1. 10 10月, 2017 1 次提交
    • T
      ALSA: usb-audio: Kill stray URB at exiting · 124751d5
      Takashi Iwai 提交于
      USB-audio driver may leave a stray URB for the mixer interrupt when it
      exits by some error during probe.  This leads to a use-after-free
      error as spotted by syzkaller like:
        ==================================================================
        BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0
        Call Trace:
         <IRQ>
         __dump_stack lib/dump_stack.c:16
         dump_stack+0x292/0x395 lib/dump_stack.c:52
         print_address_description+0x78/0x280 mm/kasan/report.c:252
         kasan_report_error mm/kasan/report.c:351
         kasan_report+0x23d/0x350 mm/kasan/report.c:409
         __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430
         snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490
         __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
         ....
      
        Allocated by task 1484:
         save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
         save_stack+0x43/0xd0 mm/kasan/kasan.c:447
         set_track mm/kasan/kasan.c:459
         kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
         kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772
         kmalloc ./include/linux/slab.h:493
         kzalloc ./include/linux/slab.h:666
         snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540
         create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516
         snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560
         create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59
         snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560
         usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618
         ....
      
        Freed by task 1484:
         save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
         save_stack+0x43/0xd0 mm/kasan/kasan.c:447
         set_track mm/kasan/kasan.c:459
         kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524
         slab_free_hook mm/slub.c:1390
         slab_free_freelist_hook mm/slub.c:1412
         slab_free mm/slub.c:2988
         kfree+0xf6/0x2f0 mm/slub.c:3919
         snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244
         snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250
         __snd_device_free+0x1ff/0x380 sound/core/device.c:91
         snd_device_free_all+0x8f/0xe0 sound/core/device.c:244
         snd_card_do_free sound/core/init.c:461
         release_card_device+0x47/0x170 sound/core/init.c:181
         device_release+0x13f/0x210 drivers/base/core.c:814
         ....
      
      Actually such a URB is killed properly at disconnection when the
      device gets probed successfully, and what we need is to apply it for
      the error-path, too.
      
      In this patch, we apply snd_usb_mixer_disconnect() at releasing.
      Also introduce a new flag, disconnected, to struct usb_mixer_interface
      for not performing the disconnection procedure twice.
      Reported-by: NAndrey Konovalov <andreyknvl@google.com>
      Tested-by: NAndrey Konovalov <andreyknvl@google.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      124751d5
  2. 18 8月, 2017 1 次提交
    • S
      ALSA: usb-audio: don't retry snd_usb_ctl_msg after timeout · 5a9a8eca
      Stephen Barber 提交于
      A few calls to snd_usb_ctl_msg wrap the function in a retry loop. In
      the worst case, the timeout for snd_usb_ctl_msg is 5 seconds, which when
      retried 10 times (for example, if a device is removed) could cause a
      probe to hang for ~50 seconds.
      
