1. 31 3月, 2017 1 次提交
    • T
      ALSA: usb-audio: Fake also USB device id when alias is given · 03a1f48e
      Takashi Iwai 提交于
      Recently snd-usb-audio driver received a new option, quirk_alias, to
      allow user to apply the existing quirk for a different device.  This
      works for many quirks as is, but some still need more tune-ups:
      namely, some quirks check the USB vendor/device IDs in various places,
      thus it doesn't work as long as the ID is different from the expected
      one.
      
      With this patch, the driver stores the aliased USB ID, so that these
      rest quirks per device ID are applied.  The transition to use the
      cached USB ID was already done in the past, so what we needed now is
      only to overwrite chip->usb_id.
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      03a1f48e
  2. 25 2月, 2017 1 次提交
  3. 22 2月, 2017 4 次提交
    • T
      ALSA: usb-audio: Tidy up mixer_us16x08.c · 7086b7b3
      Takashi Iwai 提交于
      A few more cleanups and improvements that have been overlooked:
      
      - Use ARRAY_SIZE() macro appropriately
      - Code shuffling for minor optimization
      - Omit superfluous variable initializations
      - Get rid of superfluous NULL checks
      - Add const to snd_us16x08_control_params definitions
      
      No functional changes.
      Reviewed-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      7086b7b3
    • T
      ALSA: usb-audio: Fix memory leak and corruption in mixer_us16x08.c · e2810d76
      Takashi Iwai 提交于
      There are a few places leaking memory and doing double-free in
      mixer_us16x08.c.
      
      The driver allocates a usb_mixer_elem_info object at each
      add_new_ctl() call.  This has to be freed via kctl->private_free, but
      currently this is done properly only for some controls.
      
      Also, the driver allocates three external objects (comp_store,
      eq_store, meter_store), and these are referred in elem->private_data
      (it's not kctl->private_data).  And these have to be released, but
      there are none doing it.  Moreover, these extra objects have to be
      released only once.  Thus the release should be done only by the first
      kctl element that refers to it.
      
      For fixing these, we call either snd_usb_mixer_elem_free() (only for
      kctl->private_data) or elem_private_free() (for both
      kctl->private_data and elem->private_data) via kctl->private_free
      appropriately.
      
      Last but not least, snd_us16x08_controls_create() may return in the
      middle without releasing the allocated *_store objects due to an
      error.  For fixing this, we shuffle the allocation code so that it's
      called just before its reference.
      
      Fixes: d2bb390a ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
      Reported-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
      Reviewed-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      e2810d76
    • T
      ALSA: usb-audio: purge needless variable length array · 89b593c3
      Takashi Sakamoto 提交于
      Variable length array is used in 'snd_us16x08_meter_get()', while there
      is no need. It's better to purge it because variable length array has
      overhead for stack handling.
      
      This commit replaces the array with static length. Sparse generated below
      warning.
      
      sound/usb/mixer_us16x08.c:714:18: warning: Variable length array is used.
      
      Fixes: d2bb390a ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
      Signed-off-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      89b593c3
    • B
      ALSA: usb-audio: constify snd_kcontrol_new structures · 04bab350
      Bhumika Goyal 提交于
      Declare snd_kcontrol_new structures as const as they are only passed as
      an argument to the function add_new_ctl. This agrument is of type const,
      so snd_kcontrol_new structures having this property can be made const
      too.
      Signed-off-by: NBhumika Goyal <bhumirks@gmail.com>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      04bab350
  4. 21 2月, 2017 2 次提交
  5. 20 2月, 2017 1 次提交
  6. 07 2月, 2017 2 次提交
  7. 12 1月, 2017 1 次提交
  8. 10 1月, 2017 1 次提交
  9. 05 1月, 2017 2 次提交
    • I
      ALSA: usb-audio: test EP_FLAG_RUNNING at urb completion · 13a6c832
      Ioan-Adrian Ratiu 提交于
      Testing EP_FLAG_RUNNING in snd_complete_urb() before running the completion
      logic allows us to save a few cpu cycles by returning early, skipping the
      pending urb in case the stream was stopped; the stop logic handles the urb
      and sets the completion callbacks to NULL.
      Signed-off-by: NIoan-Adrian Ratiu <adi@adirat.com>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      13a6c832
    • I
      ALSA: usb-audio: Fix irq/process data synchronization · 1d0f9530
      Ioan-Adrian Ratiu 提交于
      Commit 16200948 ("ALSA: usb-audio: Fix race at stopping the stream") was
      incomplete causing another more severe kernel panic, so it got reverted.
      This fixes both the original problem and its fallout kernel race/crash.
      
      The original fix is to move the endpoint member NULL clearing logic inside
      wait_clear_urbs() so the irq triggering the urb completion doesn't call
      retire_capture/playback_urb() after the NULL clearing and generate a panic.
      
      However this creates a new race between snd_usb_endpoint_start()'s call
      to wait_clear_urbs() and the irq urb completion handler which again calls
      retire_capture/playback_urb() leading to a new NULL dereference.
      
