The usb-audio driver implements the deferred device disconnection for
the device in use. In this mode, the disconnection callback returns
immediately while the actual ALSA card object removal happens later
when all files get closed. As Shuah reported, this code flow,
however, leads to a use-after-free, detected by KASAN:
BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
Write of size 8 by task pulseaudio/2244
Call Trace:
[<ffffffff81b31473>] dump_stack+0x67/0x94
[<ffffffff81564ef1>] kasan_object_err+0x21/0x70
[<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
[<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
[<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
[<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
[<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
[<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
[<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
[<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
[<ffffffff8242cae4>] release_card_device+0x34/0x130
[<ffffffff81ef1846>] device_release+0x76/0x1e0
[<ffffffff81b37ad7>] kobject_release+0x107/0x370
.....
Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
Allocated:
[<ffffffff810804eb>] save_stack_trace+0x2b/0x50
[<ffffffff81564296>] save_stack+0x46/0xd0
[<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
[<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
[<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
[<ffffffff8216349d>] hub_event+0xf1d/0x35f0
....
Freed:
[<ffffffff810804eb>] save_stack_trace+0x2b/0x50
[<ffffffff81564296>] save_stack+0x46/0xd0
[<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
[<ffffffff81560929>] kfree+0xd9/0x280
[<ffffffff8214de6e>] usb_release_dev+0xde/0x110
[<ffffffff81ef1846>] device_release+0x76/0x1e0
....
It's the code trying to clear drvdata of the assigned usb_device where
the usb_device itself was already released in usb_release_dev() after
the disconnect callback.
This patch fixes it by checking whether the code path is via the
disconnect callback, i.e. chip->shutdown flag is set.
Fixes: 79289e2419 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The error checking here is messed up so we could end up dereferencing
-EFAULT.
Fixes: a16039cbf1 ('ALSA: line6: Add hwdep interface to access the POD control messages')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The commit c039aaa77a was incomplete,
missing part of the setup for Live. This makes also audio input work,
in addition to audio output.
Fixes: c039aaa77a
Reported-by: Eddi De Pieri <eddi@depieri.net>
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Currently, usb-line6 module exports an array of MIDI manufacturer ID and
usb-pod module uses it. However, the declaration is not the definition in
common header. The difference is explicit length of array. Although
compiler calculates it and everything goes well, it's better to use the
same representation between definition and declaration.
This commit fills the length of array for usb-line6 module. As a small
good sub-effect, this commit suppress below warnings from static analysis
by sparse v0.5.0.
sound/usb/line6/driver.c:274:43: error: cannot size expression
sound/usb/line6/driver.c:275:16: error: cannot size expression
sound/usb/line6/driver.c:276:16: error: cannot size expression
sound/usb/line6/driver.c:277:16: error: cannot size expression
Fixes: 705ececd1c ("Staging: add line6 usb driver")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The DragonFly quirk added in 42e3121d90 ("ALSA: usb-audio: Add a more
accurate volume quirk for AudioQuest DragonFly") applies a custom dB map
on the volume control when its range is reported as 0..50 (0 .. 0.2dB).
However, there exists at least one other variant (hw v1.0c, as opposed
to the tested v1.2) which reports a different non-sensical volume range
(0..53) and the custom map is therefore not applied for that device.
This results in all of the volume change appearing close to 100% on
mixer UIs that utilize the dB TLV information.
Add a fallback case where no dB TLV is reported at all if the control
range is not 0..50 but still 0..N where N <= 1000 (3.9 dB). Also
restrict the quirk to only apply to the volume control as there is also
a mute control which would match the check otherwise.
Fixes: 42e3121d90 ("ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly")
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Reported-by: David W <regulars@d-dub.org.uk>
Tested-by: David W <regulars@d-dub.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/usb/line6/driver.c:484:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values.
NULL check before some freeing functions is not needed.
Based on checkpatch warning
"kfree(NULL) is safe this check is probably not required"
and kfreeaddr.cocci by Julia Lawall.
