linux.git/sound/usb, branch v4.9

ALSA: usb-audio: Fix use-after-free of usb_device at disconnect

2016-11-14T21:05:04+00:00

The usb-audio driver implements the deferred device disconnection for
the device in use.  In this mode, the disconnection callback returns
immediately while the actual ALSA card object removal happens later
when all files get closed.  As Shuah reported, this code flow,
however, leads to a use-after-free, detected by KASAN:

 BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
 Write of size 8 by task pulseaudio/2244
 Call Trace:
  [] dump_stack+0x67/0x94
  [] kasan_object_err+0x21/0x70
  [] kasan_report_error+0x1fa/0x4e0
  [] ? kasan_slab_free+0x87/0xb0
  [] __asan_report_store8_noabort+0x43/0x50
  [] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
  [] __snd_device_free+0x12a/0x210
  [] snd_device_free_all+0x85/0xd0
  [] release_card_device+0x34/0x130
  [] device_release+0x76/0x1e0
  [] kobject_release+0x107/0x370
  .....
 Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
 Allocated:
  [] save_stack_trace+0x2b/0x50
  [] save_stack+0x46/0xd0
  [] kasan_kmalloc+0xad/0xe0
  [] kmem_cache_alloc_trace+0xfa/0x240
  [] usb_alloc_dev+0x57/0xc90
  [] hub_event+0xf1d/0x35f0
  ....
 Freed:
  [] save_stack_trace+0x2b/0x50
  [] save_stack+0x46/0xd0
  [] kasan_slab_free+0x71/0xb0
  [] kfree+0xd9/0x280
  [] usb_release_dev+0xde/0x110
  [] device_release+0x76/0x1e0
  ....

It's the code trying to clear drvdata of the assigned usb_device where
the usb_device itself was already released in usb_release_dev() after
the disconnect callback.

This patch fixes it by checking whether the code path is via the
disconnect callback, i.e. chip->shutdown flag is set.

Fixes: 79289e24194a ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
Reported-and-tested-by: Shuah Khan 
Cc:  # v4.6+
Signed-off-by: Takashi Iwai

ALSA: usb-audio: Add quirk for Syntek STK1160

2016-10-27T10:07:19+00:00

The stk1160 chip needs QUIRK_AUDIO_ALIGN_TRANSFER. This patch resolves
the issue reported on the mailing list
(http://marc.info/?l=linux-sound&m=139223599126215&w=2) and also fixes
bug 180071 (https://bugzilla.kernel.org/show_bug.cgi?id=180071).

Signed-off-by: Marcel Hasler 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: line6: fix a crash in line6_hwdep_write()

2016-10-12T18:10:23+00:00

The error checking here is messed up so we could end up dereferencing
-EFAULT.

Fixes: a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages')
Signed-off-by: Dan Carpenter 
Reviewed-by: Takashi Sakamoto 
Signed-off-by: Takashi Iwai

ALSA: line6: Fix POD X3 Live audio input

2016-10-10T10:07:29+00:00

The commit c039aaa77a7d1d9375665a8b59ec16dc7d23e259 was incomplete,
missing part of the setup for Live. This makes also audio input work,
in addition to audio output.

Fixes: c039aaa77a7d1d9375665a8b59ec16dc7d23e259
Reported-by: Eddi De Pieri 
Signed-off-by: Andrej Krutak 
Signed-off-by: Takashi Iwai

Merge branch 'for-linus' into for-next

2016-09-29T16:20:14+00:00

ALSA: usb-line6: use the same declaration as definition in header for MIDI manufacturer ID

2016-09-25T20:17:45+00:00

Currently, usb-line6 module exports an array of MIDI manufacturer ID and
usb-pod module uses it. However, the declaration is not the definition in
common header. The difference is explicit length of array. Although
compiler calculates it and everything goes well, it's better to use the
same representation between definition and declaration.

This commit fills the length of array for usb-line6 module. As a small
good sub-effect, this commit suppress below warnings from static analysis
by sparse v0.5.0.

sound/usb/line6/driver.c:274:43: error: cannot size expression
sound/usb/line6/driver.c:275:16: error: cannot size expression
sound/usb/line6/driver.c:276:16: error: cannot size expression
sound/usb/line6/driver.c:277:16: error: cannot size expression

Fixes: 705ececd1c60 ("Staging: add line6 usb driver")
Signed-off-by: Takashi Sakamoto 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants

2016-09-23T06:32:18+00:00

The DragonFly quirk added in 42e3121d90f4 ("ALSA: usb-audio: Add a more
accurate volume quirk for AudioQuest DragonFly") applies a custom dB map
on the volume control when its range is reported as 0..50 (0 .. 0.2dB).

However, there exists at least one other variant (hw v1.0c, as opposed
to the tested v1.2) which reports a different non-sensical volume range
(0..53) and the custom map is therefore not applied for that device.

This results in all of the volume change appearing close to 100% on
mixer UIs that utilize the dB TLV information.

Add a fallback case where no dB TLV is reported at all if the control
range is not 0..50 but still 0..N where N <= 1000 (3.9 dB). Also
restrict the quirk to only apply to the volume control as there is also
a mute control which would match the check otherwise.

Fixes: 42e3121d90f4 ("ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly")
Signed-off-by: Anssi Hannula 
Reported-by: David W 
Tested-by: David W 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: line6: snd-usb-line6 depends on CONFIG_SND_HWDEP

2016-09-21T12:36:22+00:00

ERROR: "snd_hwdep_new" [sound/usb/line6/snd-usb-line6.ko] undefined!
scripts/Makefile.modpost:91: recipe for target '__modpost' failed
make[1]: *** [__modpost] Error 1

Fixes: a16039cbf1a1 ('ALSA: line6: Add hwdep interface to access the POD control messages')
Signed-off-by: Valdis Kletnieks 
Reviewed-by: Takashi Sakamoto 
Signed-off-by: Takashi Iwai

ALSA: line6: fix ifnullfree.cocci warnings

2016-09-20T10:53:23+00:00

sound/usb/line6/driver.c:484:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values.

 NULL check before some freeing functions is not needed.

 Based on checkpatch warning
 "kfree(NULL) is safe this check is probably not required"
 and kfreeaddr.cocci by Julia Lawall.

Generated by: scripts/coccinelle/free/ifnullfree.cocci

CC: Andrej Krutak 
Signed-off-by: Fengguang Wu 
Signed-off-by: Takashi Iwai

ALSA: line6: Add hwdep interface to access the POD control messages

2016-09-19T21:03:47+00:00

We must do it this way, because e.g. POD X3 won't play any sound unless
the host listens on the bulk EP, so we cannot export it only via libusb.

The driver currently doesn't use the bulk EP messages in other way,
in future it could e.g. sense/modify volume(s).

Signed-off-by: Andrej Krutak 
Signed-off-by: Takashi Iwai