9 files changed, 105 insertions, 46 deletions

diff --git a/sound/core/control.c b/sound/core/control.c
index 070aab49019..45a818002d9 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -31,6 +31,7 @@
 
 /* max number of user-defined controls */
 #define MAX_USER_CONTROLS       32
+#define MAX_CONTROL_COUNT       1028
 
 struct snd_kctl_ioctl {
         struct list_head list;          /* list of all ioctls */
@@ -195,6 +196,10 @@ static struct snd_kcontrol *snd_ctl_new(struct snd_kcontrol *control,
         
         if (snd_BUG_ON(!control || !control->count))
                 return NULL;
+
+        if (control->count > MAX_CONTROL_COUNT)
+                return NULL;
+
         kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
         if (kctl == NULL) {
                 snd_printk(KERN_ERR "Cannot allocate control instance\n");
diff --git a/sound/core/init.c b/sound/core/init.c
index ec4a50ce565..2de45fbd70f 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -607,11 +607,16 @@ card_id_store_attr(struct device *dev, struct device_attribute *attr,
                 return -EEXIST;
         }
         for (idx = 0; idx < snd_ecards_limit; idx++) {
-                if (snd_cards[idx] && !strcmp(snd_cards[idx]->id, buf1))
-                        goto __exist;
+                if (snd_cards[idx] && !strcmp(snd_cards[idx]->id, buf1)) {
+                        if (card == snd_cards[idx])
+                                goto __ok;
+                        else
+                                goto __exist;
+                }
         }
         strcpy(card->id, buf1);
         snd_info_card_id_change(card);
+__ok:
         mutex_unlock(&snd_card_mutex);
 
         return count;
diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index 8442a088677..822dd56993c 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -77,7 +77,7 @@ static int snd_mixer_oss_release(struct inode *inode, struct file *file)
         struct snd_mixer_oss_file *fmixer;
 
         if (file->private_data) {
-                fmixer = (struct snd_mixer_oss_file *) file->private_data;
+                fmixer = file->private_data;
                 module_put(fmixer->card->module);
                 snd_card_file_remove(fmixer->card, file);
                 kfree(fmixer);
@@ -368,7 +368,7 @@ static int snd_mixer_oss_ioctl1(struct snd_mixer_oss_file *fmixer, unsigned int
 
 static long snd_mixer_oss_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-        return snd_mixer_oss_ioctl1((struct snd_mixer_oss_file *) file->private_data, cmd, arg);
+        return snd_mixer_oss_ioctl1(file->private_data, cmd, arg);
 }
 
 int snd_mixer_oss_ioctl_card(struct snd_card *card, unsigned int cmd, unsigned long arg)
@@ -582,7 +582,7 @@ static int snd_mixer_oss_get_volume1(struct snd_mixer_oss_file *fmixer,
                                      struct snd_mixer_oss_slot *pslot,
                                      int *left, int *right)
 {
-        struct slot *slot = (struct slot *)pslot->private_data;
+        struct slot *slot = pslot->private_data;
         
         *left = *right = 100;
         if (slot->present & SNDRV_MIXER_OSS_PRESENT_PVOLUME) {
@@ -693,7 +693,7 @@ static int snd_mixer_oss_put_volume1(struct snd_mixer_oss_file *fmixer,
                                      struct snd_mixer_oss_slot *pslot,
                                      int left, int right)
 {
-        struct slot *slot = (struct slot *)pslot->private_data;
+        struct slot *slot = pslot->private_data;
         
         if (slot->present & SNDRV_MIXER_OSS_PRESENT_PVOLUME) {
                 snd_mixer_oss_put_volume1_vol(fmixer, pslot, slot->numid[SNDRV_MIXER_OSS_ITEM_PVOLUME], left, right);
@@ -742,7 +742,7 @@ static int snd_mixer_oss_get_recsrc1_sw(struct snd_mixer_oss_file *fmixer,
                                         struct snd_mixer_oss_slot *pslot,
                                         int *active)
 {
-        struct slot *slot = (struct slot *)pslot->private_data;
+        struct slot *slot = pslot->private_data;
         int left, right;
         
         left = right = 1;
@@ -755,7 +755,7 @@ static int snd_mixer_oss_get_recsrc1_route(struct snd_mixer_oss_file *fmixer,
                                            struct snd_mixer_oss_slot *pslot,
                                            int *active)
 {
-        struct slot *slot = (struct slot *)pslot->private_data;
+        struct slot *slot = pslot->private_data;
         int left, right;
         
