1 files changed, 19 insertions, 9 deletions

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 84fef5084e1..b9c0910fb8c 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -21,6 +21,7 @@
 /* this file included from control.c */
 
 #include <linux/compat.h>
+#include <linux/slab.h>
 
 struct snd_ctl_elem_list32 {
 	u32 offset;
@@ -82,6 +83,8 @@ struct snd_ctl_elem_info32 {
 			u32 items;
 			u32 item;
 			char name[64];
+			u64 names_ptr;
+			u32 names_length;
 		} enumerated;
 		unsigned char reserved[128];
 	} value;
@@ -109,7 +112,7 @@ static int snd_ctl_elem_info_compat(struct snd_ctl_file *ctl,
 		goto error;
 
 	snd_power_lock(ctl->card);
-	err = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0, NULL);
+	err = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0);
 	if (err >= 0)
 		err = snd_ctl_elem_info(ctl, data);
 	snd_power_unlock(ctl->card);
@@ -219,7 +222,8 @@ static int copy_ctl_value_from_user(struct snd_card *card,
 				    struct snd_ctl_elem_value32 __user *data32,
 				    int *typep, int *countp)
 {
-	int i, type, count, size;
+	int i, type, size;
+	int uninitialized_var(count);
 	unsigned int indirect;
 
 	if (copy_from_user(&data->id, &data32->id, sizeof(data->id)))
@@ -243,7 +247,7 @@ static int copy_ctl_value_from_user(struct snd_card *card,
 	} else {
 		size = get_elem_size(type, count);
 		if (size < 0) {
-			printk(KERN_ERR "snd_ioctl32_ctl_elem_value: unknown type %d\n", type);
+			dev_err(card->dev, "snd_ioctl32_ctl_elem_value: unknown type %d\n", type);
 			return -EINVAL;
 		}
 		if (copy_from_user(data->value.bytes.data,
@@ -294,7 +298,7 @@ static int snd_ctl_elem_read_user_compat(struct snd_card *card,
 		goto error;
 
 	snd_power_lock(card);
-	err = snd_power_wait(card, SNDRV_CTL_POWER_D0, NULL);
+	err = snd_power_wait(card, SNDRV_CTL_POWER_D0);
 	if (err >= 0)
 		err = snd_ctl_elem_read(card, data);
 	snd_power_unlock(card);
@@ -320,7 +324,7 @@ static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file,
 		goto error;
 
 	snd_power_lock(card);
-	err = snd_power_wait(card, SNDRV_CTL_POWER_D0, NULL);
+	err = snd_power_wait(card, SNDRV_CTL_POWER_D0);
 	if (err >= 0)
 		err = snd_ctl_elem_write(card, file, data);
 	snd_power_unlock(card);
@@ -370,6 +374,8 @@ static int snd_ctl_elem_add_compat(struct snd_ctl_file *file,
 				   &data32->value.enumerated,
 				   sizeof(data->value.enumerated)))
 			goto error;
+		data->value.enumerated.names_ptr =
+			(uintptr_t)compat_ptr(data->value.enumerated.names_ptr);
 		break;
 	default:
 		break;
@@ -392,12 +398,13 @@ enum {
 static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	struct snd_ctl_file *ctl;
-	struct list_head *list;
+	struct snd_kctl_ioctl *p;
 	void __user *argp = compat_ptr(arg);
 	int err;
 
 	ctl = file->private_data;
-	snd_assert(ctl && ctl->card, return -ENXIO);
+	if (snd_BUG_ON(!ctl || !ctl->card))
+		return -ENXIO;
 
 	switch (cmd) {
 	case SNDRV_CTL_IOCTL_PVERSION:
@@ -407,6 +414,10 @@ static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, uns
 	case SNDRV_CTL_IOCTL_POWER_STATE:
 	case SNDRV_CTL_IOCTL_ELEM_LOCK:
 	case SNDRV_CTL_IOCTL_ELEM_UNLOCK:
+	case SNDRV_CTL_IOCTL_ELEM_REMOVE:
+	case SNDRV_CTL_IOCTL_TLV_READ:
+	case SNDRV_CTL_IOCTL_TLV_WRITE:
+	case SNDRV_CTL_IOCTL_TLV_COMMAND:
 		return snd_ctl_ioctl(file, cmd, (unsigned long)argp);
 	case SNDRV_CTL_IOCTL_ELEM_LIST32:
 		return snd_ctl_elem_list_compat(ctl->card, argp);
@@ -423,8 +434,7 @@ static inline long snd_ctl_ioctl_compat(struct file *file, unsigned int cmd, uns
 	}
 
 	down_read(&snd_ioctl_rwsem);
-	list_for_each(list, &snd_control_compat_ioctls) {
-		struct snd_kctl_ioctl *p = list_entry(list, struct snd_kctl_ioctl, list);
+	list_for_each_entry(p, &snd_control_compat_ioctls, list) {
 		if (p->fioctl) {
 			err = p->fioctl(ctl->card, ctl, cmd, arg);
 			if (err != -ENOIOCTLCMD) {