control.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'sound') diff --git a/sound/core/control.c b/sound/core/control.c index 070aab490191..45a818002d99 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -31,6 +31,7 @@ /* max number of user-defined controls */ #define MAX_USER_CONTROLS 32 +#define MAX_CONTROL_COUNT 1028 struct snd_kctl_ioctl { struct list_head list; /* list of all ioctls */ @@ -195,6 +196,10 @@ static struct snd_kcontrol *snd_ctl_new(struct snd_kcontrol *control, if (snd_BUG_ON(!control || !control->count)) return NULL; + + if (control->count > MAX_CONTROL_COUNT) + return NULL; + kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL); if (kctl == NULL) { snd_printk(KERN_ERR "Cannot allocate control instance\n"); -- cgit v1.2.3 From 37979e1546a790c44adbc7f27a85569944480ebc Mon Sep 17 00:00:00 2001 From: Dominik Brodowski Date: Thu, 29 Jul 2010 16:33:23 +0200 Subject: pcmcia: simplify IntType IntType was only set to INT_MEMORY (driver pcmciamtd) or INT_MEMORY_AND_IO (all other drivers). As this flags seems to relate to ioport access, make it conditional to the driver having requested IO port access. There are two drivers which do not request IO ports, but did set INT_MEMORY_AND_IO: ray_cs and b43. For those, we consistently only set INT_MEMORY in future. CC: netdev@vger.kernel.org CC: linux-wireless@vger.kernel.org CC: linux-ide@vger.kernel.org CC: linux-usb@vger.kernel.org CC: laforge@gnumonks.org CC: linux-mtd@lists.infradead.org CC: alsa-devel@alsa-project.org CC: linux-serial@vger.kernel.org CC: Jiri Kosina CC: linux-scsi@vger.kernel.org Acked-by: Gustavo F. Padovan (for drivers/bluetooth) Tested-by: Wolfram Sang Signed-off-by: Dominik Brodowski --- sound/pcmcia/pdaudiocf/pdaudiocf.c | 1 - sound/pcmcia/vx/vxpocket.c | 1 - 2 files changed, 2 deletions(-) (limited to 'sound') diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c index 7ab9174a8a84..2e1282de77d4 100644 --- a/sound/pcmcia/pdaudiocf/pdaudiocf.c +++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c @@ -143,7 +143,6 @@ static int snd_pdacf_probe(struct pcmcia_device *link) link->resource[0]->end = 16; link->conf.Attributes = CONF_ENABLE_IRQ | CONF_ENABLE_PULSE_IRQ; - link->conf.IntType = INT_MEMORY_AND_IO; link->conf.ConfigIndex = 1; link->conf.Present = PRESENT_OPTION; diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c index a6edfc3be29a..a48b3ee71377 100644 --- a/sound/pcmcia/vx/vxpocket.c +++ b/sound/pcmcia/vx/vxpocket.c @@ -163,7 +163,6 @@ static int snd_vxpocket_new(struct snd_card *card, int ibl, link->resource[0]->end = 16; link->conf.Attributes = CONF_ENABLE_IRQ; - link->conf.IntType = INT_MEMORY_AND_IO; link->conf.ConfigIndex = 1; link->conf.Present = PRESENT_OPTION; -- cgit v1.2.3 From 7feabb6412ea23edd298c0fa90e5aa6733eb4a42 Mon Sep 17 00:00:00 2001 From: Dominik Brodowski Date: Thu, 29 Jul 2010 18:35:47 +0200 Subject: pcmcia: move config_{base,index,regs} to struct pcmcia_device Several drivers prefer to explicitly set config_{base,index,regs}, formerly known as ConfigBase, ConfigIndex and Present. Instead of passing these values inside config_req_t, store it in struct pcmcia_device. CC: netdev@vger.kernel.org CC: linux-wireless@vger.kernel.org CC: linux-ide@vger.kernel.org CC: linux-usb@vger.kernel.org CC: laforge@gnumonks.org CC: linux-mtd@lists.infradead.org CC: alsa-devel@alsa-project.org CC: linux-serial@vger.kernel.org CC: Jiri Kosina CC: linux-scsi@vger.kernel.org Acked-by: Gustavo F. Padovan (for drivers/bluetooth) Tested-by: Wolfram Sang Signed-off-by: Dominik Brodowski --- sound/pcmcia/pdaudiocf/pdaudiocf.c | 6 +++--- sound/pcmcia/vx/vxpocket.