summaryrefslogtreecommitdiff
path: root/sound/usb/mixer.c
AgeCommit message (Collapse)Author
2021-04-28ALSA: usb-audio: Remove redundant assignment to lenJiapeng Chong
Variable len is set to zero but this value is never read as it is overwritten with a new value later on, hence it is a redundant assignment and can be removed. Cleans up the following clang-analyzer warning: sound/usb/mixer.c:2713:3: warning: Value stored to 'len' is never read [clang-analyzer-deadcode.DeadStores]. Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Link: https://lore.kernel.org/r/1619519194-57806-1-git-send-email-jiapeng.chong@linux.alibaba.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-03-26ALSA: usb-audio: Check connector value on resumeKai-Heng Feng
Rear Mic on Lenovo P620 cannot record after S3, despite that there's no error and the other two functions of the USB audio, Line In and Line Out, work just fine. The mic starts to work again after running userspace app like "alsactl store". Following the lead, the evidence shows that as soon as connector status is queried, the mic can work again. So also check connector value on resume to "wake up" the USB audio to make it functional. This can be device specific, however I think this generic approach may benefit more than one device. Now the resume callback checks connector, and a new callback, reset_resume, to also restore switches and volumes. Suggested-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Link: https://lore.kernel.org/r/20210325165918.22593-2-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-03-26ALSA: usb-audio: Carve out connector value checking into a helperKai-Heng Feng
This is preparation for next patch, no functional change intended. Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Link: https://lore.kernel.org/r/20210325165918.22593-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-02-27ALSA: usb-audio: Drop bogus dB range in too low levelTakashi Iwai
Some USB audio firmware seem to report broken dB values for the volume controls, and this screws up applications like PulseAudio who blindly trusts the given data. For example, Edifier G2000 reports a PCM volume from -128dB to -127dB, and this results in barely inaudible sound. This patch adds a sort of sanity check at parsing the dB values in USB-audio driver and disables the dB reporting if the range looks bogus. Here, we assume -96dB as the bottom line of the max dB. Note that, if one can figure out that proper dB range later, it can be patched in the mixer maps. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211929 Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20210227105737.3656-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-01-21ALSA: usb-audio: Fix "RANGE setting not yet supported" errorsTakashi Iwai
At probing a UAC2/UAC3 device like NUX MG-300 USB interface, we get error messages "RANGE setting not yet supported". It comes the place where the driver tries to determine the resolution of mixer volumes via SET_CUR_RES and GET_CUR_RES verbs. Those verbs aren't supported on UAC2 and UAC3, hence the driver warns like the above. Although the driver handles this error and works as expected, it's still ugly to show such errors unnecessarily. This patch papers over the errors by applying the resolution detection only for UAC1 and skipping it for UAC2/UAC3. Reported-by: Mike Oliphant <oliphant@nostatic.org> Link: https://lore.kernel.org/r/20210120213932.1971-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-01-15ALSA: usb-audio: Convert remaining strlcpy() to strscpy()Takashi Iwai
USB-audio driver still contains two calls of strlcpy() because the return size is evaluated. Basically it just checks whether the string is copied or not, but since strcpy() may return a negative error code, we should check the negative value and treat as filled. Link: https://lore.kernel.org/r/20210115095758.19707-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-01-08ALSA: Convert strlcpy to strscpy when return value is unusedJoe Perches
strlcpy is deprecated. see: Documentation/process/deprecated.rst Change the calls that do not use the strlcpy return value to the preferred strscpy. Done with cocci script: @@ expression e1, e2, e3; @@ - strlcpy( + strscpy( e1, e2, e3); This cocci script leaves the instances where the return value is used unchanged. After this patch, sound/ has 3 uses of strlcpy() that need to be manually inspected for conversion and changed one day. $ git grep -w strlcpy sound/ sound/usb/card.c: len = strlcpy(card->longname, s, sizeof(card->longname)); sound/usb/mixer.c: return strlcpy(buf, p->name, buflen); sound/usb/mixer.c: return strlcpy(buf, p->names[index], buflen); Miscellenea: o Remove trailing whitespace in conversion of sound/core/hwdep.c Link: https://lore.kernel.org/lkml/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Signed-off-by: Joe Perches <joe@perches.com> Acked-by: Mark Brown <broonie@kernel.org> Link: https://lore.kernel.org/r/22b393d1790bb268769d0bab7bacf0866dcb0c14.camel@perches.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-12-25ALSA: usb: Use DIV_ROUND_UP() instead of open-coding itLars-Peter Clausen
