7 files changed, 102 insertions, 107 deletions

diff --git a/sound/core/control.c b/sound/core/control.c
index 4b20fa2b7e6..17b8d47a5cd 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -723,14 +723,11 @@ static int snd_ctl_elem_read_user(struct snd_card *card,
 {
         struct snd_ctl_elem_value *control;
         int result;
-        
-        control = kmalloc(sizeof(*control), GFP_KERNEL);
-        if (control == NULL)
-                return -ENOMEM; 
-        if (copy_from_user(control, _control, sizeof(*control))) {
-                kfree(control);
-                return -EFAULT;
-        }
+
+        control = memdup_user(_control, sizeof(*control));
+        if (IS_ERR(control))
+                return PTR_ERR(control);
+
         snd_power_lock(card);
         result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
         if (result >= 0)
@@ -784,13 +781,10 @@ static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
         struct snd_card *card;
         int result;
 
-        control = kmalloc(sizeof(*control), GFP_KERNEL);
-        if (control == NULL)
-                return -ENOMEM; 
-        if (copy_from_user(control, _control, sizeof(*control))) {
-                kfree(control);
-                return -EFAULT;
-        }
+        control = memdup_user(_control, sizeof(*control));
+        if (IS_ERR(control))
+                return PTR_ERR(control);
+
         card = file->card;
         snd_power_lock(card);
         result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
@@ -916,13 +910,10 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
         if (op_flag > 0) {
                 if (size > 1024 * 128)  /* sane value */
                         return -EINVAL;
-                new_data = kmalloc(size, GFP_KERNEL);
-                if (new_data == NULL)
-                        return -ENOMEM;
-                if (copy_from_user(new_data, tlv, size)) {
-                        kfree(new_data);
-                        return -EFAULT;
-                }
+
+                new_data = memdup_user(tlv, size);
+                if (IS_ERR(new_data))
+                        return PTR_ERR(new_data);
                 change = ue->tlv_data_size != size;
                 if (!change)
                         change = memcmp(ue->tlv_data, new_data, size);
diff --git a/sound/core/jack.c b/sound/core/jack.c
index c8254c667c6..d54d1a05fe6 100644
--- a/sound/core/jack.c
+++ b/sound/core/jack.c
@@ -35,6 +35,9 @@ static int snd_jack_dev_free(struct snd_device *device)
 {
         struct snd_jack *jack = device->device_data;
 
+        if (jack->private_free)
+                jack->private_free(jack);
+
         /* If the input device is registered with the input subsystem
          * then we need to use a different deallocator. */
         if (jack->registered)
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 36d7a599823..08bfed594a8 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -232,14 +232,11 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream,
         if (! (runtime = substream->runtime))
                 return -ENOTTY;
 
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
-        if (data == NULL)
-                return -ENOMEM;
         /* only fifo_size is different, so just copy all */
-        if (copy_from_user(data, data32, sizeof(*data32))) {
-                err = -EFAULT;
-                goto error;
-        }
+        data = memdup_user(data32, sizeof(*data32));
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
         if (refine)
                 err = snd_pcm_hw_refine(substream, data);
         else
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index fbb2e391591..63d088f2265 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -209,9 +209,11 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
         snd_pcm_uframes_t pos;
-        snd_pcm_uframes_t new_hw_ptr, hw_ptr_interrupt, hw_base;
-        snd_pcm_sframes_t delta;
+        snd_pcm_uframes_t old_hw_ptr, new_hw_ptr, hw_ptr_interrupt, hw_base;
+        snd_pcm_sframes_t hdelta, delta;
+        unsigned long jdelta;
 
