<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/git/stable/linux.git/sound/usb, branch linux-3.3.y</title>
<subtitle>Linux kernel stable tree</subtitle>
<id>https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/atom?h=linux-3.3.y</id>
<link rel='self' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/atom?h=linux-3.3.y'/>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/'/>
<updated>2012-02-22T07:34:58+00:00</updated>
<entry>
<title>ALSA: snd-usb-caiaq: Fix the return of XRUN</title>
<updated>2012-02-22T07:34:58+00:00</updated>
<author>
<name>Mark Hills</name>
<email>mark@pogo.org.uk</email>
</author>
<published>2012-02-21T21:26:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cb74eb15ac88d6aacf7e58db1d8f8dadee710fd9'/>
<id>urn:sha1:cb74eb15ac88d6aacf7e58db1d8f8dadee710fd9</id>
<content type='text'>
Commit 3702b08 added a lock, but did not account for the case of
SNDRV_PCM_POS_XRUN, which would get immediately overwritten.

This could be bundled into one if-else-if statement, but the goto
helps to clarify the 'exceptional' case.

Thanks to Andreas Pape for spotting this.

Signed-off-by: Mark Hills &lt;mark@pogo.org.uk&gt;
Acked-by: Daniel Mack &lt;zonque@gmail.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
</entry>
<entry>
<title>ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk()</title>
<updated>2012-02-15T13:58:15+00:00</updated>
<author>
<name>Xi Wang</name>
<email>xi.wang@gmail.com</email>
</author>
<published>2012-02-14T10:18:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8866f405efd4171f9d9c91901d2dd02f01bacb60'/>
<id>urn:sha1:8866f405efd4171f9d9c91901d2dd02f01bacb60</id>
<content type='text'>
A malicious USB device could feed in a large nr_rates value.  This would
cause the subsequent call to kmemdup() to allocate a smaller buffer than
expected, leading to out-of-bounds access.

This patch validates the nr_rates value and reuses the limit introduced
in commit 4fa0e81b ("ALSA: usb-audio: fix possible hang and overflow
in parse_uac2_sample_rate_range()").

Signed-off-by: Xi Wang &lt;xi.wang@gmail.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
</entry>
<entry>
<title>ALSA: usb-audio: add Edirol UM-3G support</title>
<updated>2012-02-08T08:46:34+00:00</updated>
<author>
<name>Clemens Ladisch</name>
<email>clemens@ladisch.de</email>
</author>
<published>2012-02-04T19:51:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=927c9423dd5f2d1c0b93d5e694ab84b4a5559713'/>
<id>urn:sha1:927c9423dd5f2d1c0b93d5e694ab84b4a5559713</id>
<content type='text'>
Signed-off-by: Clemens Ladisch &lt;clemens@ladisch.de&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
</entry>
<entry>
<title>Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound</title>
<updated>2012-01-12T16:00:30+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2012-01-12T16:00:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a429638cac1e5c656818a45aaff78df7b743004e'/>
<id>urn:sha1:a429638cac1e5c656818a45aaff78df7b743004e</id>
<content type='text'>
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (526 commits)
  ASoC: twl6040 - Add method to query optimum PDM_DL1 gain
  ALSA: hda - Fix the lost power-setup of seconary pins after PM resume
  ALSA: usb-audio: add Yamaha MOX6/MOX8 support
  ALSA: virtuoso: add S/PDIF input support for all Xonars
  ALSA: ice1724 - Support for ooAoo SQ210a
  ALSA: ice1724 - Allow card info based on model only
  ALSA: ice1724 - Create capture pcm only for ADC-enabled configurations
  ALSA: hdspm - Provide unique driver id based on card serial
  ASoC: Dynamically allocate the rtd device for a non-empty release()
  ASoC: Fix recursive dependency due to select ATMEL_SSC in SND_ATMEL_SOC_SSC
  ALSA: hda - Fix the detection of "Loopback Mixing" control for VIA codecs
  ALSA: hda - Return the error from get_wcaps_type() for invalid NIDs
  ALSA: hda - Use auto-parser for HP laptops with cx20459 codec
  ALSA: asihpi - Fix potential Oops in snd_asihpi_cmode_info()
  ALSA: hdsp - Fix potential Oops in snd_hdsp_info_pref_sync_ref()
  ALSA: hda/cirrus - support for iMac12,2 model
  ASoC: cx20442: add bias control over a platform provided regulator
  ALSA: usb-audio - Avoid flood of frame-active debug messages
  ALSA: snd-usb-us122l: Delete calls to preempt_disable
  mfd: Put WM8994 into cache only mode when suspending
  ...

