summaryrefslogtreecommitdiff
path: root/sound/usb
AgeCommit message (Collapse)Author
2019-07-02ALSA: line6: Fix write on zero-sized bufferTakashi Iwai
LINE6 drivers allocate the buffers based on the value returned from usb_maxpacket() calls. The manipulated device may return zero for this, and this results in the kmalloc() with zero size (and it may succeed) while the other part of the driver code writes the packet data with the fixed size -- which eventually overwrites. This patch adds a simple sanity check for the invalid buffer size for avoiding that problem. Reported-by: syzbot+219f00fb49874dcaea17@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-06-28ALSA: usb-audio: fix sign unintended sign extension on left shiftsColin Ian King
There are a couple of left shifts of unsigned 8 bit values that first get promoted to signed ints and hence get sign extended on the shift if the top bit of the 8 bit values are set. Fix this by casting the 8 bit values to unsigned ints to stop the unintentional sign extension. Addresses-Coverity: ("Unintended sign extension") Signed-off-by: Colin Ian King <colin.king@canonical.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-05-28ALSA: line6: Assure canceling delayed work at disconnectionTakashi Iwai
The current code performs the cancel of a delayed work at the late stage of disconnection procedure, which may lead to the access to the already cleared state. This patch assures to call cancel_delayed_work_sync() at the beginning of the disconnection procedure for avoiding that race. The delayed work object is now assigned in the common line6 object instead of its derivative, so that we can call cancel_delayed_work_sync(). Along with the change, the startup function is called via the new callback instead. This will make it easier to port other LINE6 drivers to use the delayed work for startup in later patches. Reported-by: syzbot+5255458d5e0a2b10bbb9@syzkaller.appspotmail.com Fixes: 7f84ff68be05 ("ALSA: line6: toneport: Fix broken usage of timer for delayed execution") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-05-09Merge tag 'sound-5.2-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "The most significant changes at this cycle are the Sound Open Firmware support from Intel for the common DSP framework along with its support for Intel platforms. It's a door opened to a real "free" firmware (in the sense of FOSS), and other parties show interests in it. In addition to SOF, we've got a bunch of updates and fixes as usual. Some highlights are below. ALSA core: - Cleanups and fixes in ALSA timer code to cover some races spotted by syzkaller - Cleanups and fixes in ALSA sequencer code to cover some races, again unsurprisingly, spotted by syzkaller - Optimize the common page allocation helper with alloc_pages_exact() ASoC: - Add SOF core support, as well as Intel SOF platform support - Generic card driver improvements: support for MCLK/sample rate ratio and pin switches - A big set of improvements to TLV320AIC32x4 drivers - New drivers for Freescale audio mixers, several Intel machines, several Mediatek machines, Meson G12A, Spreadtrum compressed audio and DMA devices HD-audio: - A few Realtek codec fixes for reducing pop noises - Quirks for Chromebooks - Workaround for faulty connection report on AMD/Nvidia HDMI Others: - A quirk for Focusrite Scarlett Solo USB-audio - Add support for MOTU 8pre FireWire - 24bit sample format support in aloop - GUS patch format support (finally, over a decade) in native emux synth code" * tag 'sound-5.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (375 commits) ASoC: SOF: Fix unused variable warnings ALSA: line6: toneport: Fix broken usage of timer for delayed execution ALSA: aica: Fix a long-time build breakage ALSA: hda/realtek - Support low power consumption for ALC256 ASoC: stm32: i2s: update pcm hardware constraints ASoC: codec: hdac_hdmi: no checking monitor in hw_params ASoC: mediatek: mt6358: save PGA for mixer control ASoC: mediatek: mt6358: save output volume for mixer controls ASoC: mediatek: mt6358: initialize setting when ramping volume ASoC: SOF: core: fix undefined nocodec reference ASoC: SOF: xtensa: fix undefined references ASoC: SOF: Propagate sof_get_ctrl_copy_params() error properly ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14) ALSA: hda/intel: add CometLake PCI IDs ALSA: hda/realtek - Support low power consumption for ALC295 ASoC: rockchip: Fix an uninitialized variable compile warning ASoC: SOF: Fix a compile warning with CONFIG_PCI=n ASoC: da7219: Fix a compile warning at CONFIG_COMMON_CLK=n ASoC: sound/soc/sof/: fix kconfig dependency warning ASoC: stm32: spdifrx: change trace level on iec control ...
