March 2011 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH 4/6] ALSA: VIA HDA: Update VT1718S initial verbs
by Lydia Wang 24 Mar '11

24 Mar '11

From: Lydia Wang <lydiawang(a)viatech.com.cn> Subject: ALSA: VIA HDA: Update VT1718S initial verbs. Add a verb to enable control amplifier of stereo mixer in VT1718S initial verbs. Set stereo mixer default amplifier value as un-mute. Signed-off-by: Lydia Wang <lydiawang(a)viatech.com.cn> --- sound/pci/hda/patch_via.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/sound/pci/hda/patch_via.c +++ b/sound/pci/hda/patch_via.c @@ -4255,7 +4255,8 @@ {0x10, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)}, {0x11, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)}, - + /* Enable MW0 adjust Gain 5 */ + {0x1, 0xfb2, 0x10}, /* Mute input amps (CD, Line In, Mic 1 & Mic 2) of the analog-loopback * mixer widget */ @@ -4264,7 +4265,7 @@ {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)}, {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(2)}, {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(3)}, - {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(5)}, + {0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(5)}, /* Setup default input of Front HP to MW9 */ {0x28, AC_VERB_SET_CONNECT_SEL, 0x1},

1 0

[alsa-devel] [PATCH 3/6] ALSA: VIA HDA: Update VT1708 initial verbs
by Lydia Wang 24 Mar '11

24 Mar '11

From: Lydia Wang <lydiawang(a)viatech.com.cn> Subject: ALSA: VIA HDA: Update VT1708 initial verbs. Add a verb of power down jack detect in VT1708 initial verbs. This verb is used to avoid noise caused by hardware issue. Signed-off-by: Lydia Wang <lydiawang(a)viatech.com.cn> --- sound/pci/hda/patch_via.c | 2 ++ 1 file changed, 2 insertions(+) --- a/sound/pci/hda/patch_via.c +++ b/sound/pci/hda/patch_via.c @@ -1200,6 +1200,8 @@ {0x20, AC_VERB_SET_CONNECT_SEL, 0}, /* PW9 Output enable */ {0x25, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x40}, + /* power down jack detect function */ + {0x1, 0xf81, 0x1}, { } };

1 0

[alsa-devel] [PATCH 2/6] ALSA: VIA HDA: Add VT1802 check in via_speaker_automute function
by Lydia Wang 24 Mar '11

24 Mar '11

From: Lydia Wang <lydiawang(a)viatech.com.cn> Subject: ALSA: VIA HDA: Add VT1802 check in via_speaker_automute function. Add VT1802 check in via_speaker_automute() function. Signed-off-by: Lydia Wang <lydiawang(a)viatech.com.cn> sound/pci/hda/patch_via.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/pci/hda/patch_via.c +++ b/sound/pci/hda/patch_via.c @@ -1685,7 +1685,7 @@ unsigned int hp_present; struct via_spec *spec = codec->spec; - if (spec->codec_type != VT2002P && spec->codec_type != VT1812) + if (!VT2002P_COMPATIBLE(spec)) return; hp_present = snd_hda_jack_detect(codec, spec->autocfg.hp_pins[0]);

1 0

[alsa-devel] [PATCH 1/6] ALSA: VIA HDA: Fix side channel mute invalid issue
by Lydia Wang 24 Mar '11