      Example stack trace from 3.14 which triggered a hung task timeout:
      Call Trace:
       [<ffffffffa2c1f720>] ? inet6_set_link_af.part.35+0x12/0x12
       [<ffffffffa2c20309>] schedule+0x6e/0x70
       [<ffffffffa2c1f81c>] schedule_timeout+0xfc/0x13c
       [<ffffffffa2667bbc>] ? rcu_read_unlock_sched_notrace+0x17/0x17
       [<ffffffffa2c20d68>] __wait_for_common+0x153/0x190
       [<ffffffffa2c20d68>] ? __wait_for_common+0x153/0x190
       [<ffffffffa26890e5>] ? wake_up_state+0x12/0x12
       [<ffffffffa2c20e0e>] wait_for_completion_timeout+0x1d/0x1f
       [<ffffffffa2a07c70>] usb_start_wait_urb+0x93/0xf1
       [<ffffffffa2a07daf>] usb_control_msg+0xe1/0x11d
       [<ffffffffc02cd254>] snd_usb_ctl_msg+0x9c/0xf1 [snd_usb_audio]
       [<ffffffffc02ce191>] snd_usb_mixer_set_ctl_value+0x124/0xab1 [snd_usb_audio]
       [<ffffffffc02ce230>] snd_usb_mixer_set_ctl_value+0x1c3/0xab1 [snd_usb_audio]
       [<ffffffffc02ce58e>] snd_usb_mixer_set_ctl_value+0x521/0xab1 [snd_usb_audio]
       [<ffffffffc02cee88>] snd_usb_mixer_add_control+0x36a/0x1264 [snd_usb_audio]
       [<ffffffffc02cf323>] snd_usb_mixer_add_control+0x805/0x1264 [snd_usb_audio]
       [<ffffffffa2a06e11>] ? usb_free_urb+0x1a/0x1c
       [<ffffffffc02cfcf7>] snd_usb_mixer_add_control+0x11d9/0x1264 [snd_usb_audio]
       [<ffffffffc02d000f>] snd_usb_create_mixer+0xbc/0x286 [snd_usb_audio]
       [<ffffffffc02cac18>] 0xffffffffc02cac17
       [<ffffffffa2a0aaf1>] usb_probe_interface+0x17c/0x21c
       [<ffffffffa29a65bc>] driver_probe_device+0xae/0x1fa
       [<ffffffffa29a6767>] __device_attach_driver+0x5f/0x66
       [<ffffffffa29a6708>] ? driver_probe_device+0x1fa/0x1fa
       [<ffffffffa29a4a60>] bus_for_each_drv+0x87/0xaa
       [<ffffffffa29a688a>] __device_attach+0x9d/0x101
       [<ffffffffa29a6913>] device_initial_probe+0x13/0x15
       [<ffffffffa29a5ae6>] bus_probe_device+0x33/0x96
       [<ffffffffa29a3d19>] device_add+0x328/0x547
       [<ffffffffa2a09355>] usb_set_configuration+0x624/0x674
       [<ffffffffa2a11949>] generic_probe+0x45/0x77
       [<ffffffffa2a0a962>] usb_probe_device+0x2d/0x40
       [<ffffffffa29a65bc>] driver_probe_device+0xae/0x1fa
       [<ffffffffa29a6767>] __device_attach_driver+0x5f/0x66
       [<ffffffffa29a6708>] ? driver_probe_device+0x1fa/0x1fa
       [<ffffffffa29a4a60>] bus_for_each_drv+0x87/0xaa
       [<ffffffffa29a688a>] __device_attach+0x9d/0x101
       [<ffffffffa29a6913>] device_initial_probe+0x13/0x15
       [<ffffffffa29a5ae6>] bus_probe_device+0x33/0x96
       [<ffffffffa29a3d19>] device_add+0x328/0x547
       [<ffffffffa29030bc>] ? add_device_randomness+0x111/0x130
       [<ffffffffa2a00967>] usb_new_device+0x2a2/0x3c0
       [<ffffffffa2a02ddc>] hub_thread+0xa3d/0xeed
       [<ffffffffa2c2010d>] ? __schedule+0x41e/0x5ac
       [<ffffffffa26957ce>] ? finish_wait+0x62/0x62
       [<ffffffffa2a0239f>] ? usb_reset_device+0x16a/0x16a
       [<ffffffffa267b255>] kthread+0x108/0x110
       [<ffffffffa267b14d>] ? __kthread_parkme+0x67/0x67
       [<ffffffffa2c23b2c>] ret_from_fork+0x7c/0xb0
       [<ffffffffa267b14d>] ? __kthread_parkme+0x67/0x67
      Signed-off-by: NStephen Barber <smbarber@chromium.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      5a9a8eca
  3. 17 8月, 2017 1 次提交
  4. 12 4月, 2017 1 次提交
    • B
      ALSA: usb-audio: constify snd_kcontrol_new structures · 8fdaebbb
      Bhumika Goyal 提交于
      Declare snd_kcontrol_new strcutures as const as they are only passed as
      an argument to the function snd_ctl_new1. This argument is of type const,
      so snd_kcontrol_new structures having this property can be made const too.
      Done using Coccinelle:
      
      @r disable optional_qualifier@
      identifier x;
      position p;
      @@
      static struct snd_kcontrol_new x@p={...};
      
      @ok@
      identifier r.x;
      position p;
      @@
      snd_ctl_new1(&x@p,...)
      