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) (limited to 'sound') diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c index 2e1282de77d4..4df07fce637f 100644 --- a/sound/pcmcia/pdaudiocf/pdaudiocf.c +++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c @@ -143,8 +143,8 @@ static int snd_pdacf_probe(struct pcmcia_device *link) link->resource[0]->end = 16; link->conf.Attributes = CONF_ENABLE_IRQ | CONF_ENABLE_PULSE_IRQ; - link->conf.ConfigIndex = 1; - link->conf.Present = PRESENT_OPTION; + link->config_index = 1; + link->config_regs = PRESENT_OPTION; return pdacf_config(link); } @@ -216,7 +216,7 @@ static int pdacf_config(struct pcmcia_device *link) int ret; snd_printdd(KERN_DEBUG "pdacf_config called\n"); - link->conf.ConfigIndex = 0x5; + link->config_index = 0x5; ret = pcmcia_request_io(link); if (ret) diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c index a48b3ee71377..16186adc1bdc 100644 --- a/sound/pcmcia/vx/vxpocket.c +++ b/sound/pcmcia/vx/vxpocket.c @@ -163,8 +163,8 @@ static int snd_vxpocket_new(struct snd_card *card, int ibl, link->resource[0]->end = 16; link->conf.Attributes = CONF_ENABLE_IRQ; - link->conf.ConfigIndex = 1; - link->conf.Present = PRESENT_OPTION; + link->config_index = 1; + link->config_regs = PRESENT_OPTION; *chip_ret = vxp; return 0; -- cgit v1.2.3 From 1ac71e5a35eebee60cdcf15b3980bd94498f037b Mon Sep 17 00:00:00 2001 From: Dominik Brodowski Date: Thu, 29 Jul 2010 19:27:09 +0200 Subject: pcmcia: convert pcmcia_request_configuration to pcmcia_enable_device pcmcia_enable_device() now replaces pcmcia_request_configuration(). Instead of config_req_t, all necessary flags are either passed as a parameter to pcmcia_enable_device(), or (in rare circumstances) set in struct pcmcia_device -> flags. With the last remaining user of include/pcmcia/cs.h gone, remove all references. CC: netdev@vger.kernel.org CC: linux-wireless@vger.kernel.org CC: linux-ide@vger.kernel.org CC: linux-usb@vger.kernel.org CC: laforge@gnumonks.org CC: linux-mtd@lists.infradead.org CC: alsa-devel@alsa-project.org CC: linux-serial@vger.kernel.org CC: Jiri Kosina CC: linux-scsi@vger.kernel.org Acked-by: Gustavo F. Padovan (for drivers/bluetooth) Tested-by: Wolfram Sang Signed-off-by: Dominik Brodowski --- sound/pcmcia/pdaudiocf/pdaudiocf.c | 5 +++-- sound/pcmcia/pdaudiocf/pdaudiocf.h | 1 - sound/pcmcia/vx/vxpocket.c | 6 +++--- sound/pcmcia/vx/vxpocket.h | 1 - 4 files changed, 6 insertions(+), 7 deletions(-) (limited to 'sound') diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c index 4df07fce637f..2476d5f0a14f 100644 --- a/sound/pcmcia/pdaudiocf/pdaudiocf.c +++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c @@ -142,7 +142,7 @@ static int snd_pdacf_probe(struct pcmcia_device *link) link->resource[0]->flags |= IO_DATA_PATH_WIDTH_AUTO; link->resource[0]->end = 16; - link->conf.Attributes = CONF_ENABLE_IRQ | CONF_ENABLE_PULSE_IRQ; + link->config_flags = CONF_ENABLE_IRQ | CONF_ENABLE_PULSE_IRQ; link->config_index = 1; link->config_regs = PRESENT_OPTION; @@ -217,6 +217,7 @@ static int pdacf_config(struct pcmcia_device *link) snd_printdd(KERN_DEBUG "pdacf_config called\n"); link->config_index = 0x5; + link->config_flags |= CONF_ENABLE_IRQ | CONF_ENABLE_PULSE_IRQ; ret = pcmcia_request_io(link); if (ret) @@ -226,7 +227,7 @@ static int pdacf_config(struct pcmcia_device *link) if (ret) goto failed; - ret = pcmcia_request_configuration(link, &link->conf); + ret = pcmcia_enable_device(link); if (ret) goto