The last remaining usage of strlcpy() in USB-audio driver is the setup
of the card longname string. Basically we need to know whether any
non-empty string is set or not, and no real length is needed.
Refactor the code and use strscpy() instead. After this change,
strlcpy() is gone from all sound/* code.
Link: https://lore.kernel.org/r/20210115100437.20906-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The current endpoint handling assumed (more or less) a unique 1:1
relation between the endpoint and the iface/altset. The exception was
the sync EP without the implicit feedback which has usually the
secondary EP of the same altset. This works fine for most devices,
but it turned out that some unusual devices like Pinoeer's ones have
both playback and capture endpoints in the same iface/altsetting and
use both for the implicit feedback mode. For handling such a case, we
need to extend the endpoint management to take the shared interface
into account.
This patch does that: it adds a new object snd_usb_iface_ref for
managing the reference counts of the each USB interface that is used
by each endpoint. The interface setup is performed only once for the
(sharing) endpoints, and the doubly initialization is avoided.
Along with this, the resource release of endpoints and interface
refcounts are put into a single function, snd_usb_endpoint_free_all()
instead of looping in the caller side.
Fixes: bf6313a0ff ("ALSA: usb-audio: Refactor endpoint management")
Link: https://lore.kernel.org/r/20210108075219.21463-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
strlcpy is deprecated. see: Documentation/process/deprecated.rst
Change the calls that do not use the strlcpy return value to the
preferred strscpy.
Done with cocci script:
@@
expression e1, e2, e3;
@@
- strlcpy(
+ strscpy(
e1, e2, e3);
This cocci script leaves the instances where the return value is
used unchanged.
After this patch, sound/ has 3 uses of strlcpy() that need to be
manually inspected for conversion and changed one day.
$ git grep -w strlcpy sound/
sound/usb/card.c: len = strlcpy(card->longname, s, sizeof(card->longname));
sound/usb/mixer.c: return strlcpy(buf, p->name, buflen);
sound/usb/mixer.c: return strlcpy(buf, p->names[index], buflen);
Miscellenea:
o Remove trailing whitespace in conversion of sound/core/hwdep.c
Link: https://lore.kernel.org/lkml/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/
Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/22b393d1790bb268769d0bab7bacf0866dcb0c14.camel@perches.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A new module option, implicit_fb, is added to specify the driver
looking for the implicit feedback sync. This can be useful for a
device that could be working better in the implicit feed back mode and
user wants to test it quickly. When this works, we can add the quirk
entry easily.
Tested-by: Keith Milner <kamilner@superlative.org>
Tested-by: Dylan Robinson <dylan_robinson@motu.com>
Link: https://lore.kernel.org/r/20201123085347.19667-40-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Some fields like interface and alt_idx in snd_usb_substream are mostly
useless now as they can be referred via either cur_audiofmt or
data_endpoint assigned to the substream. Drop those, and also assure
the concurrency about the access of cur_audiofmt field.
Tested-by: Keith Milner <kamilner@superlative.org>
Tested-by: Dylan Robinson <dylan_robinson@motu.com>
Link: https://lore.kernel.org/r/20201123085347.19667-31-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This is an intensive surgery for the endpoint and stream management
for achieving more robust and clean code.
The goals of this patch are:
- More clear endpoint resource changes
- The interface altsetting control in a single place
Below are brief description of the whole changes.
First off, most of the endpoint operations are moved into endpoint.c,
so that the snd_usb_endpoint object is only referred in other places.
The endpoint object is acquired and released via the new functions
snd_usb_endpoint_open() and snd_usb_endpoint_close() that are called
at PCM hw_params and hw_free callbacks, respectively. Those are
ref-counted and EPs can manage the multiple opens.
The open callback receives the audioformat and hw_params arguments,
and those are used for initializing the EP parameters; especially the
endpoint, interface and altset numbers are read from there, as well as
the PCM parameters like the format, rate and channels. Those are
stored in snd_usb_endpoint object. If it's the secondary open, the
function checks whether the given parameters are compatible with the
already opened EP setup, too.