Use DIV_ROUND_UP() instead of open-coding it. This documents intent and makes it more clear what is going on for the casual reviewer. Generated using the following the Coccinelle semantic patch. // <smpl> @@ expression x, y; @@ -(((x) + (y) - 1) / (y)) +DIV_ROUND_UP(x, y) // </smpl> Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Link: https://lore.kernel.org/r/20201223172229.781-11-lars@metafoo.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-11-23ALSA: usb-audio: Drop keep_interface flag againTakashi Iwai
This behavior turned out to be invalid from the USB spec POV and shouldn't be applied. As it's an optional flag that is set only via an card control element that must be hardly used, let's drop it again. Tested-by: Keith Milner <kamilner@superlative.org> Tested-by: Dylan Robinson <dylan_robinson@motu.com> Link: https://lore.kernel.org/r/20201123085347.19667-16-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-08-17ALSA: usb-audio: ignore broken processing/extension unitTom Yan
Some devices have broken extension unit where getting current value doesn't work. Attempt that once when creating mixer control for it. If it fails, just ignore it, so that it won't cripple the device entirely (and/or make the error floods). Signed-off-by: Tom Yan <tom.ty89@gmail.com> Link: https://lore.kernel.org/r/5f3abc52.1c69fb81.9cf2.fe91@mx.google.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-08-03ALSA: usb-audio: Add support for Lenovo ThinkStation P620Kai-Heng Feng
Lenovo ThinkStation P620 is like other TRX40 boards, is equipped with two USB audio cards. USB device (17aa:104d) provides functionality for Internal Speaker and Front Headset. It's UAC v2, so it supports insertion control (jack detection). However, when trying to get the connector status of the speaker, an error occurs: [ 5.787405] usb 3-1: cannot get connectors status: req = 0x81, wValue = 0x200, wIndex = 0x1000, type = 0 Since the insertion control works perfectly for the headset, the error for speaker is probably casued by connecting internally. So let's relax the error for a bit if it's a speaker, and always reports it's connected. USB device (17aa:1046) is for rear Line-in, Line-out and Microphone. The insertion control works for all three jacks. However, there's an Function Unit that doesn't work: [ 5.905415] usb 3-6: cannot get ctl value: req = 0x83, wValue = 0xc00, wIndex = 0x1300, type = 4 [ 5.905418] usb 3-6: 19:0: cannot get min/max values for control 12 (id 19) So turn off the FU to avoid the error. Also, add specific card name for both devices, so userspace can easily indentify both cards. Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> Link: https://lore.kernel.org/r/20200803142612.17156-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-06-24ALSA: usb-audio: Fix OOB access of mixer element listTakashi Iwai
The USB-audio mixer code holds a linked list of usb_mixer_elem_list, and several operations are performed for each mixer element. A few of them (snd_usb_mixer_notify_id() and snd_usb_mixer_interrupt_v2()) assume each mixer element being a usb_mixer_elem_info object that is a subclass of usb_mixer_elem_list, cast via container_of() and access it members. This may result in an out-of-bound access when a non-standard list element has been added, as spotted by syzkaller recently. This patch adds a new field, is_std_info, in usb_mixer_elem_list to indicate that the element is the usb_mixer_elem_info type or not, and skip the access to such an element if needed. Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com Reported-by: syzbot+2405ca3401e943c538b5@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200624122340.9615-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-05-26ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DACChris Chiu
The Asus USB DAC is a USB type-C audio dongle for connecting to the headset and headphone. The volume minimum value -23040 which is 0xa600 in hexadecimal with the resolution value 1 indicates this should be endianness issue caused by the firmware bug. Add a volume quirk to fix the volume control problem. Also fixes this warning: Warning! Unlikely big volume range (=23040), cval->res is probably wrong. [5] FU [Headset Capture Volume] ch = 1, val = -23040/0/1 Warning! Unlikely big volume range (=23040), cval->res is probably wrong. [7] FU [Headset Playback Volume] ch = 1, val = -23040/0/1 Signed-off-by: Chris Chiu <chiu@endlessm.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200526062613.55401-1-chiu@endlessm.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-22ALSA: usb-audio: Add connector notifier delegationTakashi Iwai