24 Mar '11

From: Lydia Wang <lydiawang(a)viatech.com.cn> Subject: ALSA: VIA HDA: Fix side channel mute invalid issue. Modify side_mute_channel() and update_side_mute_status() functions to fix invalid side channel mute issue of VT2002P, VT1812 and VT1802 codecs. Signed-off-by: Lydia Wang <lydiawang(a)viatech.com.cn> --- sound/pci/hda/patch_via.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) --- a/sound/pci/hda/patch_via.c +++ b/sound/pci/hda/patch_via.c @@ -708,6 +708,9 @@ case VT1709_10CH: return 0x29; case VT1708B_8CH: /* fall thru */ case VT1708S: return 0x27; + case VT2002P: return 0x19; + case VT1802: return 0x15; + case VT1812: return 0x15; default: return 0; } } @@ -716,13 +719,22 @@ { /* mute side channel */ struct via_spec *spec = codec->spec; - unsigned int parm = spec->hp_independent_mode - ? AMP_OUT_MUTE : AMP_OUT_UNMUTE; + unsigned int parm; hda_nid_t sw3 = side_mute_channel(spec); - if (sw3) - snd_hda_codec_write(codec, sw3, 0, AC_VERB_SET_AMP_GAIN_MUTE, - parm); + if (sw3) { + if (VT2002P_COMPATIBLE(spec)) + parm = spec->hp_independent_mode ? + AMP_IN_MUTE(1) : AMP_IN_UNMUTE(1); + else + parm = spec->hp_independent_mode ? + AMP_OUT_MUTE : AMP_OUT_UNMUTE; + snd_hda_codec_write(codec, sw3, 0, + AC_VERB_SET_AMP_GAIN_MUTE, parm); + if (spec->codec_type == VT1812) + snd_hda_codec_write(codec, 0x1d, 0, + AC_VERB_SET_AMP_GAIN_MUTE, parm); + } return 0; }

1 0

[alsa-devel] [PATCH] ASoC: Explicitly say registerless widgets have no register
by Mark Brown 23 Mar '11

23 Mar '11

This stops code that handles widgets generically from attempting to access registers for these widgets. Signed-off-by: Mark Brown <broonie(a)opensource.wolfsonmicro.com> --- include/sound/soc-dapm.h | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h index 979ed84..ddc2b3d 100644 --- a/include/sound/soc-dapm.h +++ b/include/sound/soc-dapm.h @@ -45,25 +45,25 @@ /* platform domain */ #define SND_SOC_DAPM_INPUT(wname) \ { .id = snd_soc_dapm_input, .name = wname, .kcontrols = NULL, \ - .num_kcontrols = 0} + .num_kcontrols = 0, .reg = SND_SOC_NOPM } #define SND_SOC_DAPM_OUTPUT(wname) \ { .id = snd_soc_dapm_output, .name = wname, .kcontrols = NULL, \ - .num_kcontrols = 0} + .num_kcontrols = 0, .reg = SND_SOC_NOPM } #define SND_SOC_DAPM_MIC(wname, wevent) \ { .id = snd_soc_dapm_mic, .name = wname, .kcontrols = NULL, \ - .num_kcontrols = 0, .event = wevent, \ + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \ .event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD} #define SND_SOC_DAPM_HP(wname, wevent) \ { .id = snd_soc_dapm_hp, .name = wname, .kcontrols = NULL, \ - .num_kcontrols = 0, .event = wevent, \ + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \ .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD} #define SND_SOC_DAPM_SPK(wname, wevent) \ { .id = snd_soc_dapm_spk, .name = wname, .kcontrols = NULL, \ - .num_kcontrols = 0, .event = wevent, \ + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \ .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD} #define SND_SOC_DAPM_LINE(wname, wevent) \ { .id = snd_soc_dapm_line, .name = wname, .kcontrols = NULL, \ - .num_kcontrols = 0, .event = wevent, \ + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \ .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD} /* path domain */ @@ -189,11 +189,11 @@ /* events that are pre and post DAPM */ #define SND_SOC_DAPM_PRE(wname, wevent) \ { .id = snd_soc_dapm_pre, .name = wname, .kcontrols = NULL, \ - .num_kcontrols = 0, .event = wevent, \ + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \ .event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD} #define SND_SOC_DAPM_POST(wname, wevent) \ { .id = snd_soc_dapm_post, .name = wname, .kcontrols = NULL, \ - .num_kcontrols = 0, .event = wevent, \ + .num_kcontrols = 0, .reg = SND_SOC_NOPM, .event = wevent, \ .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD} /* stream domain */ -- 1.7.4.1

2 1

[alsa-devel] [PATCH 1/1] Support for Boss JS-8 Jam Station
by Keith A. Milner 23 Mar '11

