summaryrefslogtreecommitdiffstats
path: root/sound/usb
Commit message (Collapse)AuthorAgeFilesLines
* ALSA: usb-audio: Add sanity checks in UAC3 clock parsersTakashi Iwai2018-04-071-3/+4
| | | | | | | | | | | The UAC3 clock parser codes lack of the sanity checks for malformed descriptors like UAC2 parser does. Without it, the driver may lead to a potential crash. Fixes: 9a2fe9b801f5 ("ALSA: usb: initial USB Audio Device Class 3.0 support") Tested-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Reviewed-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: More strict sanity checks for clock parsersTakashi Iwai2018-04-071-3/+3
| | | | | | | | | | | | | | | | | The sanity checks introduced for malformed descriptors loosely check the given descriptor size, although the size greater than the defined description is invalid. It was due to a concern of any funky firmware in the actual products. But this doesn't look hitting, and any sane products must have the defined descriptors. So in this patch, we make the validators more strict, allowing only with the defined descriptor sizes. The value in clock selector validator is corrected from 5 to 7 to count the two unlisted fields after baCSourceID[]. Suggested-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Reviewed-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: Refactor clock finder helpersTakashi Iwai2018-04-071-74/+53
| | | | | | | | | | | | | | There are lots of open-coded functions to find a clock source, selector and multiplier. Now there are both v2 and v3, so six variants. This patch refactors the code to use a common helper for the main loop, and define each validator function for each target. There is no functional change. Fixes: 9a2fe9b801f5 ("ALSA: usb: initial USB Audio Device Class 3.0 support") Reviewed-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: silence a static checker warningDan Carpenter2018-03-291-1/+1
| | | | | | | | | | We recently made "format" a u64 variable so now static checkers complain that this shift will wrap around if format is more than 31. I don't think it makes a difference for runtime, but it's simple to silence the warning. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: fix memory leak on cvalColin Ian King2018-03-271-1/+3
| | | | | | | | | | | | With the current exit return path of the ctl_info allocation failure cval is not being freed resulting in a memory leak. Fix this by kfree'ing it on the return. Detected by CoverityScan, CID#1466878 ("Resource Leak") Fixes: 21e9b3e931f7 ("ALSA: usb-audio: fix uac control query argument") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: update clock valid controlAndrew Chant2018-03-241-14/+19
| | | | | | | | | | | | | | | Make the "clock valid" control a global control instead of a mixer so that it doesn't appear in mixer applications. Additionally, remove the check for writeability prohibited by spec, and Use common code to read the control value. Tested with a UAC2 Audio device that presents a clock validity control. The control still shows up in /proc usbmixer but not in alsamixer. Signed-off-by: Andrew Chant <achant@google.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: UAC2 jack detectionAndrew Chant2018-03-241-1/+97
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This implements UAC2 jack detection support, presenting jack status as a boolean read-only mono mixer. The presence of any channel in the UAC2_TE_CONNECTOR control for a terminal will result in the mixer saying the jack is connected. Mixer naming follows the convention in sound/core/ctljack.c, terminating the mixer with " Jack". For additional clues as to which jack is being presented, the name is prefixed with " - Input Jack" or " - Output Jack" depending on if it's an input or output terminal. This is required because terminal names are ambiguous between inputs and outputs and often duplicated - Bidirectional terminal types (0x400 -> 0x4FF) "... may be used separately for input only or output only. These types require two Terminal descriptors. Both have the same type." (quote from "USB Device Class Definition for Terminal Types") Since bidirectional terminal types are common for headphone adapters, this distinguishes between two otherwise identically-named jack controls. Tested with a UAC2 audio device with connector control capability. Signed-off-by: Andrew Chant <achant@google.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: Integrate native DSD support for ITF-USB based DACs.Nobutaka Okabe2018-03-231-61/+23