It turned out that ALC1220-VB USB-audio device gives the interrupt event to some PCM terminals while those don't allow the connector state request but only the actual I/O terminals return the request. The recent commit 7dc3c5a0172e ("ALSA: usb-audio: Don't create jack controls for PCM terminals") excluded those phantom terminals, so those events are ignored, too. My first thought was that this could be easily deduced from the associated terminals, but some of them have even no associate terminal ID, hence it's not too trivial to figure out. Since the number of such terminals are small and limited, this patch implements another quirk table for the simple mapping of the connectors. It's not really scalable, but let's hope that there will be not many such funky devices in future. Fixes: 7dc3c5a0172e ("ALSA: usb-audio: Don't create jack controls for PCM terminals") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 Link: https://lore.kernel.org/r/20200422113320.26664-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-20ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobosTakashi Iwai
TRX40 mobos from MSI and others with ALC1220-VB USB-audio device need yet more quirks for the proper control names. This patch provides the mapping table for those boards, correcting the FU names for volume and mute controls as well as the terminal names for jack controls. It also improves build_connector_control() not to add the directional suffix blindly if the string is given from the mapping table. With this patch applied, the new UCM profiles will be effective. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 Link: https://lore.kernel.org/r/20200420062036.28567-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-12ALSA: usb-audio: Check mapping at creating connector controls, tooTakashi Iwai
Add the mapping check to build_connector_control() so that the device specific quirk can provide the node to skip for the badly behaving connector controls. As an example, ALC1220-VB-based codec implements the skip entry for the broken SPDIF connector detection. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200412081331.4742-5-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-12ALSA: usb-audio: Don't create jack controls for PCM terminalsTakashi Iwai
Some funky firmwares set the connector flag even on PCM terminals although it doesn't make sense (and even actually the firmware doesn't react properly!). Let's skip creation of jack controls in such a case. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200412081331.4742-4-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-12ALSA: usb-audio: Don't override ignore_ctl_error value from the mapTakashi Iwai
The mapping table may contain also ignore_ctl_error flag for devices that are known to behave wild. Since this flag always writes the card's own ignore_ctl_error flag, it overrides the value already set by the module option, so it doesn't follow user's expectation. Let's fix the code not to clear the flag that has been set by user. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200412081331.4742-3-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-12ALSA: usb-audio: Filter error from connector kctl ops, tooTakashi Iwai
The ignore_ctl_error option should filter the error at kctl accesses, but there was an overlook: mixer_ctl_connector_get() returns an error from the request. This patch covers the forgotten code path and apply filter_error() properly. The locking error is still returned since this is a fatal error that has to be reported even with ignore_ctl_error option. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200412081331.4742-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-03-14ALSA: usb-audio: Fix mixer controls' USB interface for Kingston HyperX Amp ↵Chris Wulff
(0951:16d8) Use the USB interface of the mixer that the control was created on instead of the default control interface. This fixes the Kingston HyperX AMP (0951:16d8) which has controls on two interfaces. Signed-off-by: Chris Wulff <crwulff@gmail.com> Link: https://lore.kernel.org/r/20200314165449.4086-2-crwulff@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-02-17Merge branch 'topic/usb-uac2-effect-unit' into for-nextTakashi Iwai
Merging the UAC2 effect unit parser improvement. As it's based on the previous usb-audio driver fix, it was deviated from for-next branch. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-02-17ALSA: usb-audio: Parse source ID of UAC2 effect unitTakashi Iwai
During parsing the input source, we currently cut off at the Effect Unit node without parsing further its source id. It's no big problem, so far, but it should be more consistent to parse it properly. This patch adds the recursive parsing in parse_term_effect_unit(). It doesn't add anything in the audio unit parser itself, and the effect unit itself is still skipped, though. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206147 Link: https://lore.kernel.org/r/20200213112059.18745-3-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-02-14ALSA: usb-audio: Don't create a mixer element with bogus volume rangeTakashi Iwai
Some USB-audio descriptors provide a bogus volume range (e.g. volume min and max are identical), which confuses user-space. This patch makes the driver skipping such a control element. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206221 Link: https://lore.kernel.org/r/20200214144928.23628-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-02-11ALSA: usb-audio: Fix UAC2/3 effect unit parsingTakashi Iwai
