summaryrefslogtreecommitdiffstats
path: root/sound/usb/line6/driver.c
AgeCommit message (Collapse)AuthorFilesLines
2020-07-10ALSA: line6: Sync the pending work cancel at disconnectionTakashi Iwai1-1/+1
Recently syzkaller reported a UAF in LINE6 driver, and it's likely because we call cancel_delayed_work() at the disconnect callback instead of cancel_delayed_work_sync(). Let's use the correct one instead. Reported-by: syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com Suggested-by: Alan Stern <stern@rowland.harvard.edu> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/s5hlfjr4gio.wl-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-05-02ALSA: line6: Add poll callback for hwdepVasily Khoruzhick1-0/+16
At least POD HD500 uses message-based communication, both sides can send messages. Add poll callback so application can wait for device messages without using busy loop. Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com> Link: https://lore.kernel.org/r/20200502193120.79115-3-anarsoul@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-05-02ALSA: line6: hwdep: add support for O_NONBLOCK opening modeVasily Khoruzhick1-0/+4
Currently line6 hwdep interface ignores O_NONBLOCK flag when opening device and it renders it somewhat useless when using poll. Check for O_NONBLOCK flag when opening device and don't block read() if it is set. Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com> Link: https://lore.kernel.org/r/20200502193120.79115-2-anarsoul@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-03-09ALSA: line6: Fix endless MIDI read loopTakashi Iwai1-1/+1
The MIDI input event parser of the LINE6 driver may enter into an endless loop when the unexpected data sequence is given, as it tries to continue the secondary bytes without termination. Also, when the input data is too short, the parser returns a negative error, while the caller doesn't handle it properly. This would lead to the unexpected behavior as well. This patch addresses those issues by checking the return value correctly and handling the one-byte event in the parser properly. The bug was reported by syzkaller. Reported-by: syzbot+cce32521ee0a824c21f7@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/000000000000033087059f8f8fa3@google.com Link: https://lore.kernel.org/r/20200309095922.30269-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-24ALSA: line6: sizeof (byte) is always 1, use that fact.Pavel Machek1-2/+2
sizeof (byte) is always 1, use that fact and make interesting code explicit. Signed-off-by: Pavel Machek <pavel@denx.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08Merge tag 'asoc-v5.3' of ↵Takashi Iwai1-5/+1
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v5.3 This is a very big update, mainly thanks to Morimoto-san's refactoring work and some fairly large new drivers. - Lots more work on moving towards a component based framework from Morimoto-san. - Support for force disconnecting muxes from Jerome Brunet. - New drivers for Cirrus Logic CS47L35, CS47L85 and CS47L90, Conexant CX2072X, Realtek RT1011 and RT1308. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-06-05treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 372Thomas Gleixner1-5/+1
Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation version 2 extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 135 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190531081036.435762997@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-28ALSA: line6: Drop superfluous timer helper functionTakashi Iwai1-11/+0
Now all timer usages in line6 drivers are gone, we can get rid of some helper macro and function that became superfluous. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-05-28ALSA: line6: Assure canceling delayed work at disconnectionTakashi Iwai1-0/+12
The current code performs the cancel of a delayed work at the late stage of disconnection procedure, which may lead to the access to the already cleared state. This patch assures to call cancel_delayed_work_sync() at the beginning of the disconnection procedure for avoiding that race. The delayed work object is now assigned in the common line6 object instead of its derivative, so that we can call cancel_delayed_work_sync(). Along with the change, the startup function is called via the new callback instead. This will make it easier to port other LINE6 drivers to use the delayed work for startup in later patches. Reported-by: syzbot+5255458d5e0a2b10bbb9@syzkaller.appspotmail.com Fixes: 7f84ff68be05 ("ALSA: line6: toneport: Fix broken usage of timer for delayed execution") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-04-28ALSA: line6: use dynamic buffersGreg Kroah-Hartman1-25/+35
