<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/usb/gadget/function/u_audio.c, branch v5.13</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>usb: gadget: u_audio: convert to strscpy</title>
<updated>2021-03-23T11:56:08+00:00</updated>
<author>
<name>Ruslan Bilovol</name>
<email>ruslan.bilovol@gmail.com</email>
</author>
<published>2021-03-01T13:05:36+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=d23922fcac48e57f3bf00b1dc4c9c0f5b4f6fe59'/>
<id>d23922fcac48e57f3bf00b1dc4c9c0f5b4f6fe59</id>
<content type='text'>
Usage of strlcpy in Linux Kernel has been recently
deprecated [1], convert driver to strscpy

[1] https://lore.kernel.org/lkml/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/

Signed-off-by: Ruslan Bilovol &lt;ruslan.bilovol@gmail.com&gt;
Link: https://lore.kernel.org/r/1614603943-11668-2-git-send-email-ruslan.bilovol@gmail.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Usage of strlcpy in Linux Kernel has been recently
deprecated [1], convert driver to strscpy

[1] https://lore.kernel.org/lkml/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/

Signed-off-by: Ruslan Bilovol &lt;ruslan.bilovol@gmail.com&gt;
Link: https://lore.kernel.org/r/1614603943-11668-2-git-send-email-ruslan.bilovol@gmail.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: u_audio: clean up locking</title>
<updated>2021-01-18T17:43:09+00:00</updated>
<author>
<name>Jerome Brunet</name>
<email>jbrunet@baylibre.com</email>
</author>
<published>2021-01-18T08:49:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=d70f7598c4583c6326cbd499b66bc9b3dd821e12'/>
<id>d70f7598c4583c6326cbd499b66bc9b3dd821e12</id>
<content type='text'>
snd_pcm_stream_lock() is held when the ALSA .trigger() callback is called.
The lock of 'struct uac_rtd_params' is not necessary since all its locking
operation are done under the snd_pcm_stream_lock() too.

Also, usb_request .complete() is called with irqs disabled, so saving and
restoring the irqs is not necessary.

Acked-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Link: https://lore.kernel.org/r/20210118084931.322861-1-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
snd_pcm_stream_lock() is held when the ALSA .trigger() callback is called.
The lock of 'struct uac_rtd_params' is not necessary since all its locking
operation are done under the snd_pcm_stream_lock() too.

Also, usb_request .complete() is called with irqs disabled, so saving and
restoring the irqs is not necessary.

Acked-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Link: https://lore.kernel.org/r/20210118084931.322861-1-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: u_audio: remove struct uac_req</title>
<updated>2021-01-18T17:43:09+00:00</updated>
<author>
<name>Jerome Brunet</name>
<email>jbrunet@baylibre.com</email>
</author>
<published>2021-01-18T08:46:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=2986511780438274646f63a171ac60e61313032c'/>
<id>2986511780438274646f63a171ac60e61313032c</id>
<content type='text'>
'struct uac_req' purpose is to link 'struct usb_request' to the
corresponding 'struct uac_rtd_params'. However member req is never
used. Using the context of the usb request, we can keep track of the
corresponding 'struct uac_rtd_params' just as well, without allocating
extra memory.

Acked-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Link: https://lore.kernel.org/r/20210118084642.322510-4-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
'struct uac_req' purpose is to link 'struct usb_request' to the
corresponding 'struct uac_rtd_params'. However member req is never
used. Using the context of the usb request, we can keep track of the
corresponding 'struct uac_rtd_params' just as well, without allocating
extra memory.

Acked-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Link: https://lore.kernel.org/r/20210118084642.322510-4-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: u_audio: factorize ssize to alsa fmt conversion</title>
<updated>2021-01-18T17:43:09+00:00</updated>
<author>
<name>Jerome Brunet</name>
<email>jbrunet@baylibre.com</email>
</author>
<published>2021-01-18T08:46:40+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=25dbd75dd506cd19ab4405a7ef0816042fe6892f'/>
<id>25dbd75dd506cd19ab4405a7ef0816042fe6892f</id>
<content type='text'>
Factorize format related code common to the capture and playback path.

Acked-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Link: https://lore.kernel.org/r/20210118084642.322510-3-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Factorize format related code common to the capture and playback path.

