Our code analyzer reported a uaf.
In snd_emu8000_create_mixer, the callee snd_ctl_add(..,emu->controls[i])
calls snd_ctl_add_replace(.., kcontrol,..). Inside snd_ctl_add_replace(),
if error happens, kcontrol will be freed by snd_ctl_free_one(kcontrol).
Then emu->controls[i] points to a freed memory, and the execution comes
to __error branch of snd_emu8000_create_mixer. The freed emu->controls[i]
is used in snd_ctl_remove(card, emu->controls[i]).
My patch set emu->controls[i] to NULL if snd_ctl_add() failed to avoid
the uaf.
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210426131129.4796-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Apply const prefix to each possible place: the static tables for the
resources, controls, registers, values and parameters.
Just for minor optimization and no functional changes.
Link: https://lore.kernel.org/r/20200105144823.29547-46-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Most of snd_kcontrol_new definitions are read-only and passed as-is.
Let's declare them as const for further optimization.
There should be no functional changes by this patch.
Link: https://lore.kernel.org/r/20200103081714.9560-36-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Now we may declare const for snd_device_ops definitions, so let's do
it for optimization.
There should be no functional changes by this patch.
Link: https://lore.kernel.org/r/20200103081714.9560-8-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Based on 1 normalized pattern(s):
this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version this program is distributed in the
hope that it will be useful but without any warranty without even
the implied warranty of merchantability or fitness for a particular
purpose see the gnu general public license for more details you
should have received a copy of the gnu general public license along
with this program if not write to the free software foundation inc
59 temple place suite 330 boston ma 02111 1307 usa
extracted by the scancode license scanner the SPDX license identifier
GPL-2.0-or-later
has been chosen to replace the boilerplate/reference in 1334 file(s).
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Reviewed-by: Richard Fontana <rfontana@redhat.com>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Many drivers bind the sequencer stuff in off-load by another driver
module, so that it's loaded only on demand. In the current code, this
mechanism doesn't work when the driver is built-in while the sequencer
is module. We check with IS_REACHABLE() and enable only when the
sequencer is in the same level of build.
However, this is basically a overshoot. The binder code
(snd-seq-device) is an individual module from the sequencer core
(snd-seq), and we just have to make the former a built-in while
keeping the latter a module for allowing the scenario like the above.
This patch achieves that by rewriting Kconfig slightly. Now, a driver
that provides the manual sequencer device binding should select
CONFIG_SND_SEQ_DEVICE in a way as
select SND_SEQ_DEVICE if SND_SEQUENCER != n
Note that the "!=n" is needed here to avoid the influence of the
sequencer core is module while the driver is built-in.
Also, since rawmidi.o may be linked with snd_seq_device.o when
built-in, we have to shuffle the code to make the linker happy.
(the kernel linker isn't smart enough yet to handle such a case.)
That is, snd_seq_device.c is moved to sound/core from sound/core/seq,
as well as Makefile.
Last but not least, the patch replaces the code using IS_REACHABLE()
with IS_ENABLED(), since now the condition meets always when enabled.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Fix up affected files that include this signal functionality via sched.h.
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Detected sound font memory goes unreported unless the kernel was built with
ALSA debugging enabled. Elevate that to a pr_info.
Signed-off-by: David Flater <dave@flaterco.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Applicable to any kernel since 2013:
The special case added in commit 1338fc97d0 did not handle the possibility
that the address space on an AWE64 Value would wrap around at 512 KiB. That
is what it does, so the memory is still not detected on those cards.
Fix that with a logic clean-up that eliminates the need for a special case.
Signed-off-by: David Flater <dave@flaterco.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Remove the leftover __devinit* in comments.
They have been commented out because they couldn't fit with __dev*
although they should have matched.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
CONFIG_HOTPLUG is going away as an option. As result the __dev*
markings will be going away.
Remove use of __devinit, __devexit_p, __devinitdata, __devinitconst,
and __devexit.
Signed-off-by: Bill Pemberton <wfp5p@virginia.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
v2: Fixed result still wrong in the case of 512 KiB DRAM. Oops.
Applicable to 3.5.3 mainline.
In emu8000.c, size_dram determines the amount of memory on the sound card by
doing write/readback tests starting at 512 KiB and incrementing by 512 KiB.
On success, detected_size is updated to the successful address and testing
continues. On failure, the loop is immediately exited. The resulting
detected_size is 512 KiB too small except in two special cases:
1. If there is no memory, the initial 0 value of detected_size is used, which
is correct.
2. If the address space wraps around, detected_size is updated before the
bailout, so the result is correct.
The patch corrects all cases and was tested with an AWE64 Gold. Before:
EMU8000 [0x620]: 3584 Kb on-board memory detected
asfxload 4GMGSMT.SF2 (4174814 B) fails.
After:
EMU8000 [0x620]: 4096 Kb on-board memory detected
asfxload 4GMGSMT.SF2 succeeds.
I do not have a card with 512 KiB to test with, but by forcibly enabling the
added conditional I verified on the AWE64 Gold that it detects 512 KiB
(successfully reading from the first memory location) and does not hang the
card.
C.f. Bug 46451 https://bugzilla.kernel.org/show_bug.cgi?id=46451
Signed-off-by: David Flater <dave@flaterco.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
These aren't modules, but they do make use of these macros, so
they will need export.h to get that definition. Previously,
they got it via the implicit module.h inclusion.
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
The patch "sbawe: fix memory detection" fixed detection
for memoryless SB32 cards but broke detection of memory
above 512KB. This patch fixes the regression.
The patch has been tested on the SB32 card (CT3670) with
0MB, 2MB and 8MB memory installed.
Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Memory amount is increased before a successful write-read
sequence is done. Thus, 512 kB of onboard memory is detected
on memoryless cards like SB32.
Move the increasing of memory counter after successful read
is done.
Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Kill snd_assert() in sound/isa/*, either removed or replaced with
if () with snd_BUG_ON().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
This header file exists only for some hacks to adapt alsa-driver
tree. It's useless for building in the kernel. Let's move a few
lines in it to sound/core.h and remove it.
With this patch, sound/driver.h isn't removed but has just a single
compile warning to include it. This should be really killed in
future.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Use schedule_timeout_{,un}interruptible() instead of
set_current_state()/schedule_timeout() to reduce kernel size. Also use
human-time conversion functions instead of hard-coded division to avoid
rounding issues.
Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
- Remove vmalloc wrapper
- Add release_and_free_resource() to remove kfree_nocheck() from each driver
and simplify the code
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.
Let it rip!