| | | | | | | | | | | | | | | | | | | | | | | | Integrate the native DSD support quirk codes of "ITF-USB DSD" based DACs. Now, "is_itf_usb_dsd_2alts_dac()" and "is_itf_usb_dsd_3alts_dac()" is integrated into one function "is_itf_usb_dsd_dac()". So, remove the logic to distinguish UD-501 and UD-501V2 by the "Product Name". The integration is possible by changing the following two functions. - snd_usb_select_mode_quirk(): Change the determination condition of the DSD mode switch command, from the altset number being used, to the audio format being played. Actually, this operation is same as playback using ASIO driver in Windows environment. - snd_usb_interface_dsd_format_quirk(): To which altset supports native DSD is determined by the number of altsets. Previously, it's a constant "2" or "3". Signed-off-by: Nobutaka Okabe <nob77413@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: FIX native DSD support for TEAC UD-501 DACNobutaka Okabe2018-03-231-10/+27
| | | | | | | | | | | | | There are two versions of TEAC UD-501, the normal version and the vendor updated version(UD-501V2). They have the same VID/PID, but the num of the altsetting is different, UD-501 has 2 altsets for stream, and UD-501V2 has 3. So, add the logic to distinguish them by the Product Name, not by the PID. Signed-off-by: Nobutaka Okabe <nob77413@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: Add native DSD support for Luxman DA-06Nobutaka Okabe2018-03-231-13/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add native DSD support quirk for Luxman DA-06 DAC, by adding the PID/VID 1852:5065. Rename "is_marantz_denon_dac()" function to "is_itf_usb_dsd_2alts_dac()" to cover broader device family sharing the same USB audio implementation(*). For the same reason, rename "is_teac_dsd_dac()" function to "is_itf_usb_dsd_3alts_dac()". (*) These devices have the same USB controller "ITF-USB DSD", supplied by INTERFACE Co., Ltd. "ITF-USB DSD" USB controller has two patterns, Pattern 1. (2 altsets version) - Altset 0: for control - Altset 1: for stream (S32) - Altset 2: for stream (S32, DSD_U32) Pattern 2. (3 altsets version) - Altset 0: for control - Altset 1: for stream (S16) - Altset 2: for stream (S32) - Altset 3: for stream (S32, DSD_U32) "is_itf_usb_dsd_2alts_dac()" returns true, if the DAC has "Pattern 1" USB controller, and "is_itf_usb_dsd_3alts_dac()" returns true, if "Pattern2". Signed-off-by: Nobutaka Okabe <nob77413@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Merge branch 'for-linus' into for-nextTakashi Iwai2018-03-231-0/+1
|\ | | | | | | | | | | Back-merge for applying more series of fixes for USB DSD support. Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: usb-audio: Add native DSD support for TEAC UD-301Nobutaka Okabe2018-03-231-0/+1
| | | | | | | | | | | | | | | | | | Add native DSD support quirk for TEAC UD-301 DAC, by adding the PID/VID 0644:804a. Signed-off-by: Nobutaka Okabe <nob77413@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: usb-audio: fix uac control query argumentAndrew Chant2018-03-232-28/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes code readability and should have no functional change. Correct uac control query functions to account for the 1-based indexing of USB Audio Class control identifiers. The function parameter, u8 control, should be the constant defined in audio-v2.h to identify the control to be checked for readability or writeability. This patch fixes all callers that had adjusted, and makes explicit the mapping between audio_feature_info[] array index and the associated control identifier. Signed-off-by: Andrew Chant <achant@google.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: usb: initial USB Audio Device Class 3.0 supportRuslan Bilovol2018-03-218-192/+848
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Recently released USB Audio Class 3.0 specification introduces many significant changes comparing to previous versions, like - new Power Domains, support for LPM/L1 - new Cluster descriptor - changed layout of all class-specific descriptors - new High Capability descriptors - New class-specific String descriptors - new and removed units - additional sources for interrupts - removed Type II Audio Data Formats - ... and many other things (check spec) It also provides backward compatibility through multiple configurations, as well as requires mandatory support for BADD (Basic Audio Device Definition) on each ADC3.0 compliant device This patch adds initial support of UAC3 specification that is enough for Generic I/O Profile (BAOF, BAIF) device support from BADD document. Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: usb-audio: move audioformat quirks to quirks.cRuslan Bilovol2018-03-193-29/+39