23 Mar '11

From: Keith A. Milner <maillist(a)superlative.org> Signed-off-by: Keith A. Milner <maillist(a)superlative.org> diff --git a/usb/quirks-table.h b/usb/quirks-table.h index 196c753..1cefb4a 100644 --- a/usb/quirks-table.h +++ b/usb/quirks-table.h @@ -1581,6 +1581,33 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { + /* Boss JS-8 Jam Station */ + USB_DEVICE(0x0582, 0x0109), + .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + /* .vendor_name = "BOSS", */ + /* .product_name = "JS-8", */ + .ifnum = QUIRK_ANY_INTERFACE, + .type = QUIRK_COMPOSITE, + .data = (const struct snd_usb_audio_quirk[]) { + { + .ifnum = 0, + .type = QUIRK_AUDIO_STANDARD_INTERFACE + }, + { + .ifnum = 1, + .type = QUIRK_AUDIO_STANDARD_INTERFACE + }, + { + .ifnum = 2, + .type = QUIRK_MIDI_STANDARD_INTERFACE + }, + { + .ifnum = -1 + } + } + } +}, +{ /* has ID 0x0110 when not in Advanced Driver mode */ USB_DEVICE_VENDOR_SPEC(0x0582, 0x010f), .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { -- 1.7.1

2 1

[alsa-devel] [PATCH] sound/oss/opl3: validate voice and channel indexes
by Dan Rosenberg 23 Mar '11

23 Mar '11

User-controllable indexes for voice and channel values may cause reading and writing beyond the bounds of their respective arrays, leading to potentially exploitable memory corruption. Validate these indexes. Signed-off-by: Dan Rosenberg <drosenberg(a)vsecurity.com> Cc: stable(a)kernel.org --- sound/oss/opl3.c | 15 +++++++++++++-- 1 files changed, 13 insertions(+), 2 deletions(-) diff --git a/sound/oss/opl3.c b/sound/oss/opl3.c index 938c48c..e9d443e 100644 --- a/sound/oss/opl3.c +++ b/sound/oss/opl3.c @@ -849,6 +849,10 @@ static int opl3_load_patch(int dev, int format, const char __user *addr, static void opl3_panning(int dev, int voice, int value) { + + if (voice < 0 || voice >= devc->nr_voice) + return; + devc->voc[voice].panning = value; } @@ -1066,8 +1070,15 @@ static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info static void opl3_setup_voice(int dev, int voice, int chn) { - struct channel_info *info = - &synth_devs[dev]->chn_info[chn]; + struct channel_info *info; + + if (voice < 0 || voice >= devc->nr_voice) + return; + + if (chn < 0 || chn > 15) + return; + + info = &synth_devs[dev]->chn_info[chn]; opl3_set_instr(dev, voice, info->pgm_num);

2 1

[alsa-devel] [PATCH v3] sound/oss: remove offset from load_patch callbacks
by Dan Rosenberg 23 Mar '11