      We keep the EP deactivation code in snd_usb_endpoint_start() because
      removing it will break the EP reference counting (see [1] [2] for info),
      however we don't need the "can_sleep" mechanism anymore because a new
      function was introduced (snd_usb_endpoint_sync_pending_stop()) which
      synchronizes pending stops and gets called inside the pcm prepare callback.
      
      It also makes sense to remove can_sleep because it was also removed from
      deactivate_urbs() signature in [3] so we benefit from more simplification.
      
      [1] commit 015618b9 ("ALSA: snd-usb: Fix URB cancellation at stream start")
      [2] commit e9ba389c ("ALSA: usb-audio: Fix scheduling-while-atomic bug in PCM capture stream")
      [3] commit ccc1696d ("ALSA: usb-audio: simplify endpoint deactivation code")
      
      Fixes: f8114f85 ("Revert "ALSA: usb-audio: Fix race at stopping the stream"")
      Signed-off-by: NIoan-Adrian Ratiu <adi@adirat.com>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      1d0f9530
  10. 28 12月, 2016 1 次提交
  11. 22 12月, 2016 1 次提交
  12. 13 12月, 2016 3 次提交
  13. 09 12月, 2016 2 次提交
  14. 06 12月, 2016 2 次提交
  15. 05 12月, 2016 1 次提交
    • T
      ALSA: usb-audio: Fix race at stopping the stream · 16200948
      Takashi Iwai 提交于
      We've got a kernel crash report showing like:
      
        Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = a1d7c000
        [00000008] *pgd=31c93831, *pte=00000000, *ppte=00000000
        Internal error: Oops: 17 [#1] PREEMPT SMP ARM
        CPU: 0 PID: 250 Comm: dbus-daemon Not tainted 3.14.51-03479-gf50bdf4 #1
        task: a3ae61c0 ti: a08c8000 task.ti: a08c8000
        PC is at retire_capture_urb+0x10/0x1f4 [snd_usb_audio]
        LR is at snd_complete_urb+0x140/0x1f0 [snd_usb_audio]
        pc : [<7f0eb22c>]    lr : [<7f0e57fc>]    psr: 200e0193
        sp : a08c9c98  ip : a08c9ce8  fp : a08c9ce4
        r10: 0000000a  r9 : 00000102  r8 : 94cb3000
        r7 : 94cb3000  r6 : 94d0f000  r5 : 94d0e8e8  r4 : 94d0e000
        r3 : 7f0eb21c  r2 : 00000000  r1 : 94cb3000  r0 : 00000000
        Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
        Control: 10c5387d  Table: 31d7c04a  DAC: 00000015
        Process dbus-daemon (pid: 250, stack limit = 0xa08c8238)
        Stack: (0xa08c9c98 to 0xa08ca000)
        ...
        Backtrace:
        [<7f0eb21c>] (retire_capture_urb [snd_usb_audio]) from [<7f0e57fc>] (snd_complete_urb+0x140/0x1f0 [snd_usb_audio])
        [<7f0e56bc>] (snd_complete_urb [snd_usb_audio]) from [<80371118>] (__usb_hcd_giveback_urb+0x78/0xf4)
        [<803710a0>] (__usb_hcd_giveback_urb) from [<80371514>] (usb_giveback_urb_bh+0x8c/0xc0)
        [<80371488>] (usb_giveback_urb_bh) from [<80028e3c>] (tasklet_hi_action+0xc4/0x148)
        [<80028d78>] (tasklet_hi_action) from [<80028358>] (__do_softirq+0x190/0x380)
        [<800281c8>] (__do_softirq) from [<80028858>] (irq_exit+0x8c/0xfc)
        [<800287cc>] (irq_exit) from [<8000ea88>] (handle_IRQ+0x8c/0xc8)
        [<8000e9fc>] (handle_IRQ) from [<800085e8>] (gic_handle_irq+0xbc/0xf8)
        [<8000852c>] (gic_handle_irq) from [<80509044>] (__irq_svc+0x44/0x78)
        [<80508820>] (_raw_spin_unlock_irq) from [<8004b880>] (finish_task_switch+0x5c/0x100)
        [<8004b824>] (finish_task_switch) from [<805052f0>] (__schedule+0x48c/0x6d8)
        [<80504e64>] (__schedule) from [<805055d4>] (schedule+0x98/0x9c)
        [<8050553c>] (schedule) from [<800116c8>] (do_work_pending+0x30/0xd0)
        [<80011698>] (do_work_pending) from [<8000e160>] (work_pending+0xc/0x20)
        Code: e1a0c00d e92ddff0 e24cb004 e24dd024 (e5902008)
        Kernel panic - not syncing: Fatal exception in interrupt
      
      There is a race between retire_capture_urb() and stop_endpoints().
      The latter is called at stopping the stream and it sets some endpoint
      fields to NULL.  But its call is asynchronous, thus the pending
      complete callback might get called after these NULL clears, and it
      leads the NULL dereference like the above.
      
      The fix is to move the NULL clearance after the synchronization,
      i.e. wait_clear_urbs().  This is called at prepare and hw_free
      callbacks, so it's assured to be called before the restart of the
      stream or the release of the stream.
      
