summaryrefslogtreecommitdiffstats
path: root/sound/usb
AgeCommit message (Collapse)AuthorFilesLines
2020-01-14ALSA: usb-audio: fix sync-ep altsetting sanity checkJohan Hovold1-1/+1
The altsetting sanity check in set_sync_ep_implicit_fb_quirk() was checking for there to be at least one altsetting but then went on to access the second one, which may not exist. This could lead to random slab data being used to initialise the sync endpoint in snd_usb_add_endpoint(). Fixes: c75a8a7ae565 ("ALSA: snd-usb: add support for implicit feedback") Fixes: ca10a7ebdff1 ("ALSA: usb-audio: FT C400 sync playback EP to capture EP") Fixes: 5e35dc0338d8 ("ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204") Fixes: 17f08b0d9aaf ("ALSA: usb-audio: add implicit fb quirk for Axe-Fx II") Fixes: 103e9625647a ("ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk") Cc: stable <stable@vger.kernel.org> # 3.5 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20200114083953.1106-1-johan@kernel.org Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-04ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5Takashi Iwai1-0/+1
Bose Companion 5 (with USB ID 05a7:1020) doesn't seem supporting reading back the sample rate, so the existing quirk is needed. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206063 Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200104110936.14288-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-12-20ALSA: usb-audio: fix set_format altsetting sanity checkJohan Hovold1-2/+2
Make sure to check the return value of usb_altnum_to_altsetting() to avoid dereferencing a NULL pointer when the requested alternate settings is missing. The format altsetting number may come from a quirk table and there does not seem to be any other validation of it (the corresponding index is checked however). Fixes: b099b9693d23 ("ALSA: usb-audio: Avoid superfluous usb_set_interface() calls") Cc: stable <stable@vger.kernel.org> # 4.18 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191220093134.1248-1-johan@kernel.org Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-12-18ALSA: usb-audio: set the interface format after resume on Dell WD19Hui Wang5-4/+35
Recently we found the headset-mic on the Dell Dock WD19 doesn't work anymore after s3 (s2i or deep), this problem could be workarounded by closing (pcm_close) the app and then reopening (pcm_open) the app, so this bug is not easy to be detected by users. When problem happens, retire_capture_urb() could still be called periodically, but the size of captured data is always 0, it could be a firmware bug on the dock. Anyway I found after resuming, the snd_usb_pcm_prepare() will be called, and if we forcibly run set_format() to set the interface and its endpoint, the capture size will be normal again. This problem and workaound also apply to playback. To fix it in the kernel, add a quirk to let set_format() run forcibly once after resume. Signed-off-by: Hui Wang <hui.wang@canonical.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191218132650.6303-1-hui.wang@canonical.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-25ALSA: usb-audio: Fix Focusrite Scarlett 6i6 gen1 - input handlingJens Verwiebe1-2/+21
The Scarlett 6i6 has no padding on rear inputs 3/4 but a gainstage. This patch introduces this functionality as to be seen in the mac or windows scarlett control. The correct address could already be found in the dump info, but was never used. Without this patch inputs 3/4 are quite unusable else. Signed-off-by: Jens Verwiebe <info@jensverwiebe.de> Link: https://lore.kernel.org/r/384d65cd-5e87-91eb-9fc3-e57226f534c6@jensverwiebe.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-22ALSA: usb-audio: Fix NULL dereference at parsing BADDTakashi Iwai1-0/+3
snd_usb_mixer_controls_badd() that parses UAC3 BADD profiles misses a NULL check for the given interfaces. When a malformed USB descriptor is passed, this may lead to an Oops, as spotted by syzkaller. Skip the iteration if the interface doesn't exist for avoiding the crash. Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support") Reported-by: syzbot+a36ab65c6653d7ccdd62@syzkaller.appspotmail.com Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191122112840.24797-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-22ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port dataGeoffrey D. Bennett1-18/+18
The s6i6_gen2_info.ports[] array had the Mixer and PCM port type entries in the wrong place. Use designators to explicitly specify the array elements being set. Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") Signed-off-by: Geoffrey D. Bennett <g@b4.vu> Tested-by: Alex Fellows <alex.fellows@gmail.com> Tested-by: Markus Schroetter <project.m.schroetter@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191110134356.GA31589@b4.vu Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-14ALSA: usb-audio: Add skip_validation optionTakashi Iwai3-3/+24