Acked-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Link: https://lore.kernel.org/r/20210118084642.322510-3-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: u_audio: Free requests only after callback</title>
<updated>2021-01-18T17:43:09+00:00</updated>
<author>
<name>Jack Pham</name>
<email>jackp@codeaurora.org</email>
</author>
<published>2021-01-18T08:46:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=7de8681be2cde9f6953d3be1fa6ce05f9fe6e637'/>
<id>7de8681be2cde9f6953d3be1fa6ce05f9fe6e637</id>
<content type='text'>
As per the kernel doc for usb_ep_dequeue(), it states that "this
routine is asynchronous, that is, it may return before the completion
routine runs". And indeed since v5.0 the dwc3 gadget driver updated
its behavior to place dequeued requests on to a cancelled list to be
given back later after the endpoint is stopped.

The free_ep() was incorrectly assuming that a request was ready to
be freed after calling dequeue which results in a use-after-free
in dwc3 when it traverses its cancelled list. Fix this by moving
the usb_ep_free_request() call to the callback itself in case the
ep is disabled.

Fixes: eb9fecb9e69b0 ("usb: gadget: f_uac2: split out audio core")
Reported-and-tested-by: Ferry Toth &lt;fntoth@gmail.com&gt;
Reviewed-and-tested-by: Peter Chen &lt;peter.chen@nxp.com&gt;
Acked-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Jack Pham &lt;jackp@codeaurora.org&gt;
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Link: https://lore.kernel.org/r/20210118084642.322510-2-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
As per the kernel doc for usb_ep_dequeue(), it states that "this
routine is asynchronous, that is, it may return before the completion
routine runs". And indeed since v5.0 the dwc3 gadget driver updated
its behavior to place dequeued requests on to a cancelled list to be
given back later after the endpoint is stopped.

The free_ep() was incorrectly assuming that a request was ready to
be freed after calling dequeue which results in a use-after-free
in dwc3 when it traverses its cancelled list. Fix this by moving
the usb_ep_free_request() call to the callback itself in case the
ep is disabled.

Fixes: eb9fecb9e69b0 ("usb: gadget: f_uac2: split out audio core")
Reported-and-tested-by: Ferry Toth &lt;fntoth@gmail.com&gt;
Reviewed-and-tested-by: Peter Chen &lt;peter.chen@nxp.com&gt;
Acked-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Jack Pham &lt;jackp@codeaurora.org&gt;
Signed-off-by: Jerome Brunet &lt;jbrunet@baylibre.com&gt;
Link: https://lore.kernel.org/r/20210118084642.322510-2-jbrunet@baylibre.com
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: u_audio: Fix high-speed max packet size</title>
<updated>2020-02-11T06:45:45+00:00</updated>
<author>
<name>John Keeping</name>
<email>john@metanate.com</email>
</author>
<published>2020-01-17T10:40:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=904967c60d87393a3708fed2324b684cdb79b1ee'/>
<id>904967c60d87393a3708fed2324b684cdb79b1ee</id>
<content type='text'>
Prior to commit eb9fecb9e69b ("usb: gadget: f_uac2: split out audio
core") the maximum packet size was calculated only from the high-speed
descriptor but now we use the largest of the full-speed and high-speed
descriptors.

This is correct, but the full-speed value is likely to be higher than
that for high-speed and this leads to submitting requests for OUT
transfers (received by the gadget) which are larger than the endpoint's
maximum packet size.  These are rightly rejected by the gadget core.

config_ep_by_speed() already sets up the correct maximum packet size for
the enumerated speed in the usb_ep structure, so we can simply use this
instead of the overall value that has been used to allocate buffers for
requests.

Note that the minimum period for ALSA is still set from the largest
value, and this is unavoidable because it's possible to open the audio
device before the gadget has been enumerated.

Tested-by: Pavel Hofman  &lt;pavel.hofman@ivitera.com&gt;
Signed-off-by: John Keeping &lt;john@metanate.com&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Prior to commit eb9fecb9e69b ("usb: gadget: f_uac2: split out audio
core") the maximum packet size was calculated only from the high-speed
descriptor but now we use the largest of the full-speed and high-speed
descriptors.

This is correct, but the full-speed value is likely to be higher than
that for high-speed and this leads to submitting requests for OUT
transfers (received by the gadget) which are larger than the endpoint's
maximum packet size.  These are rightly rejected by the gadget core.

config_ep_by_speed() already sets up the correct maximum packet size for
the enumerated speed in the usb_ep structure, so we can simply use this
instead of the overall value that has been used to allocate buffers for
requests.