         left = right = 1;
@@ -768,7 +768,7 @@ static int snd_mixer_oss_put_recsrc1_sw(struct snd_mixer_oss_file *fmixer,
                                         struct snd_mixer_oss_slot *pslot,
                                         int active)
 {
-        struct slot *slot = (struct slot *)pslot->private_data;
+        struct slot *slot = pslot->private_data;
         
         snd_mixer_oss_put_volume1_sw(fmixer, pslot, slot->numid[SNDRV_MIXER_OSS_ITEM_CSWITCH], active, active, 0);
         return 0;
@@ -778,7 +778,7 @@ static int snd_mixer_oss_put_recsrc1_route(struct snd_mixer_oss_file *fmixer,
                                            struct snd_mixer_oss_slot *pslot,
                                            int active)
 {
-        struct slot *slot = (struct slot *)pslot->private_data;
+        struct slot *slot = pslot->private_data;
         
         snd_mixer_oss_put_volume1_sw(fmixer, pslot, slot->numid[SNDRV_MIXER_OSS_ITEM_CROUTE], active, active, 1);
         return 0;
@@ -815,7 +815,7 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
                 if (!(mixer->mask_recsrc & (1 << idx)))
                         continue;
                 pslot = &mixer->slots[idx];
-                slot = (struct slot *)pslot->private_data;
+                slot = pslot->private_data;
                 if (slot->signature != SNDRV_MIXER_OSS_SIGNATURE)
                         continue;
                 if (!(slot->present & SNDRV_MIXER_OSS_PRESENT_CAPTURE))
@@ -864,7 +864,7 @@ static int snd_mixer_oss_put_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
                 if (!(mixer->mask_recsrc & (1 << idx)))
                         continue;
                 pslot = &mixer->slots[idx];
-                slot = (struct slot *)pslot->private_data;
+                slot = pslot->private_data;
                 if (slot->signature != SNDRV_MIXER_OSS_SIGNATURE)
                         continue;
                 if (!(slot->present & SNDRV_MIXER_OSS_PRESENT_CAPTURE))
@@ -929,7 +929,7 @@ static int snd_mixer_oss_build_test(struct snd_mixer_oss *mixer, struct slot *sl
 
 static void snd_mixer_oss_slot_free(struct snd_mixer_oss_slot *chn)
 {
-        struct slot *p = (struct slot *)chn->private_data;
+        struct slot *p = chn->private_data;
         if (p) {
                 if (p->allocated && p->assigned) {
                         kfree(p->assigned->name);
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index cbe815dfbdc..6b4b1287b31 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -203,10 +203,16 @@ static char *snd_pcm_format_names[] = {
         FORMAT(S18_3BE),
         FORMAT(U18_3LE),
         FORMAT(U18_3BE),
+        FORMAT(G723_24),
+        FORMAT(G723_24_1B),
+        FORMAT(G723_40),
+        FORMAT(G723_40_1B),
 };
 
 const char *snd_pcm_format_name(snd_pcm_format_t format)
 {
+        if (format >= ARRAY_SIZE(snd_pcm_format_names))
+                return "Unknown";
         return snd_pcm_format_names[format];
 }
 EXPORT_SYMBOL_GPL(snd_pcm_format_name);
@@ -358,22 +364,24 @@ static void snd_pcm_stream_proc_info_read(struct snd_info_entry *entry,
 static void snd_pcm_substream_proc_info_read(struct snd_info_entry *entry,
                                              struct snd_info_buffer *buffer)
 {
-        snd_pcm_proc_info_read((struct snd_pcm_substream *)entry->private_data,
-                               buffer);
+        snd_pcm_proc_info_read(entry->private_data, buffer);
 }
 
 static void snd_pcm_substream_proc_hw_params_read(struct snd_info_entry *entry,
                                                   struct snd_info_buffer *buffer)
 {
         struct snd_pcm_substream *substream = entry->private_data;
-        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_pcm_runtime *runtime;
+
+        mutex_lock(&substream->pcm->open_mutex);
+        runtime = substream->runtime;
         if (!runtime) {
                 snd_iprintf(buffer, "closed\n");
-                return;
+                goto unlock;
         }
         if (runtime->status->state == SNDRV_PCM_STATE_OPEN) {
                 snd_iprintf(buffer, "no setup\n");
-                return;
+                goto unlock;
         }
         snd_iprintf(buffer, "access: %s\n", snd_pcm_access_name(runtime->access));
         snd_iprintf(buffer, "format: %s\n", snd_pcm_format_name(runtime->format));
@@ -392,20 +400,25 @@ static void snd_pcm_substream_proc_hw_params_read(struct snd_info_entry *entry,
                 snd_iprintf(buffer, "OSS period frames: %lu\n", (unsigned long)runtime->oss.period_frames);
         }
 #endif
+ unlock:
+        mutex_unlock(&substream->pcm->open_mutex);
 }
 