The unit descriptor validation may lead to a probe error when the device provides a buggy descriptor or the validator detected incorrectly. For identifying such an error and band-aiding, give a new module option, skip_validation. With this option, the driver ignores the validation errors with the hexdump of the unit descriptor, so we can check it in a bit more details. Link: https://lore.kernel.org/r/20191114165613.7422-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-14Merge branch 'for-linus' into for-nextTakashi Iwai4-6/+11
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-14ALSA: usb-audio: Fix incorrect size check for processing/extension unitsTakashi Iwai1-3/+3
The recently introduced unit descriptor validation had some bug for processing and extension units, it counts a bControlSize byte twice so it expected a bigger size than it should have been. This seems resulting in a probe error on a few devices. Fix the calculation for proper checks of PU and EU. Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191114165613.7422-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-14ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk()Takashi Iwai1-2/+2
The commit 60849562a5db ("ALSA: usb-audio: Fix possible NULL dereference at create_yamaha_midi_quirk()") added NULL checks in create_yamaha_midi_quirk(), but there was an overlook. The code allows one of either injd or outjd is NULL, but the second if check made returning -ENODEV if any of them is NULL. Fix it in a proper form. Fixes: 60849562a5db ("ALSA: usb-audio: Fix possible NULL dereference at create_yamaha_midi_quirk()") Reported-by: Pavel Machek <pavel@denx.de> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191113111259.24123-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-13ALSA: usb-audio: not submit urb for stopped endpointHenry Lin1-0/+3
While output urb's snd_complete_urb() is executing, calling prepare_outbound_urb() may cause endpoint stopped before prepare_outbound_urb() returns and result in next urb submitted to stopped endpoint. usb-audio driver cannot re-use it afterwards as the urb is still hold by usb stack. This change checks EP_FLAG_RUNNING flag after prepare_outbound_urb() again to let snd_complete_urb() know the endpoint already stopped and does not submit next urb. Below kind of error will be fixed: [ 213.153103] usb 1-2: timeout: still 1 active urbs on EP #1 [ 213.164121] usb 1-2: cannot submit urb 0, error -16: unknown error Signed-off-by: Henry Lin <henryl@nvidia.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191113021420.13377-1-henryl@nvidia.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-09ALSA: usb-audio: Fix missing error check at mixer resolution testTakashi Iwai1-1/+3
A check of the return value from get_cur_mix_raw() is missing at the resolution test code in get_min_max_with_quirks(), which may leave the variable untouched, leading to a random uninitialized value, as detected by syzkaller fuzzer. Add the missing return error check for fixing that. Reported-and-tested-by: syzbot+abe1ab7afc62c6bb6377@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191109181658.30368-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-06ALSA: ua101: Convert to the common vmalloc memallocTakashi Iwai1-7/+7
The recent change (*) in the ALSA memalloc core allows us to drop the special vmalloc-specific allocation and page handling. This patch coverts to the common code. (*) 1fe7f397cfe2: ALSA: memalloc: Add vmalloc buffer allocation support 7e8edae39fd1: ALSA: pcm: Handle special page mapping in the default mmap handler Link: https://lore.kernel.org/r/20191105151856.10785-15-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-06ALSA: hiface: Convert to the common vmalloc memallocTakashi Iwai1-4/+5
The recent change (*) in the ALSA memalloc core allows us to drop the special vmalloc-specific allocation and page handling. This patch coverts to the common code. (*) 1fe7f397cfe2: ALSA: memalloc: Add vmalloc buffer allocation support 7e8edae39fd1: ALSA: pcm: Handle special page mapping in the default mmap handler Link: https://lore.kernel.org/r/20191105151856.10785-14-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-06ALSA: caiaq: Convert to the common vmalloc memallocTakashi Iwai1-4/+4
The recent change (*) in the ALSA memalloc core allows us to drop the special vmalloc-specific allocation and page handling. This patch coverts to the common code. (*) 1fe7f397cfe2: ALSA: memalloc: Add vmalloc buffer allocation support 7e8edae39fd1: ALSA: pcm: Handle special page mapping in the default mmap handler Link: https://lore.kernel.org/r/20191105151856.10785-13-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-06ALSA: 6fire: Convert to the common vmalloc memallocTakashi Iwai1-4/+5
The recent change (*) in the ALSA memalloc core allows us to drop the special vmalloc-specific allocation and page handling. This patch coverts to the common code. (*) 1fe7f397cfe2: ALSA: memalloc: Add vmalloc buffer allocation support 7e8edae39fd1: ALSA: pcm: Handle special page mapping in the default mmap handler Link: https://lore.kernel.org/r/20191105151856.10785-12-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-06ALSA: usb-audio: Convert to the common vmalloc memallocTakashi Iwai1-42/+8