23 Mar '11

Was: [PATCH] sound/oss/midi_synth: prevent underflow, use of uninitialized value, and signedness issue The offset passed to midi_synth_load_patch() can be essentially arbitrary. If it's greater than the header length, this will result in a copy_from_user(dst, src, negative_val). While this will just return -EFAULT on x86, on other architectures this may cause memory corruption. Additionally, the length field of the sysex_info structure may not be initialized prior to its use. Finally, a signed comparison may result in an unintentionally large loop. On suggestion by Takashi Iwai, version two removes the offset argument from the load_patch callbacks entirely, which also resolves similar issues in opl3. Compile tested only. v3 adjusts comments and hopefully gets copy offsets right. Signed-off-by: Dan Rosenberg <drosenberg(a)vsecurity.com> --- sound/oss/dev_table.h | 2 +- sound/oss/midi_synth.c | 30 +++++++++++++----------------- sound/oss/midi_synth.h | 2 +- sound/oss/opl3.c | 8 ++------ sound/oss/sequencer.c | 2 +- 5 files changed, 18 insertions(+), 26 deletions(-) diff --git a/sound/oss/dev_table.h b/sound/oss/dev_table.h index b7617be..0199a31 100644 --- a/sound/oss/dev_table.h +++ b/sound/oss/dev_table.h @@ -271,7 +271,7 @@ struct synth_operations void (*reset) (int dev); void (*hw_control) (int dev, unsigned char *event); int (*load_patch) (int dev, int format, const char __user *addr, - int offs, int count, int pmgr_flag); + int count, int pmgr_flag); void (*aftertouch) (int dev, int voice, int pressure); void (*controller) (int dev, int voice, int ctrl_num, int value); void (*panning) (int dev, int voice, int value); diff --git a/sound/oss/midi_synth.c b/sound/oss/midi_synth.c index 3c09374..2292c23 100644 --- a/sound/oss/midi_synth.c +++ b/sound/oss/midi_synth.c @@ -476,7 +476,7 @@ EXPORT_SYMBOL(midi_synth_hw_control); int midi_synth_load_patch(int dev, int format, const char __user *addr, - int offs, int count, int pmgr_flag) + int count, int pmgr_flag) { int orig_dev = synth_devs[dev]->midi_dev; @@ -491,33 +491,29 @@ midi_synth_load_patch(int dev, int format, const char __user *addr, if (!prefix_cmd(orig_dev, 0xf0)) return 0; + /* Invalid patch format */ if (format != SYSEX_PATCH) - { -/* printk("MIDI Error: Invalid patch format (key) 0x%x\n", format);*/ return -EINVAL; - } + + /* Patch header too short */ if (count < hdr_size) - { -/* printk("MIDI Error: Patch header too short\n");*/ return -EINVAL; - } + count -= hdr_size; /* - * Copy the header from user space but ignore the first bytes which have - * been transferred already. + * Copy the header from user space */ - if(copy_from_user(&((char *) &sysex)[offs], &(addr)[offs], hdr_size - offs)) + if (copy_from_user(&sysex, addr, hdr_size)) return -EFAULT; - - if (count < sysex.len) - { -/* printk(KERN_WARNING "MIDI Warning: Sysex record too short (%d<%d)\n", count, (int) sysex.len);*/ + + /* Sysex record too short */ + if ((unsigned)count < (unsigned)sysex.len) sysex.len = count; - } - left = sysex.len; - src_offs = 0; + + left = sysex.len; + src_offs = 0; for (i = 0; i < left && !signal_pending(current); i++) { diff --git a/sound/oss/midi_synth.h b/sound/oss/midi_synth.h index 6bc9d00..b64ddd6 100644 --- a/sound/oss/midi_synth.h +++ b/sound/oss/midi_synth.h @@ -8,7 +8,7 @@ int midi_synth_open (int dev, int mode); void midi_synth_close (int dev); void midi_synth_hw_control (int dev, unsigned char *event); int midi_synth_load_patch (int dev, int format, const char __user * addr, - int offs, int count, int pmgr_flag); + int count, int pmgr_flag); void midi_synth_panning (int dev, int channel, int pressure); void midi_synth_aftertouch (int dev, int channel, int pressure); void midi_synth_controller (int dev, int channel, int ctrl_num, int value); diff --git a/sound/oss/opl3.c b/sound/oss/opl3.c index 938c48c..cbf9574 100644 --- a/sound/oss/opl3.c +++ b/sound/oss/opl3.c @@ -820,7 +820,7 @@ static void opl3_hw_control(int dev, unsigned char *event) } static int opl3_load_patch(int dev, int format, const char __user *addr, - int offs, int count, int pmgr_flag) + int count, int pmgr_flag) { struct sbi_instrument ins; @@ -830,11 +830,7 @@ static int opl3_load_patch(int dev, int format, const char __user *addr, return -EINVAL; } - /* - * What the fuck is going on here? We leave junk in the beginning - * of ins and then check the field pretty close to that beginning? - */ - if(copy_from_user(&((char *) &ins)[offs], addr + offs, sizeof(ins) - offs)) + if (copy_from_user(&ins, addr, sizeof(ins))) return -EFAULT; if (ins.channel < 0 || ins.channel >= SBFM_MAXINSTR) diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c index 5ea1098..30bcfe4 100644 --- a/sound/oss/sequencer.c +++ b/sound/oss/sequencer.c @@ -241,7 +241,7 @@ int sequencer_write(int dev, struct file *file, const char __user *buf, int coun return -ENXIO; fmt = (*(short *) &event_rec[0]) & 0xffff; - err = synth_devs[dev]->load_patch(dev, fmt, buf, p + 4, c, 0); + err = synth_devs[dev]->load_patch(dev, fmt, buf + p, c, 0); if (err < 0) return err;