failed; diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.h b/sound/pcmcia/pdaudiocf/pdaudiocf.h index 5cc3e4573074..bd26e092aead 100644 --- a/sound/pcmcia/pdaudiocf/pdaudiocf.h +++ b/sound/pcmcia/pdaudiocf/pdaudiocf.h @@ -24,7 +24,6 @@ #include #include #include -#include #include #include diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c index 16186adc1bdc..017a8d6c510d 100644 --- a/sound/pcmcia/vx/vxpocket.c +++ b/sound/pcmcia/vx/vxpocket.c @@ -2,7 +2,7 @@ * Driver for Digigram VXpocket V2/440 soundcards * * Copyright (c) 2002 by Takashi Iwai - * + * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or @@ -162,7 +162,7 @@ static int snd_vxpocket_new(struct snd_card *card, int ibl, link->resource[0]->flags |= IO_DATA_PATH_WIDTH_AUTO; link->resource[0]->end = 16; - link->conf.Attributes = CONF_ENABLE_IRQ; + link->config_flags |= CONF_ENABLE_IRQ; link->config_index = 1; link->config_regs = PRESENT_OPTION; @@ -233,7 +233,7 @@ static int vxpocket_config(struct pcmcia_device *link) if (ret) goto failed; - ret = pcmcia_request_configuration(link, &link->conf); + ret = pcmcia_enable_device(link); if (ret) goto failed; diff --git a/sound/pcmcia/vx/vxpocket.h b/sound/pcmcia/vx/vxpocket.h index d9110669d042..13d658c1a216 100644 --- a/sound/pcmcia/vx/vxpocket.h +++ b/sound/pcmcia/vx/vxpocket.h @@ -23,7 +23,6 @@ #include -#include #include #include -- cgit v1.2.3 From 2e9b981a7c63ee8278df6823f8389d69dad1a499 Mon Sep 17 00:00:00 2001 From: Dominik Brodowski Date: Sun, 8 Aug 2010 11:36:26 +0200 Subject: pcmcia: move driver name to struct pcmcia_driver Tested-by: Wolfram Sang Signed-off-by: Dominik Brodowski --- sound/pcmcia/pdaudiocf/pdaudiocf.c | 4 +--- sound/pcmcia/vx/vxpocket.c | 4 +--- 2 files changed, 2 insertions(+), 6 deletions(-) (limited to 'sound') diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c index 2476d5f0a14f..8cc4733698a0 100644 --- a/sound/pcmcia/pdaudiocf/pdaudiocf.c +++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c @@ -287,9 +287,7 @@ MODULE_DEVICE_TABLE(pcmcia, snd_pdacf_ids); static struct pcmcia_driver pdacf_cs_driver = { .owner = THIS_MODULE, - .drv = { - .name = "snd-pdaudiocf", - }, + .name = "snd-pdaudiocf", .probe = snd_pdacf_probe, .remove = snd_pdacf_detach, .id_table = snd_pdacf_ids, diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c index 017a8d6c510d..80000d631f88 100644 --- a/sound/pcmcia/vx/vxpocket.c +++ b/sound/pcmcia/vx/vxpocket.c @@ -358,9 +358,7 @@ MODULE_DEVICE_TABLE(pcmcia, vxp_ids); static struct pcmcia_driver vxp_cs_driver = { .owner = THIS_MODULE, - .drv = { - .name = "snd-vxpocket", - }, + .name = "snd-vxpocket", .probe = vxpocket_probe, .remove = vxpocket_detach, .id_table = vxp_ids, -- cgit v1.2.3 From e913b146493993c8ac33561655c590e58b500c6f Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Thu, 30 Sep 2010 22:59:12 +0200 Subject: ALSA: i2c/other/ak4xx-adda: Fix a compile warning with CONFIG_PROCFS=n Signed-off-by: Takashi Iwai --- sound/i2c/other/ak4xxx-adda.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sound') diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c index 1adb8a3c2b62..42d7844ecd0b 100644 --- a/sound/i2c/other/ak4xxx-adda.c +++ b/sound/i2c/other/ak4xxx-adda.c @@ -900,7 +900,7 @@ static int proc_init(struct snd_akm4xxx *ak) return 0; } #else /* !CONFIG_PROC_FS */ -static int proc_init(struct snd_akm4xxx *ak) {} +static int proc_init(struct snd_akm4xxx *ak) { return 0; } #endif int snd_akm4xxx_build_controls(struct snd_akm4xxx *ak) -- cgit v1.2.3 From d4cfa4d12f46e2520f4c1d1a92e891ce068b7464 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Sun, 10 Oct 2010 19:33:52 +0200 Subject: OSS: soundcard: locking bug in sound_ioctl() We shouldn't return directly here because we're still holding the &soundcard_mutex. This bug goes all the way back to the start of git. It's strange that no one has complained about it as a runtime bug. CC: stable@kernel.org Signed-off-by: Dan Carpenter Acked-by: Arnd Bergmann Signed-off-by: Takashi Iwai --- sound/oss/soundcard.