The recent change (*) in the ALSA memalloc core allows us to drop the special vmalloc-specific allocation and page handling. This patch coverts to the common code. (*) 1fe7f397cfe2: ALSA: memalloc: Add vmalloc buffer allocation support 7e8edae39fd1: ALSA: pcm: Handle special page mapping in the default mmap handler Also, since the SG-buffer-specific PCM ops becomes identical with the normal PCM ops, unify them again to the single ops, too. Link: https://lore.kernel.org/r/20191105151856.10785-9-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-06ALSA: 6fire: Drop the dead codeTakashi Iwai1-7/+0
A few error handling code was forgotten where it never reaches. Drop it. Link: https://lore.kernel.org/r/20191105151856.10785-8-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-06ALSA: usb: Remove superfluous snd_dma_continuous_data()Takashi Iwai3-7/+5
The recent change (commit 08422d2c559d: "ALSA: memalloc: Allow NULL device for SNDRV_DMA_TYPE_CONTINUOUS type") made the PCM preallocation helper accepting NULL as the device pointer for the default usage. Drop the snd_dma_continuous_data() usage that became superfluous from the callers. Link: https://lore.kernel.org/r/20191105151856.10785-7-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-10-30ALSA: usb-audio: sound: usb: usb true/false for bool return typeSaurav Girepunje1-5/+5
Use true/false for bool type return in uac_clock_source_is_valid(). Signed-off-by: Saurav Girepunje <saurav.girepunje@gmail.com> Link: https://lore.kernel.org/r/20191029175200.GA7320@saurav Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-10-28Merge branch 'for-linus' into for-nextTakashi Iwai3-1/+5
Back-merge the development process for catching up the HD-audio fix (and apply a new one on top of that). Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-10-24ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB InterfaceJustin Song1-0/+1
This patch adds native DSD support for Gustard U16/X26 USB Interface. Tested using VID and fp->dsd_raw method. Signed-off-by: Justin Song <flyingecar@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/CA+9XP1ipsFn+r3bCBKRinQv-JrJ+EHOGBdZWZoMwxFv0R8Y1MQ@mail.gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-10-22ALSA: usb-audio: Fix copy&paste error in the validatorTakashi Iwai1-1/+1
The recently introduced USB-audio descriptor validator had a stupid copy&paste error that may lead to an unexpected overlook of too short descriptors for processing and extension units. It's likely the cause of the report triggered by syzkaller fuzzer. Let's fix it. Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") Reported-by: syzbot+0620f79a1978b1133fd7@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/s5hsgnkdbsl.wl-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-10-17ALSA: usb-audio: Disable quirks for BOSS Katana amplifiersSzabolcs Szőke1-0/+3
BOSS Katana amplifiers cannot be used for recording or playback if quirks are applied BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195223 Signed-off-by: Szabolcs Szőke <szszoke.code@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191011171937.8013-1-szszoke.code@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-10-07sound: Fix Kconfig indentationKrzysztof Kozlowski1-16/+16
Adjust indentation from spaces to tab (+optional two spaces) as in coding style with command like: $ sed -e 's/^ /\t/' -i */Kconfig Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Acked-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/20191004144931.3851-1-krzk@kernel.org Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-09-24ALSA: usb-audio: Add DSD support for EVGA NU AudioJussi Laako1-0/+1
EVGA NU Audio is actually a USB audio device on a PCIexpress card, with it's own USB controller. It supports both PCM and DSD. Signed-off-by: Jussi Laako <jussi@sonarnerd.net> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20190924071143.30911-1-jussi@sonarnerd.net Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-09-17ALSA: usb-audio: Add Hiby device family to quirks for native DSD supportIlya Pshonkin1-0/+1
This patch adds quirk VID ID for Hiby portable players family with native DSD playback support. Signed-off-by: Ilya Pshonkin <sudokamikaze@protonmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20190917074937.157802-1-ilya.pshonkin@netforce.ua Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-28ALSA: usb-audio: Update DSD support quirks for Oppo and RotelJussi Laako1-4/+2
Oppo has issued firmware updates that change alt setting used for DSD support. However, these devices seem to support auto-detection, so support is moved from explicit whitelisting to auto-detection. Also Rotel devices have USB interfaces that support DSD with auto-detection. Signed-off-by: Jussi Laako <jussi@sonarnerd.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-28ALSA: usb-audio: DSD auto-detection for Playback DesignsJussi Laako1-2/+4
