commit e5c812e84f0dece3400d5caf42522287e6ef139f upstream.

The line6 driver uses a lot of USB buffers off of the stack, which is
not allowed on many systems, causing the driver to crash on some of
them.  Fix this up by dynamically allocating the buffers with kmalloc()
which allows for proper DMA-able memory.
Reported-by: NChristo Gouws <gouws.christo@gmail.com>
Reported-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NChristo Gouws <gouws.christo@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

With all callbacks converted, and the timer callback prototype
switched over, the TIMER_FUNC_TYPE cast is no longer needed,
so remove it. Conversion was done with the following scripts:

    perl -pi -e 's|\(TIMER_FUNC_TYPE\)||g' \
        $(git grep TIMER_FUNC_TYPE | cut -d: -f1 | sort -u)

    perl -pi -e 's|\(TIMER_DATA_TYPE\)||g' \
        $(git grep TIMER_DATA_TYPE | cut -d: -f1 | sort -u)

The now unused macros are also dropped from include/linux/timer.h.
Signed-off-by: NKees Cook <keescook@chromium.org>

In preparation for unconditionally passing the struct timer_list pointer to
all timer callbacks, switch to using the new timer_setup() and from_timer()
to pass the timer pointer explicitly.
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

There are a few other places calling usb_submit_urb() with the URB
composed from the fixed endpoint without validation.  For avoiding the
spurious kernel warnings, add the sanity checks to appropriate
places.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

As syzkaller spotted, currently line6 drivers submit a URB with the
fixed EP without checking whether it's actually available, which may
result in a kernel warning like:
  usb 1-1: BOGUS urb xfer, pipe 3 != type 1
  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 24 at drivers/usb/core/urb.c:449
  usb_submit_urb+0xf8a/0x11d0
  Modules linked in:
  CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc2-42613-g1488251d1a98 #238
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  Workqueue: usb_hub_wq hub_event
  Call Trace:
   line6_start_listen+0x55f/0x9e0 sound/usb/line6/driver.c:82
   line6_init_cap_control sound/usb/line6/driver.c:690
   line6_probe+0x7c9/0x1310 sound/usb/line6/driver.c:764
   podhd_probe+0x64/0x70 sound/usb/line6/podhd.c:474
   usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
   ....

This patch adds a sanity check of validity of EPs at the device
initialization phase for avoiding the call with an invalid EP.
Reported-by: NAndrey Konovalov <andreyknvl@google.com>
Tested-by: NAndrey Konovalov <andreyknvl@google.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

While line6_probe() may kick off URB for a control MIDI endpoint, the
function doesn't clean up it properly at its error path.  This results
in a leftover URB action that is eventually triggered later and causes
an Oops like:
  general protection fault: 0000 [#1] PREEMPT SMP KASAN
  CPU: 1 PID: 0 Comm: swapper/1 Not tainted
  RIP: 0010:usb_fill_bulk_urb ./include/linux/usb.h:1619
  RIP: 0010:line6_start_listen+0x3fe/0x9e0 sound/usb/line6/driver.c:76
  Call Trace:
   <IRQ>
   line6_data_received+0x1f7/0x470 sound/usb/line6/driver.c:326
   __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
   usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845
   dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965
   call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281
   ....

Since the whole clean-up procedure is done in line6_disconnect()
callback, we can simply call it in the error path instead of
open-coding the whole again.  It'll fix such an issue automagically.

The bug was spotted by syzkaller.

Fixes: eedd0e95 ("ALSA: line6: Don't forget to call driver's destructor at error path")
Reported-by: NAndrey Konovalov <andreyknvl@google.com>
Tested-by: NAndrey Konovalov <andreyknvl@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

While not all line6 devices currently support PCM, it causes no
harm to 'have it prepared'.

This also fixes toneport, which only has PCM - in which case
we previously skipped the USB transfer properties detection completely.
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This reverts commit f6a0dd10.

The commit caused a regression on LINE6 Transport that has no control
caps.  Although reverting the commit may result back in a spurious
error message for some device again, it's the simplest regression fix,
hence it's taken as is at first.  The further code fix will follow
later.

Fixes: f6a0dd10 ("ALSA: line6: Only determine control port properties if needed")
Reported-by: NIgor Zinovev <zinigor@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The error checking here is messed up so we could end up dereferencing
-EFAULT.

Fixes: a16039cb ('ALSA: line6: Add hwdep interface to access the POD control messages')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Currently, usb-line6 module exports an array of MIDI manufacturer ID and
usb-pod module uses it. However, the declaration is not the definition in
common header. The difference is explicit length of array. Although
compiler calculates it and everything goes well, it's better to use the
same representation between definition and declaration.