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sound') diff --git a/sound/oss/soundcard.c b/sound/oss/soundcard.c index 92aa762ffb7e..07f803e6d203 100644 --- a/sound/oss/soundcard.c +++ b/sound/oss/soundcard.c @@ -391,11 +391,11 @@ static long sound_ioctl(struct file *file, unsigned int cmd, unsigned long arg) case SND_DEV_DSP: case SND_DEV_DSP16: case SND_DEV_AUDIO: - return audio_ioctl(dev, file, cmd, p); + ret = audio_ioctl(dev, file, cmd, p); break; case SND_DEV_MIDIN: - return MIDIbuf_ioctl(dev, file, cmd, p); + ret = MIDIbuf_ioctl(dev, file, cmd, p); break; } -- cgit v1.2.3 From 9b2167d59f38691b86430ce559c7fa9d4f973b1f Mon Sep 17 00:00:00 2001 From: Luke Yelavich Date: Wed, 6 Oct 2010 15:45:46 +1100 Subject: ALSA: hda - Add another HP DV6 quirk BugLink: https://bugs.launchpad.net/bugs/653420 Add another HP DV6 notebook (103c:363e) to use STAC_HP_DV5. Signed-off-by: Luke Yelavich Signed-off-by: Takashi Iwai --- sound/pci/hda/patch_sigmatel.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'sound') diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c index 95148e58026c..c16c5ba0fda0 100644 --- a/sound/pci/hda/patch_sigmatel.c +++ b/sound/pci/hda/patch_sigmatel.c @@ -1747,6 +1747,8 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = { "HP dv6", STAC_HP_DV5), SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3061, "HP dv6", STAC_HP_DV5), /* HP dv6-1110ax */ + SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x363e, + "HP DV6", STAC_HP_DV5), SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x7010, "HP", STAC_HP_DV5), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233, -- cgit v1.2.3 From 6038f373a3dc1f1c26496e60b6c40b164716f07e Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Sun, 15 Aug 2010 18:52:59 +0200 Subject: llseek: automatically add .llseek fop All file_operations should get a .llseek operation so we can make nonseekable_open the default for future file operations without a .llseek pointer. The three cases that we can automatically detect are no_llseek, seq_lseek and default_llseek. For cases where we can we can automatically prove that the file offset is always ignored, we use noop_llseek, which maintains the current behavior of not returning an error from a seek. New drivers should normally not use noop_llseek but instead use no_llseek and call nonseekable_open at open time. Existing drivers can be converted to do the same when the maintainer knows for certain that no user code relies on calling seek on the device file. The generated code is often incorrectly indented and right now contains comments that clarify for each added line why a specific variant was chosen. In the version that gets submitted upstream, the comments will be gone and I will manually fix the indentation, because there does not seem to be a way to do that using coccinelle. Some amount of new code is currently sitting in linux-next that should get the same modifications, which I will do at the end of the merge window. Many thanks to Julia Lawall for helping me learn to write a semantic patch that does all this. ===== begin semantic patch ===== // This adds an llseek= method to all file operations, // as a preparation for making no_llseek the default. // // The rules are // - use no_llseek explicitly if we do nonseekable_open // - use seq_lseek for sequential files // - use default_llseek if we know we access f_pos // - use noop_llseek if we know we don't access f_pos, // but we still want to allow users to call lseek // @ open1 exists @ identifier nested_open; @@ nested_open(...) { <+... nonseekable_open(...) ...