|/ | | | | | | | Offload USB audio interface parsing function by moving quirks to a specially designed location (quirks.c) Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* ALSA: usb-audio: Add a quirck for B&W PX headphonesErik Veijola2018-02-241-0/+47
| | | | | | | | | The capture interface doesn't work and the playback interface only supports 48 kHz sampling rate even though it advertises more rates. Signed-off-by: Erik Veijola <erik.veijola@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* Merge branch 'topic/fixes' into for-linusTakashi Iwai2018-02-123-9/+25
|\ | | | | | | Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: usb: add more device quirks for USB DSD devicesDaniel Mack2018-02-121-2/+5
| | | | | | | | | | | | | | | | | | Add some more devices that need quirks to handle DSD modes correctly. Signed-off-by: Daniel Mack <daniel@zonque.org> Reported-and-tested-by: Thomas Gresens <tgresens@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attributeKirill Marinushkin2018-02-121-7/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The layout of the UAC2 Control request and response varies depending on the request type. With the current implementation, only the Layout 2 Parameter Block (with the 2-byte sized RANGE attribute) is handled properly. For the Control requests with the 1-byte sized RANGE attribute (Bass Control, Mid Control, Tremble Control), the response is parsed incorrectly. This commit: * fixes the wLength field value in the request * fixes parsing the range values from the response Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0") Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204Lassi Ylikojola2018-02-121-0/+9
| | | | | | | | | | | | | | | | | | | | Add quirk to ensure a sync endpoint is properly configured. This patch is a fix for same symptoms on Behringer UFX1204 as patch from Albertto Aquirre on Dec 8 2016 for Axe-Fx II. Signed-off-by: Lassi Ylikojola <lassi.ylikojola@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | vfs: do bulk POLL* -> EPOLL* replacementLinus Torvalds2018-02-113-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the mindless scripted replacement of kernel use of POLL* variables as described by Al, done by this script: for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'` for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done done with de-mangling cleanups yet to come. NOTE! On almost all architectures, the EPOLL* constants have the same values as the POLL* constants do. But they keyword here is "almost". For various bad reasons they aren't the same, and epoll() doesn't actually work quite correctly in some cases due to this on Sparc et al. The next patch from Al will sort out the final differences, and we should be all done. Scripted-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | Merge branch 'work.misc' of ↵Linus Torvalds2018-01-312-40/+31
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs updates from Al Viro: "All kinds of misc stuff, without any unifying topic, from various people. Neil's d_anon patch, several bugfixes, introduction of kvmalloc analogue of kmemdup_user(), extending bitfield.h to deal with fixed-endians, assorted cleanups all over the place..." * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (28 commits) alpha: osf_sys.c: use timespec64 where appropriate alpha: osf_sys.c: fix put_tv32 regression jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path dcache: delete unused d_hash_mask dcache: subtract d_hash_shift from 32 in advance fs/buffer.c: fold init_buffer() into init_page_buffers() fs: fold __inode_permission() into inode_permission() fs: add RWF_APPEND sctp: use vmemdup_user() rather than badly open-coding memdup_user() snd_ctl_elem_init_enum_names(): switch to vmemdup_user() replace_user_tlv(): switch to vmemdup_user() new primitive: vmemdup_user() memdup_user(): switch to GFP_USER eventfd: fold eventfd_ctx_get() into eventfd_ctx_fileget() eventfd: fold eventfd_ctx_read() into eventfd_read() eventfd: convert to use anon_inode_getfd() nfs4file: get rid of pointless include of btrfs.h uvc_v4l2: clean copyin/copyout up vme_user: don't use __copy_..._user() usx2y: don't bother with memdup_user() for 16-byte structure ...