2 1

[alsa-devel] Problem and dirty Fix for hda-intel on ALC892
by Jan Losinski 23 Mar '11

23 Mar '11

Hello, Since last week I compiled 2.6.38 on my Desktop. After booting I noticed a regression at the sound stuff. The surround speaker where no longer controlled by the master volume control. I can control it separately, but not with the master control that controls the front, center and LFE volume. After some debugging I found some differencies at module-loading output in the kernel log and in the output from alsactl store command. The dmesg and the diff of the alsactl output can be found at the end of this message. After that I tried to understand the hda-codec code and debugged there with a lot of printks and reboots. It takes another couple of hours to find out that the index of the surround volume and switch was 0 at pre 2.6.38 and is now 1. So I wrote a dirty hack to fix this (please ignore the debugging printks): diff --git a/pci/hda/hda_codec.c b/pci/hda/hda_codec.c index ae5c5d5..d3fd6d2 100644 --- a/pci/hda/hda_codec.c +++ b/pci/hda/hda_codec.c @@ -3819,7 +3819,16 @@ int snd_hda_add_new_ctls(struct hda_codec *codec, struct snd_kcontrol_new *knew) kctl->id.device = addr; if (idx > 0) kctl->id.index = idx; + + snd_printk(KERN_INFO "PRE snd_hda_ctl_add - addr = %d, idx = %d, kctl->id.name = %s, kctl->id.index = %d, kctl->id.device = %d, kctl->count = %d", + addr, idx, kctl->id.name, kctl->id.index, kctl->id.device, kctl->count); err = snd_hda_ctl_add(codec, 0, kctl); + snd_printk(KERN_INFO "PASSED snd_hda_ctl_add - err = %d, addr = %d, idx = %d, kctl->id.name = %s, kctl->id.index = %d, kctl->id.device = %d, kctl->count = %d", + err, addr, idx, kctl->id.name, kctl->id.index, kctl->id.device, kctl->count); + if (strncmp("Surround Playback Switch", kctl->id.name, strlen("Surround Playback Switch"))) + kctl->id.index = 0; + if (strncmp("Surround Playback Volume", kctl->id.name, strlen("Surround Playback Volume"))) + kctl->id.index = 0; if (!err) break; /* try first with another device index corresponding to At all I dont understand what I've exactly done. I also know that this is not a real solution, because it will break the code for many other plattforms. So I hope someone can convert this to a real fix cor can guide me to make such one. The platform is a ASUS M4A89GTD-PRO/USB3 Board. If any further information needed, please tell me. Thanks, Jan Losinski dmesg of 2.6.37 HDA Intel 0000:00:14.2: PCI INT A -> GSI 16 (level, low) -> IRQ 16 hda_intel: position_fix set to 1 for device 1043:8410 ALSA sound/pci/hda/hda_intel.c:2532: chipset global capabilities = 0x4401 ALSA sound/pci/hda/hda_intel.c:913: codec_mask = 0x1 ALSA sound/pci/hda/hda_intel.c:1351: codec #0 probed OK ALSA sound/pci/hda/patch_realtek.c:1524: SKU: Nid=0x1d sku_cfg=0x4005e601 ALSA sound/pci/hda/patch_realtek.c:1526: SKU: port_connectivity=0x1 ALSA sound/pci/hda/patch_realtek.c:1527: SKU: enable_pcbeep=0x0 ALSA sound/pci/hda/patch_realtek.c:1528: SKU: check_sum=0x00000005 ALSA sound/pci/hda/patch_realtek.c:1529: SKU: customization=0x000000e6 ALSA sound/pci/hda/patch_realtek.c:1530: SKU: external_amp=0x0 ALSA sound/pci/hda/patch_realtek.c:1531: SKU: platform_type=0x0 ALSA sound/pci/hda/patch_realtek.c:1532: SKU: swap=0x0 ALSA sound/pci/hda/patch_realtek.c:1533: SKU: override=0x1 hda_codec: ALC892: BIOS auto-probing. ALSA sound/pci/hda/hda_codec.c:4633: autoconfig: line_outs=4 (0x14/0x15/0x16/0x17/0x0) ALSA sound/pci/hda/hda_codec.c:4637: speaker_outs=0 (0x0/0x0/0x0/0x0/0x0) ALSA sound/pci/hda/hda_codec.c:4641: hp_outs=1 (0x1b/0x0/0x0/0x0/0x0) ALSA sound/pci/hda/hda_codec.c:4642: mono: mono_out=0x0 ALSA sound/pci/hda/hda_codec.c:4645: dig-out=0x11/0x1e ALSA sound/pci/hda/hda_codec.c:4646: inputs: ALSA sound/pci/hda/hda_codec.c:4650: Rear Mic=0x18 ALSA sound/pci/hda/hda_codec.c:4650: Front Mic=0x19 ALSA sound/pci/hda/hda_codec.c:4650: Line=0x1a ALSA sound/pci/hda/hda_codec.c:4652: ALSA sound/pci/hda/patch_realtek.c:1581: realtek: No valid SSID, checking pincfg 0x4005e601 for NID 0x1d ALSA sound/pci/hda/patch_realtek.c:1597: realtek: Enabling init ASM_ID=0xe601 CODEC_ID=10ec0892 ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Side Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Speaker Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Mono Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Line-Out Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave PCM Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Side Playback Switch, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Speaker Playback Switch, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Mono Playback Switch, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Line-Out Playback Switch, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave PCM Playback Switch, skipped dmesg of 2.6.38 HDA Intel 0000:00:14.2: PCI INT A -> GSI 16 (level, low) -> IRQ 16 hda_intel: position_fix set to 1 for device 1043:8410 ALSA sound/pci/hda/hda_intel.c:2535: chipset global capabilities = 0x4401 ALSA sound/pci/hda/hda_intel.c:913: codec_mask = 0x1 ALSA sound/pci/hda/hda_intel.c:1353: codec #0 probed OK ALSA sound/pci/hda/patch_realtek.c:1527: SKU: Nid=0x1d sku_cfg=0x4005e601 ALSA sound/pci/hda/patch_realtek.c:1529: SKU: port_connectivity=0x1 ALSA sound/pci/hda/patch_realtek.c:1530: SKU: enable_pcbeep=0x0 ALSA sound/pci/hda/patch_realtek.c:1531: SKU: check_sum=0x00000005 ALSA sound/pci/hda/patch_realtek.c:1532: SKU: customization=0x000000e6 ALSA sound/pci/hda/patch_realtek.c:1533: SKU: external_amp=0x0 ALSA sound/pci/hda/patch_realtek.c:1534: SKU: platform_type=0x0 ALSA sound/pci/hda/patch_realtek.c:1535: SKU: swap=0x0 ALSA sound/pci/hda/patch_realtek.c:1536: SKU: override=0x1 hda_codec: ALC892: BIOS auto-probing. ALSA sound/pci/hda/hda_codec.c:4633: autoconfig: line_outs=4 (0x14/0x15/0x16/0x17/0x0) ALSA sound/pci/hda/hda_codec.c:4637: speaker_outs=0 (0x0/0x0/0x0/0x0/0x0) ALSA sound/pci/hda/hda_codec.c:4641: hp_outs=1 (0x1b/0x0/0x0/0x0/0x0) ALSA sound/pci/hda/hda_codec.c:4642: mono: mono_out=0x0 ALSA sound/pci/hda/hda_codec.c:4645: dig-out=0x11/0x1e ALSA sound/pci/hda/hda_codec.c:4646: inputs: ALSA sound/pci/hda/hda_codec.c:4650: Rear Mic=0x18 ALSA sound/pci/hda/hda_codec.c:4650: Front Mic=0x19 ALSA sound/pci/hda/hda_codec.c:4650: Line=0x1a ALSA sound/pci/hda/hda_codec.c:4652: ALSA sound/pci/hda/patch_realtek.c:1584: realtek: No valid SSID, checking pincfg 0x4005e601 for NID 0x1d ALSA sound/pci/hda/patch_realtek.c:1600: realtek: Enabling init ASM_ID=0xe601 CODEC_ID=10ec0892 ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Surround Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Side Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Speaker Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Mono Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Line-Out Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave PCM Playback Volume, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Surround Playback Switch, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Side Playback Switch, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Speaker Playback Switch, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Mono Playback Switch, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave Line-Out Playback Switch, skipped ALSA sound/pci/hda/hda_codec.c:2164: Cannot find slave PCM Playback Switch, skipped Diff of alsactl store output: --- store.27 2011-03-17 15:17:19.850768983 +0100 +++ store.28 2011-03-17 15:19:46.996710838 +0100 @@ -29,8 +29,9 @@ comment.dbmax 0 iface MIXER name 'Surround Playback Volume' - value.0 64 - value.1 64 + index 1 + value.0 38 + value.1 38 } control.4 { comment.access 'read write' @@ -38,6 +39,7 @@ comment.count 2 iface MIXER name 'Surround Playback Switch' + index 1 value.0 true value.1 true } @@ -130,7 +132,6 @@ comment.dbmax 1200 iface MIXER name 'Front Mic Playback Volume' - index 1 value.0 0 value.1 0 } @@ -140,7 +141,6 @@ comment.count 2 iface MIXER name 'Front Mic Playback Switch' - index 1 value.0 false value.1 false } @@ -173,7 +173,7 @@ comment.dbmin 0 comment.dbmax 3000 iface MIXER - name 'Rear Mic Boost' + name 'Rear Mic Boost Volume' value.0 0 value.1 0 } @@ -185,8 +185,7 @@ comment.dbmin 0 comment.dbmax 3000 iface MIXER - name 'Front Mic Boost' - index 1 + name 'Front Mic Boost Volume' value.0 0 value.1 0 } @@ -314,7 +313,7 @@ comment.count 1 iface MIXER name 'Master Playback Switch' - value true + value false } control.32 { comment.access 'read write user'