+> } @ open exists@ identifier open_f; identifier i, f; identifier open1.nested_open; @@ int open_f(struct inode *i, struct file *f) { <+... ( nonseekable_open(...) | nested_open(...) ) ...+> } @ read disable optional_qualifier exists @ identifier read_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; expression E; identifier func; @@ ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off) { <+... ( *off = E | *off += E | func(..., off, ...) | E = *off ) ...+> } @ read_no_fpos disable optional_qualifier exists @ identifier read_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; @@ ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off) { ... when != off } @ write @ identifier write_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; expression E; identifier func; @@ ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off) { <+... ( *off = E | *off += E | func(..., off, ...) | E = *off ) ...+> } @ write_no_fpos @ identifier write_f; identifier f, p, s, off; type ssize_t, size_t, loff_t; @@ ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off) { ... when != off } @ fops0 @ identifier fops; @@ struct file_operations fops = { ... }; @ has_llseek depends on fops0 @ identifier fops0.fops; identifier llseek_f; @@ struct file_operations fops = { ... .llseek = llseek_f, ... }; @ has_read depends on fops0 @ identifier fops0.fops; identifier read_f; @@ struct file_operations fops = { ... .read = read_f, ... }; @ has_write depends on fops0 @ identifier fops0.fops; identifier write_f; @@ struct file_operations fops = { ... .write = write_f, ... }; @ has_open depends on fops0 @ identifier fops0.fops; identifier open_f; @@ struct file_operations fops = { ... .open = open_f, ... }; // use no_llseek if we call nonseekable_open //////////////////////////////////////////// @ nonseekable1 depends on !has_llseek && has_open @ identifier fops0.fops; identifier nso ~= "nonseekable_open"; @@ struct file_operations fops = { ... .open = nso, ... +.llseek = no_llseek, /* nonseekable */ }; @ nonseekable2 depends on !has_llseek @ identifier fops0.fops; identifier open.open_f; @@ struct file_operations fops = { ... .open = open_f, ... +.llseek = no_llseek, /* open uses nonseekable */ }; // use seq_lseek for sequential files ///////////////////////////////////// @ seq depends on !has_llseek @ identifier fops0.fops; identifier sr ~= "seq_read"; @@ struct file_operations fops = { ... .read = sr, ... +.llseek = seq_lseek, /* we have seq_read */ }; // use default_llseek if there is a readdir /////////////////////////////////////////// @ fops1 depends on !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier readdir_e; @@ // any other fop is used that changes pos struct file_operations fops = { ... .readdir = readdir_e, ... +.llseek = default_llseek, /* readdir is present */ }; // use default_llseek if at least one of read/write touches f_pos ///////////////////////////////////////////////////////////////// @ fops2 depends on !fops1 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier read.read_f; @@ // read fops use offset struct file_operations fops = { ... .read = read_f, ... +.llseek = default_llseek, /* read accesses f_pos */ }; @ fops3 depends on !