The coupling with a sync EP (including an implicit feedback sync) is
done by the sole snd_usb_endpoint_set_sync() call.
The configuration of each endpoint is done in a single shot via
snd_usb_endpoint_configure() call. This is the place where most of
PCM configurations are done. A few flags and special handling in the
snd_usb_substream are dropped along with this change.
A significant difference wrt the configuration from the previous code
is the order of USB host interface setups. Now the interface is
always disabled at beginning and (re-)enabled at the last step of
snd_usb_endpoint_configure(), in order to be compliant with the
standard UAC2/3. For UAC1, the interface is set before the parameter
setups since there seem devices that require it (e.g. Yamaha THR10),
just like how it was done in the previous driver code.
The start/stop are almost same as before, also single-shots. The URB
callbacks need to be set via snd_usb_endpoint_set_callback() like the
previous code at the trigger phase, too.
Finally, the flag for the re-setup is set at the device suspend
through the full EP list, instead of PCM trigger. This catches the
overlooked cases where the PCM hasn't been running yet but the device
needs the full setup after resume.
Tested-by: Keith Milner <kamilner@superlative.org>
Tested-by: Dylan Robinson <dylan_robinson@motu.com>
Link: https://lore.kernel.org/r/20201123085347.19667-26-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The file debug.h contains a simple macro for debug prints, and it's
used only in two places, the format parser and the hw_params rules.
The former actually should print a more informative message instead,
so the only users are the hw_parmas rules.
This patch moves the contents of debug.h into the hw_params rules
local code and remove the unneeded includes. Also, the debug print in
the format parser is replaced with the information print with more
useful information, and the raw printk() call is replaced with
pr_debug().
Tested-by: Keith Milner <kamilner@superlative.org>
Tested-by: Dylan Robinson <dylan_robinson@motu.com>
Link: https://lore.kernel.org/r/20201123085347.19667-13-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
So far we've added the devices that need vendor/product string renames
or the profile setup into the standard quirk table in quirks-table.h.
This table is imported into the primary USB audio device entry, hence
it's all exported for the probing so that udev and co can take a look
at it. OTOH, for renaming or profile setup, we don't need to expose
those explicit entries because the probe itself follows the standard
way. That said, we're exposing unnecessarily too many entries.
This patch moves such internal quirk entries into the own table, and
reduces the exported device table size. Along with the moving items,
re-arrange the entries in the proper order.
Link: https://lore.kernel.org/r/20200817082140.20232-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Currently USB-audio driver manages the auto-pm of the primary
interface although a card may consist of multiple interfaces.
This may leave the secondary and other interfaces left running
unnecessarily after the auto-suspend.
This patch allows the driver managing the auto-pm of all bundled
interfaces per card. The chip->pm_intf field is extended as
chip->intf[] to contain the array of assigned interfaces, and the
runtime-PM is performed to all those interfaces.
Tested-by: Macpaul Lin <macpaul.lin@mediatek.com>
Link: https://lore.kernel.org/r/20200605064117.28504-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
When a USB-audio interface gets runtime-suspended via auto-pm feature,
the driver suspends all functionality and increment
chip->num_suspended_intf. Later on, when the system gets suspended to
S3, the driver increments chip->num_suspended_intf again, skips the
device changes, and sets the card power state to
SNDRV_CTL_POWER_D3hot. In return, when the system gets resumed from
S3, the resume callback decrements chip->num_suspended_intf. Since
this refcount is still not zero (it's been runtime-suspended), the
whole resume is skipped. But there is a small pitfall here.
The problem is that the driver doesn't restore the card power state
after this resume call, leaving it as SNDRV_CTL_POWER_D3hot. So,
even after the system resume finishes, the card instance still appears
as if it were system-suspended, and this confuses many ioctl accesses
that are blocked unexpectedly.
In details, we have two issues behind the scene: one is that the card
power state is changed only when the refcount becomes zero, and
another is that the prior auto-suspend check is kept in a boolean
flag. Although the latter problem is almost negligible since the
auto-pm feature is imposed only on the primary interface, but this can
be a potential problem on the devices with multiple interfaces.