      @bad@
      position p != {r.p,ok.p};
      identifier r.x;
      @@
      x@p
      
      @depends on !bad disable optional_qualifier@
      identifier r.x;
      @@
      +const
      struct snd_kcontrol_new x;
      Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      8fdaebbb
  5. 09 12月, 2016 1 次提交
  6. 09 4月, 2016 2 次提交
    • D
      ALSA: usb-audio: allow clock source validity interrupts · 191227d9
      Daniel Mack 提交于
      miniDSP USBStreamer UAC2 devices send clock validity changes with the
      control field set to zero. The current interrupt handler ignores all
      packets if the control field does not match the mixer element's, but
      it really should only do that in case that field is needed to
      distinguish multiple elements with the same ID.
      
      This patch implements a logic that lets notifications packets pass
      if the element ID is unique for a given device.
      Signed-off-by: NDaniel Mack <daniel@zonque.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      191227d9
    • D
      ALSA: usb-audio: add UAC2 clock sources as mixer controls · cddaafb9
      Daniel Mack 提交于
      UAC2 specifies clock sources that optionally have validity controls.
      This patch exposes them as mixer controls, so they can be read (and
      at least in theory even be written) by userspace applications in order
      to make clock selection policy decisions.
      
      This implementation does nothing if the device is not UAC2 compliant,
      or if the clock source does not define said validity control bits.
      
      Tested with a miniDSP USBStreamer (0x2752/0x0016).
      Signed-off-by: NDaniel Mack <daniel@zonque.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      cddaafb9
  7. 14 12月, 2015 1 次提交
    • A
      ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly · 42e3121d
      Anssi Hannula 提交于
      AudioQuest DragonFly DAC reports a volume control range of 0..50
      (0x0000..0x0032) which in USB Audio means a range of 0 .. 0.2dB, which
      is obviously incorrect and would cause software using the dB information
      in e.g. volume sliders to have a massive volume difference in 100..102%
      range.
      
      Commit 2d1cb7f6 ("ALSA: usb-audio: add dB range mapping for some
      devices") added a dB range mapping for it with range 0..50 dB.
      
      However, the actual volume mapping seems to be neither linear volume nor
      linear dB scale, but instead quite close to the cubic mapping e.g.
      alsamixer uses, with a range of approx. -53...0 dB.
      
      Replace the previous quirk with a custom dB mapping based on some basic
      output measurements, using a 10-item range TLV (which will still fit in
      alsa-lib MAX_TLV_RANGE_SIZE).
      
      Tested on AudioQuest DragonFly HW v1.2. The quirk is only applied if the
      range is 0..50, so if this gets fixed/changed in later HW revisions it
      will no longer be applied.
      
      v2: incorporated Takashi Iwai's suggestion for the quirk application
      method
      Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      42e3121d
  8. 28 8月, 2015 1 次提交
  9. 26 8月, 2015 1 次提交
    • T
      ALSA: usb-audio: Avoid nested autoresume calls · 47ab1545
      Takashi Iwai 提交于
      After the recent fix of runtime PM for USB-audio driver, we got a
      lockdep warning like:
      
        =============================================
        [ INFO: possible recursive locking detected ]
        4.2.0-rc8+ #61 Not tainted
        ---------------------------------------------
        pulseaudio/980 is trying to acquire lock:
         (&chip->shutdown_rwsem){.+.+.+}, at: [<ffffffffa0355dac>] snd_usb_autoresume+0x1d/0x52 [snd_usb_audio]
        but task is already holding lock:
         (&chip->shutdown_rwsem){.+.+.+}, at: [<ffffffffa0355dac>] snd_usb_autoresume+0x1d/0x52 [snd_usb_audio]
      
      This comes from snd_usb_autoresume() invoking down_read() and it's
      used in a nested way.  Although it's basically safe, per se (as these
      are read locks), it's better to reduce such spurious warnings.
      
      The read lock is needed to guarantee the execution of "shutdown"
      (cleanup at disconnection) task after all concurrent tasks are
      finished.  This can be implemented in another better way.
      