2019-05-08Merge tag 'media/v5.1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - remove the deprecated Zoran driver from staging - new I2C driver: ST MIPID02 CSI-2 camera bridge - new platform driver: Amlogic Meson AO CEC G12A Controller - add support for USB audio via the media controller - au0828 driver is now supported via the media controller on both on media and on usbaudio - new kernel test for the media device allocator - add support for stateless decoder at vicodec driver - lots of other driver improvements fixes and cleanups * tag 'media/v5.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (218 commits) media: dt-bindings: aspeed-video: Add missing memory-region property media: platform: Aspeed: Make reserved memory optional media: platform: Aspeed: Remove use of reset line media: stm32-dcmi: return appropriate error codes during probe media: vsp1: Add support for missing 16-bit RGB555 formats media: vsp1: Add support for missing 16-bit RGB444 formats media: vsp1: Add support for missing 32-bit RGB formats media: v4l: Add definitions for missing 16-bit RGB555 formats media: v4l: Add definitions for missing 16-bit RGB4444 formats media: v4l: Add definitions for missing 32-bit RGB formats media: zoran: remove deprecated driver media: MAINTAINERS: Update AO CEC with ao-cec-g12a driver media: platform: meson: Add Amlogic Meson G12A AO CEC Controller driver media: dt-bindings: media: meson-ao-cec: Add G12A AO-CEC-B Compatible media: cros-ec-cec: decrement HDMI device refcount media: seco-cec: decrement HDMI device refcount media: tegra_cec: use new cec_notifier_parse_hdmi_phandle helper media: stih_cec: use new cec_notifier_parse_hdmi_phandle helper media: s5p_cec: use new cec_notifier_parse_hdmi_phandle helper media: meson: ao-cec: use new cec_notifier_parse_hdmi_phandle helper ...
2019-05-08ALSA: line6: toneport: Fix broken usage of timer for delayed executionTakashi Iwai
The line6 toneport driver has code for some delayed initialization, and this hits the kernel Oops because mutex and other sleepable functions are used in the timer callback. Fix the abuse by a delayed work instead so that everything works gracefully. Reported-by: syzbot+a07d0142e74fdd595cfb@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-05-07Merge tag 'leds-for-5.2-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED updates from Jacek Anaszewski: "LED core fixes and improvements: - avoid races with workqueue - Kconfig: pedantic cleanup - small fixes for Flash class description leds-lt3593: - remove unneeded assignment in lt3593_led_probe - drop pdata handling code leds-blinkm: - clean up double assignment to data->i2c_addr leds-pca955x, leds-pca963x: - revert ACPI support, as it turned out that there is no evidence of officially registered ACPI IDs for these devices. - make use of device property API leds-as3645a: - switch to fwnode property API LED related addition to ACPI documentation: - document how to refer to LEDs from remote nodes LED related fix to ALSA line6/toneport driver: - avoid polluting led_* namespace And lm3532 driver relocation from MFD to LED subsystem, accompanied by various improvements and optimizations; it entails also a change in omap4-droid4-xt894.dts: - leds: lm3532: Introduce the lm3532 LED driver - mfd: ti-lmu: Remove LM3532 backlight driver references - ARM: dts: omap4-droid4: Update backlight dt properties - dt: lm3532: Add lm3532 dt doc and update ti_lmu doc" * tag 'leds-for-5.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: leds: avoid races with workqueue ALSA: line6: Avoid polluting led_* namespace leds: lm3532: Introduce the lm3532 LED driver mfd: ti-lmu: Remove LM3532 backlight driver references ARM: dts: omap4-droid4: Update backlight dt properties dt: lm3532: Add lm3532 dt doc and update ti_lmu doc leds: Small fixes for Flash class description leds: blinkm: clean up double assignment to data->i2c_addr leds: pca963x: Make use of device property API leds: pca955x: Make use of device property API leds: lt3593: Remove unneeded assignment in lt3593_led_probe leds: lt3593: drop pdata handling code leds: pca955x: Revert "Add ACPI support" leds: pca963x: Revert "Add ACPI support" drivers: leds: Kconfig: pedantic cleanups ACPI: Document how to refer to LEDs from remote nodes leds: as3645a: Switch to fwnode property API
2019-05-06Merge branch 'for-linus' into for-nextTakashi Iwai
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-04-29ALSA: usx2y: fix a double free bugWenwen Wang
In usX2Y_In04_init(), a new urb is firstly created through usb_alloc_urb() and saved to 'usX2Y->In04urb'. Then, a buffer is allocated through kmalloc() and saved to 'usX2Y->In04Buf'. If the allocation of the buffer fails, the error code ENOMEM is returned after usb_free_urb(), which frees the created urb. However, the urb is actually freed at card->private_free callback, i.e., snd_usX2Y_card_private_free(). So the free operation here leads to a double free bug. To fix the above issue, simply remove usb_free_urb(). Signed-off-by: Wenwen Wang <wang6495@umn.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-04-28ALSA: line6: use dynamic buffersGreg Kroah-Hartman