 static void snd_pcm_substream_proc_sw_params_read(struct snd_info_entry *entry,
                                                   struct snd_info_buffer *buffer)
 {
         struct snd_pcm_substream *substream = entry->private_data;
-        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_pcm_runtime *runtime;
+
+        mutex_lock(&substream->pcm->open_mutex);
+        runtime = substream->runtime;
         if (!runtime) {
                 snd_iprintf(buffer, "closed\n");
-                return;
+                goto unlock;
         }
         if (runtime->status->state == SNDRV_PCM_STATE_OPEN) {
                 snd_iprintf(buffer, "no setup\n");
-                return;
+                goto unlock;
         }
         snd_iprintf(buffer, "tstamp_mode: %s\n", snd_pcm_tstamp_mode_name(runtime->tstamp_mode));
         snd_iprintf(buffer, "period_step: %u\n", runtime->period_step);
@@ -415,24 +428,29 @@ static void snd_pcm_substream_proc_sw_params_read(struct snd_info_entry *entry,
         snd_iprintf(buffer, "silence_threshold: %lu\n", runtime->silence_threshold);
         snd_iprintf(buffer, "silence_size: %lu\n", runtime->silence_size);
         snd_iprintf(buffer, "boundary: %lu\n", runtime->boundary);
+ unlock:
+        mutex_unlock(&substream->pcm->open_mutex);
 }
 
 static void snd_pcm_substream_proc_status_read(struct snd_info_entry *entry,
                                                struct snd_info_buffer *buffer)
 {
         struct snd_pcm_substream *substream = entry->private_data;
-        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_pcm_runtime *runtime;
         struct snd_pcm_status status;
         int err;
+
+        mutex_lock(&substream->pcm->open_mutex);
+        runtime = substream->runtime;
         if (!runtime) {
                 snd_iprintf(buffer, "closed\n");
-                return;
+                goto unlock;
         }
         memset(&status, 0, sizeof(status));
         err = snd_pcm_status(substream, &status);
         if (err < 0) {
                 snd_iprintf(buffer, "error %d\n", err);
-                return;
+                goto unlock;
         }
         snd_iprintf(buffer, "state: %s\n", snd_pcm_state_name(status.state));
         snd_iprintf(buffer, "owner_pid   : %d\n", pid_vnr(substream->pid));
@@ -446,6 +464,8 @@ static void snd_pcm_substream_proc_status_read(struct snd_info_entry *entry,
         snd_iprintf(buffer, "-----\n");
         snd_iprintf(buffer, "hw_ptr      : %ld\n", runtime->status->hw_ptr);
         snd_iprintf(buffer, "appl_ptr    : %ld\n", runtime->control->appl_ptr);
+ unlock:
+        mutex_unlock(&substream->pcm->open_mutex);
 }
 
 #ifdef CONFIG_SND_PCM_XRUN_DEBUG
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index d6ecca27bb6..a1707cca9c6 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -67,6 +67,8 @@ void snd_pcm_playback_silence(struct snd_pcm_substream *substream, snd_pcm_ufram
         } else {
                 if (new_hw_ptr == ULONG_MAX) {  /* initialization */
                         snd_pcm_sframes_t avail = snd_pcm_playback_hw_avail(runtime);
+                        if (avail > runtime->buffer_size)
+                                avail = runtime->buffer_size;
                         runtime->silence_filled = avail > 0 ? avail : 0;
                         runtime->silence_start = (runtime->status->hw_ptr +
                                                   runtime->silence_filled) %
@@ -287,8 +289,11 @@ int snd_pcm_update_state(struct snd_pcm_substream *substream,
                         return -EPIPE;
                 }
         }
-        if (avail >= runtime->control->avail_min)
-                wake_up(runtime->twake ? &runtime->tsleep : &runtime->sleep);
+        if (runtime->twake) {
+                if (avail >= runtime->twake)
+                        wake_up(&runtime->tsleep);
+        } else if (avail >= runtime->control->avail_min)
+                wake_up(&runtime->sleep);
         return 0;
 }
 
