C-Media devices (at least some models) mute the playback stream when
volumes are set to the minimum value.  But this isn't informed via TLV
and the user-space, typically PulseAudio, gets confused as if it's
still played in a low volume.

This patch adds the new flag, min_mute, to struct usb_mixer_elem_info
for indicating that the mixer element is with the minimum-mute volume.
This flag is set for known C-Media devices in
snd_usb_mixer_fu_apply_quirk() in turn.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196669
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

A Senheisser headset requires the typical sample-rate quirk for
avoiding spurious errors from inquiring the current sample rate like:
 usb 1-1: 2:1: cannot get freq at ep 0x4
 usb 1-1: 3:1: cannot get freq at ep 0x83

The USB ID 1395:740a has to be added to the entries in
snd_usb_get_sample_rate_quirk().

Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1052580
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Remove Initialization from POD HD500X because it's not needed.
Every time the device is connected dmesg gives the following output:
"receive length failed (error -11)".
To solve this problem, another flags is introduced
(LINE6_CAP_CONTROL_INFO) and it is only used for PODX3 in: sysfs
entries, call podhd_startup_finalize(pod) and disconnection.
With this patch the error disappear.
Signed-off-by: NHans P. Moller <hmoller@uc.cl>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add support for the Line6 POD HD500X multi effect processor for
playback and capture (in/out audio) through USB.
Signed-off-by: NHans P. Moller <hmoller@uc.cl>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This is another attempt to work around the VLA used in
mixer_us16x08.c.  Basically the temporary array is used individually
for two cases, and we can declare locally in each block, instead of
hackish max() usage.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

A mixer element created in a quirk for Tascam US-16x08 contains a
typo: it should be "EQ MidLow Q" instead of "EQ MidQLow Q".

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195875
Fixes: d2bb390a ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Cc: <stable@vger.kernel.org> # v4.11+
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This reverts commit 89b593c3 ("ALSA: usb-audio: purge needless
variable length array").  The patch turned out to cause a severe
regression, triggering an Oops at snd_usb_ctl_msg().  It was overseen
that snd_usb_ctl_msg() writes back the response to the given buffer,
while the patch changed it to a read-only const buffer.  (One should
always double-check when an extra pointer cast is present...)

As a simple fix, just revert the affected commit.  It was merely a
cleanup.  Although it brings VLA again, it's clearer as a fix.  We'll
address the VLA later in another patch.

Fixes: 89b593c3 ("ALSA: usb-audio: purge needless variable length array")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195875
Cc: <stable@vger.kernel.org> # v4.11+
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Declare snd_kcontrol_new structures as const as they are only passed an
argument to the function snd_ctl_new1. This argument is of type const,
so snd_kcontrol_new structures having this property can be made const.
Done using Coccinelle:

@r disable optional_qualifier@
identifier x;
position p;
@@
static struct snd_kcontrol_new x@p={...};

@ok@
identifier r.x;
position p;
@@
snd_ctl_new1(&x@p,...)

@bad@
position p != {r.p,ok.p};
identifier r.x;
@@
x@p

@depends on !bad disable optional_qualifier@
identifier r.x;
@@
+const
struct snd_kcontrol_new x;

Cross compiled these files:
sound/aoa/codecs/tas.c - powerpc
sound/mips/{hal2.c/sgio2audio.c} - mips
sound/ppc/{awacs.c/beep.c/tumbler.c} - powerpc
sound/soc/sh/siu_dai.c - sh
Could not find an architecture to compile sound/sh/aica.c.
Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
Acked-by: NMark Brown <broonie@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This USB driver currently depends on X86 for some undocumented reason.
Since it compiles just fine for arm, we can at least enable compile
testing.
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Use the device-id table and a private flag to determine the device type
(US122 or US144) rather than spreading product-id conditionals
throughout the driver.

This USB driver currently depends on X86 (why?), but we should still add
the missing endianness conversions when accessing the USB
device-descriptor fields.

Compile-tested only.
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add missing endianness conversion when using the USB device-descriptor
bcdDevice field when applying the Amanero Combo384 (endianness!) quirk.