This patch addresses those issues by the following:
- Replace chip->autosuspended boolean flag with chip->system_suspend
counter
- At the first system-suspend, chip->num_suspended_intf is recorded to
chip->system_suspend
- At system-resume, the card power state is restored when the
chip->num_suspended_intf refcount reaches to chip->system_suspend,
i.e. the state returns to the auto-suspended
Also, the patch fixes yet another hidden problem by the code
refactoring along with the fixes above: namely, when some resume
procedure failed, the driver left chip->num_suspended_intf that was
already decreased, and it might lead to the refcount unbalance.
In the new code, the refcount decrement is done after the whole resume
procedure, and the problem is avoided as well.
Fixes: 0662292aec ("ALSA: usb-audio: Handle normal and auto-suspend equally")
Reported-and-tested-by: Macpaul Lin <macpaul.lin@mediatek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200603153709.6293-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The USB-audio driver may call snd_card_register() multiple times as
its probe function is per USB interface while some USB-audio devices
may provide multiple interfaces to assign different streams although
they belong to the same device. This works in most cases but the
registration is racy, hence it may miss the device recognition,
e.g. PA doesn't see certain devices when hotplugged.
The recent addition of the delayed registration quirk allows to sync
the registration at the last known interface, and the previous commit
added a new module option to allow the dynamic setup for that
purpose.
Now, this patch tries to find out and notifies for such devices that
require the delayed registration. It shows a message like:
Found post-registration device assignment: 1234abcd:02
If you hit this message, you can pass delayed_register module option
like:
snd_usb_audio.delayed_register=1234abcd:02
by just copying the last shown entry. If this works, it can be added
statically in the quirk list, registration_quirks[] found at the end
of sound/usb/quirks.c.
Link: https://lore.kernel.org/r/20200325103322.2508-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add a new option for specifying the quirk for delayed registration of
the certain device. A list of devices can be passed in a form
ID:IFACE,ID:IFACE,ID:IFACE,....
where ID is the 32bit hex number combo of vendor and device IDs and
IFACE is the interface number to trigger the register.
When a matching device is probed, the card registration is delayed
until the given interface is probed. It's needed for syncing the
registration until the last interface when multiple interfaces are
provided for the same card.
Link: https://lore.kernel.org/r/20200325103322.2508-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
A slight refactoring of the registration quirk code. Now it uses the
table lookup for easy additions in future. Also the return type was
changed to bool, and got a few more comments.
Link: https://lore.kernel.org/r/20200325103322.2508-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Create a quirk that allows special processing and/or
skipping the call to snd_card_register.
For HyperX AMP, which uses two interfaces, but only has
a capture stream in the second, this allows the capture
stream to merge with the first PCM.
Signed-off-by: Chris Wulff <crwulff@gmail.com>
Link: https://lore.kernel.org/r/20200314165449.4086-3-crwulff@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add delay to make sure that audio urbs are not sent too early.
Otherwise the device hangs. Windows driver makes ~2s delay, so use
about the same time delay value.
snd_usb_apply_boot_quirk() is called 3 times for my MOTU M4, which
is an overkill. Thus a quirk that is called only once is implemented.
Also send two vendor-specific control messages before and after
the delay. This behaviour is blindly copied from the Windows driver.
Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Link: https://lore.kernel.org/r/20200112102358.18085-1-alexander@tsoy.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The unit descriptor validation may lead to a probe error when the
device provides a buggy descriptor or the validator detected
incorrectly. For identifying such an error and band-aiding, give a
new module option, skip_validation. With this option, the driver
ignores the validation errors with the hexdump of the unit
descriptor, so we can check it in a bit more details.
Link: https://lore.kernel.org/r/20191114165613.7422-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Based on 1 normalized pattern(s):
this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version this program is distributed in the
hope that it will be useful but without any warranty without even
the implied warranty of merchantability or fitness for a particular
purpose see the gnu general public license for more details you
should have received a copy of the gnu general public license along
with this program if not write to the free software foundation inc
59 temple place suite 330 boston ma 02111 1307 usa
extracted by the scancode license scanner the SPDX license identifier
GPL-2.0-or-later
has been chosen to replace the boilerplate/reference in 1334 file(s).