      Also, while we're at it, put the EP_FLAG_RUNNING flag check at the
      beginning of snd_complete_urb() to skip the pending complete after the
      stream is stopped.
      
      Fixes: b2eb950d ("ALSA: usb-audio: stop both data and sync...")
      Reported-by: NJiada Wang <jiada_wang@mentor.com>
      Reported-by: NMark Craske <Mark_Craske@mentor.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      16200948
  16. 30 11月, 2016 2 次提交
  17. 15 11月, 2016 1 次提交
    • T
      ALSA: usb-audio: Fix use-after-free of usb_device at disconnect · 6ff1a253
      Takashi Iwai 提交于
      The usb-audio driver implements the deferred device disconnection for
      the device in use.  In this mode, the disconnection callback returns
      immediately while the actual ALSA card object removal happens later
      when all files get closed.  As Shuah reported, this code flow,
      however, leads to a use-after-free, detected by KASAN:
      
       BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
       Write of size 8 by task pulseaudio/2244
       Call Trace:
        [<ffffffff81b31473>] dump_stack+0x67/0x94
        [<ffffffff81564ef1>] kasan_object_err+0x21/0x70
        [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
        [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
        [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
        [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
        [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
        [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
        [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
        [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
        [<ffffffff8242cae4>] release_card_device+0x34/0x130
        [<ffffffff81ef1846>] device_release+0x76/0x1e0
        [<ffffffff81b37ad7>] kobject_release+0x107/0x370
        .....
       Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
       Allocated:
        [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
        [<ffffffff81564296>] save_stack+0x46/0xd0
        [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
        [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
        [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
        [<ffffffff8216349d>] hub_event+0xf1d/0x35f0
        ....
       Freed:
        [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
        [<ffffffff81564296>] save_stack+0x46/0xd0
        [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
        [<ffffffff81560929>] kfree+0xd9/0x280
        [<ffffffff8214de6e>] usb_release_dev+0xde/0x110
        [<ffffffff81ef1846>] device_release+0x76/0x1e0
        ....
      
      It's the code trying to clear drvdata of the assigned usb_device where
      the usb_device itself was already released in usb_release_dev() after
      the disconnect callback.
      
      This patch fixes it by checking whether the code path is via the
      disconnect callback, i.e. chip->shutdown flag is set.
      
      Fixes: 79289e24 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
      Reported-and-tested-by: NShuah Khan <shuahkh@osg.samsung.com>
      Cc: <stable@vger.kernel.org> # v4.6+
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      6ff1a253
  18. 27 10月, 2016 1 次提交
  19. 13 10月, 2016 1 次提交
  20. 10 10月, 2016 1 次提交
  21. 26 9月, 2016 1 次提交
    • T
      ALSA: usb-line6: use the same declaration as definition in header for MIDI manufacturer ID · 8da08ca0
      Takashi Sakamoto 提交于
      Currently, usb-line6 module exports an array of MIDI manufacturer ID and
      usb-pod module uses it. However, the declaration is not the definition in
      common header. The difference is explicit length of array. Although
      compiler calculates it and everything goes well, it's better to use the
      same representation between definition and declaration.
      
      This commit fills the length of array for usb-line6 module. As a small
      good sub-effect, this commit suppress below warnings from static analysis
      by sparse v0.5.0.
      
      sound/usb/line6/driver.c:274:43: error: cannot size expression
      sound/usb/line6/driver.c:275:16: error: cannot size expression
      sound/usb/line6/driver.c:276:16: error: cannot size expression
      sound/usb/line6/driver.c:277:16: error: cannot size expression
      
      Fixes: 705ececd ("Staging: add line6 usb driver")
      Signed-off-by: NTakashi Sakamoto <o-takashi@sakamocchi.jp>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      8da08ca0
  22. 23 9月, 2016 1 次提交
    • A
      ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants · eb1a74b7
      Anssi Hannula 提交于
      The DragonFly quirk added in 42e3121d ("ALSA: usb-audio: Add a more
      accurate volume quirk for AudioQuest DragonFly") applies a custom dB map
      on the volume control when its range is reported as 0..50 (0 .. 0.2dB).
      
      However, there exists at least one other variant (hw v1.0c, as opposed
      to the tested v1.2) which reports a different non-sensical volume range
      (0..53) and the custom map is therefore not applied for that device.
      
      This results in all of the volume change appearing close to 100% on
      mixer UIs that utilize the dB TLV information.
      
      Add a fallback case where no dB TLV is reported at all if the control
      range is not 0..50 but still 0..N where N <= 1000 (3.9 dB). Also
      restrict the quirk to only apply to the volume control as there is also
      a mute control which would match the check otherwise.
      
      Fixes: 42e3121d ("ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly")
      Signed-off-by: NAnssi Hannula <anssi.hannula@iki.fi>
      Reported-by: NDavid W <regulars@d-dub.org.uk>
      Tested-by: NDavid W <regulars@d-dub.org.uk>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      eb1a74b7
  23. 21 9月, 2016 1 次提交
  24. 20 9月, 2016 6 次提交