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier write.write_f; @@ // write fops use offset struct file_operations fops = { ... .write = write_f, ... + .llseek = default_llseek, /* write accesses f_pos */ }; // Use noop_llseek if neither read nor write accesses f_pos /////////////////////////////////////////////////////////// @ fops4 depends on !fops1 && !fops2 && !fops3 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier read_no_fpos.read_f; identifier write_no_fpos.write_f; @@ // write fops use offset struct file_operations fops = { ... .write = write_f, .read = read_f, ... +.llseek = noop_llseek, /* read and write both use no f_pos */ }; @ depends on has_write && !has_read && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier write_no_fpos.write_f; @@ struct file_operations fops = { ... .write = write_f, ... +.llseek = noop_llseek, /* write uses no f_pos */ }; @ depends on has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; identifier read_no_fpos.read_f; @@ struct file_operations fops = { ... .read = read_f, ... +.llseek = noop_llseek, /* read uses no f_pos */ }; @ depends on !has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @ identifier fops0.fops; @@ struct file_operations fops = { ... +.llseek = noop_llseek, /* no read or write fn */ }; ===== End semantic patch ===== Signed-off-by: Arnd Bergmann Cc: Julia Lawall Cc: Christoph Hellwig --- sound/core/seq/oss/seq_oss.c | 1 + sound/core/sound.c | 3 ++- sound/oss/msnd_pinnacle.c | 1 + sound/soc/soc-core.c | 1 + sound/soc/soc-dapm.c | 1 + sound/sound_core.c | 1 + 6 files changed, 7 insertions(+), 1 deletion(-) (limited to 'sound') diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c index f25e3cc7ddfa..a1f1a2f00ccb 100644 --- a/sound/core/seq/oss/seq_oss.c +++ b/sound/core/seq/oss/seq_oss.c @@ -220,6 +220,7 @@ static const struct file_operations seq_oss_f_ops = .poll = odev_poll, .unlocked_ioctl = odev_ioctl, .compat_ioctl = odev_ioctl_compat, + .llseek = noop_llseek, }; static int __init diff --git a/sound/core/sound.c b/sound/core/sound.c index ac42af42b787..62a093efb453 100644 --- a/sound/core/sound.c +++ b/sound/core/sound.c @@ -184,7 +184,8 @@ static int snd_open(struct inode *inode, struct file *file) static const struct file_operations snd_fops = { .owner = THIS_MODULE, - .open = snd_open + .open = snd_open, + .llseek = noop_llseek, }; #ifdef CONFIG_SND_DYNAMIC_MINORS diff --git a/sound/oss/msnd_pinnacle.c b/sound/oss/msnd_pinnacle.c index 2e48b17667d0..ca942f7cd231 100644 --- a/sound/oss/msnd_pinnacle.c +++ b/sound/oss/msnd_pinnacle.c @@ -1117,6 +1117,7 @@ static const struct file_operations dev_fileops = { .unlocked_ioctl = dev_ioctl, .open = dev_open, .release = dev_release, + .llseek = noop_llseek, }; static int reset_dsp(void) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index acc91daa1c55..4057d35343bb 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -223,6 +223,7 @@ static const struct file_operations codec_reg_fops = { .open = codec_reg_open_file, .read = codec_reg_read_file, .write = codec_reg_write_file, + .llseek = default_llseek, }; static void soc_init_codec_debugfs(struct snd_soc_codec *codec) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index 03cb7c05ebec..72a53d0a41e9 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -1089,6 +1089,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file, static const struct file_operations