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Reviewed-by: Richard Fontana <rfontana@redhat.com>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Media Device Allocator API to allows multiple drivers share a media device.
This API solves a very common use-case for media devices where one physical
device (an USB stick) provides both audio and video. When such media device
exposes a standard USB Audio class, a proprietary Video class, two or more
independent drivers will share a single physical USB bridge. In such cases,
it is necessary to coordinate access to the shared resource.
Using this API, drivers can allocate a media device with the shared struct
device as the key. Once the media device is allocated by a driver, other
drivers can get a reference to it. The media device is released when all
the references are released.
Change the ALSA driver to use the Media Controller API to share media
resources with DVB, and V4L2 drivers on a AU0828 media device.
The Media Controller specific initialization is done after sound card is
registered. ALSA creates Media interface and entity function graph nodes
for Control, Mixer, PCM Playback, and PCM Capture devices.
snd_usb_hw_params() will call Media Controller enable source handler
interface to request the media resource. If resource request is granted,
it will release it from snd_usb_hw_free(). If resource is busy, -EBUSY is
returned.
Media specific cleanup is done in usb_audio_disconnect().
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Shuah Khan <shuah@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Pull the PCM suspend improvement / cleanup.
This moves the most of snd_pcm_suspend*() calls into PCM's own device
PM ops. There should be no change from the functionality POV.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The call of snd_pcm_suspend_all() & co became superfluous since we
call it in the PCM PM ops. Let's remove them.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
There are a few places where we access the data without checking the
actual object size from the USB audio descriptor. This may result in
OOB access, as recently reported.
This patch addresses these missing checks. Most of added codes are
simple bLength checks in the caller side. For the input and output
terminal parsers, we put the length check in the parser functions.
For the input terminal, a new argument is added to distinguish between
UAC1 and the rest, as they treat different objects.
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reported-by: Hui Peng <benquike@163.com>
Tested-by: Hui Peng <benquike@163.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
If a USB sound card reports 0 interfaces, an error condition is triggered
and the function usb_audio_probe errors out. In the error path, there was a
use-after-free vulnerability where the memory object of the card was first
freed, followed by a decrement of the number of active chips. Moving the
decrement above the atomic_dec fixes the UAF.
[ The original problem was introduced in 3.1 kernel, while it was
developed in a different form. The Fixes tag below indicates the
original commit but it doesn't mean that the patch is applicable
cleanly. -- tiwai ]
Fixes: 362e4e49ab ("ALSA: usb-audio - clear chip->probing on error exit")
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Set the UAC3 Power Domain state for an Audio Streaming interface
to D2 state before suspending the device (usb_driver callback).
This lets the device know there is no intention to use any of the
Units in the Audio Function and that the host is not going to
even listen for wake-up events (interrupts) on the units.
When the usb_driver gets resumed, the state D0 (fully powered) will
be set. This ties up the UAC3 Power Domains to the runtime PM.
Signed-off-by: Jorge Sanjuan <jorge.sanjuan@codethink.co.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Currently, USB-audio driver allocates the PCM buffer via vmalloc(), as
this serves merely as an intermediate buffer that is copied to each
URB transfer buffer. This works well in general on x86, but on some
archs this may result in cache coherency issues when mmap is used.
OTOH, it works also on such arch unless mmap is used.
This patch is a step for mitigating the inconvenience; a new module
option "use_vmalloc" is provided so that user can choose to allocate
the DMA coherent buffer instead of the existing vmalloc buffer.
The drawback is that it'd be the standard dma_alloc_coherent() calls
and the system would require contiguous pages on non-x86 archs.
Note that it's a global option and not dynamically switchable since
the buffer is pre-allocated at the probe time. In theory, it's
possible to be switchable, but it'd be trickier and racier.
