1. 22 8月, 2019 5 次提交
    • T
      ALSA: usb-audio: Remove superfluous bLength checks · b8e4f1fd
      Takashi Iwai 提交于
      Now that we got the more comprehensive validation code for USB-audio
      descriptors, the check of overflow in each descriptor unit parser
      became superfluous.  Drop some of the obvious cases.
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      b8e4f1fd
    • T
      ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects · 52c3e317
      Takashi Iwai 提交于
      Instead of the direct kfree() calls, introduce a new local helper to
      release the usb_mixer_elem_info object.  This will be extended to do
      more than a single kfree() in the later patches.
      
      Also, use the standard goto instead of multiple calls in
      parse_audio_selector_unit() error paths.
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      52c3e317
    • T
      ALSA: usb-audio: Simplify parse_audio_unit() · 68e9fde2
      Takashi Iwai 提交于
      Minor code refactoring by combining the UAC version and the type in
      the switch-case flow, so that we reduce the indentation and
      redundancy.  One good bonus is that the duplicated definition of the
      same type value (e.g. UAC2_EFFECT_UNIT) can be handled more cleanly.
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      68e9fde2
    • T
      ALSA: usb-audio: More validations of descriptor units · 57f87706
      Takashi Iwai 提交于
      Introduce a new helper to validate each audio descriptor unit before
      and check the unit before actually accessing it.  This should harden
      against the OOB access cases with malformed descriptors that have been
      recently frequently reported by fuzzers.
      
      The existing descriptor checks are still kept although they become
      superfluous after this patch.  They'll be cleaned up eventually
      later.
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      57f87706
    • T
      ALSA: usb-audio: Check mixer unit bitmap yet more strictly · f9f0e9ed
      Takashi Iwai 提交于
      The bmControls (for UAC1) or bmMixerControls (for UAC2/3) bitmap has a
      variable size depending on both input and output pins.  Its size is to
      fit with input * output bits.  The problem is that the input size
      can't be determined simply from the unit descriptor itself but it
      needs to parse the whole connected sources.  Although the
      uac_mixer_unit_get_channels() tries to check some possible overflow of
      this bitmap, it's incomplete due to the lack of the  evaluation of
      input pins.
      
      For covering possible overflows, this patch adds the bitmap overflow
      check in the loop of input pins in parse_audio_mixer_unit().
      
      Fixes: 0bfe5e43 ("ALSA: usb-audio: Check mixer unit descriptors more strictly")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      f9f0e9ed
  2. 16 8月, 2019 1 次提交
  3. 15 8月, 2019 1 次提交
    • H
      ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit · daac0715
      Hui Peng 提交于
      The `uac_mixer_unit_descriptor` shown as below is read from the
      device side. In `parse_audio_mixer_unit`, `baSourceID` field is
      accessed from index 0 to `bNrInPins` - 1, the current implementation
      assumes that descriptor is always valid (the length  of descriptor
      is no shorter than 5 + `bNrInPins`). If a descriptor read from
      the device side is invalid, it may trigger out-of-bound memory
      access.
      
      ```
      struct uac_mixer_unit_descriptor {
      	__u8 bLength;
      	__u8 bDescriptorType;
      	__u8 bDescriptorSubtype;
      	__u8 bUnitID;
      	__u8 bNrInPins;
      	__u8 baSourceID[];
      }
      ```
      
      This patch fixes the bug by add a sanity check on the length of
      the descriptor.
      Reported-by: NHui Peng <benquike@gmail.com>
      Reported-by: NMathias Payer <mathias.payer@nebelwelt.net>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NHui Peng <benquike@gmail.com>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      daac0715
  4. 28 7月, 2019 1 次提交
  5. 05 7月, 2019 1 次提交
    • T
      ALSA: usb-audio: Fix parse of UAC2 Extension Units · ca95c7bf
      Takashi Iwai 提交于
      Extension Unit (XU) is used to have a compatible layout with
      Processing Unit (PU) on UAC1, and the usb-audio driver code assumed it
      for parsing the descriptors.  Meanwhile, on UAC2, XU became slightly
      incompatible with PU; namely, XU has a one-byte bmControls bitmap
      while PU has two bytes bmControls bitmap.  This incompatibility
      results in the read of a wrong address for the last iExtension field,
      which ended up with an incorrect string for the mixer element name, as
      recently reported for Focusrite Scarlett 18i20 device.
      
      This patch corrects this misalignment by introducing a couple of new
      macros and calling them depending on the descriptor type.
      