The line6 driver uses a lot of USB buffers off of the stack, which is not allowed on many systems, causing the driver to crash on some of them. Fix this up by dynamically allocating the buffers with kmalloc() which allows for proper DMA-able memory. Reported-by: Christo Gouws <gouws.christo@gmail.com> Reported-by: Alan Stern <stern@rowland.harvard.edu> Tested-by: Christo Gouws <gouws.christo@gmail.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-15ALSA: usb: Remove superfluous snd_pcm_suspend*() callsTakashi Iwai1-3/+1
The call of snd_pcm_suspend_all() & co became superfluous since we call it in the PCM PM ops. Let's remove them. Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-11-21treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE castsKees Cook1-1/+1
With all callbacks converted, and the timer callback prototype switched over, the TIMER_FUNC_TYPE cast is no longer needed, so remove it. Conversion was done with the following scripts: perl -pi -e 's|\(TIMER_FUNC_TYPE\)||g' \ $(git grep TIMER_FUNC_TYPE | cut -d: -f1 | sort -u) perl -pi -e 's|\(TIMER_DATA_TYPE\)||g' \ $(git grep TIMER_DATA_TYPE | cut -d: -f1 | sort -u) The now unused macros are also dropped from include/linux/timer.h. Signed-off-by: Kees Cook <keescook@chromium.org>
2017-10-17ALSA: usb-audio: Convert timers to use timer_setup()Kees Cook1-2/+2
In preparation for unconditionally passing the struct timer_list pointer to all timer callbacks, switch to using the new timer_setup() and from_timer() to pass the timer pointer explicitly. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-10-17Merge branch 'for-linus' into for-nextTakashi Iwai1-3/+4
Back-merge for applying the timer API conversion patch for line6 driver that conflicts with the recent fix in upstream. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-10-11ALSA: line6: Add yet more sanity checks for invalid EPsTakashi Iwai1-8/+15
There are a few other places calling usb_submit_urb() with the URB composed from the fixed endpoint without validation. For avoiding the spurious kernel warnings, add the sanity checks to appropriate places. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-10-11ALSA: line6: Add a sanity check for invalid EPsTakashi Iwai1-0/+7
As syzkaller spotted, currently line6 drivers submit a URB with the fixed EP without checking whether it's actually available, which may result in a kernel warning like: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 24 at drivers/usb/core/urb.c:449 usb_submit_urb+0xf8a/0x11d0 Modules linked in: CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc2-42613-g1488251d1a98 #238 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: line6_start_listen+0x55f/0x9e0 sound/usb/line6/driver.c:82 line6_init_cap_control sound/usb/line6/driver.c:690 line6_probe+0x7c9/0x1310 sound/usb/line6/driver.c:764 podhd_probe+0x64/0x70 sound/usb/line6/podhd.c:474 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 .... This patch adds a sanity check of validity of EPs at the device initialization phase for avoiding the call with an invalid EP. Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-10-09ALSA: line6: Fix leftover URB at error-path during probeTakashi Iwai1-3/+4
While line6_probe() may kick off URB for a control MIDI endpoint, the function doesn't clean up it properly at its error path. This results in a leftover URB action that is eventually triggered later and causes an Oops like: general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 0 Comm: swapper/1 Not tainted RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619 RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76 Call Trace: <IRQ> line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326 __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779 usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845 dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965 call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281 .... Since the whole clean-up procedure is done in line6_disconnect() callback, we can simply call it in the error path instead of open-coding the whole again. It'll fix such an issue automagically. The bug was spotted by syzkaller. Fixes: eedd0e95d355 ("ALSA: line6: Don't forget to call driver's destructor at error path") Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-02-07ALSA: line6: Always setup isochronous transfer propertiesAndrej Krutak1-22/+26
While not all line6 devices currently support PCM, it causes no harm to 'have it prepared'. This also fixes toneport, which only has PCM - in which case we previously skipped the USB transfer properties detection completely. Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-02-07Revert "ALSA: line6: Only determine control port properties if needed"Takashi Iwai1-1/+2