Add DSD support auto-detection for newer Playback Designs devices. Older device generations have a different USB interface implementation. Keep the auto-detection VID whitelist sorted. Signed-off-by: Jussi Laako <jussi@sonarnerd.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-26ALSA: usb-audio: remove some dead codeDan Carpenter1-1/+0
We recently cleaned up the error handling in commit 52c3e317a857 ("ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects") but accidentally left this stray return. Fixes: 52c3e317a857 ("ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-26ALSA: usb-audio: Fix possible NULL dereference at create_yamaha_midi_quirk()Takashi Iwai1-2/+2
The previous addition of descriptor validation may lead to a NULL dereference at create_yamaha_midi_quirk() when either injd or outjd is NULL. Add proper non-NULL checks. Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-25ALSA: usb-audio: Clean up check_input_term()Takashi Iwai1-192/+209
The primary changes in this patch are cleanups of __check_input_term() and move to a non-nested switch-case block by evaluating the pair of UAC version and the unit type, as we've done for parse_audio_unit(). Also each parser is split into the function for readability. Now, a slight behavior change by this cleanup is the handling of processing and extension units. Formerly we've dealt with them differently between UAC1/2 and UAC3; the latter returns an error if no input sources are available, while the former continues to parse. In this patch, unify the behavior in all cases: when input sources are available, it parses recursively, then override the type and the id, as well as channel information if not provided yet. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22Merge branch 'topic/usb-validation' into for-nextTakashi Iwai12-211/+516
Pull USB validation patches. It's based on the latest 5.3 development branch, so we shall catch up the whole things. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: Remove superfluous bLength checksTakashi Iwai2-92/+6
Now that we got the more comprehensive validation code for USB-audio descriptors, the check of overflow in each descriptor unit parser became superfluous. Drop some of the obvious cases. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: Unify the release of usb_mixer_elem_info objectsTakashi Iwai1-20/+28
Instead of the direct kfree() calls, introduce a new local helper to release the usb_mixer_elem_info object. This will be extended to do more than a single kfree() in the later patches. Also, use the standard goto instead of multiple calls in parse_audio_selector_unit() error paths. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: Simplify parse_audio_unit()Takashi Iwai1-56/+39
Minor code refactoring by combining the UAC version and the type in the switch-case flow, so that we reduce the indentation and redundancy. One good bonus is that the duplicated definition of the same type value (e.g. UAC2_EFFECT_UNIT) can be handled more cleanly. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: More validations of descriptor unitsTakashi Iwai7-13/+366
Introduce a new helper to validate each audio descriptor unit before and check the unit before actually accessing it. This should harden against the OOB access cases with malformed descriptors that have been recently frequently reported by fuzzers. The existing descriptor checks are still kept although they become superfluous after this patch. They'll be cleaned up eventually later. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: Check mixer unit bitmap yet more strictlyTakashi Iwai1-8/+28
The bmControls (for UAC1) or bmMixerControls (for UAC2/3) bitmap has a variable size depending on both input and output pins. Its size is to fit with input * output bits. The problem is that the input size can't be determined simply from the unit descriptor itself but it needs to parse the whole connected sources. Although the uac_mixer_unit_get_channels() tries to check some possible overflow of this bitmap, it's incomplete due to the lack of the evaluation of input pins. For covering possible overflows, this patch adds the bitmap overflow check in the loop of input pins in parse_audio_mixer_unit(). Fixes: 0bfe5e434e66 ("ALSA: usb-audio: Check mixer unit descriptors more strictly") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-21ALSA: line6: Fix memory leak at line6_init_pcm() error pathTakashi Iwai1-9/+9
I forgot to release the allocated object at the early error path in line6_init_pcm(). For addressing it, slightly shuffle the code so that the PCM destructor (pcm->private_free) is assigned properly before all error paths. Fixes: 3450121997ce ("ALSA: line6: Fix write on zero-sized buffer") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-21ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate()Takashi Iwai1-4/+4