As default use_vmalloc option is set to true, so that the old behavior
is kept. For allowing the coherent mmap on ARM or MIPS, pass
use_vmalloc=0 option explicitly.
Reported-and-tested-by: Daniel Danzberger <daniel@dd-wrt.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Simplify the device management by replacing the lowlevel device object
allocation with the card->private_data. Nowadays there is almost no
advantage by the lowlevel device, and with card->private_data, the
code becomes cleaner.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Avoid if ((err = ...) style and expand to multiple lines instead.
No change in the end result, but just the beautification.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Recently released USB Audio Class 3.0 specification
contains BADD (Basic Audio Device Definition) document
which describes pre-defined UAC3 configurations.
BADD support is mandatory for UAC3 devices, it should be
implemented as a separate USB device configuration.
As per BADD document, class-specific descriptors
shall not be included in the Device’s Configuration
descriptor ("inferred"), but host can guess them
from BADD profile number, number of endpoints and
their max packed sizes.
This patch adds support of all BADD profiles from the spec
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Tested-by: Jorge Sanjuan <jorge.sanjuan@codethink.co.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The control header needs to be read from buffer at this point only
in the case of UAC1 protocol. Move it inside the switch case as other
protocols such as the Basic Audio Device spec will have an empty buffer
that is latter filled as inferred.
Signed-off-by: Jorge Sanjuan <jorge.sanjuan@codethink.co.uk>
[Ruslan: updated with recently added sanity checks]
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Historically USB-audio driver sets the card's longname field with the
details of the device and the bus information. It's good per se, but
not preferable when it's referred as the identifier for UCM profile.
This patch adds a quirk profile_name field to override the card's
longname string to a pre-defined one, so that one can create a unique
and consistent ID string for the specific USB device via a quirk table
to be used as a UCM profile name.
The patch does a slight code refactoring to split out the functions to
set shortname and longname fields as well.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Recently released USB Audio Class 3.0 specification
introduces many significant changes comparing to
previous versions, like
- new Power Domains, support for LPM/L1
- new Cluster descriptor
- changed layout of all class-specific descriptors
- new High Capability descriptors
- New class-specific String descriptors
- new and removed units
- additional sources for interrupts
- removed Type II Audio Data Formats
- ... and many other things (check spec)
It also provides backward compatibility through
multiple configurations, as well as requires
mandatory support for BADD (Basic Audio Device
Definition) on each ADC3.0 compliant device
This patch adds initial support of UAC3 specification
that is enough for Generic I/O Profile (BAOF, BAIF)
device support from BADD document.
Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This patch changes the semantics of the enable option for snd-usb-audio
in order to allow users to disable a device specified by either or both
of the vendor id and the product id.
Signed-off-by: Tamaki Nishino <otamachan@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
usb_device_id are not supposed to change at runtime. All functions
working with usb_device_id provided by <linux/usb.h> work with
const usb_device_id. So mark the non-const structs as const.
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Recently snd-usb-audio driver received a new option, quirk_alias, to
allow user to apply the existing quirk for a different device. This
works for many quirks as is, but some still need more tune-ups:
namely, some quirks check the USB vendor/device IDs in various places,
thus it doesn't work as long as the ID is different from the expected
one.
With this patch, the driver stores the aliased USB ID, so that these
rest quirks per device ID are applied. The transition to use the
cached USB ID was already done in the past, so what we needed now is
only to overwrite chip->usb_id.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The function returns -EINVAL even if it builds the stream properly.
The bogus error code sneaked in during the code refactoring, but it
wasn't noticed until now since the returned error code itself is
ignored in anyway. Kill it here, but there is no behavior change by
this patch, obviously.