We've got a regression report about M-Audio Fast Track C400 device, and the git bisection resulted in the commit e0ccdef92653 ("ALSA: usb-audio: Clean up check_input_term()"). This commit was about the rewrite of the input terminal parser, and it's not too obvious from the change what really broke. The answer is: it's the interpretation of UAC2/3 effect units. In the original code, UAC2 effect unit is as if through UAC1 processing unit because both UAC1 PU and UAC2/3 EU share the same number (0x07). The old code went through a complex switch-case fallthrough, finally bailing out in the middle: if (protocol == UAC_VERSION_2 && hdr[2] == UAC2_EFFECT_UNIT) { /* UAC2/UAC1 unit IDs overlap here in an * uncompatible way. Ignore this unit for now. */ return 0; } ... and this special handling was missing in the new code; the new code treats UAC2/3 effect unit as if it were equivalent with the processing unit. Actually, the old code was too confusing. The effect unit has an incompatible unit description with the processing unit, so we shouldn't have dealt with EU in the same way. This patch addresses the regression by changing the effect unit handling to the own parser function. The own parser function makes the clear distinct with PU, so it improves the readability, too. The EU parser just sets the type and the id like the old kernels. Once when the proper effect unit support is added, we can revisit this parser function, but for now, let's keep this simple setup as is. Fixes: e0ccdef92653 ("ALSA: usb-audio: Clean up check_input_term()") Cc: <stable@vger.kernel.org> BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206147 Link: https://lore.kernel.org/r/20200211160521.31990-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-05ALSA: usb-audio: More constificationsTakashi Iwai
Apply const prefix to the remaining places: the static table for the unit information, the mixer maps, the validator tables, etc. Just for minor optimization and no functional changes. Link: https://lore.kernel.org/r/20200105144823.29547-12-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-03ALSA: usb: Constify snd_kcontrol_new itemsTakashi Iwai
Most of snd_kcontrol_new definitions are read-only and passed as-is. Let's declare them as const for further optimization. There should be no functional changes by this patch. Link: https://lore.kernel.org/r/20200103081714.9560-42-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-03ALSA: usb: Constify snd_device_ops definitionsTakashi Iwai
Now we may declare const for snd_device_ops definitions, so let's do it for optimization. There should be no functional changes by this patch. Link: https://lore.kernel.org/r/20200103081714.9560-11-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-22ALSA: usb-audio: Fix NULL dereference at parsing BADDTakashi Iwai
snd_usb_mixer_controls_badd() that parses UAC3 BADD profiles misses a NULL check for the given interfaces. When a malformed USB descriptor is passed, this may lead to an Oops, as spotted by syzkaller. Skip the iteration if the interface doesn't exist for avoiding the crash. Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support") Reported-by: syzbot+a36ab65c6653d7ccdd62@syzkaller.appspotmail.com Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191122112840.24797-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-09ALSA: usb-audio: Fix missing error check at mixer resolution testTakashi Iwai
A check of the return value from get_cur_mix_raw() is missing at the resolution test code in get_min_max_with_quirks(), which may leave the variable untouched, leading to a random uninitialized value, as detected by syzkaller fuzzer. Add the missing return error check for fixing that. Reported-and-tested-by: syzbot+abe1ab7afc62c6bb6377@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191109181658.30368-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-26ALSA: usb-audio: remove some dead codeDan Carpenter
We recently cleaned up the error handling in commit 52c3e317a857 ("ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects") but accidentally left this stray return. Fixes: 52c3e317a857 ("ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-25ALSA: usb-audio: Clean up check_input_term()Takashi Iwai
The primary changes in this patch are cleanups of __check_input_term() and move to a non-nested switch-case block by evaluating the pair of UAC version and the unit type, as we've done for parse_audio_unit(). Also each parser is split into the function for readability. Now, a slight behavior change by this cleanup is the handling of processing and extension units. Formerly we've dealt with them differently between UAC1/2 and UAC3; the latter returns an error if no input sources are available, while the former continues to parse. In this patch, unify the behavior in all cases: when input sources are available, it parses recursively, then override the type and the id, as well as channel information if not provided yet. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22Merge branch 'topic/usb-validation' into for-nextTakashi Iwai