This commit fills the length of array for usb-line6 module. As a small
good sub-effect, this commit suppress below warnings from static analysis
by sparse v0.5.0.

sound/usb/line6/driver.c:274:43: error: cannot size expression
sound/usb/line6/driver.c:275:16: error: cannot size expression
sound/usb/line6/driver.c:276:16: error: cannot size expression
sound/usb/line6/driver.c:277:16: error: cannot size expression

Fixes: 705ececd ("Staging: add line6 usb driver")
Signed-off-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

sound/usb/line6/driver.c:484:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values.

 NULL check before some freeing functions is not needed.

 Based on checkpatch warning
 "kfree(NULL) is safe this check is probably not required"
 and kfreeaddr.cocci by Julia Lawall.

Generated by: scripts/coccinelle/free/ifnullfree.cocci

CC: Andrej Krutak <dev@andree.sk>
Signed-off-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

We must do it this way, because e.g. POD X3 won't play any sound unless
the host listens on the bulk EP, so we cannot export it only via libusb.

The driver currently doesn't use the bulk EP messages in other way,
in future it could e.g. sense/modify volume(s).
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Not all line6 devices use the control port.
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Not all PODs use MIDI via USB data interface, thus allow avoiding
that code and instead using direct processing.
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

POD X3 can initialize similarly to older PODs, but it doesn't have the MIDI
interface. Instead, configuration is done via proprietary bulk EP messages.
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This has two parts:
* intervals_per_second setup
  (high speed needs 8000, instead of 1000)
* iso_buffers setup (count of iso buffers depends on
  USB speed, 2 is not enough for high speed)
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This basically changes LINE6_ISO_BUFFERS constant to a configurable
iso_buffers property.
Signed-off-by: NAndrej Krutak <dev@andree.sk>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The address cannot be negative so make it unsigned.  Also, an unsigned
int is always sufficient for the length, so no need to overdo it with a
size_t.  Finally, add in range checks to see if the values passed in
actually fit where they are used.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The serial number (aka ESN) is a 32-bit value.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Put an upper bound on how long we will wait for the device to respond to
a read/write request (i.e., 100 milliseconds) and return an error if
this is reached.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The device indicates the result of a read/write operation by making the
status available on a subsequent request from the driver.  This is not
ready immediately, though, so the driver is currently slamming the
device with hundreds of pointless requests before getting the expected
response.  Add a two millisecond delay before each attempt.  This is
approximately the behavior observed with version 4.2.7.1 of the Windows
driver.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Provide a unique name for each driver instead of using "line6usb" for
all of them.  This will allow for different configurations based on the
driver type.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

line6_start_timer passes an unsigned int as argument to be used in mod_timer
which is then used by mod_timer as unsigned long, this just fixes up the
argument type. This change helps make static code checkers happy.
Signed-off-by: NNicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This is only an API consolidation and should make things more readable
it replaces var * HZ / 1000 by msecs_to_jiffies(var).
Signed-off-by: NNicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Most of them are rather relevant with the definitions in driver.h,
and there are only a few lines, so just rip it off.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The definition is no longer used.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Just reformatting the comments and typos fixed, no functional
changes.  Particularly,
- avoid the kerneldoc marker "/**",
- reduce multiple comment lines into single lines,
- corrected wrongly referred function names
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Move the check of multi configurations before snd_card_new() as a
short path, and reduce superfluous pointer references.
Tested-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Instead of allocating the private data individually in each driver's
probe at first, let snd_card_new() allocate the data that is called in
line6_probe().  This simplifies the primary probe functions.
Tested-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The interface argument is used just for retrieving the assigned
device, which can be already found in line6->ifcdev.  Drop them from
the callbacks.  Also, pass the usb id to private_init so that the
driver can deal with it there.  This is a preliminary work for the
further cleanup to move the whole allocation into driver.c.
Tested-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The function isn't used any longer after rewriting from sysfs to leds
class in toneport.c.
Tested-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Fix memory leak at probe error path by rearranging the call order in
line6_destruct() so that the common destructor is always called.
Also this simplifies the error path to a single goto label.
Tested-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Split some codes in the lengthy line6_probe().
Tested-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Currently disconnect callback is used as a driver's destructor, and
this has to be called not only at the disconnection time but also at
the error paths during probe.
Tested-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

It's utterly unsafe to proceed further the disconnect procedure if the
assigned usbdev is inconsistent with the expected object.  Better to
put a WARN_ON() for more cautions and abort immediately.
Tested-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

... in line6_disconnect() as well.
Tested-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The driver version string was removed in an ealier commit for being
useless.  These are equally useless.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The correct spelling includes the space.  Fix this in strings and
comments that refer to the manufacturer.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>