Fixes: e5779998bf ('ALSA: usb-audio: refactor code')
Signed-off-by: Takashi Iwai <tiwai@suse.de>
The usb-audio driver implements the deferred device disconnection for
the device in use. In this mode, the disconnection callback returns
immediately while the actual ALSA card object removal happens later
when all files get closed. As Shuah reported, this code flow,
however, leads to a use-after-free, detected by KASAN:
BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
Write of size 8 by task pulseaudio/2244
Call Trace:
[<ffffffff81b31473>] dump_stack+0x67/0x94
[<ffffffff81564ef1>] kasan_object_err+0x21/0x70
[<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
[<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
[<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
[<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
[<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
[<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
[<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
[<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
[<ffffffff8242cae4>] release_card_device+0x34/0x130
[<ffffffff81ef1846>] device_release+0x76/0x1e0
[<ffffffff81b37ad7>] kobject_release+0x107/0x370
.....
Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
Allocated:
[<ffffffff810804eb>] save_stack_trace+0x2b/0x50
[<ffffffff81564296>] save_stack+0x46/0xd0
[<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
[<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
[<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
[<ffffffff8216349d>] hub_event+0xf1d/0x35f0
....
Freed:
[<ffffffff810804eb>] save_stack_trace+0x2b/0x50
[<ffffffff81564296>] save_stack+0x46/0xd0
[<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
[<ffffffff81560929>] kfree+0xd9/0x280
[<ffffffff8214de6e>] usb_release_dev+0xde/0x110
[<ffffffff81ef1846>] device_release+0x76/0x1e0
....
It's the code trying to clear drvdata of the assigned usb_device where
the usb_device itself was already released in usb_release_dev() after
the disconnect callback.
This patch fixes it by checking whether the code path is via the
disconnect callback, i.e. chip->shutdown flag is set.
Fixes: 79289e2419 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Unfortunately, this patch caused several regressions at au0828 and
snd-usb-audio, like this one:
https://bugzilla.kernel.org/show_bug.cgi?id=115561
It also showed several troubles at the MC core that handles pretty
poorly the memory protections and data lifetime management.
So, better to revert it and fix the core before reapplying this
change.
This reverts commit aebb2b89bf ("[media] sound/usb: Use Media
Controller API to share media resources")'
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
After a heavy storm by syzkaller in 4.5 cycle, we have relatively few
changes in the core at this time while a lot of changes are found in
the driver side, unsurprisingly. Below are some highlights:
ALSA core:
- A few more hardening in ALSA timer codes
- An extension of sequencer API for advertising the card / pid
- Small fixes in compress-offload and jack layers
HD-audio:
- Dynamic PCM assignment in HDMI/DP codec; preparation for upcoming
DP-MST support
- Lots of code refactoring for sharing with ASoC SKL driver
- Regression fixes for Intel HDMI/DP
- Fixups for CX20724 codec, Lenovo AiO
USB-audio:
- Add quirk_alias option to make quirk debugging easier
- Fixes for possible Oops by malformed firmware
Firewire:
- Add support for FW-1804 in tascam driver
- Improvements / changes in card registration, multi stream handling,
etc for DICE
- Lots of code refactoring
ASoC:
- Enhancements of still ongoing topology API
- Lots of commits for Intel Skylake support including HDMI support
- A few Intel Atom driver updates for recent devices