Fixes: 3eff682d ("ALSA: usb-audio: Support both DSD LE/BE Amanero firmware versions")
Cc: Jussi Laako <jussi@sonarnerd.net>
Signed-off-by: NJohan Hovold <johan@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The /proc/bus/usb devices don't exist anymore, since when we
got rid of usbfs. Those devices are now seen at
/dev/bus/usb.
Signed-off-by: NMauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

In kernel APIs of ALSA control interface, drivers can create a control
element set by a call of snd_ctl_new1() with a template. This template
is known to have const qualifier in general cases.

This commit adds the qualifier to template array, for safer program and
runtime. Application of this change moves the symbol from .data section
to .rodata section.

Cc: Bhumika Goyal <bhumirks@gmail.com>
Signed-off-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Declare snd_kcontrol_new strcutures as const as they are only passed as
an argument to the function snd_ctl_new1. This argument is of type const,
so snd_kcontrol_new structures having this property can be made const too.
Done using Coccinelle:

@r disable optional_qualifier@
identifier x;
position p;
@@
static struct snd_kcontrol_new x@p={...};

@ok@
identifier r.x;
position p;
@@
snd_ctl_new1(&x@p,...)

@bad@
position p != {r.p,ok.p};
identifier r.x;
@@
x@p

@depends on !bad disable optional_qualifier@
identifier r.x;
@@
+const
struct snd_kcontrol_new x;
Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Declare snd_kcontrol_new strcutures as const as they are only passed as
an argument to the function snd_ctl_new1. This argument is of type const,
so snd_kcontrol_new structures having this property can be made const too.
Done using Coccinelle:

@r disable optional_qualifier@
identifier x;
position p;
@@
static struct snd_kcontrol_new x@p={...};

@ok@
identifier r.x;
position p;
@@
snd_ctl_new1(&x@p,...)

@bad@
position p != {r.p,ok.p};
identifier r.x;
@@
x@p

@depends on !bad disable optional_qualifier@
identifier r.x;
@@
+const
struct snd_kcontrol_new x;
Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Recently snd-usb-audio driver received a new option, quirk_alias, to
allow user to apply the existing quirk for a different device.  This
works for many quirks as is, but some still need more tune-ups:
namely, some quirks check the USB vendor/device IDs in various places,
thus it doesn't work as long as the ID is different from the expected
one.

With this patch, the driver stores the aliased USB ID, so that these
rest quirks per device ID are applied.  The transition to use the
cached USB ID was already done in the past, so what we needed now is
only to overwrite chip->usb_id.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

->fault(), ->page_mkwrite(), and ->pfn_mkwrite() calls do not need to
take a vma and vmf parameter when the vma already resides in vmf.

Remove the vma parameter to simplify things.

[arnd@arndb.de: fix ARM build]
  Link: http://lkml.kernel.org/r/20170125223558.1451224-1-arnd@arndb.de
Link: http://lkml.kernel.org/r/148521301778.19116.10840599906674778980.stgit@djiang5-desk3.ch.intel.comSigned-off-by: NDave Jiang <dave.jiang@intel.com>
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Reviewed-by: NRoss Zwisler <ross.zwisler@linux.intel.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Darrick J. Wong <darrick.wong@oracle.com>
Cc: Matthew Wilcox <mawilcox@microsoft.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Jan Kara <jack@suse.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

A few more cleanups and improvements that have been overlooked:

- Use ARRAY_SIZE() macro appropriately
- Code shuffling for minor optimization
- Omit superfluous variable initializations
- Get rid of superfluous NULL checks
- Add const to snd_us16x08_control_params definitions

No functional changes.
Reviewed-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

There are a few places leaking memory and doing double-free in
mixer_us16x08.c.

The driver allocates a usb_mixer_elem_info object at each
add_new_ctl() call.  This has to be freed via kctl->private_free, but
currently this is done properly only for some controls.

Also, the driver allocates three external objects (comp_store,
eq_store, meter_store), and these are referred in elem->private_data
(it's not kctl->private_data).  And these have to be released, but
there are none doing it.  Moreover, these extra objects have to be
released only once.  Thus the release should be done only by the first
kctl element that refers to it.

For fixing these, we call either snd_usb_mixer_elem_free() (only for
kctl->private_data) or elem_private_free() (for both
kctl->private_data and elem->private_data) via kctl->private_free
appropriately.