Generated by: scripts/coccinelle/free/ifnullfree.cocci
CC: Andrej Krutak <dev@andree.sk>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
We must do it this way, because e.g. POD X3 won't play any sound unless
the host listens on the bulk EP, so we cannot export it only via libusb.
The driver currently doesn't use the bulk EP messages in other way,
in future it could e.g. sense/modify volume(s).
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Only initialize PCM for POD HD devices that support it.
No POD HD seems to support MIDI, thus drop the initialization.
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This includes audio in/out and basic initialization via control EP (emulates
what original driver does). The initialization is done similarly to original
POD, firmware and serial IDs are read and exported via sysfs.
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Not all PODs use MIDI via USB data interface, thus allow avoiding
that code and instead using direct processing.
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
POD X3 can initialize similarly to older PODs, but it doesn't have the MIDI
interface. Instead, configuration is done via proprietary bulk EP messages.
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
E.g. POD X3 seems to require playback data to be sent to it to generate
capture data. Otherwise the device stalls and doesn't send any more capture
data until it's reset.
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Splits max_packet_size to max_packet_size_in/out (e.g. for
different channel counts).
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This has two parts:
* intervals_per_second setup
(high speed needs 8000, instead of 1000)
* iso_buffers setup (count of iso buffers depends on
USB speed, 2 is not enough for high speed)
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This basically changes LINE6_ISO_BUFFERS constant to a configurable
iso_buffers property.
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Avoid getting sample rate on B850V3 CP2114 as it is unsupported and
causes noisy "current rate is different from the runtime rate" messages
when playback starts.
Signed-off-by: Ken Lin <ken.lin@advantech.com.tw>
Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
kmalloc already print similar error once failing to alloc
enough memory, so let's remove this dump here.
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Users of devices affected by the Tenor feedback data error report
buffer underruns, even with the +/- 0x1.0000 quirk applied.
Compensating the error with 0xf000 instead seems to reliably fix
that issue.
See
https://sourceforge.net/p/alsa/mailman/message/35230259/
Reported-and-tested-by: Norman Nolte <norman.nolte@gmx.net>
Reported-and-tested-by: Thomas Gresens <T.Gresens@intershop.de>
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The quirk seems to be necessary not only for TEAC UD-H01 devices, but to
more that are based on the Tenor 8802TL chipset. Devices built by T+A
are affected too, and they apparently all use the same USB PID:PID.
Extend the quirky handling for that device as well, and rename the
quirks flag.
Reported-and-tested-by: Thomas Gresens <T.Gresens@intershop.de>
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
That's a quirk, after all, so move it where to all the other quirks
live.
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The commit 02fc76f6a changed base of the sysfs attributes from device to card.
The "show" callbacks dereferenced wrong objects because of this.
Fixes: 02fc76f6a7 ('ALSA: line6: Create sysfs via snd_card_add_dev_attr()')
Cc: <stable@vger.kernel.org> # v4.0+
Reviewed-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
If there's an error, pcm is released in line6_pcm_acquire already.
Fixes: 247d95ee6d ('ALSA: line6: Handle error from line6_pcm_acquire()')
Cc: <stable@vger.kernel.org> # v4.0+
Reviewed-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Andrej Krutak <dev@andree.sk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
kmalloc will print enough information in case of failure.
Signed-off-by: Wolfram Sang <wsa-dev@sang-engineering.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The ELP HD USB Camera (05a3:9420) needs this quirk for suppressing
the unsupported sample rate inquiry.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=98481
Cc: <stable@vger.kernel.org>
Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
VF0610 does not support reading the sample rate which leads to many
lines of "cannot get freq at ep 0x82". This patch adds the USB ID
(0x041E:4080) to snd_usb_get_sample_rate_quirk() list.
Signed-off-by: Piotr Karasinski <peter.karasinski@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
To allow for structure randomisation, replace the in order struct
initialisation style with explicit field style.