Pull USB validation patches. It's based on the latest 5.3 development branch, so we shall catch up the whole things. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: Remove superfluous bLength checksTakashi Iwai
Now that we got the more comprehensive validation code for USB-audio descriptors, the check of overflow in each descriptor unit parser became superfluous. Drop some of the obvious cases. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: Unify the release of usb_mixer_elem_info objectsTakashi Iwai
Instead of the direct kfree() calls, introduce a new local helper to release the usb_mixer_elem_info object. This will be extended to do more than a single kfree() in the later patches. Also, use the standard goto instead of multiple calls in parse_audio_selector_unit() error paths. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: Simplify parse_audio_unit()Takashi Iwai
Minor code refactoring by combining the UAC version and the type in the switch-case flow, so that we reduce the indentation and redundancy. One good bonus is that the duplicated definition of the same type value (e.g. UAC2_EFFECT_UNIT) can be handled more cleanly. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: More validations of descriptor unitsTakashi Iwai
Introduce a new helper to validate each audio descriptor unit before and check the unit before actually accessing it. This should harden against the OOB access cases with malformed descriptors that have been recently frequently reported by fuzzers. The existing descriptor checks are still kept although they become superfluous after this patch. They'll be cleaned up eventually later. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22ALSA: usb-audio: Check mixer unit bitmap yet more strictlyTakashi Iwai
The bmControls (for UAC1) or bmMixerControls (for UAC2/3) bitmap has a variable size depending on both input and output pins. Its size is to fit with input * output bits. The problem is that the input size can't be determined simply from the unit descriptor itself but it needs to parse the whole connected sources. Although the uac_mixer_unit_get_channels() tries to check some possible overflow of this bitmap, it's incomplete due to the lack of the evaluation of input pins. For covering possible overflows, this patch adds the bitmap overflow check in the loop of input pins in parse_audio_mixer_unit(). Fixes: 0bfe5e434e66 ("ALSA: usb-audio: Check mixer unit descriptors more strictly") Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-15ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_termHui Peng
`check_input_term` recursively calls itself with input from device side (e.g., uac_input_terminal_descriptor.bCSourceID) as argument (id). In `check_input_term`, if `check_input_term` is called with the same `id` argument as the caller, it triggers endless recursive call, resulting kernel space stack overflow. This patch fixes the bug by adding a bitmap to `struct mixer_build` to keep track of the checked ids and stop the execution if some id has been checked (similar to how parse_audio_unit handles unitid argument). Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Hui Peng <benquike@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-14ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unitHui Peng
The `uac_mixer_unit_descriptor` shown as below is read from the device side. In `parse_audio_mixer_unit`, `baSourceID` field is accessed from index 0 to `bNrInPins` - 1, the current implementation assumes that descriptor is always valid (the length of descriptor is no shorter than 5 + `bNrInPins`). If a descriptor read from the device side is invalid, it may trigger out-of-bound memory access. ``` struct uac_mixer_unit_descriptor { __u8 bLength; __u8 bDescriptorType; __u8 bDescriptorSubtype; __u8 bUnitID; __u8 bNrInPins; __u8 baSourceID[]; } ``` This patch fixes the bug by add a sanity check on the length of the descriptor. Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Cc: <stable@vger.kernel.org> Signed-off-by: Hui Peng <benquike@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-28ALSA: usb-audio: Scarlett Gen 2 mixer interfaceGeoffrey D. Bennett
Add mixer quirk for the Focusrite Scarlett 6i6, 18i8, and 18i20 Gen 2 audio interfaces. Although the interfaces are USB compliant, additional input/output level controls and hardware routing/mixing functionality are available using proprietary USB requests. Signed-off-by: Geoffrey D. Bennett <g@b4.vu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08Merge tag 'asoc-v5.3' of ↵Takashi Iwai
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v5.3 This is a very big update, mainly thanks to Morimoto-san's refactoring work and some fairly large new drivers. - Lots more work on moving towards a component based framework from Morimoto-san. - Support for force disconnecting muxes from Jerome Brunet. - New drivers for Cirrus Logic CS47L35, CS47L85 and CS47L90, Conexant CX2072X, Realtek RT1011 and RT1308. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-05ALSA: usb-audio: Fix parse of UAC2 Extension UnitsTakashi Iwai