The line6 driver uses a lot of USB buffers off of the stack, which is not allowed on many systems, causing the driver to crash on some of them. Fix this up by dynamically allocating the buffers with kmalloc() which allows for proper DMA-able memory. Reported-by: Christo Gouws <gouws.christo@gmail.com> Reported-by: Alan Stern <stern@rowland.harvard.edu> Tested-by: Christo Gouws <gouws.christo@gmail.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-04-28ALSA: usb-audio: Fix a memory leak bugWenwen Wang
In parse_audio_selector_unit(), the string array 'namelist' is allocated through kmalloc_array(), and each string pointer in this array, i.e., 'namelist[]', is allocated through kmalloc() in the following for loop. Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If an error occurs during the creation process, the string array 'namelist', including all string pointers in the array 'namelist[]', should be freed, before the error code ENOMEM is returned. However, the current code does not free 'namelist[]', resulting in memory leaks. To fix the above issue, free all string pointers 'namelist[]' in a loop. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-04-24ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()Takashi Iwai
The error from snd_usb_mixer_apply_create_quirk() is ignored in the current usb-audio driver code, which will continue the probing even after the error. Let's take it more serious. Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks") Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-04-22media: sound/usb: Use Media Controller API to share media resourcesShuah Khan
Media Device Allocator API to allows multiple drivers share a media device. This API solves a very common use-case for media devices where one physical device (an USB stick) provides both audio and video. When such media device exposes a standard USB Audio class, a proprietary Video class, two or more independent drivers will share a single physical USB bridge. In such cases, it is necessary to coordinate access to the shared resource. Using this API, drivers can allocate a media device with the shared struct device as the key. Once the media device is allocated by a driver, other drivers can get a reference to it. The media device is released when all the references are released. Change the ALSA driver to use the Media Controller API to share media resources with DVB, and V4L2 drivers on a AU0828 media device. The Media Controller specific initialization is done after sound card is registered. ALSA creates Media interface and entity function graph nodes for Control, Mixer, PCM Playback, and PCM Capture devices. snd_usb_hw_params() will call Media Controller enable source handler interface to request the media resource. If resource request is granted, it will release it from snd_usb_hw_free(). If resource is busy, -EBUSY is returned. Media specific cleanup is done in usb_audio_disconnect(). Reviewed-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Shuah Khan <shuah@kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-04-18ALSA: line6: Avoid polluting led_* namespaceJacek Anaszewski
led_colors clashes with the array of the same name being added to the LED class. Do the following amendments to fix this issue and the other prospective one. led_colors -> toneport_led_colors led_init_vals -> toneport_led_init_vals Fixes: f44edd7b2bbed ("ALSA: line6/toneport: Implement LED controls via LED class") Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com> Cc: Jaroslav Kysela <perex@perex.cz> Cc: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Takashi Iwai <tiwai@suse.de>
2019-04-15ALSA: usb-audio: Add quirk for Focusrite Scarlett SoloRoope Salmi
The device reports Synch: Synchronous on the playback interface. This causes regular audible napping on sample rates that are not multiples of 1 kHz. Fix to Synch: Asynchronous. Specifically observed on Focusrite Scarlett Solo 2nd generation. I assume the first generation model has a different device ID. A first generation Scarlett 2i2 I was able to test advertised Synch: Asynchronous by default. For example, with a sample rate of 44100 Hz, a silent sample is played every 40.96 seconds (likely 44.0 samples instead of 44.1 transmitted per USB frame on average, 4096 being the size of some internal buffer). There may be some other bug at play here since this doesn't happen on other platforms. However, a feedback endpoint is listed and using it fixes the issue. That is the only change in the quirk, but I didn't find a way to declare only it. Tested on two units and on two different computers. Signed-off-by: Roope Salmi <rpsalmi@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-03-27ALSA: us122l: Use alloc_pages_exact()Takashi Iwai
alloc_pages_exact() is more suitable choice for allocating the sound buffers, as it doesn't need to align with power-of-two. Along with the conversion, we can drop __GFP_COMP as well. The patch also replace the error messages to be more explicit. Acked-by: Michal Hocko <mhocko@suse.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-03-27ALSA: Replace snd_malloc_pages() and snd_free_pages() with standard helpers, ↵Takashi Iwai