+        old_hw_ptr = runtime->status->hw_ptr;
         pos = snd_pcm_update_hw_ptr_pos(substream, runtime);
         if (pos == SNDRV_PCM_POS_XRUN) {
                 xrun(substream);
@@ -247,7 +249,30 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                         new_hw_ptr = hw_base + pos;
                 }
         }
-        if (delta > runtime->period_size) {
+        hdelta = new_hw_ptr - old_hw_ptr;
+        jdelta = jiffies - runtime->hw_ptr_jiffies;
+        if (((hdelta * HZ) / runtime->rate) > jdelta + HZ/100) {
+                delta = jdelta /
+                        (((runtime->period_size * HZ) / runtime->rate)
+                                                                + HZ/100);
+                hw_ptr_error(substream,
+                             "hw_ptr skipping! [Q] "
+                             "(pos=%ld, delta=%ld, period=%ld, "
+                             "jdelta=%lu/%lu/%lu)\n",
+                             (long)pos, (long)hdelta,
+                             (long)runtime->period_size, jdelta,
+                             ((hdelta * HZ) / runtime->rate), delta);
+                hw_ptr_interrupt = runtime->hw_ptr_interrupt +
+                                   runtime->period_size * delta;
+                if (hw_ptr_interrupt >= runtime->boundary)
+                        hw_ptr_interrupt -= runtime->boundary;
+                /* rebase to interrupt position */
+                hw_base = new_hw_ptr = hw_ptr_interrupt;
+                /* align hw_base to buffer_size */
+                hw_base -= hw_base % runtime->buffer_size;
+                delta = 0;
+        }
+        if (delta > runtime->period_size + runtime->period_size / 2) {
                 hw_ptr_error(substream,
                              "Lost interrupts? "
                              "(stream=%i, delta=%ld, intr_ptr=%ld)\n",
@@ -263,6 +288,7 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
 
         runtime->hw_ptr_base = hw_base;
         runtime->status->hw_ptr = new_hw_ptr;
+        runtime->hw_ptr_jiffies = jiffies;
         runtime->hw_ptr_interrupt = hw_ptr_interrupt;
 
         return snd_pcm_update_hw_ptr_post(substream, runtime);
@@ -275,6 +301,7 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
         snd_pcm_uframes_t pos;
         snd_pcm_uframes_t old_hw_ptr, new_hw_ptr, hw_base;
         snd_pcm_sframes_t delta;
+        unsigned long jdelta;
 
         old_hw_ptr = runtime->status->hw_ptr;
         pos = snd_pcm_update_hw_ptr_pos(substream, runtime);
@@ -286,14 +313,15 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
         new_hw_ptr = hw_base + pos;
 
         delta = new_hw_ptr - old_hw_ptr;
+        jdelta = jiffies - runtime->hw_ptr_jiffies;
         if (delta < 0) {
                 delta += runtime->buffer_size;
                 if (delta < 0) {
                         hw_ptr_error(substream, 
                                      "Unexpected hw_pointer value [2] "
-                                     "(stream=%i, pos=%ld, old_ptr=%ld)\n",
+                                     "(stream=%i, pos=%ld, old_ptr=%ld, jdelta=%li)\n",
                                      substream->stream, (long)pos,
-                                     (long)old_hw_ptr);
+                                     (long)old_hw_ptr, jdelta);
                         return 0;
                 }
                 hw_base += runtime->buffer_size;
@@ -301,12 +329,13 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
                         hw_base = 0;
                 new_hw_ptr = hw_base + pos;
         }
-        if (delta > runtime->period_size && runtime->periods > 1) {
+        if (((delta * HZ) / runtime->rate) > jdelta + HZ/100) {
                 hw_ptr_error(substream,
                              "hw_ptr skipping! "
-                             "(pos=%ld, delta=%ld, period=%ld)\n",
+                             "(pos=%ld, delta=%ld, period=%ld, jdelta=%lu/%lu)\n",
                              (long)pos, (long)delta,
-                             (long)runtime->period_size);
+                             (long)runtime->period_size, jdelta,
+                             ((delta * HZ) / runtime->rate));
                 return 0;
         }
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
@@ -315,6 +344,7 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
 