| * | usx2y: don't bother with memdup_user() for 16-byte structureAl Viro2017-12-281-25/+18
| | | | | | | | | | | | | | | | | | ... when it can bloody well go into a local variable. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| * | usx2y: don't bother with access_ok() in ->dsp_load()Al Viro2017-12-281-15/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | memdup_user() checks it, so the only effect would be failing with -EINVAL instead of -EFAULT in case when access_ok() is false. However, the caller has already checked access_ok() itself (and would have buggered off with -EFAULT), so the check is completely pointless. Removing it both simplifies the only instance of ->dsp_load() and allows to get rid of the check in caller - its sole effect used to be in preventing a bogus error value from access_ok() in the instance. Let memdup_user() do the right thing instead... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* | | Merge branch 'misc.poll' of ↵Linus Torvalds2018-01-303-5/+5
|\ \ \ | |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull poll annotations from Al Viro: "This introduces a __bitwise type for POLL### bitmap, and propagates the annotations through the tree. Most of that stuff is as simple as 'make ->poll() instances return __poll_t and do the same to local variables used to hold the future return value'. Some of the obvious brainos found in process are fixed (e.g. POLLIN misspelled as POLL_IN). At that point the amount of sparse warnings is low and most of them are for genuine bugs - e.g. ->poll() instance deciding to return -EINVAL instead of a bitmap. I hadn't touched those in this series - it's large enough as it is. Another problem it has caught was eventpoll() ABI mess; select.c and eventpoll.c assumed that corresponding POLL### and EPOLL### were equal. That's true for some, but not all of them - EPOLL### are arch-independent, but POLL### are not. The last commit in this series separates userland POLL### values from the (now arch-independent) kernel-side ones, converting between them in the few places where they are copied to/from userland. AFAICS, this is the least disruptive fix preserving poll(2) ABI and making epoll() work on all architectures. As it is, it's simply broken on sparc - try to give it EPOLLWRNORM and it will trigger only on what would've triggered EPOLLWRBAND on other architectures. EPOLLWRBAND and EPOLLRDHUP, OTOH, are never triggered at all on sparc. With this patch they should work consistently on all architectures" * 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (37 commits) make kernel-side POLL... arch-independent eventpoll: no need to mask the result of epi_item_poll() again eventpoll: constify struct epoll_event pointers debugging printk in sg_poll() uses %x to print POLL... bitmap annotate poll(2) guts 9p: untangle ->poll() mess ->si_band gets POLL... bitmap stored into a user-visible long field ring_buffer_poll_wait() return value used as return value of ->poll() the rest of drivers/*: annotate ->poll() instances media: annotate ->poll() instances fs: annotate ->poll() instances ipc, kernel, mm: annotate ->poll() instances net: annotate ->poll() instances apparmor: annotate ->poll() instances tomoyo: annotate ->poll() instances sound: annotate ->poll() instances acpi: annotate ->poll() instances crypto: annotate ->poll() instances block: annotate ->poll() instances x86: annotate ->poll() instances ...
| * | sound: annotate ->poll() instancesAl Viro2017-11-273-5/+5
| |/ | | | | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* | ALSA: usb-audio: Support changing input on Sound Blaster E1Ian Douglas Scott2018-01-181-0/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | The E1 has two headphone jacks, one of which can be set as a microphone input. In the default mode, it uses the built-in microphone as an input. By sending a special command, the second headphone jack is instead used as an input. This might work with the E3 as well, but I don't have one of those to test it. Signed-off-by: Ian Douglas Scott <ian@iandouglasscott.