Commit Graph

183 Commits

Author SHA1 Message Date
Takashi Iwai
21cba9c535 ALSA: usb-audio: Drop bogus dB range in too low level
Some USB audio firmware seem to report broken dB values for the volume
controls, and this screws up applications like PulseAudio who blindly
trusts the given data.  For example, Edifier G2000 reports a PCM
volume from -128dB to -127dB, and this results in barely inaudible
sound.

This patch adds a sort of sanity check at parsing the dB values in
USB-audio driver and disables the dB reporting if the range looks
bogus.  Here, we assume -96dB as the bottom line of the max dB.

Note that, if one can figure out that proper dB range later, it can be
patched in the mixer maps.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211929
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210227105737.3656-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-02-27 11:58:05 +01:00
Takashi Iwai
85db1cfb13 ALSA: usb-audio: Fix "RANGE setting not yet supported" errors
At probing a UAC2/UAC3 device like NUX MG-300 USB interface, we get
error messages "RANGE setting not yet supported".  It comes the place
where the driver tries to determine the resolution of mixer volumes
via SET_CUR_RES and GET_CUR_RES verbs.  Those verbs aren't supported
on UAC2 and UAC3, hence the driver warns like the above.  Although the
driver handles this error and works as expected, it's still ugly to
show such errors unnecessarily.

This patch papers over the errors by applying the resolution detection
only for UAC1 and skipping it for UAC2/UAC3.

Reported-by: Mike Oliphant <oliphant@nostatic.org>
Link: https://lore.kernel.org/r/20210120213932.1971-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-01-21 12:47:19 +01:00
Takashi Iwai
e8afdfdc81 ALSA: usb-audio: Convert remaining strlcpy() to strscpy()
USB-audio driver still contains two calls of strlcpy() because the
return size is evaluated.  Basically it just checks whether the string
is copied or not, but since strcpy() may return a negative error code,
we should check the negative value and treat as filled.

Link: https://lore.kernel.org/r/20210115095758.19707-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-01-15 11:05:20 +01:00
Joe Perches
75b1a8f9d6 ALSA: Convert strlcpy to strscpy when return value is unused
strlcpy is deprecated.  see: Documentation/process/deprecated.rst

Change the calls that do not use the strlcpy return value to the
preferred strscpy.

Done with cocci script:

@@
expression e1, e2, e3;
@@

-	strlcpy(
+	strscpy(
	e1, e2, e3);

This cocci script leaves the instances where the return value is
used unchanged.

After this patch, sound/ has 3 uses of strlcpy() that need to be
manually inspected for conversion and changed one day.

$ git grep -w strlcpy sound/
sound/usb/card.c:               len = strlcpy(card->longname, s, sizeof(card->longname));
sound/usb/mixer.c:      return strlcpy(buf, p->name, buflen);
sound/usb/mixer.c:                      return strlcpy(buf, p->names[index], buflen);

Miscellenea:

o Remove trailing whitespace in conversion of sound/core/hwdep.c

Link: https://lore.kernel.org/lkml/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/

Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/22b393d1790bb268769d0bab7bacf0866dcb0c14.camel@perches.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2021-01-08 09:30:05 +01:00
Lars-Peter Clausen
e4d8aef214 ALSA: usb: Use DIV_ROUND_UP() instead of open-coding it
Use DIV_ROUND_UP() instead of open-coding it. This documents intent
and makes it more clear what is going on for the casual reviewer.

Generated using the following the Coccinelle semantic patch.

// <smpl>
@@
expression x, y;
@@
-(((x) + (y) - 1) / (y))
+DIV_ROUND_UP(x, y)
// </smpl>

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Link: https://lore.kernel.org/r/20201223172229.781-11-lars@metafoo.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-12-25 09:11:52 +01:00
Takashi Iwai
982150560c ALSA: usb-audio: Drop keep_interface flag again
This behavior turned out to be invalid from the USB spec POV and
shouldn't be applied.  As it's an optional flag that is set only via
an card control element that must be hardly used, let's drop it
again.

Tested-by: Keith Milner <kamilner@superlative.org>
Tested-by: Dylan Robinson <dylan_robinson@motu.com>
Link: https://lore.kernel.org/r/20201123085347.19667-16-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-11-23 15:13:37 +01:00
Tom Yan
d8d0db7bb3 ALSA: usb-audio: ignore broken processing/extension unit
Some devices have broken extension unit where getting current value
doesn't work. Attempt that once when creating mixer control for it. If
it fails, just ignore it, so that it won't cripple the device entirely
(and/or make the error floods).

