A malicious USB device could feed in a large nr_rates value. This would
cause the subsequent call to kmemdup() to allocate a smaller buffer than
expected, leading to out-of-bounds access.
This patch validates the nr_rates value and reuses the limit introduced
in commit 4fa0e81b ("ALSA: usb-audio: fix possible hang and overflow
in parse_uac2_sample_rate_range()").
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A malicious USB device may feed in carefully crafted min/max/res values,
so that the inner loop in parse_uac2_sample_rate_range() could run for
a long time or even never terminate, e.g., given max = INT_MAX.
Also nr_rates could be a large integer, which causes an integer overflow
in the subsequent call to kmalloc() in parse_audio_format_rates_v2().
Thus, kmalloc() would allocate a smaller buffer than expected, leading
to a memory corruption.
To exploit the two vulnerabilities, an attacker needs physical access
to the machine to plug in a malicious USB device.
This patch makes two changes.
1) The type of "rate" is changed to unsigned int, so that the loop could
stop once "rate" is larger than INT_MAX.
2) Limit nr_rates to 1024.
Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
There are certain devices that are reportedly so slow that they need
more than 100 ms to handle control transfers. Therefore, increase the
timeout in mixer(_quirks).c to 1000 ms.
The timeout parameter of snd_usb_ctl_msg() is now constant, so we can
drop it.
Reported-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Just in case a prototype changes, we'll be warned. This also fixes a
sparse warning.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch adds support for the Terratec Aureon 7.1 USB which uses a
C-Media cm6206 and needs all the quirks already found in the past.
Signed-off-by: Wolfgang Breyha <wbreyha@gmx.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add support for the 24-bit audio I/Os of the Edirol SD-90 interface.
Reported-any-tested-by: Jim Grusendorf <alsa-user@grusendorf.ca>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The Audio Class v2 support code in 2.6.35 added checks for the
bInterfaceProtocol field. However, there are devices (usually those
detected by vendor-specific quirks) that do not have one of the
predefined values in this field, which made the driver reject them.
To fix this regression, restore the old behaviour, i.e., assume that
a device with an unknown bInterfaceProtocol field (other than
UAC_VERSION_2) has more or less UAC-v1-compatible descriptors.
[compile warning fixes by tiwai]
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: Daniel Mack <daniel@caiaq.de>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Gcc complains that ret might be used uninitialized:
sound/usb/format.c: In function ‘snd_usb_parse_audio_format’:
sound/usb/format.c:354: warning: ‘ret’ may be used uninitialized in this function
sound/usb/format.c:354: note: ‘ret’ was declared here
sound/usb/format.c:414: warning: ‘ret’ may be used uninitialized in this function
sound/usb/format.c:414: note: ‘ret’ was declared here
I suppose it could be uninitialized if there is ever a UAC_VERSION_3
released. Anyway this patch is worthwhile if only to silence the gcc
warning.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
As the control interface is now carried in struct snd_usb_audio, we can
simplify the API a little and also drop the private ctrlif field from
struct usb_mixer_interface.
Also remove a left-over function prototype in pcm.h.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A device may report its supported sample rates in ranges rather than in
discrete triplets. The code used to only parse the MIN field instead of
properly paying attention to the MAX and RES values.
Also, handle RES values of 1 correctly and announce a continous sample
rate range in this case.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Reported-by: Alex Lee <alexlee188@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Control messages directed to an interface must have the interface number
set in the lower 8 bits of wIndex. This wasn't done correctly for some
clock and mixer messages.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Reported-by: Alex Lee <alexlee188@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Audio devices which comply to the UAC2 standard can export complex clock
topologies in its descriptors and set up links between them.
The entities that are defined are
- clock sources, which define the end-leafs.
- clock selectors, which act as switch to select one out of many
possible clocks sources.
- clock multipliers, which have an input clock source, and act as clock
source again. They can be used to derive one clock from another.
All sample rate changes, clock validity queries and the like must go to
clock source elements, while clock selectors and multipliers can be used
as terminal clock source.
The following patch adds a parser for these elements and functions to
iterate over the tree and find the leaf nodes (clock sources).
The samplerate set functions were moved to the new clock.c file.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
-1 is not a good return value as it means -EPERM, "not permitted".
Choose -ENOTSUPP instead, which is what the code really wants to tell
its callers.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
No need for the private enum.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
- Split the audio.h file in two to clearly denote the differences
between the standards.
- Add many more defines to audio-v2.h. Most of them are not currently
used.
- Replaced a magic value with a proper define
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Change the parser to correctly handle v2 descriptors with multiple
format bits set.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
In preparation for USB audio 2.0 support, change the audioformat
structure so that it uses a bitmask to specify possible formats.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Clean up the usb audio driver by factoring out a lot of functions to
separate files. Code for procfs, quirks, urbs, format parsers etc all
got a new home now.
Moved almost all special quirk handling to quirks.c and introduced new
generic functions to handle them, so the exceptions do not pollute the
whole driver.
Renamed usbaudio.c to card.c because this is what it actually does now.
Renamed usbmidi.c to midi.c for namespace clarity.
Removed more things from usbaudio.h.
The non-standard drivers were adopted accordingly.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Xi Wang
Clemens Ladisch
Takashi Iwai
Daniel Mack
Wolfgang Breyha
Dan Carpenter
Daniel Mack
Stephen Rothwell