Note that the minimum period for ALSA is still set from the largest
value, and this is unavoidable because it's possible to open the audio
device before the gadget has been enumerated.

Tested-by: Pavel Hofman  &lt;pavel.hofman@ivitera.com&gt;
Signed-off-by: John Keeping &lt;john@metanate.com&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: f_uac2: fix packet size calculation</title>
<updated>2020-01-15T09:39:23+00:00</updated>
<author>
<name>John Keeping</name>
<email>john@metanate.com</email>
</author>
<published>2020-01-10T11:28:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=6b02af3465ee11b63a938b13bddbf7ecd92860f3'/>
<id>6b02af3465ee11b63a938b13bddbf7ecd92860f3</id>
<content type='text'>
The packet size for USB audio must always be a multiple of the frame
size, otherwise we are transmitting a partial frame which omits some
channels (and these end up at the wrong offset in the next packet).
Furthermore, it breaks the residue handling such that we end up trying
to send a packet exceeding the maximum packet size for the endpoint.

Signed-off-by: John Keeping &lt;john@metanate.com&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The packet size for USB audio must always be a multiple of the frame
size, otherwise we are transmitting a partial frame which omits some
channels (and these end up at the wrong offset in the next packet).
Furthermore, it breaks the residue handling such that we end up trying
to send a packet exceeding the maximum packet size for the endpoint.

Signed-off-by: John Keeping &lt;john@metanate.com&gt;
Signed-off-by: Felipe Balbi &lt;balbi@kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: u_audio: Drop superfluous ioctl PCM ops</title>
<updated>2019-12-17T15:24:12+00:00</updated>
<author>
<name>Takashi Iwai</name>
<email>tiwai@suse.de</email>
</author>
<published>2019-12-10T14:18:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=fcc84698291203f6588598be417b3ac58d2561d3'/>
<id>fcc84698291203f6588598be417b3ac58d2561d3</id>
<content type='text'>
PCM core deals the empty ioctl field now as default.
Let's kill the redundant lines.

Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Link: https://lore.kernel.org/r/20191210141822.18705-3-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
PCM core deals the empty ioctl field now as default.
Let's kill the redundant lines.

Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Link: https://lore.kernel.org/r/20191210141822.18705-3-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: u_audio: Use managed buffer allocation</title>
<updated>2019-12-17T15:24:11+00:00</updated>
<author>
<name>Takashi Iwai</name>
<email>tiwai@suse.de</email>
</author>
<published>2019-12-10T14:18:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=d27ab1e60970a6a32a0f8b3287f3463e20d68909'/>
<id>d27ab1e60970a6a32a0f8b3287f3463e20d68909</id>
<content type='text'>
Clean up the driver with the new managed buffer allocation API.
The hw_params and hw_free callbacks became superfluous and dropped.

Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Link: https://lore.kernel.org/r/20191210141822.18705-2-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Clean up the driver with the new managed buffer allocation API.
The hw_params and hw_free callbacks became superfluous and dropped.

Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
Link: https://lore.kernel.org/r/20191210141822.18705-2-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>usb: gadget: u_audio: Remove superfluous snd_dma_continuous_data()</title>
<updated>2019-11-09T17:04:18+00:00</updated>
<author>
<name>Takashi Iwai</name>
<email>tiwai@suse.de</email>
</author>
<published>2019-11-04T13:36:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=67b2945d632328fa0245279e8281e34bf1c78ae2'/>
<id>67b2945d632328fa0245279e8281e34bf1c78ae2</id>
<content type='text'>
The recent change (commit 08422d2c559d: "ALSA: memalloc: Allow NULL
device for SNDRV_DMA_TYPE_CONTINUOUS type") made the PCM preallocation
helper accepting NULL as the device pointer for the default usage.
Drop the snd_dma_continuous_data() usage that became superfluous from
the callers.

Acked-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Link: https://lore.kernel.org/r/20191108164214.611-1-tiwai@suse.de
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The recent change (commit 08422d2c559d: "ALSA: memalloc: Allow NULL
device for SNDRV_DMA_TYPE_CONTINUOUS type") made the PCM preallocation
helper accepting NULL as the device pointer for the default usage.
Drop the snd_dma_continuous_data() usage that became superfluous from
the callers.

Acked-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Link: https://lore.kernel.org/r/20191108164214.611-1-tiwai@suse.de
Signed-off-by: Takashi Iwai &lt;tiwai@suse.de&gt;
</pre>
</div>
</content>
</entry>
</feed>