      Fixes: 23caaf19 ("ALSA: usb-mixer: Add support for Audio Class v2.0")
      Reported-by: NStefan Sauer <ensonic@hora-obscura.de>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      ca95c7bf
  6. 31 5月, 2019 1 次提交
  7. 28 4月, 2019 1 次提交
    • W
      ALSA: usb-audio: Fix a memory leak bug · cb517359
      Wenwen Wang 提交于
      In parse_audio_selector_unit(), the string array 'namelist' is allocated
      through kmalloc_array(), and each string pointer in this array, i.e.,
      'namelist[]', is allocated through kmalloc() in the following for loop.
      Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
      an error occurs during the creation process, the string array 'namelist',
      including all string pointers in the array 'namelist[]', should be freed,
      before the error code ENOMEM is returned. However, the current code does
      not free 'namelist[]', resulting in memory leaks.
      
      To fix the above issue, free all string pointers 'namelist[]' in a loop.
      Signed-off-by: NWenwen Wang <wang6495@umn.edu>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      cb517359
  8. 24 4月, 2019 1 次提交
  9. 07 2月, 2019 1 次提交
  10. 09 1月, 2019 1 次提交
  11. 07 1月, 2019 3 次提交
  12. 09 8月, 2018 1 次提交
  13. 16 7月, 2018 5 次提交
  14. 15 6月, 2018 3 次提交
  15. 13 6月, 2018 1 次提交
    • K
      treewide: kmalloc() -> kmalloc_array() · 6da2ec56
      Kees Cook 提交于
      The kmalloc() function has a 2-factor argument form, kmalloc_array(). This
      patch replaces cases of:
      
              kmalloc(a * b, gfp)
      
      with:
              kmalloc_array(a * b, gfp)
      
      as well as handling cases of:
      
              kmalloc(a * b * c, gfp)
      
      with:
      
              kmalloc(array3_size(a, b, c), gfp)
      
      as it's slightly less ugly than:
      
              kmalloc_array(array_size(a, b), c, gfp)
      
      This does, however, attempt to ignore constant size factors like:
      
              kmalloc(4 * 1024, gfp)
      
      though any constants defined via macros get caught up in the conversion.
      
      Any factors with a sizeof() of "unsigned char", "char", and "u8" were
      dropped, since they're redundant.
      
      The tools/ directory was manually excluded, since it has its own
      implementation of kmalloc().
      
      The Coccinelle script used for this was:
      
      // Fix redundant parens around sizeof().
      @@
      type TYPE;
      expression THING, E;
      @@
      
      (
        kmalloc(
      -	(sizeof(TYPE)) * E
      +	sizeof(TYPE) * E
        , ...)
      |
        kmalloc(
      -	(sizeof(THING)) * E
      +	sizeof(THING) * E
        , ...)
      )
      
      // Drop single-byte sizes and redundant parens.
      @@
      expression COUNT;
      typedef u8;
      typedef __u8;
      @@
      
      (
        kmalloc(
      -	sizeof(u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(__u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(char) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(unsigned char) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(u8) * COUNT
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(__u8) * COUNT
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(char) * COUNT
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(unsigned char) * COUNT
      +	COUNT
        , ...)
      )
      
      // 2-factor product with sizeof(type/expression) and identifier or constant.
      @@
      type TYPE;
      expression THING;
      identifier COUNT_ID;
      constant COUNT_CONST;
      @@
      
      (
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * (COUNT_ID)
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * COUNT_ID
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * COUNT_CONST
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * (COUNT_ID)
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * COUNT_ID
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * COUNT_CONST
      +	COUNT_CONST, sizeof(THING)
        , ...)
      )
      
      // 2-factor product, only identifiers.
      @@
      identifier SIZE, COUNT;
      @@
      
      - kmalloc
      + kmalloc_array
        (
      -	SIZE * COUNT
      +	COUNT, SIZE
        , ...)
      