Signed-off-by: Tom Yan <tom.ty89@gmail.com>
Link: https://lore.kernel.org/r/5f3abc52.1c69fb81.9cf2.fe91@mx.google.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-08-17 19:58:29 +02:00
Kai-Heng Feng
f8c11eb7da ALSA: usb-audio: Add support for Lenovo ThinkStation P620
Lenovo ThinkStation P620 is like other TRX40 boards, is equipped with
two USB audio cards.

USB device (17aa:104d) provides functionality for Internal Speaker and
Front Headset. It's UAC v2, so it supports insertion control (jack
detection). However, when trying to get the connector status of the
speaker, an error occurs:
[    5.787405] usb 3-1: cannot get connectors status: req = 0x81, wValue = 0x200, wIndex = 0x1000, type = 0

Since the insertion control works perfectly for the headset, the error
for speaker is probably casued by connecting internally. So let's relax
the error for a bit if it's a speaker, and always reports it's connected.

USB device (17aa:1046) is for rear Line-in, Line-out and Microphone.
The insertion control works for all three jacks. However, there's an
Function Unit that doesn't work:
[    5.905415] usb 3-6: cannot get ctl value: req = 0x83, wValue = 0xc00, wIndex = 0x1300, type = 4
[    5.905418] usb 3-6: 19:0: cannot get min/max values for control 12 (id 19)

So turn off the FU to avoid the error.

Also, add specific card name for both devices, so userspace can easily
indentify both cards.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Link: https://lore.kernel.org/r/20200803142612.17156-1-kai.heng.feng@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-08-03 16:31:20 +02:00
Takashi Iwai
220345e98f ALSA: usb-audio: Fix OOB access of mixer element list
The USB-audio mixer code holds a linked list of usb_mixer_elem_list,
and several operations are performed for each mixer element.  A few of
them (snd_usb_mixer_notify_id() and snd_usb_mixer_interrupt_v2())
assume each mixer element being a usb_mixer_elem_info object that is a
subclass of usb_mixer_elem_list, cast via container_of() and access it
members.  This may result in an out-of-bound access when a
non-standard list element has been added, as spotted by syzkaller
recently.

This patch adds a new field, is_std_info, in usb_mixer_elem_list to
indicate that the element is the usb_mixer_elem_info type or not, and
skip the access to such an element if needed.

Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com
Reported-by: syzbot+2405ca3401e943c538b5@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200624122340.9615-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-06-24 14:24:29 +02:00
Chris Chiu
4020d1ccbe ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
The Asus USB DAC is a USB type-C audio dongle for connecting to
the headset and headphone. The volume minimum value -23040 which
is 0xa600 in hexadecimal with the resolution value 1 indicates
this should be endianness issue caused by the firmware bug. Add
a volume quirk to fix the volume control problem.

Also fixes this warning:
  Warning! Unlikely big volume range (=23040), cval->res is probably wrong.
  [5] FU [Headset Capture Volume] ch = 1, val = -23040/0/1
  Warning! Unlikely big volume range (=23040), cval->res is probably wrong.
  [7] FU [Headset Playback Volume] ch = 1, val = -23040/0/1

Signed-off-by: Chris Chiu <chiu@endlessm.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200526062613.55401-1-chiu@endlessm.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-05-26 08:30:35 +02:00
Takashi Iwai
fef66ae73a ALSA: usb-audio: Add connector notifier delegation
It turned out that ALC1220-VB USB-audio device gives the interrupt
event to some PCM terminals while those don't allow the connector
state request but only the actual I/O terminals return the request.
The recent commit 7dc3c5a017 ("ALSA: usb-audio: Don't create jack
controls for PCM terminals") excluded those phantom terminals, so
those events are ignored, too.

My first thought was that this could be easily deduced from the
associated terminals, but some of them have even no associate terminal
ID, hence it's not too trivial to figure out.

Since the number of such terminals are small and limited, this patch
implements another quirk table for the simple mapping of the
connectors.  It's not really scalable, but let's hope that there will
be not many such funky devices in future.