         runtime->hw_ptr_base = hw_base;
         runtime->status->hw_ptr = new_hw_ptr;
+        runtime->hw_ptr_jiffies = jiffies;
 
         return snd_pcm_update_hw_ptr_post(substream, runtime);
 }
@@ -1441,6 +1471,7 @@ static int snd_pcm_lib_ioctl_reset(struct snd_pcm_substream *substream,
                 runtime->status->hw_ptr %= runtime->buffer_size;
         else
                 runtime->status->hw_ptr = 0;
+        runtime->hw_ptr_jiffies = jiffies;
         snd_pcm_stream_unlock_irqrestore(substream, flags);
         return 0;
 }
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index a151fb01ba8..fc6f98e257d 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -327,21 +327,16 @@ static int snd_pcm_hw_refine_user(struct snd_pcm_substream *substream,
         struct snd_pcm_hw_params *params;
         int err;
 
-        params = kmalloc(sizeof(*params), GFP_KERNEL);
-        if (!params) {
-                err = -ENOMEM;
-                goto out;
-        }
-        if (copy_from_user(params, _params, sizeof(*params))) {
-                err = -EFAULT;
-                goto out;
-        }
+        params = memdup_user(_params, sizeof(*params));
+        if (IS_ERR(params))
+                return PTR_ERR(params);
+
         err = snd_pcm_hw_refine(substream, params);
         if (copy_to_user(_params, params, sizeof(*params))) {
                 if (!err)
                         err = -EFAULT;
         }
-out:
+
         kfree(params);
         return err;
 }
@@ -465,21 +460,16 @@ static int snd_pcm_hw_params_user(struct snd_pcm_substream *substream,
         struct snd_pcm_hw_params *params;
         int err;
 
-        params = kmalloc(sizeof(*params), GFP_KERNEL);
-        if (!params) {
-                err = -ENOMEM;
-                goto out;
-        }
-        if (copy_from_user(params, _params, sizeof(*params))) {
-                err = -EFAULT;
-                goto out;
-        }
+        params = memdup_user(_params, sizeof(*params));
+        if (IS_ERR(params))
+                return PTR_ERR(params);
+
         err = snd_pcm_hw_params(substream, params);
         if (copy_to_user(_params, params, sizeof(*params))) {
                 if (!err)
                         err = -EFAULT;
         }
-out:
+
         kfree(params);
         return err;
 }
@@ -2593,13 +2583,11 @@ static int snd_pcm_playback_ioctl1(struct file *file,
                         return -EFAULT;
                 if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
                         return -EFAULT;
-                bufs = kmalloc(sizeof(void *) * runtime->channels, GFP_KERNEL);
-                if (bufs == NULL)
-                        return -ENOMEM;
-                if (copy_from_user(bufs, xfern.bufs, sizeof(void *) * runtime->channels)) {
-                        kfree(bufs);
-                        return -EFAULT;
-                }
+
+                bufs = memdup_user(xfern.bufs,
+                                   sizeof(void *) * runtime->channels);
+                if (IS_ERR(bufs))
+                        return PTR_ERR(bufs);
                 result = snd_pcm_lib_writev(substream, bufs, xfern.frames);
                 kfree(bufs);
                 __put_user(result, &_xfern->result);
@@ -2675,13 +2663,11 @@ static int snd_pcm_capture_ioctl1(struct file *file,
                         return -EFAULT;
                 if (copy_from_user(&xfern, _xfern, sizeof(xfern)))
                         return -EFAULT;
-                bufs = kmalloc(sizeof(void *) * runtime->channels, GFP_KERNEL);
-                if (bufs == NULL)
-                        return -ENOMEM;
-                if (copy_from_user(bufs, xfern.bufs, sizeof(void *) * runtime->channels)) {
-                        kfree(bufs);
-                        return -EFAULT;
-                }
+
+                bufs = memdup_user(xfern.bufs,
+                                   sizeof(void *) * runtime->channels);
+                if (IS_ERR(bufs))
+                        return PTR_ERR(bufs);
                 result = snd_pcm_lib_readv(substream, bufs, xfern.frames);
                 kfree(bufs);
                 __put_user(result, &_xfern->result);
@@ -3312,18 +3298,12 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
         int err;
 