Extension Unit (XU) is used to have a compatible layout with Processing Unit (PU) on UAC1, and the usb-audio driver code assumed it for parsing the descriptors. Meanwhile, on UAC2, XU became slightly incompatible with PU; namely, XU has a one-byte bmControls bitmap while PU has two bytes bmControls bitmap. This incompatibility results in the read of a wrong address for the last iExtension field, which ended up with an incorrect string for the mixer element name, as recently reported for Focusrite Scarlett 18i20 device. This patch corrects this misalignment by introducing a couple of new macros and calling them depending on the descriptor type. Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0") Reported-by: Stefan Sauer <ensonic@hora-obscura.de> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-05-30treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156Thomas Gleixner
Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details you should have received a copy of the gnu general public license along with this program if not write to the free software foundation inc 59 temple place suite 330 boston ma 02111 1307 usa extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 1334 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Reviewed-by: Richard Fontana <rfontana@redhat.com> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-04-28ALSA: usb-audio: Fix a memory leak bugWenwen Wang
In parse_audio_selector_unit(), the string array 'namelist' is allocated through kmalloc_array(), and each string pointer in this array, i.e., 'namelist[]', is allocated through kmalloc() in the following for loop. Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If an error occurs during the creation process, the string array 'namelist', including all string pointers in the array 'namelist[]', should be freed, before the error code ENOMEM is returned. However, the current code does not free 'namelist[]', resulting in memory leaks. To fix the above issue, free all string pointers 'namelist[]' in a loop. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-04-24ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()Takashi Iwai
The error from snd_usb_mixer_apply_create_quirk() is ignored in the current usb-audio driver code, which will continue the probing even after the error. Let's take it more serious. Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks") Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-06ALSA: usb: Clean up with new procfs helpersTakashi Iwai
Simplify the proc fs creation code with new helper functions, snd_card_ro_proc_new() and snd_card_rw_proc_new(). Just a code refactoring and no functional changes. Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-09ALSA: usb-audio: Remove set but not used variable 'first_ch_bits'YueHaibing
Fixes gcc '-Wunused-but-set-variable' warning: sound/usb/mixer.c: In function 'parse_audio_feature_unit': sound/usb/mixer.c:1838:28: warning: variable 'first_ch_bits' set but not used [-Wunused-but-set-variable] It never used since 2.6 Signed-off-by: YueHaibing <yuehaibing@huawei.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07ALSA: usb-audio: Always check descriptor sizes in parser codeTakashi Iwai
There are a few places where we access the data without checking the actual object size from the USB audio descriptor. This may result in OOB access, as recently reported. This patch addresses these missing checks. Most of added codes are simple bLength checks in the caller side. For the input and output terminal parsers, we put the length check in the parser functions. For the input terminal, a new argument is added to distinguish between UAC1 and the rest, as they treat different objects. Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Reported-by: Hui Peng <benquike@163.com> Tested-by: Hui Peng <benquike@163.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07ALSA: usb-audio: Check mixer unit descriptors more strictlyTakashi Iwai
We've had some sanity checks of the mixer unit descriptors but they are too loose and some corner cases are overlooked. Add more strict checks in uac_mixer_unit_get_channels() for avoiding possible OOB accesses by malformed descriptors. This also changes the semantics of uac_mixer_unit_get_channels() slightly. Now it returns zero for the cases where the descriptor lacks of bmControls instead of -EINVAL. Then the caller side skips the mixer creation for such unit while it keeps parsing it. This corresponds to the case like Maya44. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()Takashi Iwai
The parser for the processing unit reads bNrInPins field before the bLength sanity check, which may lead to an out-of-bound access when a malformed descriptor is given. Fix it by assignment after the bLength check. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>