- Lots of improvements to the Renesas drivers
- Capture support for Qualcomm drivers
- Support for TI DaVinci DRA7xxx devices
- New machine drivers for Freescale systems with Cirrus CODECs,
Mediatek systems with RT5650 CODECs
- New CPU drivers for Allwinner S/PDIF controllers
- New CODEC drivers for Maxim MAX9867 and MAX98926 and Realtek RT5514
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJW69UAAAoJEGwxgFQ9KSmkoaAQAJ6uBco1gqTmYkJGyLMRRblT
BxEQ0NMSlPrNEJpR6GOYknrdPZiA4WfxT1zhswDQoNvSKery3bn3aOGfWHA9I+9j
TRUwHkOAlRCcwgTfy70pRS0fcAx34y9nTcAWsVn9RbrMP3ydkwKyMXRqTwqYr5u5
UU53PSdwhUO8q/PomvBeip8nvw7zrV+06nVbEMUnIQlgp165n/qq0sRFBVkRBBJ7
ooqe6VW6F2Es3Zh+W9Vp/qn9OpZEdDCKvmICX1RIFJUgYRRxbL+L021TGjkaXVmT
Or9L9StRYePZsCo1I1vsYUbYc6+Y3qDmqViGhREHBZ27EY8G1Utk7wy959vt0eFj
1xHynw36kmjrw/QlPraJBRuYIQh4SRAcXhw+wQdM5rxdp7gDjikhkezHZQWrvQAJ
5XXitZhVVNa9DRS5ZRwnW5nT/emQ+KBuJyl9gyAL1HaoZoYnDvRkfe9CGpgj7TRP
wYcnL+rKL9x8eiJY5VTfL9rIxTgNYXvuPPBgdmJEp8qu5de8O1g5UN0xHSGf3yhr
DVE5r/2J+gYNprsSF9DV6pfFQuh/Efw9XW2IbK6k6WF4labWGeD7rLrI4t9aJcXv
PJ1FY/sUFhHZhZjHlGbR9emK+BLtZweFvOAvY7dD74ON65D5tYXvHPo0QTc4V5Op
d0eDg0pcTdFLDqq8ZLLr
=Cc+v
-----END PGP SIGNATURE-----
Merge tag 'sound-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound updates from Takashi Iwai:
"After a heavy storm by syzkaller in 4.5 cycle, we have relatively few
changes in the core at this time while a lot of changes are found in
the driver side, unsurprisingly. Below are some highlights:
ALSA core:
- A few more hardening in ALSA timer codes
- An extension of sequencer API for advertising the card / pid
- Small fixes in compress-offload and jack layers
HD-audio:
- Dynamic PCM assignment in HDMI/DP codec; preparation for upcoming
DP-MST support
- Lots of code refactoring for sharing with ASoC SKL driver
- Regression fixes for Intel HDMI/DP
- Fixups for CX20724 codec, Lenovo AiO
USB-audio:
- Add quirk_alias option to make quirk debugging easier
- Fixes for possible Oops by malformed firmware
Firewire:
- Add support for FW-1804 in tascam driver
- Improvements / changes in card registration, multi stream handling,
etc for DICE
- Lots of code refactoring
ASoC:
- Enhancements of still ongoing topology API
- Lots of commits for Intel Skylake support including HDMI support
- A few Intel Atom driver updates for recent devices
- Lots of improvements to the Renesas drivers
- Capture support for Qualcomm drivers
- Support for TI DaVinci DRA7xxx devices
- New machine drivers for Freescale systems with Cirrus CODECs,
Mediatek systems with RT5650 CODECs
- New CPU drivers for Allwinner S/PDIF controllers
- New CODEC drivers for Maxim MAX9867 and MAX98926 and Realtek RT5514"
* tag 'sound-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (291 commits)
ALSA: hda - Fix mutex deadlock at HDMI/DP hotplug
ALSA: ctl: change return value in compatibility layer so that it's the same value in core implementation
ALSA: mixart: silence an uninitialized variable warning
ALSA: usb-audio: Add sanity checks for endpoint accesses
ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()
ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()
ALSA: hda - Limit i915 HDMI binding only for HSW and later
ALSA: hda - Fix unconditional GPIO toggle via automute
ALSA: mixart: silence unitialized variable warnings
ALSA: hda - Fixes double fault in nvhdmi_chmap_cea_alloc_validate_get_type
ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda
ASoC: rsnd: add simplified module explanation
ASoC: hdac_hdmi: Add broxton device ID
ASoC: Intel: Bxtn: Add Broxton PCI ID
ASoC: Intel: Skylake: Move Skylake dsp ops & loader ops
ASoC: Intel: add dmabuffer to common sst_dsp
ASoC: Intel: Skylake: Unstatify skl_dsp_enable_core
ASoC: Intel: Skylake: Fix whitepsace issues
ASoC: Intel: Skylake: Move module id defines
...
