[PATCH] UBUNTU sound/core/: Apply various fixes to ALSA core (hwdep.c, init.c, pcm_lib.c)

[crimsun at fungus.sh.nu]

From b9a83ec0adf1c08537574e33bba7d6b74d3ca31f Mon Sep 17 00:00:00 2001
From: Daniel T. Chen <crimsun at garnish.localdomain>
Date: Fri, 2 Feb 2007 00:40:50 -0500
Subject: [PATCH] UBUNTU sound/core/: Apply various fixes to ALSA core (hwdep.c, init.c, pcm_lib.c)

Status: Committed in upstream alsa-kernel hg

The following fixes are applicable to ALSA core:

(1) Cleanup and error reporting for sound/core/init.c:

Make the control flow clear with indentation, add some comments
and improve error reporting.

Signed-off-by: Oliver Neukum <oneukum at suse.de>

(2) Fix for snd_hwdep_release() race:

snd_card_file_remove() can free the snd_card.
Touch hw->* only before calling snd_card_file_remove().
Unrelated: Allow hwdep devices not to have own ops.release();

Signed-off-by: Karsten Wiese <fzu at wemgehoertderstaat.de>

(3) Fix possible invalid memory access in PCM core

From Takashi Iwai:

snd_internval_list() may access invalid memory in the case count = 0
is given. It shouldn't be passed, but it'd better to make the code
a bit more robust.

Signed-off-by: Daniel T Chen <crimsun at ubuntu.com>
---
 sound/core/hwdep.c   |    9 +++++----
 sound/core/init.c    |   22 ++++++++++++++--------
 sound/core/pcm_lib.c |    5 +++++
 3 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index 46b4768..0b5426e 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -159,15 +159,16 @@ static int snd_hwdep_release(struct inode *inode, struct file * file)
 	int err = -ENXIO;
 	struct snd_hwdep *hw = file->private_data;
 	struct module *mod = hw->card->module;
+
 	mutex_lock(&hw->open_mutex);
-	if (hw->ops.release) {
+	if (hw->ops.release)
 		err = hw->ops.release(hw, file);
-		wake_up(&hw->open_wait);
-	}
 	if (hw->used > 0)
 		hw->used--;
-	snd_card_file_remove(hw->card, file);
 	mutex_unlock(&hw->open_mutex);
+	wake_up(&hw->open_wait);
+
+	snd_card_file_remove(hw->card, file);
 	module_put(mod);
 	return err;
 }
diff --git a/sound/core/init.c b/sound/core/init.c
index 6152a75..e780257 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -114,22 +114,28 @@ struct snd_card *snd_card_new(int idx, const char *xid,
 	if (idx < 0) {
 		int idx2;
 		for (idx2 = 0; idx2 < SNDRV_CARDS; idx2++)
+			/* idx == -1 == 0xffff means: take any free slot */
 			if (~snd_cards_lock & idx & 1<<idx2) {
 				idx = idx2;
 				if (idx >= snd_ecards_limit)
 					snd_ecards_limit = idx + 1;
 				break;
 			}
-	} else if (idx < snd_ecards_limit) {
-		if (snd_cards_lock & (1 << idx))
-			err = -ENODEV;	/* invalid */
-	} else if (idx < SNDRV_CARDS)
-		snd_ecards_limit = idx + 1; /* increase the limit */
-	else
-		err = -ENODEV;
+	} else {
+		 if (idx < snd_ecards_limit) {
+			if (snd_cards_lock & (1 << idx))
+				err = -EBUSY;	/* invalid */
+		} else {
+			if (idx < SNDRV_CARDS)
+				snd_ecards_limit = idx + 1; /* increase the limit */
+			else
+				err = -ENODEV;
+		}
+	}
 	if (idx < 0 || err < 0) {
 		mutex_unlock(&snd_card_mutex);
-		snd_printk(KERN_ERR "cannot find the slot for index %d (range 0-%i)\n", idx, snd_ecards_limit - 1);
+		snd_printk(KERN_ERR "cannot find the slot for index %d (range 0-%i), error: %d\n",
+			 idx, snd_ecards_limit - 1, err);
 		goto __error;
 	}
 	snd_cards_lock |= 1 << idx;		/* lock it */
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index b336797..9fefcaa 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -781,6 +781,11 @@ int snd_interval_list(struct snd_interval *i, unsigned int count, unsigned int *
 {
         unsigned int k;
 	int changed = 0;
+
+	if (!count) {
+		i->empty = 1;
+		return -EINVAL;
+	}
         for (k = 0; k < count; k++) {
 		if (mask && !(mask & (1 << k)))
 			continue;
-- 
1.4.4.2

-- 
Daniel T. Chen            crimsun at ubuntu.com
GPG key:  0xC88ABDA3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20070201/de5a523f/attachment.sig>