Fixes: 7dc3c5a017 ("ALSA: usb-audio: Don't create jack controls for PCM terminals")
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873
Link: https://lore.kernel.org/r/20200422113320.26664-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-22 13:33:46 +02:00
Takashi Iwai
a43c1c41bc ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos
TRX40 mobos from MSI and others with ALC1220-VB USB-audio device need
yet more quirks for the proper control names.

This patch provides the mapping table for those boards, correcting the
FU names for volume and mute controls as well as the terminal names
for jack controls.  It also improves build_connector_control() not to
add the directional suffix blindly if the string is given from the
mapping table.

With this patch applied, the new UCM profiles will be effective.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873
Link: https://lore.kernel.org/r/20200420062036.28567-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-20 08:21:28 +02:00
Takashi Iwai
934b96594e ALSA: usb-audio: Check mapping at creating connector controls, too
Add the mapping check to build_connector_control() so that the device
specific quirk can provide the node to skip for the badly behaving
connector controls.  As an example, ALC1220-VB-based codec implements
the skip entry for the broken SPDIF connector detection.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200412081331.4742-5-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-12 10:14:54 +02:00
Takashi Iwai
7dc3c5a017 ALSA: usb-audio: Don't create jack controls for PCM terminals
Some funky firmwares set the connector flag even on PCM terminals
although it doesn't make sense (and even actually the firmware doesn't
react properly!).  Let's skip creation of jack controls in such a
case.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200412081331.4742-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-12 10:14:48 +02:00
Takashi Iwai
3507245b82 ALSA: usb-audio: Don't override ignore_ctl_error value from the map
The mapping table may contain also ignore_ctl_error flag for devices
that are known to behave wild.  Since this flag always writes the
card's own ignore_ctl_error flag, it overrides the value already set
by the module option, so it doesn't follow user's expectation.
Let's fix the code not to clear the flag that has been set by user.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200412081331.4742-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-12 10:14:44 +02:00
Takashi Iwai
48cc429735 ALSA: usb-audio: Filter error from connector kctl ops, too
The ignore_ctl_error option should filter the error at kctl accesses,
but there was an overlook: mixer_ctl_connector_get() returns an error
from the request.

This patch covers the forgotten code path and apply filter_error()
properly.  The locking error is still returned since this is a fatal
error that has to be reported even with ignore_ctl_error option.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200412081331.4742-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-04-12 10:14:39 +02:00
Chris Wulff
0aef31b752 ALSA: usb-audio: Fix mixer controls' USB interface for Kingston HyperX Amp (0951:16d8)
Use the USB interface of the mixer that the control
was created on instead of the default control interface.

This fixes the Kingston HyperX AMP (0951:16d8) which has
controls on two interfaces.

Signed-off-by: Chris Wulff <crwulff@gmail.com>
Link: https://lore.kernel.org/r/20200314165449.4086-2-crwulff@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-03-14 18:24:19 +01:00
Takashi Iwai
2948f4a4e5 Merge branch 'topic/usb-uac2-effect-unit' into for-next
Merging the UAC2 effect unit parser improvement.  As it's based on the
previous usb-audio driver fix, it was deviated from for-next branch.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-02-17 15:30:32 +01:00
Takashi Iwai
60081b35c6 ALSA: usb-audio: Parse source ID of UAC2 effect unit
During parsing the input source, we currently cut off at the Effect
Unit node without parsing further its source id.  It's no big problem,
so far, but it should be more consistent to parse it properly.

This patch adds the recursive parsing in parse_term_effect_unit().
It doesn't add anything in the audio unit parser itself, and the
effect unit itself is still skipped, though.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206147
Link: https://lore.kernel.org/r/20200213112059.18745-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-02-17 15:30:16 +01:00
Takashi Iwai
e9a0ef0b5d ALSA: usb-audio: Don't create a mixer element with bogus volume range
Some USB-audio descriptors provide a bogus volume range (e.g. volume
min and max are identical), which confuses user-space.
This patch makes the driver skipping such a control element.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206221
Link: https://lore.kernel.org/r/20200214144928.23628-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-02-14 15:51:35 +01:00
Takashi Iwai
d75a170fd8 ALSA: usb-audio: Fix UAC2/3 effect unit parsing
We've got a regression report about M-Audio Fast Track C400 device,
and the git bisection resulted in the commit e0ccdef926 ("ALSA:
usb-audio: Clean up check_input_term()").  This commit was about the
rewrite of the input terminal parser, and it's not too obvious from
the change what really broke.  The answer is: it's the interpretation
of UAC2/3 effect units.