         params = kmalloc(sizeof(*params), GFP_KERNEL);
-        if (!params) {
-                err = -ENOMEM;
-                goto out;
-        }
-        oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);
-        if (!oparams) {
-                err = -ENOMEM;
-                goto out;
-        }
+        if (!params)
+                return -ENOMEM;
 
-        if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {
-                err = -EFAULT;
+        oparams = memdup_user(_oparams, sizeof(*oparams));
+        if (IS_ERR(oparams)) {
+                err = PTR_ERR(oparams);
                 goto out;
         }
         snd_pcm_hw_convert_from_old_params(params, oparams);
@@ -3333,9 +3313,10 @@ static int snd_pcm_hw_refine_old_user(struct snd_pcm_substream *substream,
                 if (!err)
                         err = -EFAULT;
         }
+
+        kfree(oparams);
 out:
         kfree(params);
-        kfree(oparams);
         return err;
 }
 
@@ -3347,17 +3328,12 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
         int err;
 
         params = kmalloc(sizeof(*params), GFP_KERNEL);
-        if (!params) {
-                err = -ENOMEM;
-                goto out;
-        }
-        oparams = kmalloc(sizeof(*oparams), GFP_KERNEL);
-        if (!oparams) {
-                err = -ENOMEM;
-                goto out;
-        }
-        if (copy_from_user(oparams, _oparams, sizeof(*oparams))) {
-                err = -EFAULT;
+        if (!params)
+                return -ENOMEM;
+
+        oparams = memdup_user(_oparams, sizeof(*oparams));
+        if (IS_ERR(oparams)) {
+                err = PTR_ERR(oparams);
                 goto out;
         }
         snd_pcm_hw_convert_from_old_params(params, oparams);
@@ -3367,9 +3343,10 @@ static int snd_pcm_hw_params_old_user(struct snd_pcm_substream *substream,
                 if (!err)
                         err = -EFAULT;
         }
+
+        kfree(oparams);
 out:
         kfree(params);
-        kfree(oparams);
         return err;
 }
 #endif /* CONFIG_SND_SUPPORT_OLD_API */
diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c
index 38693f47c26..c956fe46256 100644
--- a/sound/core/seq/seq_compat.c
+++ b/sound/core/seq/seq_compat.c
@@ -48,12 +48,11 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
         struct snd_seq_port_info *data;
         mm_segment_t fs;
 
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
-        if (! data)
-                return -ENOMEM;
+        data = memdup_user(data32, sizeof(*data32));
+        if (IS_ERR(data))
+                return PTR_ERR(data);
 
-        if (copy_from_user(data, data32, sizeof(*data32)) ||
-            get_user(data->flags, &data32->flags) ||
+        if (get_user(data->flags, &data32->flags) ||
             get_user(data->time_queue, &data32->time_queue))
                 goto error;
         data->kernel = NULL;
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 3f0050d0b71..8f8b17ac074 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1395,13 +1395,10 @@ static int snd_timer_user_ginfo(struct file *file,
         struct list_head *p;
         int err = 0;
 
-        ginfo = kmalloc(sizeof(*ginfo), GFP_KERNEL);
-        if (! ginfo)
-                return -ENOMEM;
-        if (copy_from_user(ginfo, _ginfo, sizeof(*ginfo))) {
-                kfree(ginfo);
-                return -EFAULT;
-        }
+        ginfo = memdup_user(_ginfo, sizeof(*ginfo));
+        if (IS_ERR(ginfo))
+                return PTR_ERR(ginfo);
+
         tid = ginfo->tid;
         memset(ginfo, 0, sizeof(*ginfo));
         ginfo->tid = tid;