take#2 snd_malloc_pages() and snd_free_pages() are merely thin wrappers of the standard page allocator / free functions. Even the arguments are compatible with some standard helpers, so there is little merit of keeping these wrappers. This patch replaces the all existing callers of snd_malloc_pages() and snd_free_pages() with the direct calls of the standard helper functions. In this version, we use a recently introduced one, alloc_pages_exact(), which suits better than the old snd_malloc_pages() implementation for our purposes. Then we can avoid the waste of pages by alignment to power-of-two. Since alloc_pages_exact() does split pages, we need no longer __GFP_COMP flag; or better to say, we must not pass __GFP_COMP to alloc_pages_exact(). So the former unconditional addition of __GFP_COMP flag in snd_malloc_pages() is dropped, as well as in most other places. Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Acked-by: Michal Hocko <mhocko@suse.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-03-13ALSA: usx2y: Fix potential NULL pointer dereferenceAditya Pakki
usb_alloc_urb() can fail due to kmalloc failure and push the error upstream. Further this can cause a NULL pointer dereference in init_pipe_urbs(). This patch avoids such a scenario. Signed-off-by: Aditya Pakki <pakki001@umn.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-28ALSA: usb-audio: Add quirk for MOTU MicroBook IIManuel Reinhardt
Add an entry to the quirks-table to for usb-audio to recognize the Microbook II (although it only exposes vendor interfaces). A simple boot quirk is also implemented to set up the sample rate and make sure that no audio urbs are sent before the device is ready. This patch only provides audio playback and capture at 96kHz sample rate. Notice the following shortcomings: - The sample rate is currently hardcoded to 96k although the device also supports 48k and 44.1k. - The various mixer controls of the MicroBook are not made available. - The keep-iface control should be on by default because the device shuts down whenever the altsetting is reset which is usually unwanted. (I don't know the best way to do this) - The communication format used by the MicroBook for sample rate setting and also other setup has been reverse engineered by looking at the usbmon output while running the windows driver through virtualbox. In this patch the first byte of every message is set to \0 while in the observed communications the first byte acts as a "message-counter" increasing its value with every message sent. Leaving it at \0 does not seem to affect the device. Signed-off-by: Manuel Reinhardt <manuel.rhdt@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-18ALSA: usb-audio: Expose sample resolution through proc interfaceJussi Laako
At least some USB devices use (MSB-aligned) audio format larger than the actual resolution of the device. In order to expose the actual device resolution (bBitResolution), add extra field to the procfs stream info interface. Signed-off-by: Jussi Laako <jussi@sonarnerd.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-08Merge branch 'for-linus' into for-nextTakashi Iwai
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-08Merge branch 'topic/memory-device-fixes-2' into for-nextTakashi Iwai
Pull further device memory allocation cleanups (but no API change yet). Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-07ALSA: usb-audio: Fix implicit fb endpoint setup by quirkManuel Reinhardt
The commit a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function") introduced an error in the handling of quirks for implicit feedback endpoints. This commit fixes this. If a quirk successfully sets up an implicit feedback endpoint, usb-audio no longer tries to find the implicit fb endpoint itself. Fixes: a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function") Signed-off-by: Manuel Reinhardt <manuel.rhdt@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-06ALSA: usb: Clean up with new procfs helpersTakashi Iwai
Simplify the proc fs creation code with new helper functions, snd_card_ro_proc_new() and snd_card_rw_proc_new(). Just a code refactoring and no functional changes. Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-06ALSA: usb: Drop superfluous PCM preallocation error checksTakashi Iwai
snd_pcm_lib_preallocate_pages() and co always succeed, so the error check is simply redundant. Drop it. Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-05ALSA: usb-audio: Add support for new T+A USB DACUdo Eberhardt
This patch adds the T+A VID to the generic check in order to enable native DSD support for T+A devices. This works with the new T+A USB DAC model SD3100HV and will also work with future devices which support the XMOS/Thesycon style DSD format. Signed-off-by: Udo Eberhardt <udo.eberhardt@thesycon.de> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-29ALSA: usb-audio: Cleanup DSD whitelistJussi Laako
