aboutsummaryrefslogtreecommitdiff
path: root/sound/usb/format.c
AgeCommit message (Collapse)Author
2012-02-15ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk()Xi Wang
A malicious USB device could feed in a large nr_rates value. This would cause the subsequent call to kmemdup() to allocate a smaller buffer than expected, leading to out-of-bounds access. This patch validates the nr_rates value and reuses the limit introduced in commit 4fa0e81b ("ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()"). Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-01-08ALSA: usb-audio: fix possible hang and overflow in ↵Xi Wang
parse_uac2_sample_rate_range() A malicious USB device may feed in carefully crafted min/max/res values, so that the inner loop in parse_uac2_sample_rate_range() could run for a long time or even never terminate, e.g., given max = INT_MAX. Also nr_rates could be a large integer, which causes an integer overflow in the subsequent call to kmalloc() in parse_audio_format_rates_v2(). Thus, kmalloc() would allocate a smaller buffer than expected, leading to a memory corruption. To exploit the two vulnerabilities, an attacker needs physical access to the machine to plug in a malicious USB device. This patch makes two changes. 1) The type of "rate" is changed to unsigned int, so that the loop could stop once "rate" is larger than INT_MAX. 2) Limit nr_rates to 1024. Suggested-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-09-27ALSA: usb-audio: increase control transfer timeoutClemens Ladisch
There are certain devices that are reportedly so slow that they need more than 100 ms to handle control transfers. Therefore, increase the timeout in mixer(_quirks).c to 1000 ms. The timeout parameter of snd_usb_ctl_msg() is now constant, so we can drop it. Reported-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-05-22Merge branch 'topic/misc' into for-linusTakashi Iwai
2011-05-18ALSA: usb-audio: include format.h in format.cDaniel Mack
Just in case a prototype changes, we'll be warned. This also fixes a sparse warning. Signed-off-by: Daniel Mack <zonque@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-04-28ALSA: usb-audio - Terratec Aureon 7.1 USB ID as C-Media cm6206 quirksWolfgang Breyha
This patch adds support for the Terratec Aureon 7.1 USB which uses a C-Media cm6206 and needs all the quirks already found in the past. Signed-off-by: Wolfgang Breyha <wbreyha@gmx.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-01-10ALSA: usb-audio: add Edirol SD-90 PCM supportClemens Ladisch
Add support for the 24-bit audio I/Os of the Edirol SD-90 interface. Reported-any-tested-by: Jim Grusendorf <alsa-user@grusendorf.ca> Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-03ALSA: usb-audio: fix detection of vendor-specific device protocol settingsClemens Ladisch
The Audio Class v2 support code in 2.6.35 added checks for the bInterfaceProtocol field. However, there are devices (usually those detected by vendor-specific quirks) that do not have one of the predefined values in this field, which made the driver reject them. To fix this regression, restore the old behaviour, i.e., assume that a device with an unknown bInterfaceProtocol field (other than UAC_VERSION_2) has more or less UAC-v1-compatible descriptors. [compile warning fixes by tiwai] Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Cc: Daniel Mack <daniel@caiaq.de> Cc: <stable@kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-15ALSA: sound/usb/format: silence uninitialized variable warningsDan Carpenter
Gcc complains that ret might be used uninitialized: sound/usb/format.c: In function ‘snd_usb_parse_audio_format’: sound/usb/format.c:354: warning: ‘ret’ may be used uninitialized in this function sound/usb/format.c:354: note: ‘ret’ was declared here sound/usb/format.c:414: warning: ‘ret’ may be used uninitialized in this function sound/usb/format.c:414: note: ‘ret’ was declared here I suppose it could be uninitialized if there is ever a UAC_VERSION_3 released. Anyway this patch is worthwhile if only to silence the gcc warning. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-06-23ALSA: usb-audio: simplify control interface accessDaniel Mack
As the control interface is now carried in struct snd_usb_audio, we can simplify the API a little and also drop the private ctrlif field from struct usb_mixer_interface. Also remove a left-over function prototype in pcm.h. Signed-off-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-06-11ALSA: usb-audio: parse UAC2 sample rate ranges correctlyDaniel Mack
A device may report its supported sample rates in ranges rather than in discrete triplets. The code used to only parse the MIN field instead of properly paying attention to the MAX and RES values. Also, handle RES values of 1 correctly and announce a continous sample rate range in this case. Signed-off-by: Daniel Mack <daniel@caiaq.de> Reported-by: Alex Lee <alexlee188@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-06-11ALSA: usb-audio: fix control messages for USB_RECIP_INTERFACEDaniel Mack
Control messages directed to an interface must have the interface number set in the lower 8 bits of wIndex. This wasn't done correctly for some clock and mixer messages. Signed-off-by: Daniel Mack <daniel@caiaq.de> Reported-by: Alex Lee <alexlee188@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-06-11ALSA: usb-audio: add check for faulty clock in parse_audio_format_rates_v2()Daniel Mack
Signed-off-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-05-31ALSA: usb-audio: parse clock topology of UAC2 devicesDaniel Mack
Audio devices which comply to the UAC2 standard can export complex clock topologies in its descriptors and set up links between them. The entities that are defined are - clock sources, which define the end-leafs. - clock selectors, which act as switch to select one out of many possible clocks sources. - clock multipliers, which have an input clock source, and act as clock source again. They can be used to derive one clock from another. All sample rate changes, clock validity queries and the like must go to clock source elements, while clock selectors and multipliers can be used as terminal clock source. The following patch adds a parser for these elements and functions to iterate over the tree and find the leaf nodes (clock sources). The samplerate set functions were moved to the new clock.c file. Signed-off-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-05-27ALSA: usb-audio: fix return valuesDaniel Mack
-1 is not a good return value as it means -EPERM, "not permitted". Choose -ENOTSUPP instead, which is what the code really wants to tell its callers. Signed-off-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-05-27ALSA: usb-audio: parse more format descriptors with structsDaniel Mack
Signed-off-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-29ALSA: usb - use of kmalloc/kfree requires the include of slab.hStephen Rothwell
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-12ALSA: usb-mixer: use defines from audio.hDaniel Mack
No need for the private enum. Signed-off-by: Daniel Mack <daniel@caiaq.de> Cc: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-12linux/usb/audio.h: split headerDaniel Mack
- Split the audio.h file in two to clearly denote the differences between the standards. - Add many more defines to audio-v2.h. Most of them are not currently used. - Replaced a magic value with a proper define Signed-off-by: Daniel Mack <daniel@caiaq.de> Acked-by: Greg Kroah-Hartman <gregkh@suse.de> Cc: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-05ALSA: usb-audio: support multiple formats with audio class v2 devicesClemens Ladisch
Change the parser to correctly handle v2 descriptors with multiple format bits set. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-05ALSA: usb-audio: use a format bitmask per alternate settingClemens Ladisch
In preparation for USB audio 2.0 support, change the audioformat structure so that it uses a bitmask to specify possible formats. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-05ALSA: usb-audio: refactor codeDaniel Mack
Clean up the usb audio driver by factoring out a lot of functions to separate files. Code for procfs, quirks, urbs, format parsers etc all got a new home now. Moved almost all special quirk handling to quirks.c and introduced new generic functions to handle them, so the exceptions do not pollute the whole driver. Renamed usbaudio.c to card.c because this is what it actually does now. Renamed usbmidi.c to midi.c for namespace clarity. Removed more things from usbaudio.h. The non-standard drivers were adopted accordingly. Signed-off-by: Daniel Mack <daniel@caiaq.de> Cc: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>