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: usb-audio: Add a quirk for Nura's first gen headsetMartin Peres2018-01-151-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | The capture interface does not work, and the playback interface actually supports only 48kHz unlike what is advertised (44.1, 32, 22, 16, 8). The only unknown here is if there are other devices that use the same product ID, but given that this ID is currently unknown, I would assume it is specially allocated for the nura headset. Signed-off-by: Martin Peres <martin.peres@free.fr> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: usb-audio: Proper fallback at get_term_name()Takashi Iwai2017-12-191-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | get_term_name() calls snd_usb_copy_string_desc() for retrieving the name when a specific ID (name field) is given. When this returns an error (zero), however, it simply returns as is. This will end up in a fixed name string in the caller side, which often is meaningless. For giving a bit more useful name string depending on the terminal type, change the get_term_name() function to go through the fallback mode. Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | Merge branch 'for-linus' into for-nextTakashi Iwai2017-12-192-11/+22
|\ \ | | | | | | | | | | | | | | | | | | Back-merge of 4.15-rc development branch for further development of USB-audio stuff. Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | ALSA: usb-audio: Fix the missing ctl name suffix at parsing SUTakashi Iwai2017-12-191-11/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The commit 89b89d121ffc ("ALSA: usb-audio: Add check return value for usb_string()") added the check of the return value from snd_usb_copy_string_desc(), which is correct per se, but it introduced a regression. In the original code, either the "Clock Source", "Playback Source" or "Capture Source" suffix is added after the terminal string, while the commit changed it to add the suffix only when get_term_name() is failing. It ended up with an incorrect ctl name like "PCM" instead of "PCM Capture Source". Also, even the original code has a similar bug: when the ctl name is generated from snd_usb_copy_string_desc() for the given iSelector, it also doesn't put the suffix. This patch addresses these issues: the suffix is added always when no static mapping is found. Also the patch tries to put more comments and cleans up the if/else block for better readability in order to avoid the same pitfall again. Fixes: 89b89d121ffc ("ALSA: usb-audio: Add check return value for usb_string()") Reported-and-tested-by: Mauro Santos <registo.mailling@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | ALSA: usb-audio: Add native DSD support for Esoteric D-05XJussi Laako2017-12-071-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds VID:PID of Esoteric D-05X to the TEAC device id's. Renames the is_teac_50X_dac() function to is_teac_dsd_dac() to cover broader device family from the same corporation sharing the same USB audio implementation. Signed-off-by: Jussi Laako <jussi@sonarnerd.net> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | ALSA: usb-audio: Add check return value for usb_string()Jaejoong Kim2017-12-041-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | snd_usb_copy_string_desc() returns zero if usb_string() fails. In case of failure, we need to check the snd_usb_copy_string_desc()'s return value and add an exception case Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * | ALSA: usb-audio: Fix out-of-bound errorJaejoong Kim2017-12-041-0/+4
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The snd_usb_copy_string_desc() retrieves the usb string corresponding to the index number through the usb_string(). The problem is that the usb_string() returns the length of the string (>= 0) when successful, but it can also return a negative value about the error case or status of usb_control_msg(). If iClockSource is '0' as shown below, usb_string() will returns -EINVAL. This will result in '0' being inserted into buf[-22], and the following KASAN out-of-bound error message will be output. AudioControl Interface Descriptor: bLength 8 bDescriptorType 36 bDescriptorSubtype 10 (CLOCK_SOURCE) bClockID 1 bmAttributes 0x07 Internal programmable Clock (synced to SOF) bmControls 0x07 Clock Frequency Control (read/write) Clock Validity Control (read-only) bAssocTerminal 0 