XMOS/Thesycon family of USB Audio Class firmware flags DSD altsetting separate from the PCM ones. Thus the DSD altsetting can be auto-detected based on the flag and doesn't need maintaining specific altsetting whitelist. In addition, static VID:PID-to-altsetting whitelisting causes problems when firmware update changes the altsetting, or same VID:PID is reused for another device that has different kind of firmware. This patch removes existing explicit whitelist mappings for XMOS VID (0x20b1) and Thesycon VID (0x152a). Also corrects placement of Hegel HD12 and NuPrime DAC-10 to keep list sorted based on VID. Signed-off-by: Jussi Laako <jussi@sonarnerd.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-29Merge branch 'for-linus' into for-nextTakashi Iwai
Pull 5.0 branch for further development of USB-audio quirks Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-25ALSA: usb-audio: Add Opus #3 to quirks for native DSD supportOlek Poplavsky
This patch adds quirk VID/PID IDs for the Opus #3 DAP (made by 'The Bit') in order to enable Native DSD support. [ NOTE: this could be handled in the generic way with fp->dvd_raw if we add 0x10cb to the vendor whitelist, but since 0x10cb shows a different vendor name (Erantech), put to the individual entry at this time -- tiwai ] Signed-off-by: Olek Poplavsky <woodenbits@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-18Merge branch 'topic/pcm-device-suspend' into for-nextTakashi Iwai
Pull the PCM suspend improvement / cleanup. This moves the most of snd_pcm_suspend*() calls into PCM's own device PM ops. There should be no change from the functionality POV. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-15ALSA: usb: Remove superfluous snd_pcm_suspend*() callsTakashi Iwai
The call of snd_pcm_suspend_all() & co became superfluous since we call it in the PCM PM ops. Let's remove them. Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-09ALSA: usb-audio: Remove set but not used variable 'first_ch_bits'YueHaibing
Fixes gcc '-Wunused-but-set-variable' warning: sound/usb/mixer.c: In function 'parse_audio_feature_unit': sound/usb/mixer.c:1838:28: warning: variable 'first_ch_bits' set but not used [-Wunused-but-set-variable] It never used since 2.6 Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-08ALSA: usb-audio: fix CM6206 register definitionsAmadeusz Sławiński
fix typo after a recent commit causing headphones to have no sound Fixes: ad43d528a7ac (ALSA: usb-audio: Define registers for CM6206) Signed-off-by: Amadeusz Sławiński <amade@asmblr.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07ALSA: line6: fix check on snd_card_registerAditya Pakki
The fix checks if snd_card_register() fails, and if so logs the error via dev_err() consistent with other patches. Signed-off-by: Aditya Pakki <pakki001@umn.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirksHui Peng
In `create_composite_quirk`, the terminating condition of for loops is `quirk->ifnum < 0`. So any composite quirks should end with `struct snd_usb_audio_quirk` object with ifnum < 0. for (quirk = quirk_comp->data; quirk->ifnum >= 0; ++quirk) { ..... } the data field of Bower's & Wilkins PX headphones usb device device quirks do not end with {.ifnum = -1}, wihch may result in out-of-bound read. This Patch fix the bug by adding an ending quirk object. Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones") Signed-off-by: Hui Peng <benquike@163.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07ALSA: usb-audio: Always check descriptor sizes in parser codeTakashi Iwai
There are a few places where we access the data without checking the actual object size from the USB audio descriptor. This may result in OOB access, as recently reported. This patch addresses these missing checks. Most of added codes are simple bLength checks in the caller side. For the input and output terminal parsers, we put the length check in the parser functions. For the input terminal, a new argument is added to distinguish between UAC1 and the rest, as they treat different objects. Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Reported-by: Hui Peng <benquike@163.com> Tested-by: Hui Peng <benquike@163.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07ALSA: usb-audio: Check mixer unit descriptors more strictlyTakashi Iwai
We've had some sanity checks of the mixer unit descriptors but they are too loose and some corner cases are overlooked. Add more strict checks in uac_mixer_unit_get_channels() for avoiding possible OOB accesses by malformed descriptors. This also changes the semantics of uac_mixer_unit_get_channels() slightly. Now it returns zero for the cases where the descriptor lacks of bmControls instead of -EINVAL. Then the caller side skips the mixer creation for such unit while it keeps parsing it. This corresponds to the case like Maya44. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()Takashi Iwai
The parser for the processing unit reads bNrInPins field before the bLength sanity check, which may lead to an out-of-bound access when a malformed descriptor is given. Fix it by assignment after the bLength check. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-12-07Merge branch 'for-linus' into for-nextTakashi Iwai