dapm_widget_power_fops = { .open = dapm_widget_power_open_file, .read = dapm_widget_power_read_file, + .llseek = default_llseek, }; void snd_soc_dapm_debugfs_init(struct snd_soc_codec *codec) diff --git a/sound/sound_core.c b/sound/sound_core.c index cb61317df509..c03bbaefdbc3 100644 --- a/sound/sound_core.c +++ b/sound/sound_core.c @@ -165,6 +165,7 @@ static const struct file_operations soundcore_fops = /* We must have an owner or the module locking fails */ .owner = THIS_MODULE, .open = soundcore_open, + .llseek = noop_llseek, }; /* -- cgit v1.2.3 From aa73aec6c385e2c797ac25cc7ccf0318031de7c8 Mon Sep 17 00:00:00 2001 From: Clemens Ladisch Date: Fri, 15 Oct 2010 12:06:18 +0200 Subject: ALSA: rawmidi: fix oops (use after free) when unloading a driver module When a driver module is unloaded and the last still open file is a raw MIDI device, the card and its devices will be actually freed in the snd_card_file_remove() call when that file is closed. Afterwards, rmidi and rmidi->card point into freed memory, so the module pointer is likely to be garbage. (This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.) Signed-off-by: Clemens Ladisch Reported-by: Krzysztof Foltman Cc: 2.6.30-2.6.35 Signed-off-by: Takashi Iwai --- sound/core/rawmidi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'sound') diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index a7868ad4d530..cbbed0db9e56 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct inode *inode, struct file *file) { struct snd_rawmidi_file *rfile; struct snd_rawmidi *rmidi; + struct module *module; rfile = file->private_data; rmidi = rfile->rmidi; rawmidi_release_priv(rfile); kfree(rfile); + module = rmidi->card->module; snd_card_file_remove(rmidi->card, file); - module_put(rmidi->card->module); + module_put(module); return 0; } -- cgit v1.2.3 From 631dd1a885b6d7e9f6f51b4e5b311c2bb04c323c Mon Sep 17 00:00:00 2001 From: "Justin P. Mattock" Date: Mon, 18 Oct 2010 11:03:14 +0200 Subject: Update broken web addresses in the kernel. The patch below updates broken web addresses in the kernel Signed-off-by: Justin P. Mattock Cc: Maciej W. Rozycki Cc: Geert Uytterhoeven Cc: Finn Thain Cc: Randy Dunlap Cc: Matt Turner Cc: Dimitry Torokhov Cc: Mike Frysinger Acked-by: Ben Pfaff Acked-by: Hans J. Koch Reviewed-by: Finn Thain Signed-off-by: Jiri Kosina --- sound/oss/ac97_codec.c | 7 ++----- sound/pci/ens1370.c | 2 +- sound/pci/intel8x0.c | 2 +- 3 files changed, 4 insertions(+), 7 deletions(-) (limited to 'sound') diff --git a/sound/oss/ac97_codec.c b/sound/oss/ac97_codec.c index 456a1b4d7832..854c303264dc 100644 --- a/sound/oss/ac97_codec.c +++ b/sound/oss/ac97_codec.c @@ -21,11 +21,8 @@ * ************************************************************************** * - * The Intel Audio Codec '97 specification is available at the Intel - * audio homepage: http://developer.intel.com/ial/scalableplatforms/audio/ - * - * The specification itself is currently available at: - * ftp://download.intel.com/ial/scalableplatforms/ac97r22.pdf + * The Intel Audio Codec '97 specification is available at: + * http://download.intel.com/support/motherboards/desktop/sb/ac97_r23.pdf * ************************************************************************** * diff --git a/sound/pci/ens1370.c b/sound/pci/ens1370.c index c7fba5379813..537cfba829a5 100644 --- a/sound/pci/ens1370.c +++ b/sound/pci/ens1370.c @@ -22,7 +22,7 @@ /* Power-Management-Code ( CONFIG_PM ) * for ens1371 only ( FIXME ) * derived from cs4281.c, atiixp.c and via82xx.c - * using