Last but not least, snd_us16x08_controls_create() may return in the
middle without releasing the allocated *_store objects due to an
error.  For fixing this, we shuffle the allocation code so that it's
called just before its reference.

Fixes: d2bb390a ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Reported-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Reviewed-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Variable length array is used in 'snd_us16x08_meter_get()', while there
is no need. It's better to purge it because variable length array has
overhead for stack handling.

This commit replaces the array with static length. Sparse generated below
warning.

sound/usb/mixer_us16x08.c:714:18: warning: Variable length array is used.

Fixes: d2bb390a ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Signed-off-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Declare snd_kcontrol_new structures as const as they are only passed as
an argument to the function add_new_ctl. This agrument is of type const,
so snd_kcontrol_new structures having this property can be made const
too.
Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

When accessed inner a file, functions should have static qualifier for
local-linkage.

This commit fixes the bug. Sparse generated below warning.

sound/usb/mixer_us16x08.c:1043:32: warning: symbol 'snd_us16x08_create_meter_store' was not declared. Should it be static?

Fixes: d2bb390a ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Signed-off-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

When accessed by one referrer inner a file, variables should have static
qualifier to declare local-linkage.

This commit fixes the bug. Sparse generated below warnings.
sound/usb/mixer_us16x08.c:156:13: warning: duplicate const
sound/usb/mixer_us16x08.c:156:18: warning: symbol 'route_names' was not declared. Should it be static?

Fixes: d2bb390a ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Signed-off-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add mixer quirk for Tascam US-16x08 usb interface.
Even that this is an usb compliant device,
the input channels and DSP functions (EQ/Compressor) aren't accessible
by default.
Signed-off-by: NDetlef Urban <onkel@paraair.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

While not all line6 devices currently support PCM, it causes no
harm to 'have it prepared'.

This also fixes toneport, which only has PCM - in which case
we previously skipped the USB transfer properties detection completely.
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This reverts commit f6a0dd10.

The commit caused a regression on LINE6 Transport that has no control
caps.  Although reverting the commit may result back in a spurious
error message for some device again, it's the simplest regression fix,
hence it's taken as is at first.  The further code fix will follow
later.

Fixes: f6a0dd10 ("ALSA: line6: Only determine control port properties if needed")
Reported-by: NIgor Zinovev <zinigor@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Now snd_rawmidi_ops is maintained as a const pointer in snd_rawmidi,
we can constify the definitions.
Reviewed-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Plantronics BT600 does not support reading the sample rate which leads
to many lines of "cannot get freq at ep 0x1" and "cannot get freq at
ep 0x82". This patch adds the USB ID of the BT600 to quirks.c and
avoids those error messages.
Signed-off-by: NDennis Kadioglu <denk@post.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Testing EP_FLAG_RUNNING in snd_complete_urb() before running the completion
logic allows us to save a few cpu cycles by returning early, skipping the
pending urb in case the stream was stopped; the stop logic handles the urb
and sets the completion callbacks to NULL.
Signed-off-by: NIoan-Adrian Ratiu <adi@adirat.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Commit 16200948 ("ALSA: usb-audio: Fix race at stopping the stream") was
incomplete causing another more severe kernel panic, so it got reverted.
This fixes both the original problem and its fallout kernel race/crash.

The original fix is to move the endpoint member NULL clearing logic inside
wait_clear_urbs() so the irq triggering the urb completion doesn't call
retire_capture/playback_urb() after the NULL clearing and generate a panic.

However this creates a new race between snd_usb_endpoint_start()'s call
to wait_clear_urbs() and the irq urb completion handler which again calls
retire_capture/playback_urb() leading to a new NULL dereference.

We keep the EP deactivation code in snd_usb_endpoint_start() because
removing it will break the EP reference counting (see [1] [2] for info),
however we don't need the "can_sleep" mechanism anymore because a new
function was introduced (snd_usb_endpoint_sync_pending_stop()) which
synchronizes pending stops and gets called inside the pcm prepare callback.

It also makes sense to remove can_sleep because it was also removed from
deactivate_urbs() signature in [3] so we benefit from more simplification.