The quirk function snd_emuusb_set_samplerate() has a NULL check for the mixer element, but this is useless in the current code. It used to be a check against mixer->id_elems[unitid] but it was changed later to the value after mixer_eleme_list_to_info() which is always non-NULL due to the container_of() usage. This patch fixes the check before the conversion. While we're at it, correct a typo in the comment in the function, too. Fixes: 8c558076c740 ("ALSA: usb-audio: Clean up mixer element list traverse") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-20ALSA: usb-audio: Add implicit fb quirk for Behringer UFX1604Takashi Iwai1-0/+1
Behringer UFX1604 requires the similar quirk to apply implicit fb like another Behringer model UFX1204 in order to fix the noisy playback. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204631 Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-15ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_termHui Peng1-8/+27
`check_input_term` recursively calls itself with input from device side (e.g., uac_input_terminal_descriptor.bCSourceID) as argument (id). In `check_input_term`, if `check_input_term` is called with the same `id` argument as the caller, it triggers endless recursive call, resulting kernel space stack overflow. This patch fixes the bug by adding a bitmap to `struct mixer_build` to keep track of the checked ids and stop the execution if some id has been checked (similar to how parse_audio_unit handles unitid argument). Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-14ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unitHui Peng1-0/+2
The `uac_mixer_unit_descriptor` shown as below is read from the device side. In `parse_audio_mixer_unit`, `baSourceID` field is accessed from index 0 to `bNrInPins` - 1, the current implementation assumes that descriptor is always valid (the length of descriptor is no shorter than 5 + `bNrInPins`). If a descriptor read from the device side is invalid, it may trigger out-of-bound memory access. ``` struct uac_mixer_unit_descriptor { __u8 bLength; __u8 bDescriptorType; __u8 bDescriptorSubtype; __u8 bUnitID; __u8 bNrInPins; __u8 baSourceID[]; } ``` This patch fixes the bug by add a sanity check on the length of the descriptor. Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Cc: <stable@vger.kernel.org> Signed-off-by: Hui Peng <benquike@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-07ALSA: hiface: fix multiple memory leak bugsWenwen Wang1-3/+8
In hiface_pcm_init(), 'rt' is firstly allocated through kzalloc(). Later on, hiface_pcm_init_urb() is invoked to initialize 'rt->out_urbs[i]'. In hiface_pcm_init_urb(), 'rt->out_urbs[i].buffer' is allocated through kzalloc(). However, if hiface_pcm_init_urb() fails, both 'rt' and 'rt->out_urbs[i].buffer' are not deallocated, leading to memory leak bugs. Also, 'rt->out_urbs[i].buffer' is not deallocated if snd_pcm_new() fails. To fix the above issues, free 'rt' and 'rt->out_urbs[i].buffer'. Fixes: a91c3fb2f842 ("Add M2Tech hiFace USB-SPDIF driver") Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-06ALSA: usb-audio: Add Pioneer DDJ-SX3 PCM quirckArd van Breemen1-0/+57
The Pioneer DDJ-SX3 is a plain 12 32bit channel out and 10 channel in PCM/midi controller. The PCM part is "vendor specific". It needs the "ignore invalid bsynchaddress" patch as it uses 0 for that. Signed-off-by: Ard van Breemen <ard@kwaak.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-06ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalidArd van Breemen1-0/+1
The Linux kernel assumes that get_endpoint(alts,0) and get_endpoint(alts,1) are eachothers feedback endpoints. To reassure that validity it will test bsynchaddress to comply with that assumption. But if the bsyncaddress is 0 (invalid), it will flag that as a wrong assumption and return an error. Fix: Skip the test if bSynchAddress is 0. Note: those with a valid bSynchAddress should have a code quirck added. Signed-off-by: Ard van Breemen <ard@kwaak.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-06ALSA: usb-audio: fix PCM device orderAlexander Tsoy1-1/+33
Some cards have alternate setting with non-PCM format as the first altsetting in the interface descriptors. This confuses userspace, since alsa-lib uses device 0 by default. So lets parse interfaces in two steps: 1. Parse altsettings with PCM formats. 2. Parse altsettings with non-PCM formats. This fixes at least following cards: - Audinst HUD-mx2 - Audinst HUD-mini [ Adapted to 5.3 kernel by tiwai ] Signed-off-by: Alexander Tsoy <alexander@tsoy.me> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-06ALSA: usb-audio: Unify audioformat release codeTakashi Iwai1-17/+14
There are many open code for releasing audioformat object. Provide a unified helper and call it from the all places. Only a cleanup, no functional changes. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-06Merge branch 'for-linus' into for-nextTakashi Iwai2-1/+2
Pull 5.3 development branch for further fixes of USB-audio stuff. Signed-off-by: Takashi Iwai <tiwai@suse.de>
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-23 10:22:35 +0000