http://www.alsa-project.org/~iwai/writing-an-alsa-driver/c1540.htm + * using http://www.alsa-project.org/~tiwai/writing-an-alsa-driver/ * by Kurt J. Bosch */ diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c index 6433e65c9507..a2999d678918 100644 --- a/sound/pci/intel8x0.c +++ b/sound/pci/intel8x0.c @@ -716,7 +716,7 @@ static void snd_intel8x0_setup_periods(struct intel8x0 *chip, struct ichdev *ich * Intel 82443MX running a 100MHz processor system bus has a hardware bug, * which aborts PCI busmaster for audio transfer. A workaround is to set * the pages as non-cached. For details, see the errata in - * http://www.intel.com/design/chipsets/specupdt/245051.htm + * http://download.intel.com/design/chipsets/specupdt/24505108.pdf */ static void fill_nocache(void *buf, int size, int nocache) { -- cgit v1.2.3 From 39aba963d937edb20db7d9d93e6dda5d2adfdcdd Mon Sep 17 00:00:00 2001 From: Kay Sievers Date: Sat, 4 Sep 2010 22:33:14 -0700 Subject: driver core: remove CONFIG_SYSFS_DEPRECATED_V2 but keep it for block devices This patch removes the old CONFIG_SYSFS_DEPRECATED_V2 config option, but it keeps the logic around to handle block devices in the old manner as some people like to run new kernel versions on old (pre 2007/2008) distros. Signed-off-by: Kay Sievers Cc: Jens Axboe Cc: Stephen Hemminger Cc: "Eric W. Biederman" Cc: Alan Stern Cc: "James E.J. Bottomley" Cc: Andrew Morton Cc: Alexey Kuznetsov Cc: Randy Dunlap Cc: Tejun Heo Cc: "David S. Miller" Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: Ingo Molnar Cc: Peter Zijlstra Cc: David Howells Signed-off-by: Greg Kroah-Hartman --- sound/core/init.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) (limited to 'sound') diff --git a/sound/core/init.c b/sound/core/init.c index ec4a50ce5656..f7c3df8b521b 100644 --- a/sound/core/init.c +++ b/sound/core/init.c @@ -395,12 +395,10 @@ int snd_card_disconnect(struct snd_card *card) snd_printk(KERN_ERR "not all devices for card %i can be disconnected\n", card->number); snd_info_card_disconnect(card); -#ifndef CONFIG_SYSFS_DEPRECATED if (card->card_dev) { device_unregister(card->card_dev); card->card_dev = NULL; } -#endif #ifdef CONFIG_PM wake_up(&card->power_sleep); #endif @@ -573,7 +571,6 @@ void snd_card_set_id(struct snd_card *card, const char *nid) } EXPORT_SYMBOL(snd_card_set_id); -#ifndef CONFIG_SYSFS_DEPRECATED static ssize_t card_id_show_attr(struct device *dev, struct device_attribute *attr, char *buf) @@ -630,7 +627,6 @@ card_number_show_attr(struct device *dev, static struct device_attribute card_number_attrs = __ATTR(number, S_IRUGO, card_number_show_attr, NULL); -#endif /* CONFIG_SYSFS_DEPRECATED */ /** * snd_card_register - register the soundcard @@ -649,7 +645,7 @@ int snd_card_register(struct snd_card *card) if (snd_BUG_ON(!card)) return -EINVAL; -#ifndef CONFIG_SYSFS_DEPRECATED + if (!card->card_dev) { card->card_dev = device_create(sound_class, card->dev, MKDEV(0, 0), card, @@ -657,7 +653,7 @@ int snd_card_register(struct snd_card *card) if (IS_ERR(card->card_dev)) card->card_dev = NULL; } -#endif + if ((err = snd_device_register_all(card)) < 0) return err; mutex_lock(&snd_card_mutex); @@ -674,7 +670,6 @@ int snd_card_register(struct snd_card *card) if (snd_mixer_oss_notify_callback) snd_mixer_oss_notify_callback(card, SND_MIXER_OSS_NOTIFY_REGISTER); #endif -#ifndef CONFIG_SYSFS_DEPRECATED if (card->card_dev) { err = device_create_file(card->card_dev, &card_id_attrs); if (err < 0) @@ -683,7 +678,7 @@ int snd_card_register(struct snd_card *card) if (err < 0) return err; } -#endif + return 0; } -- cgit v1.2.3