In the original code, UAC2 effect unit is as if through UAC1
processing unit because both UAC1 PU and UAC2/3 EU share the same
number (0x07).  The old code went through a complex switch-case
fallthrough, finally bailing out in the middle:

  if (protocol == UAC_VERSION_2 &&
      hdr[2] == UAC2_EFFECT_UNIT) {
         /* UAC2/UAC1 unit IDs overlap here in an
          * uncompatible way. Ignore this unit for now.
          */
         return 0;
   }

... and this special handling was missing in the new code; the new
code treats UAC2/3 effect unit as if it were equivalent with the
processing unit.

Actually, the old code was too confusing.  The effect unit has an
incompatible unit description with the processing unit, so we
shouldn't have dealt with EU in the same way.

This patch addresses the regression by changing the effect unit
handling to the own parser function.  The own parser function makes
the clear distinct with PU, so it improves the readability, too.

The EU parser just sets the type and the id like the old kernels.
Once when the proper effect unit support is added, we can revisit this
parser function, but for now, let's keep this simple setup as is.

Fixes: e0ccdef926 ("ALSA: usb-audio: Clean up check_input_term()")
Cc: <stable@vger.kernel.org>
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206147
Link: https://lore.kernel.org/r/20200211160521.31990-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-02-11 17:06:16 +01:00
Takashi Iwai
a01df925d1 ALSA: usb-audio: More constifications
Apply const prefix to the remaining places: the static table for the
unit information, the mixer maps, the validator tables, etc.

Just for minor optimization and no functional changes.

Link: https://lore.kernel.org/r/20200105144823.29547-12-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-05 16:14:34 +01:00
Takashi Iwai
195727e8b6 ALSA: usb: Constify snd_kcontrol_new items
Most of snd_kcontrol_new definitions are read-only and passed as-is.
Let's declare them as const for further optimization.

There should be no functional changes by this patch.

Link: https://lore.kernel.org/r/20200103081714.9560-42-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-03 09:24:34 +01:00
Takashi Iwai
c0a142e21b ALSA: usb: Constify snd_device_ops definitions
Now we may declare const for snd_device_ops definitions, so let's do
it for optimization.

There should be no functional changes by this patch.

Link: https://lore.kernel.org/r/20200103081714.9560-11-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2020-01-03 09:24:01 +01:00
Takashi Iwai
9435f2bb66 ALSA: usb-audio: Fix NULL dereference at parsing BADD
snd_usb_mixer_controls_badd() that parses UAC3 BADD profiles misses a
NULL check for the given interfaces.  When a malformed USB descriptor
is passed, this may lead to an Oops, as spotted by syzkaller.
Skip the iteration if the interface doesn't exist for avoiding the
crash.

Fixes: 17156f23e9 ("ALSA: usb: add UAC3 BADD profiles support")
Reported-by: syzbot+a36ab65c6653d7ccdd62@syzkaller.appspotmail.com
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191122112840.24797-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-22 14:08:31 +01:00
Takashi Iwai
167beb1756 ALSA: usb-audio: Fix missing error check at mixer resolution test
A check of the return value from get_cur_mix_raw() is missing at the
resolution test code in get_min_max_with_quirks(), which may leave the
variable untouched, leading to a random uninitialized value, as
detected by syzkaller fuzzer.

Add the missing return error check for fixing that.

Reported-and-tested-by: syzbot+abe1ab7afc62c6bb6377@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191109181658.30368-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-11-09 19:17:49 +01:00
Dan Carpenter
b39e077fcb ALSA: usb-audio: remove some dead code
We recently cleaned up the error handling in commit 52c3e317a8 ("ALSA:
usb-audio: Unify the release of usb_mixer_elem_info objects") but
accidentally left this stray return.

Fixes: 52c3e317a8 ("ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-26 15:51:39 +02:00
Takashi Iwai
e0ccdef926 ALSA: usb-audio: Clean up check_input_term()
The primary changes in this patch are cleanups of __check_input_term()
and move to a non-nested switch-case block by evaluating the pair of
UAC version and the unit type, as we've done for parse_audio_unit().
Also each parser is split into the function for readability.