      // 3-factor product with 1 sizeof(type) or sizeof(expression), with
      // redundant parens removed.
      @@
      expression THING;
      identifier STRIDE, COUNT;
      type TYPE;
      @@
      
      (
        kmalloc(
      -	sizeof(TYPE) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      )
      
      // 3-factor product with 2 sizeof(variable), with redundant parens removed.
      @@
      expression THING1, THING2;
      identifier COUNT;
      type TYPE1, TYPE2;
      @@
      
      (
        kmalloc(
      -	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kmalloc(
      -	sizeof(THING1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kmalloc(
      -	sizeof(THING1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      )
      
      // 3-factor product, only identifiers, with redundant parens removed.
      @@
      identifier STRIDE, SIZE, COUNT;
      @@
      
      (
        kmalloc(
      -	(COUNT) * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	(COUNT) * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	(COUNT) * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	(COUNT) * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      )
      
      // Any remaining multi-factor products, first at least 3-factor products,
      // when they're not all constants...
      @@
      expression E1, E2, E3;
      constant C1, C2, C3;
      @@
      
      (
        kmalloc(C1 * C2 * C3, ...)
      |
        kmalloc(
      -	(E1) * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kmalloc(
      -	(E1) * (E2) * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kmalloc(
      -	(E1) * (E2) * (E3)
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kmalloc(
      -	E1 * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      )
      
      // And then all remaining 2 factors products when they're not all constants,
      // keeping sizeof() as the second factor argument.
      @@
      expression THING, E1, E2;
      type TYPE;
      constant C1, C2, C3;
      @@
      
      (
        kmalloc(sizeof(THING) * C2, ...)
      |
        kmalloc(sizeof(TYPE) * C2, ...)
      |
        kmalloc(C1 * C2 * C3, ...)
      |
        kmalloc(C1 * C2, ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * (E2)
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * E2
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * (E2)
      +	E2, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * E2
      +	E2, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	(E1) * E2
      +	E1, E2
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	(E1) * (E2)
      +	E1, E2
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	E1 * E2
      +	E1, E2
        , ...)
      )
      Signed-off-by: NKees Cook <keescook@chromium.org>
      6da2ec56
  16. 28 5月, 2018 1 次提交
  17. 15 5月, 2018 3 次提交
  18. 14 5月, 2018 1 次提交
  19. 13 5月, 2018 1 次提交
    • R
      ALSA: usb: add UAC3 BADD profiles support · 17156f23
      Ruslan Bilovol 提交于
      Recently released USB Audio Class 3.0 specification
      contains BADD (Basic Audio Device Definition) document
      which describes pre-defined UAC3 configurations.
      
      BADD support is mandatory for UAC3 devices, it should be
      implemented as a separate USB device configuration.
      As per BADD document, class-specific descriptors
      shall not be included in the Device’s Configuration
      descriptor ("inferred"), but host can guess them
      from BADD profile number, number of endpoints and
      their max packed sizes.
      
      This patch adds support of all BADD profiles from the spec
      Signed-off-by: NRuslan Bilovol <ruslan.bilovol@gmail.com>
      Tested-by: NJorge Sanjuan <jorge.sanjuan@codethink.co.uk>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      17156f23
  20. 04 5月, 2018 1 次提交
  21. 03 5月, 2018 1 次提交
  22. 02 5月, 2018 2 次提交
    • T
      ALSA: usb-audio: Add "Keep Interface" control · 4120fbed
      Takashi Iwai 提交于
      This patch adds "Keep Interface" control for each USB-audio device.
      The control element is with SND_CTL_IFACE_CARD, so that it won't
      appear on any sane mixer applications.  For a device that is confirmed
      to work well with "keep-interface" mode, user can flip the control via
      amixer, e.g.
        % amixer -c1 cset iface=CARD,name='Keep Interface' on
      
      and save/restore the state via alsactl.
      
      The reason to provide this via control API is that the behavior must
      be pretty depending on the device (and the firmware in it), so it's
      not ideal to apply via module option.
      
      For a device that certainly works, we may set it statically via a
      quirk table entry.  But a device like Dell WD15 dock behaves so
      differently depending on the firmware, and we can't set it
      statically.  So leave this as a dynamic switch each user can adjust
      freely.
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      4120fbed
    • T
      ALSA: usb-audio: Initialize Dell Dock playback volumes · 964af639
      Takashi Iwai 提交于
      In the early commit adcdd0d5 ("ALSA: usb-audio: Skip volume
      controls triggers hangup on Dell USB Dock"), we add the mixer quirks
      for Dell dock to skip two mixer FU's for playback.  This supposed that
      the device has always the proper initial volume, but it doesn't seem
      always correct.
      
      This patch adds the explicit initialization of the volumes to the
      fixed 0dB at the device probe time.  Also, such a fixup is needed
      after the resume, so a new function is hooked to the resume callback
      as well.
      
      Bugzilla: http://bugzilla.suse.com/show_bug.cgi?id=1089467Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      964af639
  23. 24 4月, 2018 1 次提交
  24. 23 4月, 2018 1 次提交
  25. 27 3月, 2018 1 次提交