iClockSource 0 To fix it, check usb_string()'return value and bail out. ================================================================== BUG: KASAN: stack-out-of-bounds in parse_audio_unit+0x1327/0x1960 [snd_usb_audio] Write of size 1 at addr ffff88007e66735a by task systemd-udevd/18376 CPU: 0 PID: 18376 Comm: systemd-udevd Not tainted 4.13.0+ #3 Hardware name: LG Electronics 15N540-RFLGL/White Tip Mountain, BIOS 15N5 Call Trace: dump_stack+0x63/0x8d print_address_description+0x70/0x290 ? parse_audio_unit+0x1327/0x1960 [snd_usb_audio] kasan_report+0x265/0x350 __asan_store1+0x4a/0x50 parse_audio_unit+0x1327/0x1960 [snd_usb_audio] ? save_stack+0xb5/0xd0 ? save_stack_trace+0x1b/0x20 ? save_stack+0x46/0xd0 ? kasan_kmalloc+0xad/0xe0 ? kmem_cache_alloc_trace+0xff/0x230 ? snd_usb_create_mixer+0xb0/0x4b0 [snd_usb_audio] ? usb_audio_probe+0x4de/0xf40 [snd_usb_audio] ? usb_probe_interface+0x1f5/0x440 ? driver_probe_device+0x3ed/0x660 ? build_feature_ctl+0xb10/0xb10 [snd_usb_audio] ? save_stack_trace+0x1b/0x20 ? init_object+0x69/0xa0 ? snd_usb_find_csint_desc+0xa8/0xf0 [snd_usb_audio] snd_usb_mixer_controls+0x1dc/0x370 [snd_usb_audio] ? build_audio_procunit+0x890/0x890 [snd_usb_audio] ? snd_usb_create_mixer+0xb0/0x4b0 [snd_usb_audio] ? kmem_cache_alloc_trace+0xff/0x230 ? usb_ifnum_to_if+0xbd/0xf0 snd_usb_create_mixer+0x25b/0x4b0 [snd_usb_audio] ? snd_usb_create_stream+0x255/0x2c0 [snd_usb_audio] usb_audio_probe+0x4de/0xf40 [snd_usb_audio] ? snd_usb_autosuspend.part.7+0x30/0x30 [snd_usb_audio] ? __pm_runtime_idle+0x90/0x90 ? kernfs_activate+0xa6/0xc0 ? usb_match_one_id_intf+0xdc/0x130 ? __pm_runtime_set_status+0x2d4/0x450 usb_probe_interface+0x1f5/0x440 Cc: <stable@vger.kernel.org> Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | ALSA: usb-audio: Change the semantics of the enable optionTamaki Nishino2017-11-301-6/+15
| | | | | | | | | | | | | | | | | | This patch changes the semantics of the enable option for snd-usb-audio in order to allow users to disable a device specified by either or both of the vendor id and the product id. Signed-off-by: Tamaki Nishino <otamachan@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | Revert "ALSA: usb-audio: Fix potential zero-division at parsing FU"Takashi Iwai2017-11-281-2/+2
|/ | | | | | | | | | | The commit 8428a8ebde2d ("ALSA: usb-audio: Fix potential zero-division at parsing FU") is utterly bogus and breaks the case with csize=1 instead of fixing anything. Just take it back again. Reported-by: Jörg Otte <jrg.otte@gmail.com> Fixes: 8428a8ebde2d ("ALSA: usb-audio: Fix potential zero-division at parsing FU" Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Merge branch 'timers-urgent-for-linus' of ↵Linus Torvalds2017-11-251-1/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: - The final conversion of timer wheel timers to timer_setup(). A few manual conversions and a large coccinelle assisted sweep and the removal of the old initialization mechanisms and the related code. - Remove the now unused VSYSCALL update code - Fix permissions of /proc/timer_list. I still need to get rid of that file completely - Rename a misnomed clocksource function and remove a stale declaration * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits) m68k/macboing: Fix missed timer callback assignment treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts timer: Remove redundant __setup_timer*() macros timer: Pass function down to initialization routines timer: Remove unused data arguments from macros timer: Switch callback prototype to take struct timer_list * argument timer: Pass timer_list pointer to callbacks unconditionally Coccinelle: Remove setup_timer.cocci timer: Remove setup_*timer() interface timer: Remove init_timer() interface treewide: setup_timer() -> timer_setup() (2 field) treewide: setup_timer() -> timer_setup() treewide: init_timer() -> setup_timer() treewide: Switch DEFINE_TIMER callbacks to struct timer_list * s390: cmm: Convert timers to use timer_setup() lightnvm: Convert timers to use timer_setup() drivers/net: cris: Convert timers to use timer_setup() drm/vc4: Convert timers to use timer_setup() block/laptop_mode: Convert timers to use timer_setup() net/atm/mpc: Avoid open-coded assignment of timer callback function ...
| * treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE castsKees Cook2017-11-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With all callbacks converted, and the timer callback prototype switched over, the TIMER_FUNC_TYPE cast is no longer needed, so remove it. Conversion was done with the following scripts: perl -pi -e 's|\(TIMER_FUNC_TYPE\)||g' \ $(git grep TIMER_FUNC_TYPE | cut -d: -f1 | sort -u) perl -pi -e 's|\(TIMER_DATA_TYPE\)||g' \ $(git grep TIMER_DATA_TYPE | cut -d: -f1 | sort -u) The now unused macros are also dropped from include/linux/timer.h. Signed-off-by: Kees Cook <keescook@chromium.org>
* | Merge tag 'sound-fix-4.15-rc1' of ↵Linus Torvalds2017-11-232-7/+28
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "All commits found here are small fixes for regression or stable: - PCM timestamp behavior fix that could be seen as a regression - Remove spurious WARN_ON() from ALSA timer 32bit compat ioctl - HD-audio HDMI/DP channel mapping fix for 32bit archs - Fix the previous fix for HD-audio initialization code - More hardening USB-audio against malicious USB descriptors - HD-audio quirks/fixes (Realtek codec, AMD controller) - Missing help text for the recent Intel SST kconfig change" * tag 'sound-fix-4.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda: Add Raven PCI ID ALSA: hda/realtek - Fix ALC700 family no sound issue ALSA: hda - Fix yet remaining issue with vmaster 0dB initialization ALSA: usb-audio: Add sanity checks in v2 clock parsers ALSA: usb-audio: Fix potential zero-division at parsing FU ALSA: usb-audio: Fix potential out-of-bound access at parsing SU ALSA: usb-audio: Add sanity checks to FE parser ALSA: timer: Remove kernel warning at compat ioctl error paths ALSA: pcm: update tstamp only if audio_tstamp changed ALSA: hda/realtek: Add headset mic support for Intel NUC Skull Canyon ALSA: hda: Fix too short HDMI/DP chmap reporting ALSA: usb-audio: uac1: Invalidate ctl on interrupt ALSA: hda/realtek - Fix ALC275 no sound issue ASoC: Intel: Add help text for SND_SOC_INTEL_SST_TOPLEVEL
| * ALSA: usb-audio: Add sanity checks in v2 clock parsersTakashi Iwai2017-11-211-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | The helper functions to parse and look for the clock source, selector and multiplier unit may return the descriptor with a too short length than required, while there is no sanity check in the caller side. Add some sanity checks in the parsers, at least, to guarantee the given descriptor size, for avoiding the potential crashes. Fixes: 79f920fbff56 ("ALSA: usb-audio: parse clock topology of UAC2 devices") Reported-by: Andrey Konovalov <andreyknvl@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: usb-audio: Fix potential zero-division at parsing FUTakashi Iwai2017-11-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | parse_audio_feature_unit() contains a code dividing potentially with zero when a malformed FU descriptor is passed. Although there is already a sanity check, it checks only the value zero, hence it can still lead to a zero-division when a value 1 is passed there. Fix it by correcting the sanity check (and the error message thereof). Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: usb-audio: Fix potential out-of-bound access at parsing SUTakashi Iwai2017-11-211-1/+2
| | | | | | | | | | | | | | | | | | | | | | The usb-audio driver may trigger an out-of-bound access at parsing a malformed selector unit, as it checks the header length only after evaluating bNrInPins field, which can be already above the given length. Fix it by adding the length check beforehand. Fixes: 99fc86450c43 ("ALSA: usb-mixer: parse descriptors with structs") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: usb-audio: Add sanity checks to FE parserTakashi Iwai2017-11-211-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | When the usb-audio descriptor contains the malformed feature unit description with a too short length, the driver may access out-of-bounds. Add a sanity check of the header size at the beginning of parse_audio_feature_unit(). Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0") Reported-by: Andrey Konovalov <andreyknvl@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| * ALSA: usb-audio: uac1: Invalidate ctl on interruptJulian Scheel2017-11-171-1/+6
| | | | | | | | | | | | | | | | | | | | When an interrupt occurs, the value of at least one of the belonging controls should have changed. To make sure they get re-read from device on the next read, invalidate the cache. This was correctly implemented for uac2 already, but missing for uac1. Signed-off-by: Julian Scheel <julian@jusst.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
* | Merge tag 'sound-4.15-rc1' of ↵Linus Torvalds2017-11-1421-91/+181