[1] commit 015618b9 ("ALSA: snd-usb: Fix URB cancellation at stream start")
[2] commit e9ba389c ("ALSA: usb-audio: Fix scheduling-while-atomic bug in PCM capture stream")
[3] commit ccc1696d ("ALSA: usb-audio: simplify endpoint deactivation code")

Fixes: f8114f85 ("Revert "ALSA: usb-audio: Fix race at stopping the stream"")
Signed-off-by: NIoan-Adrian Ratiu <adi@adirat.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add DSD support for both little endian (DSD_U32_LE) and big endian
(DSD_U32_BE) version of the Amanero firmware.
Signed-off-by: NJussi Laako <jussi@sonarnerd.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This reverts commit 16200948.

The commit was intended to cover the race condition, but it introduced
yet another regression for devices with the implicit feedback, leading
to a kernel panic due to NULL-dereference in an irq context.

As the race condition that was addressed by the commit is very rare
and the regression is much worse, let's revert the commit for rc1, and
fix the issue properly in a later patch.

Fixes: 16200948 ("ALSA: usb-audio: Fix race at stopping the stream")
Reported-by: NIoan-Adrian Ratiu <adi@adirat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Sampling rate changes after first set one are not reflected to the
hardware, while driver and ALSA think the rate has been changed.

Fix the problem by properly stopping the interface at the beginning of
prepare call, allowing new rate to be set to the hardware. This keeps
the hardware in sync with the driver.
Signed-off-by: NJussi Laako <jussi@sonarnerd.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

[Problem]
In some USB DACs, a terrible pop noise comes to be heard
at the start of DSD playback (in the following situations).

- play first DSD track
- change from PCM track to DSD track
- change from DSD64 track to DSD128 track (and etc...)
- seek DSD track
- Fast-Forward/Rewind DSD track

[Cause]
At the start of playback, there is a little silence.
The silence bit pattern "0x69" is required on DSD mode,
but it is not like that.

[Solution]
This patch adds DSD silence pattern to the endpoint settings.
Signed-off-by: NNobutaka Okabe <nob77413@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This patch adds native DSD support for the following devices.

- TEAC NT-503
- TEAC UD-503
- TEAC UD-501

(1) Add quirks for native DSD support for TEAC devices.
(2) A specific vendor command is needed to switch between PCM/DOP and
    DSD mode, same as Denon/Marantz devices.
Signed-off-by: NNobutaka Okabe <nob77413@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The Logitech QuickCam Communicate Deluxe/S7500 microphone fails with the
following warning.

[    6.778995] usb 2-1.2.2.2: Warning! Unlikely big volume range (=3072),
cval->res is probably wrong.
[    6.778996] usb 2-1.2.2.2: [5] FU [Mic Capture Volume] ch = 1, val =
4608/7680/1

Adding it to the list of devices in volume_control_quirks makes it work
properly, fixing related typo.
Signed-off-by: NCon Kolivas <kernel@kolivas.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The Axe-Fx II implicit feedback end point and the data sync endpoint
are in different interface descriptors. Add quirk to ensure a sync
endpoint is properly configured.
Signed-off-by: NAlberto Aguirre <albaguirre@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

since commit 57e6dae1 ("ALSA: usb-audio: do not trust too-big
wMaxPacketSize values"), the expected packetsize is always limited
to nominal + 25%. It was discovered, that some devices (Android audio
accessory) have a much higher jitter in used packetsizes than 25%
which would result in BABBLE condition and dropping of packets.
A better solution is so assume the jitter to be the nominal packetsize:
-one nearly empty packet followed by a almost 150% sized one.

V2: changed to assume max frequency is +50 of nominal packetsize.
Signed-off-by: NAndreas Pape <apape@de.adit-jv.com>
Signed-off-by: NJiada Wang <jiada_wang@mentor.com>
Acked-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Some of userland applications call 'snd_pcm_hw_params()' and
'snd_pcm_hw_prepare()' sequentially, which means 'snd_pcm_hw_prepare()'
is called twice and the second 'snd_pcm_hw_prepare()' is called in
'SNDRV_PCM_STATE_PREPARED' state.

Some devices are not able to manage this and they will stop playback
if the sample rate will be configured several times over USB protocol.