Change ALSA driver to use Media Controller API to share media resources
with DVB and V4L2 drivers on a AU0828 media device. Media Controller
specific initialization is done after sound card is registered. ALSA
creates Media interface and entity function graph nodes for Control,
Mixer, PCM Playback, and PCM Capture devices.
snd_usb_hw_params() will call Media Controller enable source handler
interface to request the media resource. If resource request is
granted, it will release it from snd_usb_hw_free(). If resource is
busy, -EBUSY is returned.
Media specific cleanup is done in usb_audio_disconnect().
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Acked-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This patch adds a new option "quirk_alias" to snd-usb-audio driver for
allowing user to pass the quirk alias list. A quirk alias consists of
a string form like 0123abcd:5678beef, which makes to apply a quirk to
a device with USB ID 0123:abcd treated as if it were 5678:beef.
This feature is useful to test an existing quirk, typically for a
newer model of the same vendor, without patching / rebuilding the
kernel driver.
The current implementation is fairly simplistic: since there is no API
for matching a usb_device_id to the given ID pair, it has an open code
to loop over the id table and matches only with vendor:product pair.
So far, this is OK, as all existing entries are with vendor:product
pairs, indeed. Once when we have another matching entry, however,
we'd need to update get_alias_quirk() as well.
Note that this option is provided only for testing / development. If
you want to have a proper support, contact to upstream for adding the
matching quirk in the driver code statically.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This is a preliminary patch for the later change to allow a better
quirk ID management. In the current USB-audio code, there are a few
places looking at usb_device idVendor and idProduct fields directly
even though we have already a static member in snd_usb_audio.usb_id.
This patch modifies such codes to refer to the latter field.
For achieving this, two slightly intensive changes have been done:
- The snd_usb_audio object is set/reset via dev_getdrv() for the given
USB device; it's needed for minimizing the changes for some existing
quirks that take only usb_device object.
- __snd_usbmidi_create() is introduced to receive the pre-given usb_id
argument. The exported snd_usbmidi_create() is unchanged by calling
this new function internally.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
ALSA PCM may still have a leftover instance after disconnection and
it delays its release. The problem is that the PCM close code path of
USB-audio driver has a call of snd_usb_autosuspend(). This involves
with the call of usb_autopm_put_interface() and it may lead to a
kernel Oops due to the NULL object like:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000190
IP: [<ffffffff815ae7ef>] usb_autopm_put_interface+0xf/0x30 PGD 0
Call Trace:
[<ffffffff8173bd94>] snd_usb_autosuspend+0x14/0x20
[<ffffffff817461bc>] snd_usb_pcm_close.isra.14+0x5c/0x90
[<ffffffff8174621f>] snd_usb_playback_close+0xf/0x20
[<ffffffff816ef58a>] snd_pcm_release_substream.part.36+0x3a/0x90
[<ffffffff816ef6b3>] snd_pcm_release+0xa3/0xb0
[<ffffffff816debb0>] snd_disconnect_release+0xd0/0xe0
[<ffffffff8114d417>] __fput+0x97/0x1d0
[<ffffffff8114d589>] ____fput+0x9/0x10
[<ffffffff8109e452>] task_work_run+0x72/0x90
[<ffffffff81088510>] do_exit+0x280/0xa80
[<ffffffff8108996a>] do_group_exit+0x3a/0xa0
[<ffffffff8109261f>] get_signal+0x1df/0x540
[<ffffffff81040903>] do_signal+0x23/0x620
[<ffffffff8114c128>] ? do_readv_writev+0x128/0x200
[<ffffffff810012e1>] prepare_exit_to_usermode+0x91/0xd0
[<ffffffff810013ba>] syscall_return_slowpath+0x9a/0x120
[<ffffffff817587cd>] ? __sys_recvmsg+0x5d/0x70
[<ffffffff810d2765>] ? ktime_get_ts64+0x45/0xe0
[<ffffffff8115dea0>] ? SyS_poll+0x60/0xf0
[<ffffffff818d2327>] int_ret_from_sys_call+0x25/0x8f
We have already a check of disconnection in snd_usb_autoresume(), but
the check is missing its counterpart. The fix is just to put the same
check in snd_usb_autosuspend(), too.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109431
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Takashi Iwai