Skip to content

K
Kernel

openeuler / Kernel
1 年多 前同步成功

通知 8
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 15 11月, 2019 1 次提交
  3. 14 11月, 2019 1 次提交
  5. 13 11月, 2019 1 次提交
    • H
      ALSA: usb-audio: not submit urb for stopped endpoint · 52869931
      由 Henry Lin 提交于 
      While output urb's snd_complete_urb() is executing, calling
prepare_outbound_urb() may cause endpoint stopped before
prepare_outbound_urb() returns and result in next urb submitted
to stopped endpoint. usb-audio driver cannot re-use it afterwards as
the urb is still hold by usb stack.

This change checks EP_FLAG_RUNNING flag after prepare_outbound_urb() again
to let snd_complete_urb() know the endpoint already stopped and does not
submit next urb. Below kind of error will be fixed:

[  213.153103] usb 1-2: timeout: still 1 active urbs on EP #1
[  213.164121] usb 1-2: cannot submit urb 0, error -16: unknown error
Signed-off-by: NHenry Lin <henryl@nvidia.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191113021420.13377-1-henryl@nvidia.comSigned-off-by: NTakashi Iwai <tiwai@suse.de>
      52869931
  7. 10 11月, 2019 1 次提交
  9. 06 11月, 2019 7 次提交
  11. 30 10月, 2019 1 次提交
  13. 24 10月, 2019 1 次提交
  15. 22 10月, 2019 1 次提交
  17. 17 10月, 2019 1 次提交
  19. 07 10月, 2019 1 次提交
  21. 24 9月, 2019 1 次提交
  23. 17 9月, 2019 1 次提交
  25. 28 8月, 2019 2 次提交
  27. 26 8月, 2019 2 次提交
  29. 25 8月, 2019 1 次提交
    • T
      ALSA: usb-audio: Clean up check_input_term() · e0ccdef9
      由 Takashi Iwai 提交于 
      The primary changes in this patch are cleanups of __check_input_term()
and move to a non-nested switch-case block by evaluating the pair of
UAC version and the unit type, as we've done for parse_audio_unit().
Also each parser is split into the function for readability.

Now, a slight behavior change by this cleanup is the handling of
processing and extension units.  Formerly we've dealt with them
differently between UAC1/2 and UAC3; the latter returns an error if no
input sources are available, while the former continues to parse.

In this patch, unify the behavior in all cases: when input sources are
available, it parses recursively, then override the type and the id,
as well as channel information if not provided yet.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      e0ccdef9
  31. 22 8月, 2019 6 次提交
    • T
      ALSA: usb-audio: Remove superfluous bLength checks · b8e4f1fd
      由 Takashi Iwai 提交于 
      Now that we got the more comprehensive validation code for USB-audio
descriptors, the check of overflow in each descriptor unit parser
became superfluous.  Drop some of the obvious cases.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      b8e4f1fd
    • T
      ALSA: usb-audio: Unify the release of usb_mixer_elem_info objects · 52c3e317
      由 Takashi Iwai 提交于 
      Instead of the direct kfree() calls, introduce a new local helper to
release the usb_mixer_elem_info object.  This will be extended to do
more than a single kfree() in the later patches.

Also, use the standard goto instead of multiple calls in
parse_audio_selector_unit() error paths.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      52c3e317
    • T
      ALSA: usb-audio: Simplify parse_audio_unit() · 68e9fde2
      由 Takashi Iwai 提交于 
      Minor code refactoring by combining the UAC version and the type in
the switch-case flow, so that we reduce the indentation and
redundancy.  One good bonus is that the duplicated definition of the
same type value (e.g. UAC2_EFFECT_UNIT) can be handled more cleanly.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      68e9fde2
    • T
      ALSA: usb-audio: More validations of descriptor units · 57f87706
      由 Takashi Iwai 提交于 
      Introduce a new helper to validate each audio descriptor unit before
and check the unit before actually accessing it.  This should harden
against the OOB access cases with malformed descriptors that have been
recently frequently reported by fuzzers.