V2: updated Changelog
Signed-off-by: NDaniel Girnus <dgirnus@de.adit-jv.com>
Signed-off-by: NJens Lorenz <jlorenz@de.adit-jv.com>
Signed-off-by: NJiada Wang <jiada_wang@mentor.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

We've got a kernel crash report showing like:

  Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = a1d7c000
  [00000008] *pgd=31c93831, *pte=00000000, *ppte=00000000
  Internal error: Oops: 17 [#1] PREEMPT SMP ARM
  CPU: 0 PID: 250 Comm: dbus-daemon Not tainted 3.14.51-03479-gf50bdf4 #1
  task: a3ae61c0 ti: a08c8000 task.ti: a08c8000
  PC is at retire_capture_urb+0x10/0x1f4 [snd_usb_audio]
  LR is at snd_complete_urb+0x140/0x1f0 [snd_usb_audio]
  pc : [<7f0eb22c>]    lr : [<7f0e57fc>]    psr: 200e0193
  sp : a08c9c98  ip : a08c9ce8  fp : a08c9ce4
  r10: 0000000a  r9 : 00000102  r8 : 94cb3000
  r7 : 94cb3000  r6 : 94d0f000  r5 : 94d0e8e8  r4 : 94d0e000
  r3 : 7f0eb21c  r2 : 00000000  r1 : 94cb3000  r0 : 00000000
  Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
  Control: 10c5387d  Table: 31d7c04a  DAC: 00000015
  Process dbus-daemon (pid: 250, stack limit = 0xa08c8238)
  Stack: (0xa08c9c98 to 0xa08ca000)
  ...
  Backtrace:
  [<7f0eb21c>] (retire_capture_urb [snd_usb_audio]) from [<7f0e57fc>] (snd_complete_urb+0x140/0x1f0 [snd_usb_audio])
  [<7f0e56bc>] (snd_complete_urb [snd_usb_audio]) from [<80371118>] (__usb_hcd_giveback_urb+0x78/0xf4)
  [<803710a0>] (__usb_hcd_giveback_urb) from [<80371514>] (usb_giveback_urb_bh+0x8c/0xc0)
  [<80371488>] (usb_giveback_urb_bh) from [<80028e3c>] (tasklet_hi_action+0xc4/0x148)
  [<80028d78>] (tasklet_hi_action) from [<80028358>] (__do_softirq+0x190/0x380)
  [<800281c8>] (__do_softirq) from [<80028858>] (irq_exit+0x8c/0xfc)
  [<800287cc>] (irq_exit) from [<8000ea88>] (handle_IRQ+0x8c/0xc8)
  [<8000e9fc>] (handle_IRQ) from [<800085e8>] (gic_handle_irq+0xbc/0xf8)
  [<8000852c>] (gic_handle_irq) from [<80509044>] (__irq_svc+0x44/0x78)
  [<80508820>] (_raw_spin_unlock_irq) from [<8004b880>] (finish_task_switch+0x5c/0x100)
  [<8004b824>] (finish_task_switch) from [<805052f0>] (__schedule+0x48c/0x6d8)
  [<80504e64>] (__schedule) from [<805055d4>] (schedule+0x98/0x9c)
  [<8050553c>] (schedule) from [<800116c8>] (do_work_pending+0x30/0xd0)
  [<80011698>] (do_work_pending) from [<8000e160>] (work_pending+0xc/0x20)
  Code: e1a0c00d e92ddff0 e24cb004 e24dd024 (e5902008)
  Kernel panic - not syncing: Fatal exception in interrupt

There is a race between retire_capture_urb() and stop_endpoints().
The latter is called at stopping the stream and it sets some endpoint
fields to NULL.  But its call is asynchronous, thus the pending
complete callback might get called after these NULL clears, and it
leads the NULL dereference like the above.

The fix is to move the NULL clearance after the synchronization,
i.e. wait_clear_urbs().  This is called at prepare and hw_free
callbacks, so it's assured to be called before the restart of the
stream or the release of the stream.

Also, while we're at it, put the EP_FLAG_RUNNING flag check at the
beginning of snd_complete_urb() to skip the pending complete after the
stream is stopped.

Fixes: b2eb950d ("ALSA: usb-audio: stop both data and sync...")
Reported-by: NJiada Wang <jiada_wang@mentor.com>
Reported-by: NMark Craske <Mark_Craske@mentor.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>