From 626f5cefc60b281a00db1402b82deff82080c70a Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Tue, 28 Jul 2009 00:54:39 +0200 Subject: ALSA: hda - Add quirk for Dell Studio 1555 Added a quirk entry for Dell Studio 1555. Reference: Novell bnc#525244 https://bugzilla.novell.com/show_bug.cgi?id=525244 Signed-off-by: Takashi Iwai --- sound/pci/hda/patch_sigmatel.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c index 512f3b9..5383d8c 100644 --- a/sound/pci/hda/patch_sigmatel.c +++ b/sound/pci/hda/patch_sigmatel.c @@ -1809,6 +1809,8 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = { "Dell Studio 1537", STAC_DELL_M6_DMIC), SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02a0, "Dell Studio 17", STAC_DELL_M6_DMIC), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02be, + "Dell Studio 1555", STAC_DELL_M6_DMIC), {} /* terminator */ }; -- cgit v1.1 From 78735cffc2d9ab0dec32f1ba7cbc1d84b45bbf29 Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Wed, 29 Jul 2009 14:35:20 +0200 Subject: ALSA: hda: fix out-of-bound hdmi_eld.sad[] write e->sad[] is declared with size ELD_MAX_SAD=16, but the guard allows range 0-31. Signed-off-by: Roel Kluin Signed-off-by: Wu Fengguang Signed-off-by: Takashi Iwai --- sound/pci/hda/hda_eld.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c index fcad5ec..9446a5a 100644 --- a/sound/pci/hda/hda_eld.c +++ b/sound/pci/hda/hda_eld.c @@ -508,7 +508,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry, char name[64]; char *sname; long long val; - int n; + unsigned int n; while (!snd_info_get_line(buffer, line, sizeof(line))) { if (sscanf(line, "%s %llx", name, &val) != 2) @@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry, sname++; n = 10 * n + name[4] - '0'; } - if (n < 0 || n > 31) /* double the CEA limit */ + if (n >= ELD_MAX_SAD) continue; if (!strcmp(sname, "_coding_type")) e->sad[n].format = val; -- cgit v1.1 From c45ec06c74512265969aef40b00f320c6afb7a90 Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Wed, 29 Jul 2009 11:46:59 +0200 Subject: sound: aedsp16: Buffer overflow DSPVersion is declared as char[3], but the sprintf writes at least 4 bytes including terminating null. Signed-off-by: Roel Kluin Signed-off-by: Takashi Iwai --- sound/oss/aedsp16.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/sound/oss/aedsp16.c b/sound/oss/aedsp16.c index 3ee9900..35b5912 100644 --- a/sound/oss/aedsp16.c +++ b/sound/oss/aedsp16.c @@ -325,8 +325,9 @@ /* * Size of character arrays that store name and version of sound card */ -#define CARDNAMELEN 15 /* Size of the card's name in chars */ -#define CARDVERLEN 2 /* Size of the card's version in chars */ +#define CARDNAMELEN 15 /* Size of the card's name in chars */ +#define CARDVERLEN 10 /* Size of the card's version in chars */ +#define CARDVERDIGITS 2 /* Number of digits in the version */ #if defined(CONFIG_SC6600) /* @@ -410,7 +411,7 @@ static int soft_cfg __initdata = 0; /* bitmapped config */ static int soft_cfg_mss __initdata = 0; /* bitmapped mss config */ -static int ver[CARDVERLEN] __initdata = {0, 0}; /* DSP Ver: +static int ver[CARDVERDIGITS] __initdata = {0, 0}; /* DSP Ver: hi->ver[0] lo->ver[1] */ #if defined(CONFIG_SC6600) @@ -957,7 +958,7 @@ static int __init aedsp16_dsp_version(int port) * string is finished. */ ver[len++] = ret; - } while (len < CARDVERLEN); + } while (len < CARDVERDIGITS); sprintf(DSPVersion, "%d.%d", ver[0], ver[1]); DBG(("success.\n")); -- cgit v1.1 From a987004fbcf163b100d227284999602f83044d7e Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Wed, 29 Jul 2009 12:12:09 +0200 Subject: sound: mpu401.c: Buffer overflow mpu_synth_info[m].name is a char[30], and the minimum length of the data written by sprintf is 31 bytes including terminating null. Signed-off-by: Roel Kluin Signed-off-by: Takashi Iwai --- sound/oss/mpu401.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/oss/mpu401.c b/sound/oss/mpu401.c index 1b2316f..734b8f9 100644 --- a/sound/oss/mpu401.c +++ b/sound/oss/mpu401.c @@ -1074,7 +1074,7 @@ int attach_mpu401(struct address_info *hw_config, struct module *owner) sprintf(mpu_synth_info[m].name, "%s (MPU401)", hw_config->name); else sprintf(mpu_synth_info[m].name, - "MPU-401 %d.%d%c Midi interface #%d", + "MPU-401 %d.%d%c MIDI #%d", (int) (devc->version & 0xf0) >> 4, devc->version & 0x0f, revision_char, -- cgit v1.1 From aa563af763373a7e67a7b8fdb427d2a2fcbeab3b Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Fri, 31 Jul 2009 10:05:11 +0200 Subject: ALSA: hda - Increase PCM stream name buf in patch_realtek.c The name buf with size 16 is too short for some codec names, e.g. truncated like "ALC861-VD Analo". Now the size is doubled. Signed-off-by: Takashi Iwai --- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c index 8c8b273..b95df5d 100644 --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -275,13 +275,13 @@ struct alc_spec { */ unsigned int num_init_verbs; - char stream_name_analog[16]; /* analog PCM stream */ + char stream_name_analog[32]; /* analog PCM stream */ struct hda_pcm_stream *stream_analog_playback; struct hda_pcm_stream *stream_analog_capture; struct hda_pcm_stream *stream_analog_alt_playback; struct hda_pcm_stream *stream_analog_alt_capture; - char stream_name_digital[16]; /* digital PCM stream */ + char stream_name_digital[32]; /* digital PCM stream */ struct hda_pcm_stream *stream_digital_playback; struct hda_pcm_stream *stream_digital_capture; -- cgit v1.1 From f065fabc864f4c98857bf67caa2365e9f8545751 Mon Sep 17 00:00:00 2001 From: Julia Lawall Date: Fri, 31 Jul 2009 08:32:03 +0200 Subject: ALSA: sound/aoa: Add kmalloc NULL tests Check that the result of kzalloc is not NULL before a dereference. The semantic match that finds this problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // @@ expression *x; identifier f; constant char *C; @@ x = \(kmalloc\|kcalloc\|kzalloc\)(...); ... when != x == NULL when != x != NULL when != (x || ...) ( kfree(x) | f(...,C,...,x,...) | *f(...,x,...) | *x->f ) // Signed-off-by: Julia Lawall Signed-off-by: Takashi Iwai --- sound/aoa/core/gpio-pmf.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/aoa/core/gpio-pmf.c b/sound/aoa/core/gpio-pmf.c index 5ca2220..1dd0c28 100644 --- a/sound/aoa/core/gpio-pmf.c +++ b/sound/aoa/core/gpio-pmf.c @@ -182,6 +182,10 @@ static int pmf_set_notify(struct gpio_runtime *rt, if (!old && notify) { irq_client = kzalloc(sizeof(struct pmf_irq_client), GFP_KERNEL); + if (!irq_client) { + err = -ENOMEM; + goto out_unlock; + } irq_client->data = notif; irq_client->handler = pmf_handle_notify_irq; irq_client->owner = THIS_MODULE; -- cgit v1.1