|\ \ | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "There are no big surprising changes in this cycle, yet not too boring, either. The biggest change from diffstat POV is the removal of the legacy OSS driver codes that have been already disabled for a long time. This will bring a few trivial merge conflicts. As new features in ASoC side, there are two things: a new AC97 bus implementation and AMD Stony platform support. Both include the relevant changes shared with other subsystems, e.g. AC97 MFD changes and DRM AMD changes. Some other highlighted topics are: - A bunch of USB-audio drivers got the hardening against the malicious device accesses with a new helper code for endpoint sanity check - Lots of cleanups for ASoC Intel platform code, including support for their open source audio firmware - Continued ASoC core componentization works - Support for scaling MCLK with sample rate in ASoC simple-card - Stabler PCM hot-unplug capability, especially for ASoC usages" * tag 'sound-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (302 commits) Documentation: sound: hd-audio: notes.rst ASoC: bcm2835: Support left/right justified and DSP modes ASoC: bcm2835: Enforce full symmetry ASoC: bcm2835: Support additional samplerates up to 384kHz ASoC: bcm2835: Add support for TDM modes ASoC: add mclk-fs support to audio graph card ASoC: add mclk-fs to audio graph card binding ASoC: rt5514: work around link error ASoC: rt5514: mark PM functions as __maybe_unused ASoC: rt5663: Check the JD status in the button pushing ASoC: amd: Modified DMA transfer Mechanism for Playback ASoC: rt5645: Wait for 400msec before concluding on value of RT5645_VENDOR_ID2 ASoC: sun4i-codec: fixed 32bit audio capture support for H3/H2+ ASoC: da7213: add support for DSP modes ASoC: sun8i-codec: Add a comment on the LRCK inversion ASoC: sun8i-codec: Set the BCLK divider ASoC: rt5663: Delay and retry reading rt5663 ID register ASoC: amd: use do_div rather than 64 bit division to fix 32 bit builds ASoC: cs42l56: Fix reset GPIO name in example DT binding ASoC: rt5514-spi: check irq status to schedule data copy in resume function ...
| * Merge tag 'asoc-v4.15' of ↵Takashi Iwai2017-11-1329-0/+29
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v4.15 The biggest thing this release has been the conversion of the AC98 bus to the driver model, that's been a long time coming so thanks to Robert Jarzmik for his dedication there. Due to there being some AC97 MFD there's a few fairly large changes in input and the MFD layer, mainly to the wm97xx driver. There's also some drivers/drm changes to support the new AMD Stoney platform, these are shared with the DRM subsystem and should be being merged via both. Within the subsystem the overwhelming bulk of the changes is in the Intel drivers which continue to need lots of cleanups and fixes, this release they've also gained support for their open source firmware. There's also some large changs in the core as Morimoto-san continues to mirror operations into the component level in preparation for conversion of drivers to that. - The AC97 bus has finally caught up with the driver model thanks to some dedicated and persistent work from Robert Jarzmik. - Continued work from Morimoto-san on moving us towards being able to use components for everything. - Lots of cleanups for the Intel platform code, including support for their open source audio firmware. - Support for scaling MCLK with sample rate in simple-card. - Support for AMD Stoney platform.
| * \ Merge branch 'for-next' into for-linusTakashi Iwai2017-11-1321-91/+181
| |\ \ | | | | | | | | | | | | | | | | | | | | Pull 4.15 updates to take over the previous urgent fixes. Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | * \ Merge branch 'topic/usb-ep-check-v2' into for-nextTakashi Iwai2017-11-061-6/+17
| | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | Pull another fix of URB EP type check. Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | | * | ALSA: usx2y: Fix invalid stream URBsTakashi Iwai2017-11-061-6/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The us122l driver creates URBs per the fixed endpoints, and this may end up with URBs with inconsistent pipes when a fuzzer or a malicious program deals with the manipulated endpoints. It ends up with a kernel warning like: usb 1-1: BOGUS urb xfer, pipe 0 != type 3 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 24 at drivers/usb/core/urb.c:471 usb_submit_urb+0x113e/0x1400 Call Trace: usb_stream_start+0x48a/0x9f0 sound/usb/usx2y/usb_stream.c:690 us122l_start+0x116/0x290 sound/usb/usx2y/us122l.c:365 us122l_create_card sound/usb/usx2y/us122l.c:502 us122l_usb_probe sound/usb/usx2y/us122l.c:588 .... For avoiding the bad access, this patch adds a few sanity checks of the validity of created URBs like previous similar fixes using the new usb_urb_ep_type_check() helper function. Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
| | * | | ALSA: usb-audio: Convert timers to use timer_setup()Kees Cook2017-10-177-39/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
OpenPOWER on IntegriCloud