This reverts commit f6a0dd107ad0c8b59d1c9735eea4b8cb9f460949. The commit caused a regression on LINE6 Transport that has no control caps. Although reverting the commit may result back in a spurious error message for some device again, it's the simplest regression fix, hence it's taken as is at first. The further code fix will follow later. Fixes: f6a0dd107ad0 ("ALSA: line6: Only determine control port properties if needed") Reported-by: Igor Zinovev <zinigor@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-10-12ALSA: line6: fix a crash in line6_hwdep_write()Dan Carpenter1-2/+2
The error checking here is messed up so we could end up dereferencing -EFAULT. Fixes: a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-09-25ALSA: usb-line6: use the same declaration as definition in header for MIDI ↵Takashi Sakamoto1-1/+1
manufacturer ID Currently, usb-line6 module exports an array of MIDI manufacturer ID and usb-pod module uses it. However, the declaration is not the definition in common header. The difference is explicit length of array. Although compiler calculates it and everything goes well, it's better to use the same representation between definition and declaration. This commit fills the length of array for usb-line6 module. As a small good sub-effect, this commit suppress below warnings from static analysis by sparse v0.5.0. sound/usb/line6/driver.c:274:43: error: cannot size expression sound/usb/line6/driver.c:275:16: error: cannot size expression sound/usb/line6/driver.c:276:16: error: cannot size expression sound/usb/line6/driver.c:277:16: error: cannot size expression Fixes: 705ececd1c60 ("Staging: add line6 usb driver") Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-09-20ALSA: line6: fix ifnullfree.cocci warningskbuild test robot1-2/+1
sound/usb/line6/driver.c:484:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. NULL check before some freeing functions is not needed. Based on checkpatch warning "kfree(NULL) is safe this check is probably not required" and kfreeaddr.cocci by Julia Lawall. Generated by: scripts/coccinelle/free/ifnullfree.cocci CC: Andrej Krutak <dev@andree.sk> Signed-off-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-09-19ALSA: line6: Add hwdep interface to access the POD control messagesAndrej Krutak1-4/+148
We must do it this way, because e.g. POD X3 won't play any sound unless the host listens on the bulk EP, so we cannot export it only via libusb. The driver currently doesn't use the bulk EP messages in other way, in future it could e.g. sense/modify volume(s). Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-09-19ALSA: line6: Only determine control port properties if neededAndrej Krutak1-2/+1
Not all line6 devices use the control port. Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-09-19ALSA: line6: Allow processing of raw incoming messagesAndrej Krutak1-25/+34
Not all PODs use MIDI via USB data interface, thus allow avoiding that code and instead using direct processing. Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-09-19ALSA: line6: Distinguish device init (ctrl EP) and MIDI data transfer (int EP)Andrej Krutak1-20/+52
POD X3 can initialize similarly to older PODs, but it doesn't have the MIDI interface. Instead, configuration is done via proprietary bulk EP messages. Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-09-19ALSA: line6: Add high-speed USB supportAndrej Krutak1-5/+10
This has two parts: * intervals_per_second setup (high speed needs 8000, instead of 1000) * iso_buffers setup (count of iso buffers depends on USB speed, 2 is not enough for high speed) Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-09-19ALSA: line6: Enable different number of URBs for frame transfersAndrej Krutak1-0/+1
This basically changes LINE6_ISO_BUFFERS constant to a configurable iso_buffers property. Signed-off-by: Andrej Krutak <dev@andree.sk> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-02-12ALSA: line6: Improve line6_read/write_data() interfacesChris Rorvick1-4/+10
The address cannot be negative so make it unsigned. Also, an unsigned int is always sufficient for the length, so no need to overdo it with a size_t. Finally, add in range checks to see if the values passed in actually fit where they are used. Signed-off-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-02-11ALSA: line6: Use explicit type for serial numberChris Rorvick1-1/+1
The serial number (aka ESN) is a 32-bit value. Signed-off-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-02-11ALSA: line6: Return EIO if read/write not successfulChris Rorvick1-2/+2
Signed-off-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-02-11ALSA: line6: Return error if device not respondingChris Rorvick1-6/+23
Put an upper bound on how long we will wait for the device to respond to a read/write request (i.e., 100 milliseconds) and return an error if this is reached. Signed-off-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-02-11ALSA: line6: Add delay before reading statusChris Rorvick1-0/+6
