Also, silences the following smatch warning:
sound/usb/format.c:170 parse_audio_format_rates_v1() warn:
returning -1 instead of -ENOMEM is sloppy
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

A malicious USB device could feed in a large nr_rates value.  This would
cause the subsequent call to kmemdup() to allocate a smaller buffer than
expected, leading to out-of-bounds access.

This patch validates the nr_rates value and reuses the limit introduced
in commit 4fa0e81b ("ALSA: usb-audio: fix possible hang and overflow
in parse_uac2_sample_rate_range()").
Signed-off-by: NXi Wang <xi.wang@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

A malicious USB device may feed in carefully crafted min/max/res values,
so that the inner loop in parse_uac2_sample_rate_range() could run for
a long time or even never terminate, e.g., given max = INT_MAX.

Also nr_rates could be a large integer, which causes an integer overflow
in the subsequent call to kmalloc() in parse_audio_format_rates_v2().
Thus, kmalloc() would allocate a smaller buffer than expected, leading
to a memory corruption.

To exploit the two vulnerabilities, an attacker needs physical access
to the machine to plug in a malicious USB device.

This patch makes two changes.

1) The type of "rate" is changed to unsigned int, so that the loop could
   stop once "rate" is larger than INT_MAX.

2) Limit nr_rates to 1024.
Suggested-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NXi Wang <xi.wang@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

There are certain devices that are reportedly so slow that they need
more than 100 ms to handle control transfers.  Therefore, increase the
timeout in mixer(_quirks).c to 1000 ms.

The timeout parameter of snd_usb_ctl_msg() is now constant, so we can
drop it.
Reported-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Just in case a prototype changes, we'll be warned. This also fixes a
sparse warning.
Signed-off-by: NDaniel Mack <zonque@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

This patch adds support for the Terratec Aureon 7.1 USB which uses a
C-Media cm6206 and needs all the quirks already found in the past.
Signed-off-by: NWolfgang Breyha <wbreyha@gmx.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Add support for the 24-bit audio I/Os of the Edirol SD-90 interface.
Reported-any-tested-by: NJim Grusendorf <alsa-user@grusendorf.ca>
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The Audio Class v2 support code in 2.6.35 added checks for the
bInterfaceProtocol field.  However, there are devices (usually those
detected by vendor-specific quirks) that do not have one of the
predefined values in this field, which made the driver reject them.

To fix this regression, restore the old behaviour, i.e., assume that
a device with an unknown bInterfaceProtocol field (other than
UAC_VERSION_2) has more or less UAC-v1-compatible descriptors.

[compile warning fixes by tiwai]
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Cc: Daniel Mack <daniel@caiaq.de>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Gcc complains that ret might be used uninitialized:

sound/usb/format.c: In function ‘snd_usb_parse_audio_format’:
sound/usb/format.c:354: warning: ‘ret’ may be used uninitialized in this function
sound/usb/format.c:354: note: ‘ret’ was declared here
sound/usb/format.c:414: warning: ‘ret’ may be used uninitialized in this function
sound/usb/format.c:414: note: ‘ret’ was declared here

I suppose it could be uninitialized if there is ever a UAC_VERSION_3
released. Anyway this patch is worthwhile if only to silence the gcc
warning.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Acked-by: NDaniel Mack <daniel@caiaq.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

As the control interface is now carried in struct snd_usb_audio, we can
simplify the API a little and also drop the private ctrlif field from
struct usb_mixer_interface.

Also remove a left-over function prototype in pcm.h.
Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

A device may report its supported sample rates in ranges rather than in
discrete triplets. The code used to only parse the MIN field instead of
properly paying attention to the MAX and RES values.

Also, handle RES values of 1 correctly and announce a continous sample
rate range in this case.
Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Reported-by: NAlex Lee <alexlee188@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Control messages directed to an interface must have the interface number
set in the lower 8 bits of wIndex. This wasn't done correctly for some
clock and mixer messages.
Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Reported-by: NAlex Lee <alexlee188@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Audio devices which comply to the UAC2 standard can export complex clock
topologies in its descriptors and set up links between them.

The entities that are defined are

 - clock sources, which define the end-leafs.
 - clock selectors, which act as switch to select one out of many
   possible clocks sources.
 - clock multipliers, which have an input clock source, and act as clock
   source again. They can be used to derive one clock from another.

All sample rate changes, clock validity queries and the like must go to
clock source elements, while clock selectors and multipliers can be used
as terminal clock source.

The following patch adds a parser for these elements and functions to
iterate over the tree and find the leaf nodes (clock sources).

The samplerate set functions were moved to the new clock.c file.
Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

-1 is not a good return value as it means -EPERM, "not permitted".
Choose -ENOTSUPP instead, which is what the code really wants to tell
its callers.
Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

No need for the private enum.
Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

- Split the audio.h file in two to clearly denote the differences
  between the standards.
- Add many more defines to audio-v2.h. Most of them are not currently
  used.
- Replaced a magic value with a proper define
Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Acked-by: NGreg Kroah-Hartman <gregkh@suse.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Change the parser to correctly handle v2 descriptors with multiple
format bits set.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

In preparation for USB audio 2.0 support, change the audioformat
structure so that it uses a bitmask to specify possible formats.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Clean up the usb audio driver by factoring out a lot of functions to
separate files. Code for procfs, quirks, urbs, format parsers etc all
got a new home now.

Moved almost all special quirk handling to quirks.c and introduced new
generic functions to handle them, so the exceptions do not pollute the
whole driver.

Renamed usbaudio.c to card.c because this is what it actually does now.
Renamed usbmidi.c to midi.c for namespace clarity.
Removed more things from usbaudio.h.

The non-standard drivers were adopted accordingly.
Signed-off-by: NDaniel Mack <daniel@caiaq.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>