3 5

[alsa-devel] [PATCH v2] sound/oss: remove offset from load_patch callbacks
by Dan Rosenberg 23 Mar '11

23 Mar '11

Was: [PATCH] sound/oss/midi_synth: prevent underflow, use of uninitialized value, and signedness issue The offset passed to midi_synth_load_patch() can be essentially arbitrary. If it's greater than the header length, this will result in a copy_from_user(dst, src, negative_val). While this will just return -EFAULT on x86, on other architectures this may cause memory corruption. Additionally, the length field of the sysex_info structure may not be initialized prior to its use. Finally, a signed comparison may result in an unintentionally large loop. On suggestion by Takashi Iwai, version two removes the offset argument from the load_patch callbacks entirely, which also resolves similar issues in opl3. Compile tested only. Signed-off-by: Dan Rosenberg <drosenberg(a)vsecurity.com> Cc: stable(a)kernel.org --- sound/oss/dev_table.h | 2 +- sound/oss/midi_synth.c | 27 ++++++++++++--------------- sound/oss/midi_synth.h | 2 +- sound/oss/opl3.c | 4 ++-- sound/oss/sequencer.c | 2 +- 5 files changed, 17 insertions(+), 20 deletions(-) diff --git a/sound/oss/dev_table.h b/sound/oss/dev_table.h index b7617be..0199a31 100644 --- a/sound/oss/dev_table.h +++ b/sound/oss/dev_table.h @@ -271,7 +271,7 @@ struct synth_operations void (*reset) (int dev); void (*hw_control) (int dev, unsigned char *event); int (*load_patch) (int dev, int format, const char __user *addr, - int offs, int count, int pmgr_flag); + int count, int pmgr_flag); void (*aftertouch) (int dev, int voice, int pressure); void (*controller) (int dev, int voice, int ctrl_num, int value); void (*panning) (int dev, int voice, int value); diff --git a/sound/oss/midi_synth.c b/sound/oss/midi_synth.c index 3c09374..8d3611c 100644 --- a/sound/oss/midi_synth.c +++ b/sound/oss/midi_synth.c @@ -476,7 +476,7 @@ EXPORT_SYMBOL(midi_synth_hw_control); int midi_synth_load_patch(int dev, int format, const char __user *addr, - int offs, int count, int pmgr_flag) + int count, int pmgr_flag) { int orig_dev = synth_devs[dev]->midi_dev; @@ -491,16 +491,14 @@ midi_synth_load_patch(int dev, int format, const char __user *addr, if (!prefix_cmd(orig_dev, 0xf0)) return 0; + /* Invalid patch format */ if (format != SYSEX_PATCH) - { -/* printk("MIDI Error: Invalid patch format (key) 0x%x\n", format);*/ return -EINVAL; - } + + /* Patch header too short */ if (count < hdr_size) - { -/* printk("MIDI Error: Patch header too short\n");*/ return -EINVAL; - } + count -= hdr_size; /* @@ -508,16 +506,15 @@ midi_synth_load_patch(int dev, int format, const char __user *addr, * been transferred already. */ - if(copy_from_user(&((char *) &sysex)[offs], &(addr)[offs], hdr_size - offs)) + if (copy_from_user(&sysex, addr, hdr_size)) return -EFAULT; - - if (count < sysex.len) - { -/* printk(KERN_WARNING "MIDI Warning: Sysex record too short (%d<%d)\n", count, (int) sysex.len);*/ + + /* Sysex record too short */ + if ((unsigned)count < (unsigned)sysex.len) sysex.len = count; - } - left = sysex.len; - src_offs = 0; + + left = sysex.len; + src_offs = 0; for (i = 0; i < left && !signal_pending(current); i++) { diff --git a/sound/oss/midi_synth.h b/sound/oss/midi_synth.h index 6bc9d00..b64ddd6 100644 --- a/sound/oss/midi_synth.h +++ b/sound/oss/midi_synth.h @@ -8,7 +8,7 @@ int midi_synth_open (int dev, int mode); void midi_synth_close (int dev); void midi_synth_hw_control (int dev, unsigned char *event); int midi_synth_load_patch (int dev, int format, const char __user * addr, - int offs, int count, int pmgr_flag); + int count, int pmgr_flag); void midi_synth_panning (int dev, int channel, int pressure); void midi_synth_aftertouch (int dev, int channel, int pressure); void midi_synth_controller (int dev, int channel, int ctrl_num, int value); diff --git a/sound/oss/opl3.c b/sound/oss/opl3.c index 938c48c..a3bec38 100644 --- a/sound/oss/opl3.c +++ b/sound/oss/opl3.c @@ -820,7 +820,7 @@ static void opl3_hw_control(int dev, unsigned char *event) } static int opl3_load_patch(int dev, int format, const char __user *addr, - int offs, int count, int pmgr_flag) + int count, int pmgr_flag) { struct sbi_instrument ins; @@ -834,7 +834,7 @@ static int opl3_load_patch(int dev, int format, const char __user *addr, * What the fuck is going on here? We leave junk in the beginning * of ins and then check the field pretty close to that beginning? */ - if(copy_from_user(&((char *) &ins)[offs], addr + offs, sizeof(ins) - offs)) + if (copy_from_user(&ins, addr, sizeof(ins))) return -EFAULT; if (ins.channel < 0 || ins.channel >= SBFM_MAXINSTR) diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c index 5ea1098..2e842cb 100644 --- a/sound/oss/sequencer.c +++ b/sound/oss/sequencer.c @@ -241,7 +241,7 @@ int sequencer_write(int dev, struct file *file, const char __user *buf, int coun return -ENXIO; fmt = (*(short *) &event_rec[0]) & 0xffff; - err = synth_devs[dev]->load_patch(dev, fmt, buf, p + 4, c, 0); + err = synth_devs[dev]->load_patch(dev, fmt, buf, c, 0); if (err < 0) return err;

2 3