The device indicates the result of a read/write operation by making the status available on a subsequent request from the driver. This is not ready immediately, though, so the driver is currently slamming the device with hundreds of pointless requests before getting the expected response. Add a two millisecond delay before each attempt. This is approximately the behavior observed with version 4.2.7.1 of the Windows driver. Signed-off-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-02-08ALSA: line6: Pass driver name to line6_probe()Chris Rorvick1-1/+2
Provide a unique name for each driver instead of using "line6usb" for all of them. This will allow for different configurations based on the driver type. Signed-off-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-02-03ALSA: line6: fixup of line6_start_timer argument typeNicholas Mc Guire1-1/+1
line6_start_timer passes an unsigned int as argument to be used in mod_timer which is then used by mod_timer as unsigned long, this just fixes up the argument type. This change helps make static code checkers happy. Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-02-03ALSA: line6: use msecs_to_jiffies for conversionNicholas Mc Guire1-1/+1
This is only an API consolidation and should make things more readable it replaces var * HZ / 1000 by msecs_to_jiffies(var). Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Move the contents of usbdefs.h into driver.hTakashi Iwai1-1/+0
Most of them are rather relevant with the definitions in driver.h, and there are only a few lines, so just rip it off. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Remove revision.hTakashi Iwai1-1/+0
The definition is no longer used. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Tidy up and typo fixes in commentsTakashi Iwai1-1/+1
Just reformatting the comments and typos fixed, no functional changes. Particularly, - avoid the kerneldoc marker "/**", - reduce multiple comment lines into single lines, - corrected wrongly referred function names Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Minor tidy up in line6_probe()Takashi Iwai1-11/+9
Move the check of multi configurations before snd_card_new() as a short path, and reduce superfluous pointer references. Tested-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Let snd_card_new() allocate private dataTakashi Iwai1-15/+10
Instead of allocating the private data individually in each driver's probe at first, let snd_card_new() allocate the data that is called in line6_probe(). This simplifies the primary probe functions. Tested-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Drop interface argument from private_init and disconnect callbacksTakashi Iwai1-4/+5
The interface argument is used just for retrieving the assigned device, which can be already found in line6->ifcdev. Drop them from the callbacks. Also, pass the usb id to private_init so that the driver can deal with it there. This is a preliminary work for the further cleanup to move the whole allocation into driver.c. Tested-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Remove unused line6_nop_read()Takashi Iwai1-10/+0
The function isn't used any longer after rewriting from sysfs to leds class in toneport.c. Tested-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Fix memory leak at probe error pathTakashi Iwai1-29/+30
Fix memory leak at probe error path by rearranging the call order in line6_destruct() so that the common destructor is always called. Also this simplifies the error path to a single goto label. Tested-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Minor refactoringTakashi Iwai1-45/+49
Split some codes in the lengthy line6_probe(). Tested-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Don't forget to call driver's destructor at error pathTakashi Iwai1-0/+2
Currently disconnect callback is used as a driver's destructor, and this has to be called not only at the disconnection time but also at the error paths during probe. Tested-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Abort if inconsistent usbdev is found at disconnectTakashi Iwai1-3/+3
It's utterly unsafe to proceed further the disconnect procedure if the assigned usbdev is inconsistent with the expected object. Better to put a WARN_ON() for more cautions and abort immediately. Tested-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-28ALSA: line6: Yet more cleanup of superfluous NULL checksTakashi Iwai1-11/+2
... in line6_disconnect() as well. Tested-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-20ALSA: line6: Remove driver version from header commentChris Rorvick1-1/+1
The driver version string was removed in an ealier commit for being useless. These are equally useless. Signed-off-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-01-20ALSA: line6: Refer to manufacturer as "Line 6"Chris Rorvick1-12/+12
The correct spelling includes the space. Fix this in strings and comments that refer to the manufacturer. Signed-off-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-13 10:45:11 +0000