The Coccinelle semantic patch used to make this change is as follows:
@decl@
identifier i1,fld;
type T;
field list[n] fs;
@@
struct i1 {
fs
T fld;
...};
@@
identifier decl.i1,i2,decl.fld;
expression e;
position bad.p, bad.fix;
@@
struct i1 i2@p = { ...,
+ .fld = e
- e@fix
,...};
Signed-off-by: Amitoj Kaur Chawla <amitoj1606@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Phoenix Audio has yet another device with another id (even a different
vendor id, 0556:0014) that requires the same quirk for the sample
rate.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=110221
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Phoenix Audio MT202pcs (1de7:0114) and MT202exe (1de7:0013) need the
same workaround as TMX320 for avoiding the firmware bug. It fixes the
frequent error about the sample rate inquiries and the slow device
probe as consequence.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=117321
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
There are many USB audio devices with buggy firmware that don't react
with the sample rate reading properly. This often results in the
flood of error messages and slowing down the operation.
The sample rate read back is basically only for confirming the sample
rate setup, and it's not critically important. As a compromise, in
this patch, we stop the sample rate read back once when the device
gives errors more than tolerance (twice, as of now). This should
improve most of error cases while we still can catch the firmware
bugginess.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
we've had a very calm development cycle, so far. Here are the few
fixes for HD-audio and USB-audio, all of which are small and easy.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJXD2IxAAoJEGwxgFQ9KSmkckEQAJUw0T+6LGzvt91R1NUTvVc2
N5UAVWblefXL32siYFVNQ7H1PJMrCLdgMb6jBXUYvWxSPKtn37v/RAdSVC3LFTq1
V8tbmEkMZJzNECTeLH/wnj4reRjXO/hS1GibKx7ZdPGEaYWZV+T0kHkufu7s/KmC
THNspUwchfgcKc4BNkVm/ateypkPbuhA/hq6jB+XwjSE46AaZYVvDwy7uIbSEJhL
kODppXrOLp0qjUtU2T+vZXFghmv2d4FCt42R80KNwREQMzq1KNprP7uG64sz4hFw
Er/OTuhRezBssgr2xHvqF0mFQAjSMSJDB2j3tQGOaWjWR0aDHM8KKP9qjl4iWQ9e
FJ7fxmiPJqEd4Ixm+2KZXEfWk8dpF+d/6tPgi43oxz3svKwMKbS4CRANIOJvTxvQ
CCZkyqeySw6RR0OSXb2wwQlv39CEnAX872JpLpwH7kWLn27q8Prxojm5SH6iFJPv
fHVgDw9vZ2QWE6fN2sPZFP/4TQ39XWptt+gTFV6r2aX9OkYWv4MFGdypMxOOiG2P
TnyHIczqwjz/9f8OaI2F0U+bXmFC6IaC8tTBht1abhMcqe3jfpJDWccuHX7QNDGn
6Kcwb1pfgylk2NqAf2jc+X8LPwI/mqtMRNsYu6hOedVSwuSF76xDlafhdyfS8Ygp
IivXk+F+YdpX85fwVffp
=PYqq
-----END PGP SIGNATURE-----
Merge tag 'sound-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"We've had a very calm development cycle, so far. Here are the few
fixes for HD-audio and USB-audio, all of which are small and easy"
* tag 'sound-4.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: hda - Fix inconsistent monitor_present state until repoll
ALSA: hda - Fix regression of monitor_present flag in eld proc file
ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock
ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s
ALSA: sscape: Use correct format identifier for size_t
ALSA: usb-audio: Add a quirk for Plantronics BT300
ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320
ALSA: hda - Bind with i915 only when Intel graphics is present
This is Dell usb dock audio workaround.
It was fixed the master volume keep lower.
[Some background: the patch essentially skips the controls of a couple
of FU volumes. Although the firmware exposes the dB and the value
information via the usb descriptor, changing the values (we set the
min volume as default) screws up the device. Although this has been
fixed in the newer firmware, the devices are shipped with the old
firmware, thus we need the workaround in the driver side. -- tiwai]
Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
miniDSP USBStreamer UAC2 devices send clock validity changes with the
control field set to zero. The current interrupt handler ignores all
packets if the control field does not match the mixer element's, but
it really should only do that in case that field is needed to
distinguish multiple elements with the same ID.