@@ -1711,7 +1716,7 @@ EXPORT_SYMBOL(snd_pcm_period_elapsed);
  * The available space is stored on availp.  When err = 0 and avail = 0
  * on the capture stream, it indicates the stream is in DRAINING state.
  */
-static int wait_for_avail_min(struct snd_pcm_substream *substream,
+static int wait_for_avail(struct snd_pcm_substream *substream,
                               snd_pcm_uframes_t *availp)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
@@ -1761,7 +1766,7 @@ static int wait_for_avail_min(struct snd_pcm_substream *substream,
                         avail = snd_pcm_playback_avail(runtime);
                 else
                         avail = snd_pcm_capture_avail(runtime);
-                if (avail >= runtime->control->avail_min)
+                if (avail >= runtime->twake)
                         break;
         }
  _endloop:
@@ -1824,7 +1829,7 @@ static snd_pcm_sframes_t snd_pcm_lib_write1(struct snd_pcm_substream *substream,
                 goto _end_unlock;
         }
 
-        runtime->twake = 1;
+        runtime->twake = runtime->control->avail_min ? : 1;
         while (size > 0) {
                 snd_pcm_uframes_t frames, appl_ptr, appl_ofs;
                 snd_pcm_uframes_t avail;
@@ -1837,7 +1842,9 @@ static snd_pcm_sframes_t snd_pcm_lib_write1(struct snd_pcm_substream *substream,
                                 err = -EAGAIN;
                                 goto _end_unlock;
                         }
-                        err = wait_for_avail_min(substream, &avail);
+                        runtime->twake = min_t(snd_pcm_uframes_t, size,
+                                        runtime->control->avail_min ? : 1);
+                        err = wait_for_avail(substream, &avail);
                         if (err < 0)
                                 goto _end_unlock;
                 }
@@ -2046,7 +2053,7 @@ static snd_pcm_sframes_t snd_pcm_lib_read1(struct snd_pcm_substream *substream,
                 goto _end_unlock;
         }
 
-        runtime->twake = 1;
+        runtime->twake = runtime->control->avail_min ? : 1;
         while (size > 0) {
                 snd_pcm_uframes_t frames, appl_ptr, appl_ofs;
                 snd_pcm_uframes_t avail;
@@ -2064,7 +2071,9 @@ static snd_pcm_sframes_t snd_pcm_lib_read1(struct snd_pcm_substream *substream,
                                 err = -EAGAIN;
                                 goto _end_unlock;
                         }
-                        err = wait_for_avail_min(substream, &avail);
+                        runtime->twake = min_t(snd_pcm_uframes_t, size,
+                                        runtime->control->avail_min ? : 1);
+                        err = wait_for_avail(substream, &avail);
                         if (err < 0)
                                 goto _end_unlock;
                         if (!avail)
diff --git a/sound/core/pcm_misc.c b/sound/core/pcm_misc.c
index ea2bf82c937..434af3c56d5 100644
--- a/sound/core/pcm_misc.c
+++ b/sound/core/pcm_misc.c
@@ -128,6 +128,14 @@ static struct pcm_format_data pcm_formats[SNDRV_PCM_FORMAT_LAST+1] = {
                 .width = 4, .phys = 4, .le = -1, .signd = -1,
                 .silence = {},
         },
+        [SNDRV_PCM_FORMAT_G723_24] = {
+                .width = 3, .phys = 3, .le = -1, .signd = -1,
+                .silence = {},
+        },
+        [SNDRV_PCM_FORMAT_G723_40] = {
+                .width = 5, .phys = 5, .le = -1, .signd = -1,
+                .silence = {},
+        },
         /* FIXME: the following three formats are not defined properly yet */
         [SNDRV_PCM_FORMAT_MPEG] = {
                 .le = -1, .signd = -1,
@@ -186,6 +194,14 @@ static struct pcm_format_data pcm_formats[SNDRV_PCM_FORMAT_LAST+1] = {
                 .width = 18, .phys = 24, .le = 0, .signd = 0,
                 .silence = { 0x02, 0x00, 0x00 },
         },
+        [SNDRV_PCM_FORMAT_G723_24_1B] = {
+                .width = 3, .phys = 8, .le = -1, .signd = -1,
+                .silence = {},
+        },
+        [SNDRV_PCM_FORMAT_G723_40_1B] = {
+                .width = 5, .phys = 8, .le = -1, .signd = -1,
+                .silence = {},
+        },
 };
 
 
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 2d2e1b65ee9..8bc7cb3db33 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -142,7 +142,7 @@ int snd_pcm_info_user(struct snd_pcm_substream *substream,
 