Now, a slight behavior change by this cleanup is the handling of
processing and extension units.  Formerly we've dealt with them
differently between UAC1/2 and UAC3; the latter returns an error if no
input sources are available, while the former continues to parse.

In this patch, unify the behavior in all cases: when input sources are
available, it parses recursively, then override the type and the id,
as well as channel information if not provided yet.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-25 10:12:52 +02:00
Takashi Iwai
744f51e863 Merge branch 'topic/usb-validation' into for-next
Pull USB validation patches.  It's based on the latest 5.3 development
branch, so we shall catch up the whole things.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22 15:42:03 +02:00
Takashi Iwai
b8e4f1fdfa ALSA: usb-audio: Remove superfluous bLength checks
Now that we got the more comprehensive validation code for USB-audio
descriptors, the check of overflow in each descriptor unit parser
became superfluous.  Drop some of the obvious cases.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22 10:36:00 +02:00
Takashi Iwai
52c3e317a8 ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects
Instead of the direct kfree() calls, introduce a new local helper to
release the usb_mixer_elem_info object.  This will be extended to do
more than a single kfree() in the later patches.

Also, use the standard goto instead of multiple calls in
parse_audio_selector_unit() error paths.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22 10:36:00 +02:00
Takashi Iwai
68e9fde245 ALSA: usb-audio: Simplify parse_audio_unit()
Minor code refactoring by combining the UAC version and the type in
the switch-case flow, so that we reduce the indentation and
redundancy.  One good bonus is that the duplicated definition of the
same type value (e.g. UAC2_EFFECT_UNIT) can be handled more cleanly.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22 10:35:59 +02:00
Takashi Iwai
57f8770620 ALSA: usb-audio: More validations of descriptor units
Introduce a new helper to validate each audio descriptor unit before
and check the unit before actually accessing it.  This should harden
against the OOB access cases with malformed descriptors that have been
recently frequently reported by fuzzers.

The existing descriptor checks are still kept although they become
superfluous after this patch.  They'll be cleaned up eventually
later.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22 10:35:59 +02:00
Takashi Iwai
f9f0e9ed35 ALSA: usb-audio: Check mixer unit bitmap yet more strictly
The bmControls (for UAC1) or bmMixerControls (for UAC2/3) bitmap has a
variable size depending on both input and output pins.  Its size is to
fit with input * output bits.  The problem is that the input size
can't be determined simply from the unit descriptor itself but it
needs to parse the whole connected sources.  Although the
uac_mixer_unit_get_channels() tries to check some possible overflow of
this bitmap, it's incomplete due to the lack of the  evaluation of
input pins.

For covering possible overflows, this patch adds the bitmap overflow
check in the loop of input pins in parse_audio_mixer_unit().

Fixes: 0bfe5e434e ("ALSA: usb-audio: Check mixer unit descriptors more strictly")
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-22 10:33:12 +02:00
Hui Peng
19bce474c4 ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
`check_input_term` recursively calls itself with input from
device side (e.g., uac_input_terminal_descriptor.bCSourceID)
as argument (id). In `check_input_term`, if `check_input_term`
is called with the same `id` argument as the caller, it triggers
endless recursive call, resulting kernel space stack overflow.

This patch fixes the bug by adding a bitmap to `struct mixer_build`
to keep track of the checked ids and stop the execution if some id
has been checked (similar to how parse_audio_unit handles unitid
argument).

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-15 21:48:52 +02:00
Hui Peng
daac07156b ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
The `uac_mixer_unit_descriptor` shown as below is read from the
device side. In `parse_audio_mixer_unit`, `baSourceID` field is
accessed from index 0 to `bNrInPins` - 1, the current implementation
assumes that descriptor is always valid (the length  of descriptor
is no shorter than 5 + `bNrInPins`). If a descriptor read from
the device side is invalid, it may trigger out-of-bound memory
access.

```
struct uac_mixer_unit_descriptor {
	__u8 bLength;
	__u8 bDescriptorType;
	__u8 bDescriptorSubtype;
	__u8 bUnitID;
	__u8 bNrInPins;
	__u8 baSourceID[];
}
```

This patch fixes the bug by add a sanity check on the length of
the descriptor.