Fix up trivial conflicts in:
 - arch/arm/mach-s3c64xx/mach-crag6410.c:
	renamed speyside_wm8962 to tobermory, added littlemill right
	next to it
 - drivers/base/regmap/{regcache.c,regmap.c}:
	duplicate diff that had already come in with other changes in
	the regmap tree
</content>
</entry>
<entry>
<title>ALSA: usb-audio: add Yamaha MOX6/MOX8 support</title>
<updated>2012-01-11T08:24:53+00:00</updated>
<author>
<name>Clemens Ladisch</name>
<email>clemens@ladisch.de</email>
</author>
<published>2011-12-19T22:09:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8c3f5d8a9b7d0d8506bc2a0525e012eae02b1853'/>
<id>urn:sha1:8c3f5d8a9b7d0d8506bc2a0525e012eae02b1853</id>
<content type='text'>
Signed-off-by: Clemens Ladisch &lt;clemens@ladisch.de&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
</entry>
<entry>
<title>ALSA: usb-audio - Avoid flood of frame-active debug messages</title>
<updated>2012-01-09T10:40:46+00:00</updated>
<author>
<name>Takashi Iwai</name>
<email>tiwai@suse.de</email>
</author>
<published>2012-01-09T10:37:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=80c8a2a372599e604b04a9c568952fe39cd1851d'/>
<id>urn:sha1:80c8a2a372599e604b04a9c568952fe39cd1851d</id>
<content type='text'>
With some buggy devices, the usb-audio driver may give "frame xxx active"
kernel messages too often.  Better to keep it as debug-only using
snd_printdd(), and also add the rate-limit for avoiding floods.

Bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=738681

Cc: &lt;stable@kernel.org&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
</entry>
<entry>
<title>ALSA: snd-usb-us122l: Delete calls to preempt_disable</title>
<updated>2012-01-09T10:31:30+00:00</updated>
<author>
<name>Karsten Wiese</name>
<email>fzu@wemgehoertderstaat.de</email>
</author>
<published>2011-12-30T00:42:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d0f3a2eb9062560bebca8b923424f3ca02a331ba'/>
<id>urn:sha1:d0f3a2eb9062560bebca8b923424f3ca02a331ba</id>
<content type='text'>
They are not needed here.

Signed-off-by: Karsten Wiese &lt;fzu@wemgehoertderstaat.de&gt;
Cc: stable@kernel.org
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
</entry>
<entry>
<title>ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()</title>
<updated>2012-01-08T15:03:12+00:00</updated>
<author>
<name>Xi Wang</name>
<email>xi.wang@gmail.com</email>
</author>
<published>2012-01-08T14:02:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4fa0e81b83503900be277e6273a79651b375e288'/>
<id>urn:sha1:4fa0e81b83503900be277e6273a79651b375e288</id>
<content type='text'>
A malicious USB device may feed in carefully crafted min/max/res values,
so that the inner loop in parse_uac2_sample_rate_range() could run for
a long time or even never terminate, e.g., given max = INT_MAX.

Also nr_rates could be a large integer, which causes an integer overflow
in the subsequent call to kmalloc() in parse_audio_format_rates_v2().
Thus, kmalloc() would allocate a smaller buffer than expected, leading
to a memory corruption.

To exploit the two vulnerabilities, an attacker needs physical access
to the machine to plug in a malicious USB device.

This patch makes two changes.

1) The type of "rate" is changed to unsigned int, so that the loop could
   stop once "rate" is larger than INT_MAX.

2) Limit nr_rates to 1024.

Suggested-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Signed-off-by: Xi Wang &lt;xi.wang@gmail.com&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
</entry>
<entry>
<title>Merge branch 'driver-core-next' into Linux 3.2</title>
<updated>2012-01-06T19:42:52+00:00</updated>
<author>
<name>Greg Kroah-Hartman</name>
<email>gregkh@suse.de</email>
</author>
<published>2012-01-06T19:42:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ff4b8a57f0aaa2882d444ca44b2b9b333d22a4df'/>
<id>urn:sha1:ff4b8a57f0aaa2882d444ca44b2b9b333d22a4df</id>
<content type='text'>
This resolves the conflict in the arch/arm/mach-s3c64xx/s3c6400.c file,
and it fixes the build error in the arch/x86/kernel/microcode_core.c
file, that the merge did not catch.

The microcode_core.c patch was provided by Stephen Rothwell
&lt;sfr@canb.auug.org.au&gt; who was invaluable in the merge issues involved
with the large sysdev removal process in the driver-core tree.

Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;
</content>
</entry>
<entry>
<title>ALSA: module_param: make bool parameters really bool</title>
<updated>2011-12-19T09:34:41+00:00</updated>
<author>
<name>Rusty Russell</name>
<email>rusty@rustcorp.com.au</email>
</author>
<published>2011-12-15T03:19:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a67ff6a54095e27093ea501fb143fefe51a536c2'/>
<id>urn:sha1:a67ff6a54095e27093ea501fb143fefe51a536c2</id>
<content type='text'>
module_param(bool) used to counter-intuitively take an int.  In
fddd5201 (mid-2009) we allowed bool or int/unsigned int using a messy
trick.

It's time to remove the int/unsigned int option.  For this version
it'll simply give a warning, but it'll break next kernel version.

Signed-off-by: Rusty Russell &lt;rusty@rustcorp.com.au&gt;
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
</entry>
</feed>
