1. 08 Jul, 2015 1 commit
  2. 22 Jun, 2015 3 commits
  3. 06 Jun, 2015 5 commits
  4. 17 May, 2015 1 commit
    • Alexey Khoroshilov's avatar
      sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND) · cccea7f5
      Alexey Khoroshilov authored
      commit bc26d4d06e337ade069f33d3f4377593b24e6e36 upstream.
      
      A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND)
      on /dev/sequencer with TMR_ECHO midi event.
      
      In this case the control flow is:
      sound_ioctl()
      -> case SND_DEV_SEQ:
         case SND_DEV_SEQ2:
           sequencer_ioctl()
           -> case SNDCTL_SEQ_OUTOFBAND:
                spin_lock_irqsave(&lock,flags);
                play_event();
                -> case EV_TIMING:
                     seq_timing_event()
                     -> case TMR_ECHO:
                          seq_copy_to_input()
                          -> spin_lock_irqsave(&lock,flags);
      
      It seems that spin_lock_irqsave() around play_event() is not necessary,
      because the only other call location in seq_startplay() makes the call
      without acquiring spinlock.
      
      So, the patch just removes spinlocks around play_event().
      By the way, it removes unreachable code in seq_timing_event(),
      since (seq_mode == SEQ_2) case is handled in the beginning.
      
      Compile tested only.
      
      Found by Linux Driver Verification project (linuxtesting.org).
      Signed-off-by: 's avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
      Signed-off-by: 's avatarTakashi Iwai <tiwai@suse.de>
      Cc: Willy Tarreau <w@1wt.eu>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cccea7f5
  5. 13 May, 2015 5 commits
    • Takashi Iwai's avatar
      ALSA: hda - Fix mute-LED fixed mode · 4453c82b
      Takashi Iwai authored
      commit ee52e56e7b12834476cd0031c5986254ba1b6317 upstream.
      
      The mute-LED mode control has the fixed on/off states that are
      supposed to remain on/off regardless of the master switch.  However,
      this doesn't work actually because the vmaster hook is called in the
      vmaster code itself.
      
      This patch fixes it by calling the hook indirectly after checking the
      mute LED mode.
      Reported-and-tested-by: 's avatarPali Rohár <pali.rohar@gmail.com>
      Signed-off-by: 's avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4453c82b
    • Peter Zubaj's avatar
      ALSA: emu10k1: Emu10k2 32 bit DMA mode · b68ed131
      Peter Zubaj authored
      commit 7241ea558c6715501e777396b5fc312c372e11d9 upstream.
      
      Looks like audigy emu10k2 (probably emu10k1 - sb live too) support two
      modes for DMA. Second mode is useful for 64 bit os with more then 2 GB
      of ram (fixes problems with big soundfont loading)
      
      1) 32MB from 2 GB address space using 8192 pages (used now as default)
      2) 16MB from 4 GB address space using 4096 pages
      
      Mode is set using HCFG_EXPANDED_MEM flag in HCFG register.
      Also format of emu10k2 page table is then different.
      Signed-off-by: 's avatarPeter Zubaj <pzubaj@marticonet.sk>
      Tested-by: 's avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: 's avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b68ed131
    • Takashi Iwai's avatar
      ALSA: emu10k1: Fix card shortname string buffer overflow · 0da12e28
      Takashi Iwai authored
      commit d02260824e2cad626fb2a9d62e27006d34b6dedc upstream.
      
      Some models provide too long string for the shortname that has 32bytes
      including the terminator, and it results in a non-terminated string
      exposed to the user-space.  This isn't too critical, though, as the
      string is stopped at the succeeding longname string.
      
      This patch fixes such entries by dropping "SB" prefix (it's enough to
      fit within 32 bytes, so far).  Meanwhile, it also changes strcpy()
      with strlcpy() to make sure that this kind of problem won't happen in
      future, too.
      Signed-off-by: 's avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      0da12e28
    • Takashi Iwai's avatar
      ALSA: emux: Fix mutex deadlock in OSS emulation · c542e915
      Takashi Iwai authored
      commit 1c94e65c668f44d2c69ae7e7fc268ab3268fba3e upstream.
      
      The OSS emulation in synth-emux helper has a potential AB/BA deadlock
      at the simultaneous closing and opening:
      
        close ->
          snd_seq_release() ->
            sne_seq_free_client() ->
              snd_seq_delete_all_ports(): takes client->ports_mutex ->
      	  port_delete() ->
      	    snd_emux_unuse(): takes emux->register_mutex
      
        open ->
          snd_seq_oss_open() ->
            snd_emux_open_seq_oss(): takes emux->register_mutex ->
              snd_seq_event_port_attach() ->
      	  snd_seq_create_port(): takes client->ports_mutex
      
      This patch addresses the deadlock by reducing the rance taking
      emux->register_mutex in snd_emux_open_seq_oss().  The lock is needed
      for the refcount handling, so move it locally.  The calls in
      emux_seq.c are already with the mutex, thus they are replaced with the
      version without mutex lock/unlock.
      Signed-off-by: 's avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c542e915
    • Takashi Iwai's avatar
      ALSA: emux: Fix mutex deadlock at unloading · c19e7790
      Takashi Iwai authored
      commit 07b0e5d49d227e3950cb13a3e8caf248ef2a310e upstream.
      
      The emux-synth driver has a possible AB/BA mutex deadlock at unloading
      the emu10k1 driver:
      
        snd_emux_free() ->
          snd_emux_detach_seq(): mutex_lock(&emu->register_mutex) ->
            snd_seq_delete_kernel_client() ->
              snd_seq_free_client(): mutex_lock(&register_mutex)
      
        snd_seq_release() ->
          snd_seq_free_client(): mutex_lock(&register_mutex) ->
            snd_seq_delete_all_ports() ->
              snd_emux_unuse(): mutex_lock(&emu->register_mutex)
      
      Basically snd_emux_detach_seq() doesn't need a protection of
      emu->register_mutex as it's already being unregistered.  So, we can
      get rid of this for avoiding the deadlock.
      Signed-off-by: 's avatarTakashi Iwai <tiwai@suse.de>
      Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c19e7790
  6. 08 May, 2015 1 commit
  7. 07 May, 2015 1 commit
  8. 06 May, 2015 1 commit
  9. 19 Apr, 2015 3 commits
  10. 13 Apr, 2015 11 commits
  11. 26 Mar, 2015 6 commits
  12. 18 Mar, 2015 2 commits