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-08-14 20:05:56 +02:00
Geoffrey D. Bennett
9e4d5c1be2 ALSA: usb-audio: Scarlett Gen 2 mixer interface
Add mixer quirk for the Focusrite Scarlett 6i6, 18i8, and 18i20 Gen 2
audio interfaces. Although the interfaces are USB compliant,
additional input/output level controls and hardware routing/mixing
functionality are available using proprietary USB requests.

Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-28 17:47:48 +02:00
Takashi Iwai
3c53c6255d ASoC: Updates for v5.3
This is a very big update, mainly thanks to Morimoto-san's refactoring
 work and some fairly large new drivers.
 
  - Lots more work on moving towards a component based framework from
    Morimoto-san.
  - Support for force disconnecting muxes from Jerome Brunet.
  - New drivers for Cirrus Logic CS47L35, CS47L85 and CS47L90, Conexant
    CX2072X, Realtek RT1011 and RT1308.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAl0jGwUTHGJyb29uaWVA
 a2VybmVsLm9yZwAKCRAk1otyXVSH0LD4B/9AkutfS+vznOrk0V0wFb2SUfjwE4Pr
 +z/kAehohAOl/7pg9Dun/lmZYBWMyOM2aYmK81ahEo2DfO+uzwkwjCaXFjGVGwEK
 j7XpWkrIjKnou/z1FeALgVvt+crzdy5iNWC04AbKaP2WHCcI7zvPQIsBta/V0OJt
 lg+j0J7pagnTMcgV1+qJdaASmofy/hpoZ79Gv0PIfGC8hpJ/3mBgcNPCLQrJtD4R
 v+tzvCZNrZVqCanwLf3vouEm1bpWYOpI+Wdmu4u6rY7MhmCj72EJ2zyfdm/qtaxF
 e7whgCyOQFkWe7NgDn0G08aAT6LsaxOtPNr7H8tL8S8sw8425fqeOouV
 =n/HQ
 -----END PGP SIGNATURE-----

Merge tag 'asoc-v5.3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Updates for v5.3

This is a very big update, mainly thanks to Morimoto-san's refactoring
work and some fairly large new drivers.

 - Lots more work on moving towards a component based framework from
   Morimoto-san.
 - Support for force disconnecting muxes from Jerome Brunet.
 - New drivers for Cirrus Logic CS47L35, CS47L85 and CS47L90, Conexant
   CX2072X, Realtek RT1011 and RT1308.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-08 14:45:34 +02:00
Takashi Iwai
ca95c7bf3d ALSA: usb-audio: Fix parse of UAC2 Extension Units
Extension Unit (XU) is used to have a compatible layout with
Processing Unit (PU) on UAC1, and the usb-audio driver code assumed it
for parsing the descriptors.  Meanwhile, on UAC2, XU became slightly
incompatible with PU; namely, XU has a one-byte bmControls bitmap
while PU has two bytes bmControls bitmap.  This incompatibility
results in the read of a wrong address for the last iExtension field,
which ended up with an incorrect string for the mixer element name, as
recently reported for Focusrite Scarlett 18i20 device.

This patch corrects this misalignment by introducing a couple of new
macros and calling them depending on the descriptor type.

Fixes: 23caaf19b1 ("ALSA: usb-mixer: Add support for Audio Class v2.0")
Reported-by: Stefan Sauer <ensonic@hora-obscura.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-07-05 08:06:47 +02:00
Thomas Gleixner
1a59d1b8e0 treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation either version 2 of the license or at
  your option any later version this program is distributed in the
  hope that it will be useful but without any warranty without even
  the implied warranty of merchantability or fitness for a particular
  purpose see the gnu general public license for more details you
  should have received a copy of the gnu general public license along
  with this program if not write to the free software foundation inc
  59 temple place suite 330 boston ma 02111 1307 usa

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 1334 file(s).

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Reviewed-by: Richard Fontana <rfontana@redhat.com>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-30 11:26:35 -07:00
Wenwen Wang
cb5173594d ALSA: usb-audio: Fix a memory leak bug
In parse_audio_selector_unit(), the string array 'namelist' is allocated
through kmalloc_array(), and each string pointer in this array, i.e.,
'namelist[]', is allocated through kmalloc() in the following for loop.
Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
an error occurs during the creation process, the string array 'namelist',
including all string pointers in the array 'namelist[]', should be freed,
before the error code ENOMEM is returned. However, the current code does
not free 'namelist[]', resulting in memory leaks.