      Also, the current check of chip->in_pm isn't good enough for
      protecting the racy execution of multiple auto-resumes.
      
      This patch rewrites the logic of snd_usb_autoresume() & co; namely,
      - The recursive call of autopm is avoided by the new refcount,
        chip->active.  The chip->in_pm flag is removed accordingly.
      - Instead of rwsem, another refcount, chip->usage_count, is introduced
        for tracking the period to delay the shutdown procedure.  At
        the last clear of this refcount, wake_up() to the shutdown waiter is
        called.
      - The shutdown flag is replaced with shutdown atomic count; this is
        for reducing the lock.
      - Two new helpers are introduced to simplify the management of these
        refcounts; snd_usb_lock_shutdown() increases the usage_count, checks
        the shutdown state, and does autoresume.  snd_usb_unlock_shutdown()
        does the opposite.  Most of mixer and other codes just need this,
        and simply returns an error if it receives an error from lock.
      
      Fixes: 9003ebb1 ('ALSA: usb-audio: Fix runtime PM unbalance')
      Reported-and-tested-by: NAlexnader Kuleshov <kuleshovmail@gmail.com>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      47ab1545
  10. 20 8月, 2015 1 次提交
  11. 14 8月, 2015 1 次提交
  12. 11 6月, 2015 1 次提交
  13. 03 6月, 2015 1 次提交
  14. 29 5月, 2015 1 次提交
  15. 18 1月, 2015 1 次提交
  16. 21 11月, 2014 2 次提交
    • T
      ALSA: usb-audio: Allow quirks to handle own resume and proc dump · 3360b84b
      Takashi Iwai 提交于
      So far, we blindly assumed that the all usb-audio mixer elements
      follow the standard and apply the standard resume method for the
      registered elements in the id_elems[] list.  However, some quirks
      really need the own resume and it's incomplete for now.
      
      This patch enhances the resume handling in two folds:
      - split some fields in struct usb_mixer_elem_info into a smaller
        header struct (usb_mixer_elem_list) for keeping the minimal
        information in the linked-list; the usb_mixer_elem_info embeds this
        header struct instead
      - add resume and dump callbacks to usb_mixer_elem_list struct to allow
        quirks providing the own methods
      
      For the standard mixer elements, these new callbacks are set to the
      standard ones as default, thus there is no functional change by this
      patch yet.
      
      The dump and resume callbacks are typedef'ed for ease of later patches
      using arrays of such function pointers.
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      3360b84b
    • T
      ALSA: usb-audio: Refactor ignore_ctl_error checks · 5aeee342
      Takashi Iwai 提交于
      Introduce an internal helper macro for avoiding many open codes.
      
      The only slight behavior change is in a couple of get ballcks where
      the value is reset at error no matter whether ignore_ctl_error is set
      or not.  Actually this is even safer than before.
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      5aeee342
  17. 17 11月, 2014 1 次提交
  18. 13 11月, 2014 1 次提交
  19. 04 11月, 2014 1 次提交
  20. 19 10月, 2014 1 次提交
  21. 04 8月, 2014 1 次提交
  22. 25 5月, 2014 2 次提交
  23. 28 4月, 2014 1 次提交
  24. 05 3月, 2014 1 次提交
  25. 26 2月, 2014 1 次提交
    • T
      ALSA: usb-audio: Use standard printk helpers · 0ba41d91
      Takashi Iwai 提交于
      Convert with dev_err() and co from snd_printk(), etc.
      As there are too deep indirections (e.g. ep->chip->dev->dev),
      a few new local macros, usb_audio_err() & co, are introduced.
      
      Also, the device numbers in some messages are dropped, as they are
      shown in the prefix automatically.
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      0ba41d91
  26. 14 2月, 2014 1 次提交
  27. 03 2月, 2014 1 次提交
  28. 26 9月, 2013 1 次提交
  29. 12 8月, 2013 1 次提交
  30. 17 6月, 2013 1 次提交
  31. 05 6月, 2013 1 次提交
  32. 20 3月, 2013 3 次提交
  33. 11 2月, 2013 1 次提交
  34. 27 1月, 2013 1 次提交
  35. 29 11月, 2012 1 次提交