 #ifdef RULES_DEBUG
 #define HW_PARAM(v) [SNDRV_PCM_HW_PARAM_##v] = #v
-char *snd_pcm_hw_param_names[] = {
+static const char * const snd_pcm_hw_param_names[] = {
         HW_PARAM(ACCESS),
         HW_PARAM(FORMAT),
         HW_PARAM(SUBFORMAT),
@@ -451,13 +451,11 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
         snd_pcm_timer_resolution_change(substream);
         runtime->status->state = SNDRV_PCM_STATE_SETUP;
 
-        if (substream->latency_pm_qos_req) {
-                pm_qos_remove_request(substream->latency_pm_qos_req);
-                substream->latency_pm_qos_req = NULL;
-        }
+        if (pm_qos_request_active(&substream->latency_pm_qos_req))
+                pm_qos_remove_request(&substream->latency_pm_qos_req);
         if ((usecs = period_to_usecs(runtime)) >= 0)
-                substream->latency_pm_qos_req = pm_qos_add_request(
-                                        PM_QOS_CPU_DMA_LATENCY, usecs);
+                pm_qos_add_request(&substream->latency_pm_qos_req,
+                                   PM_QOS_CPU_DMA_LATENCY, usecs);
         return 0;
  _error:
         /* hardware might be unuseable from this time,
@@ -512,8 +510,7 @@ static int snd_pcm_hw_free(struct snd_pcm_substream *substream)
         if (substream->ops->hw_free)
                 result = substream->ops->hw_free(substream);
         runtime->status->state = SNDRV_PCM_STATE_OPEN;
-        pm_qos_remove_request(substream->latency_pm_qos_req);
-        substream->latency_pm_qos_req = NULL;
+        pm_qos_remove_request(&substream->latency_pm_qos_req);
         return result;
 }
 
@@ -983,6 +980,10 @@ static int snd_pcm_do_pause(struct snd_pcm_substream *substream, int push)
 {
         if (substream->runtime->trigger_master != substream)
                 return 0;
+        /* some drivers might use hw_ptr to recover from the pause -
+           update the hw_ptr now */
+        if (push)
+                snd_pcm_update_hw_ptr(substream);
         /* The jiffies check in snd_pcm_update_hw_ptr*() is done by
          * a delta betwen the current jiffies, this gives a large enough
          * delta, effectively to skip the check once.
@@ -1993,6 +1994,8 @@ void snd_pcm_release_substream(struct snd_pcm_substream *substream)
                 substream->ops->close(substream);
                 substream->hw_opened = 0;
         }
+        if (pm_qos_request_active(&substream->latency_pm_qos_req))
+                pm_qos_remove_request(&substream->latency_pm_qos_req);
         if (substream->pcm_release) {
                 substream->pcm_release(substream);
                 substream->pcm_release = NULL;
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index eb68326c37d..a7868ad4d53 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -829,6 +829,8 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card,
                 
                 if (get_user(device, (int __user *)argp))
                         return -EFAULT;
+                if (device >= SNDRV_RAWMIDI_DEVICES) /* next device is -1 */
+                        device = SNDRV_RAWMIDI_DEVICES - 1;
                 mutex_lock(&register_mutex);
                 device = device < 0 ? 0 : device + 1;
                 while (device < SNDRV_RAWMIDI_DEVICES) {
diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
index 685712276ac..69cd7b3c362 100644
--- a/sound/core/seq/oss/seq_oss_init.c
+++ b/sound/core/seq/oss/seq_oss_init.c
@@ -281,13 +281,10 @@ snd_seq_oss_open(struct file *file, int level)
         return 0;
 
  _error:
-        snd_seq_oss_writeq_delete(dp->writeq);
-        snd_seq_oss_readq_delete(dp->readq);
         snd_seq_oss_synth_cleanup(dp);
         snd_seq_oss_midi_cleanup(dp);
-        delete_port(dp);
         delete_seq_queue(dp->queue);
-        kfree(dp);
+        delete_port(dp);
 
         return rc;
 }
@@ -350,8 +347,10 @@ create_port(struct seq_oss_devinfo *dp)
 static int
 delete_port(struct seq_oss_devinfo *dp)
 {
-        if (dp->port < 0)
+        if (dp->port < 0) {
+                kfree(dp);
                 return 0;
+        }
 
         debug_printk(("delete_port %i\n", dp->port));
         return snd_seq_event_port_detach(dp->cseq, dp->port);