davinci oss: improve clipping and arbritary noise

Audio capturing generated arbritrary noise as if old buffers (or random data) was being played. This patch tries to protect against that by checking boundaries and make some defensive trade-offs. Noise is almost gone, but not entirely.

sound/oss/davinci-audio-aic32.c

@@ -248,8 +248,11 @@ static audio_state_t aic32_state = {
 	.owner = THIS_MODULE,
 	.output_stream = &output_stream,
 	.input_stream = &input_stream,
+	.rd_ref = 0,
+	.wr_ref = 0,
 /*    .need_tx_for_rx = 1, //Once the Full Duplex works  */
 	.need_tx_for_rx = 0,
+	.data = NULL,
 	.hw_init = davinci_aic32_initialize,
 	.hw_shutdown = davinci_aic32_shutdown,
 	.client_ioctl = davinci_aic32_ioctl,
@@ -257,6 +260,7 @@ static audio_state_t aic32_state = {
 	.hw_remove = __exit_p(davinci_aic32_remove),
 	.hw_suspend = davinci_aic32_suspend,
 	.hw_resume = davinci_aic32_resume,
+	.pm_dev = NULL,
 };
 
 /* This will be defined in the audio.h */

sound/oss/davinci-audio-dma-intfc.c

@@ -274,6 +274,8 @@ davinci_request_sound_dma(int device_id, const char *device_name, void *data,
 		return -ENOMEM;
 	}
 
+	memset(*channels, 0, sizeof(int) * NUMBER_OF_CHANNELS_TO_LINK);
+
 	/* request for the Master channel and setup the params */
 	i = 0;
 	err = davinci_request_dma(device_id, device_name,
@@ -538,6 +540,7 @@ int audio_sync(struct file *file)
 		/*wait for a buffer to become free */
 		if (wait_for_completion_interruptible(&s->wfc))
 			return 0;
+
 		/*
 		 * HACK ALERT !
 		 * To avoid increased complexity in the rest of the code
@@ -545,12 +548,14 @@ int audio_sync(struct file *file)
 		 * with the start pointer here and don't forget to restore
 		 * it later.
 		 */
+		local_irq_save(flags);
 		shiftval = s->fragsize - b->offset;
+		if (shiftval > 0) {
 			b->offset = shiftval;
 			b->dma_addr -= shiftval;
 			b->data -= shiftval;
-		local_irq_save(flags);
 			s->bytecount -= shiftval;
+		     }
 		if (++s->usr_head >= s->nbfrags)
 			s->usr_head = 0;
 
@@ -572,7 +577,7 @@ int audio_sync(struct file *file)
 	remove_wait_queue(&s->wq, &wait);
 
 	/* undo the pointer hack above */
-	if (shiftval) {
+	if (shiftval > 0) {
 		local_irq_save(flags);
 		b->dma_addr += shiftval;
 		b->data += shiftval;

sound/oss/davinci-audio.c

@@ -59,7 +59,7 @@
 /***************************** MACROS ************************************/
 
 #undef DEBUG
-/* #define DEBUG */
+
 #ifdef DEBUG
 #define DPRINTK  printk
 #define FN_IN printk("[davinci_audio.c:[%s] start\n", __FUNCTION__)
@@ -548,7 +548,7 @@ audio_write(struct file *file, const char *buffer, size_t count, loff_t * ppos)
 		chunksize = s->fragsize - b->offset;
 		if (chunksize > count)
 			chunksize = count;
-		DPRINTK("write %d to %d\n", chunksize, s->usr_head);
+		DPRINTK("write %d to %d (0x%p)\n", chunksize, s->usr_head, buffer);
 		if (copy_from_user(b->data + b->offset, buffer, chunksize)) {
 			DPRINTK("Audio: CopyFrom User failed \n");
 			complete(&s->wfc);
@@ -576,9 +576,9 @@ audio_write(struct file *file, const char *buffer, size_t count, loff_t * ppos)
 		audio_process_dma(s);
 	}
 
-	if ((buffer - buffer0))
+	if ((buffer - buffer0)) {
 		ret = buffer - buffer0;
-
+	}
 	DPRINTK("audio_write: return=%d\n", ret);
 	return ret;
 }