To fix the above issue, free all string pointers 'namelist[]' in a loop.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-04-28 09:11:50 +02:00
Takashi Iwai
328e9f6973 ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
The error from snd_usb_mixer_apply_create_quirk() is ignored in the
current usb-audio driver code, which will continue the probing even
after the error.  Let's take it more serious.

Fixes: 7b1eda223d ("ALSA: usb-mixer: factor out quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-04-24 13:00:03 +02:00
Takashi Iwai
7449054af0 ALSA: usb: Clean up with new procfs helpers
Simplify the proc fs creation code with new helper functions,
snd_card_ro_proc_new() and snd_card_rw_proc_new().
Just a code refactoring and no functional changes.

Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-02-06 18:11:57 +01:00
YueHaibing
36c346e1c5 ALSA: usb-audio: Remove set but not used variable 'first_ch_bits'
Fixes gcc '-Wunused-but-set-variable' warning:

sound/usb/mixer.c: In function 'parse_audio_feature_unit':
sound/usb/mixer.c:1838:28: warning:
 variable 'first_ch_bits' set but not used [-Wunused-but-set-variable]

It never used since 2.6

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-09 10:32:18 +01:00
Takashi Iwai
3e96d7280f ALSA: usb-audio: Always check descriptor sizes in parser code
There are a few places where we access the data without checking the
actual object size from the USB audio descriptor.  This may result in
OOB access, as recently reported.

This patch addresses these missing checks.  Most of added codes are
simple bLength checks in the caller side.  For the input and output
terminal parsers, we put the length check in the parser functions.
For the input terminal, a new argument is added to distinguish between
UAC1 and the rest, as they treat different objects.

Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reported-by: Hui Peng <benquike@163.com>
Tested-by: Hui Peng <benquike@163.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07 11:10:17 +01:00
Takashi Iwai
0bfe5e434e ALSA: usb-audio: Check mixer unit descriptors more strictly
We've had some sanity checks of the mixer unit descriptors but they
are too loose and some corner cases are overlooked.  Add more strict
checks in uac_mixer_unit_get_channels() for avoiding possible OOB
accesses by malformed descriptors.

This also changes the semantics of uac_mixer_unit_get_channels()
slightly.  Now it returns zero for the cases where the descriptor
lacks of bmControls instead of -EINVAL.  Then the caller side skips
the mixer creation for such unit while it keeps parsing it.
This corresponds to the case like Maya44.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07 10:46:27 +01:00
Takashi Iwai
f4351a199c ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
The parser for the processing unit reads bNrInPins field before the
bLength sanity check, which may lead to an out-of-bound access when a
malformed descriptor is given.  Fix it by assignment after the bLength
check.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-01-07 10:46:26 +01:00
Gustavo A. R. Silva
91c6e15efc ALSA: usb-audio: Mark expected switch fall-through
In preparation to enabling -Wimplicit-fallthrough, mark switch cases
where we are expecting to fall through.

Addresses-Coverity-ID: 1357413 ("Missing break in switch")
Addresses-Coverity-ID: 114917 ("Missing break in switch")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-08-09 08:52:33 +02:00
Jorge Sanjuan
55b8cb46a7 ALSA: usb-audio: Tidy up logic for Processing Unit min/max values
This patch refactors the processing units min/max calculation logic
for the mixer controls and fixes an issue where the Mode Select
checking of the Up/Down mixers doesn't differentiate between the
UAC1 and UAC2 Control Selector (0x02) and the UAC3 one which is
different (0x01).

Signed-off-by: Jorge Sanjuan <jorge.sanjuan@codethink.co.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-07-16 16:36:15 +02:00
Jorge Sanjuan
8b3a087f7f ALSA: usb-audio: Unify virtual type units type to UAC3 values
The Audio Control interface descriptor subtypes do not match
across all the UAC versions. That makes reusability of the
"virtual type" (Mixer, Processors, Selectors, etc) terminals
difficult. It also makes the mixer get the default names for
the virtual terminals wrong due to the overlap.

This patch proposes an unified approach by always using the most
comprehensive spec version to define them all (in this case UAC3).

Signed-off-by: Jorge Sanjuan <jorge.sanjuan@codethink.co.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2018-07-16 16:35:55 +02:00