This patch implements a logic that lets notifications packets pass
if the element ID is unique for a given device.
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
UAC2 specifies clock sources that optionally have validity controls.
This patch exposes them as mixer controls, so they can be read (and
at least in theory even be written) by userspace applications in order
to make clock selection policy decisions.
This implementation does nothing if the device is not UAC2 compliant,
or if the clock source does not define said validity control bits.
Tested with a miniDSP USBStreamer (0x2752/0x0016).
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Plantronics BT300 does not support reading the sample rate which leads
to many lines of "cannot get freq at ep 0x1". This patch adds the USB
ID of the BT300 to quirks.c and avoids those error messages.
Signed-off-by: Dennis Kadioglu <denk@post.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABAgAGBQJXAx6uAAoJEAhfPr2O5OEVOVgP/3MYTUiaBau9xs3oPtY6HEFr
JpPs6jblmutGXhosrP/+LBytoufXCEmlXEUyjgMQIDlQqDe2u3xIIKvliFTxtN4n
LqUTqs5lZFDOiRcIitSLeDW0zTYJsWiTvM8w5o0+wdtdf2wY8VXoIM/kAPUfWHxl
c9LHQ+A4PofJ/FkMF0vy7aTr0zm4NALQH9OW6ot6NzNW6F3hT9pTy6GKFITnP0cc
ALHkv2N8Wd5nn9tmxBlXjSPoClfEypMjPzxB32EmZstCGS61tX5coV+2m6+T+ik6
Yausr63EKQAsRF3LpON7AjcexTpFNcWj8HdsJFU9+GpbjdAPO3tfQfRdoSFVXGKv
b4WVQkaFOULKWIgrA1pm1NjLMMMcBof1gel1rPBrOc6Hd1YSxSzZzYKWCyFtsJHf
3bTajmTn7Zw+d5uUXYGN9T4HWLzzupFZYIqS7ggdXf78mk2G7f0cew1egkxPuS4D
mBM8LLep287SdbZ2M5F9B/7ua3yLiR4Z1/nHpnWjE/aqFbU1Qy4Rn5had6OchP3I
YgqucGSORTPNtC+lkn9BKeL3hkucn3+tDW9vcWuok5eOQm7OPyveWE5AHOCeWI04
oNnvZNsY91wpHEc1AgywcNE7kNJienpe9Y2MMhFn9A9ORXXs1scfbhR1uOUW+1Rb
jKYjjIcm4izDykPMZUPs
=eZp5
-----END PGP SIGNATURE-----
Merge tag 'media/v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab:
"Some bug fixes on au0828 and snd-usb-audio:
- the au0828+snd-usb-audio MC patch broke several things and produced
some race conditions. Better to revert the patches, and re-work on
them for a next version
- fix a regression at tuner disable links logic
- properly handle dev_state as a bitmask"
* tag 'media/v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
[media] Revert "[media] media: au0828 change to use Managed Media Controller API"
[media] Revert "[media] sound/usb: Use Media Controller API to share media resources"
[media] au0828: Fix dev_state handling
[media] au0828: fix au0828_v4l2_close() dev_state race condition
[media] media: au0828 fix to clear enable/disable/change source handlers
[media] v4l2-mc: cleanup a warning
[media] au0828: disable tuner links and cache tuner/decoder
Takashi Iwai
Marcel Hasler
Dan Carpenter
Andrej Krutak
Takashi Sakamoto
Anssi Hannula
Valdis Kletnieks
kbuild test robot
Ken Lin
Shawn Lin
Daniel Mack
Wolfram Sang
Vittorio Gambaletta (VittGam)
Piotr Karasinski
Kazuki Oikawa
Amitoj Kaur Chawla
Oliver Neukum
Linus Torvalds
Kailang Yang
Dennis Kadioglu