The existing descriptor checks are still kept although they become
superfluous after this patch.  They'll be cleaned up eventually
later.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      57f87706
    • T
      ALSA: usb-audio: Check mixer unit bitmap yet more strictly · f9f0e9ed
      由 Takashi Iwai 提交于 
      The bmControls (for UAC1) or bmMixerControls (for UAC2/3) bitmap has a
variable size depending on both input and output pins.  Its size is to
fit with input * output bits.  The problem is that the input size
can't be determined simply from the unit descriptor itself but it
needs to parse the whole connected sources.  Although the
uac_mixer_unit_get_channels() tries to check some possible overflow of
this bitmap, it's incomplete due to the lack of the  evaluation of
input pins.

For covering possible overflows, this patch adds the bitmap overflow
check in the loop of input pins in parse_audio_mixer_unit().

Fixes: 0bfe5e43 ("ALSA: usb-audio: Check mixer unit descriptors more strictly")
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      f9f0e9ed
    • T
      ALSA: line6: Fix memory leak at line6_init_pcm() error path · 1bc8d18c
      由 Takashi Iwai 提交于 
      I forgot to release the allocated object at the early error path in
line6_init_pcm().  For addressing it, slightly shuffle the code so
that the PCM destructor (pcm->private_free) is assigned properly
before all error paths.

Fixes: 34501219 ("ALSA: line6: Fix write on zero-sized buffer")
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      1bc8d18c
  33. 21 8月, 2019 1 次提交
    • T
      ALSA: usb-audio: Fix invalid NULL check in snd_emuusb_set_samplerate() · 6de3c9e3
      由 Takashi Iwai 提交于 
      The quirk function snd_emuusb_set_samplerate() has a NULL check for
the mixer element, but this is useless in the current code.  It used
to be a check against mixer->id_elems[unitid] but it was changed later
to the value after mixer_eleme_list_to_info() which is always non-NULL
due to the container_of() usage.

This patch fixes the check before the conversion.

While we're at it, correct a typo in the comment in the function,
too.

Fixes: 8c558076 ("ALSA: usb-audio: Clean up mixer element list traverse")
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      6de3c9e3
  35. 20 8月, 2019 1 次提交
  37. 16 8月, 2019 1 次提交
  39. 15 8月, 2019 1 次提交
    • H
      ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit · daac0715
      由 Hui Peng 提交于 
      The `uac_mixer_unit_descriptor` shown as below is read from the
device side. In `parse_audio_mixer_unit`, `baSourceID` field is
accessed from index 0 to `bNrInPins` - 1, the current implementation
assumes that descriptor is always valid (the length  of descriptor
is no shorter than 5 + `bNrInPins`). If a descriptor read from
the device side is invalid, it may trigger out-of-bound memory
access.

```
struct uac_mixer_unit_descriptor {
	__u8 bLength;
	__u8 bDescriptorType;
	__u8 bDescriptorSubtype;
	__u8 bUnitID;
	__u8 bNrInPins;
	__u8 baSourceID[];
}
```

This patch fixes the bug by add a sanity check on the length of
the descriptor.
Reported-by: NHui Peng <benquike@gmail.com>
Reported-by: NMathias Payer <mathias.payer@nebelwelt.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: NHui Peng <benquike@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      daac0715
  41. 07 8月, 2019 1 次提交
    • W
      ALSA: hiface: fix multiple memory leak bugs · 3d92aa45
      由 Wenwen Wang 提交于 
      In hiface_pcm_init(), 'rt' is firstly allocated through kzalloc(). Later
on, hiface_pcm_init_urb() is invoked to initialize 'rt->out_urbs[i]'. In
hiface_pcm_init_urb(), 'rt->out_urbs[i].buffer' is allocated through
kzalloc().  However, if hiface_pcm_init_urb() fails, both 'rt' and
'rt->out_urbs[i].buffer' are not deallocated, leading to memory leak bugs.
Also, 'rt->out_urbs[i].buffer' is not deallocated if snd_pcm_new() fails.

To fix the above issues, free 'rt' and 'rt->out_urbs[i].buffer'.

Fixes: a91c3fb2 ("Add M2Tech hiFace USB-SPDIF driver")
Signed-off-by: NWenwen Wang <wenwen@cs.uga.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      3d92aa45
  43. 06 8月, 2019 5 次提交
  45. 30 7月, 2019 1 次提交