Back-merge for applying the more HD-audio quirks on top of the latest code. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-12-03ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.cHui Peng
If a USB sound card reports 0 interfaces, an error condition is triggered and the function usb_audio_probe errors out. In the error path, there was a use-after-free vulnerability where the memory object of the card was first freed, followed by a decrement of the number of active chips. Moving the decrement above the atomic_dec fixes the UAF. [ The original problem was introduced in 3.1 kernel, while it was developed in a different form. The Fixes tag below indicates the original commit but it doesn't mean that the patch is applicable cleanly. -- tiwai ] Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit") Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-11-29ALSA: usb-audio: Add SMSL D1 to quirks for native DSD supportTony Das
This patch adds quirk VID/PID IDs for the SMSL D1 in order to enable Native DSD support. [ Moved the added entry in numerical order -- tiwai ] Signed-off-by: Tony Das <tdas444@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-11-28ALSA: usb-audio: Add vendor and product name for Dell WD19 DockHui Wang
Like the Dell WD15 Dock, the WD19 Dock (0bda:402e) doens't provide useful string for the vendor and product names too. In order to share the UCM with WD15, here we keep the profile_name same as the WD15. Signed-off-by: Hui Wang <hui.wang@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-11-06ALSA: usb-audio: Define registers for CM6206Linus Walleij
The register map for CM6206 is known and we can define what the values written to the different registers actually mean. I tested to print the hex values before/after this change, there is no functional change. Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-10-12ALSA: caiaq: Add fall-through annotationTakashi Iwai
As a preparatory patch for the upcoming -Wimplicit-fallthrough compiler checks, add the "fall through" annotation in caiaq driver. Note that this seems necessary to be put exactly before the next label, so it's outside the ifdef block. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-10-05ALSA: usb-audio: Add custom mixer status quirks for RME CC devicesJussi Laako
Adds several vendor specific mixer quirks for RME's Class Compliant USB devices. These provide extra status information from the device otherwise not available. These include AES/SPDIF rate and status information, current system sampling rate and measured frequency. This information is especially useful in cases where device's clock is slaved to external clock source. Signed-off-by: Jussi Laako <jussi@sonarnerd.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-10-04ALSA: usb-audio: update quirk for B&W PX to remove microphoneNicolas Huaman
A quirk in snd-usb-audio was added to automate setting sample rate to 4800k and remove the previously exposed nonfunctional microphone for the Bowers & Wilkins PX: commit 240a8af929c7c57dcde28682725b29cf8474e8e5 https://lore.kernel.org/patchwork/patch/919689/ However the headphones where updated shortly after that to remove the unintentional microphone functionality. I guess because of this the headphones now crash when connecting them via USB while the quirk is active. Dmesg: snd-usb-audio: probe of 2-3:1.0 failed with error -22 usb 2-3: 2:1: cannot get min/max values for control 2 (id 2) This patch removes the microfone and allows the headphones to connect and work out of the box. It is based on the current mainline kernel and successfully applied an tested on my machine (4.18.10.arch1-1). Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones") Signed-off-by: Nicolas Huaman <nicolas@herochao.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-10-04ALSA: rawmidi: A lightweight function to discard pending bytesTakashi Iwai
For discarding the pending bytes on rawmidi, we process with a loop of snd_rawmidi_transmit() which is just a waste of CPU power. Implement a lightweight API function to discard the pending bytes and the proceed the ring buffer instantly, and use it instead of open codes. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-08-09ALSA: usb-audio: Mark expected switch fall-throughGustavo A. R. Silva
In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 1357413 ("Missing break in switch") Addresses-Coverity-ID: 114917 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-08-02ALSA: usb-audio: Fix invalid use of sizeof in parse_uac_endpoint_attributes()Wei Yongjun
sizeof() when applied to a pointer typed expression gives the size of the pointer, not that of the pointed data. Fixes: 7edf3b5e6a45 ("ALSA: usb-audio: AudioStreaming Power Domain parsing") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-08-01ALSA: usb: Mark expected switch fall-throughGustavo A. R. Silva
In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 115084 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
generated by cgit (git 2.34.1) at 2024-05-07 16:25:24 +0000