Commit Graph

22 Commits

Author SHA1 Message Date
Xi Wang 8866f405ef ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk()
A malicious USB device could feed in a large nr_rates value.  This would
cause the subsequent call to kmemdup() to allocate a smaller buffer than
expected, leading to out-of-bounds access.

This patch validates the nr_rates value and reuses the limit introduced
in commit 4fa0e81b ("ALSA: usb-audio: fix possible hang and overflow
in parse_uac2_sample_rate_range()").

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-02-15 14:58:15 +01:00
Xi Wang 4fa0e81b83 ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()
A malicious USB device may feed in carefully crafted min/max/res values,
so that the inner loop in parse_uac2_sample_rate_range() could run for
a long time or even never terminate, e.g., given max = INT_MAX.

Also nr_rates could be a large integer, which causes an integer overflow
in the subsequent call to kmalloc() in parse_audio_format_rates_v2().
Thus, kmalloc() would allocate a smaller buffer than expected, leading
to a memory corruption.

To exploit the two vulnerabilities, an attacker needs physical access
to the machine to plug in a malicious USB device.

This patch makes two changes.

1) The type of "rate" is changed to unsigned int, so that the loop could
   stop once "rate" is larger than INT_MAX.

2) Limit nr_rates to 1024.

Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-01-08 16:03:12 +01:00
Clemens Ladisch 17d900c4a1 ALSA: usb-audio: increase control transfer timeout
There are certain devices that are reportedly so slow that they need
more than 100 ms to handle control transfers.  Therefore, increase the
timeout in mixer(_quirks).c to 1000 ms.

The timeout parameter of snd_usb_ctl_msg() is now constant, so we can
drop it.

Reported-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-09-27 09:21:48 +02:00
Takashi Iwai 02e5fbf622 Merge branch 'topic/misc' into for-linus 2011-05-22 10:01:29 +02:00
Daniel Mack ee95cb6121 ALSA: usb-audio: include format.h in format.c
Just in case a prototype changes, we'll be warned. This also fixes a
sparse warning.

Signed-off-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-05-18 11:44:41 +02:00
Wolfgang Breyha 8129e79ed7 ALSA: usb-audio - Terratec Aureon 7.1 USB ID as C-Media cm6206 quirks
This patch adds support for the Terratec Aureon 7.1 USB which uses a
C-Media cm6206 and needs all the quirks already found in the past.

Signed-off-by: Wolfgang Breyha <wbreyha@gmx.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-04-28 18:22:41 +02:00
Clemens Ladisch 061b869eca ALSA: usb-audio: add Edirol SD-90 PCM support
Add support for the 24-bit audio I/Os of the Edirol SD-90 interface.

Reported-any-tested-by: Jim Grusendorf <alsa-user@grusendorf.ca>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-01-10 16:47:10 +01:00
Clemens Ladisch a2acad8298 ALSA: usb-audio: fix detection of vendor-specific device protocol settings
The Audio Class v2 support code in 2.6.35 added checks for the
bInterfaceProtocol field.  However, there are devices (usually those
detected by vendor-specific quirks) that do not have one of the
predefined values in this field, which made the driver reject them.

To fix this regression, restore the old behaviour, i.e., assume that
a device with an unknown bInterfaceProtocol field (other than
UAC_VERSION_2) has more or less UAC-v1-compatible descriptors.

[compile warning fixes by tiwai]

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: Daniel Mack <daniel@caiaq.de>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-09-03 22:36:39 +02:00
Dan Carpenter 38d7b08f37 ALSA: sound/usb/format: silence uninitialized variable warnings
Gcc complains that ret might be used uninitialized:

sound/usb/format.c: In function ‘snd_usb_parse_audio_format’:
sound/usb/format.c:354: warning: ‘ret’ may be used uninitialized in this function
sound/usb/format.c:354: note: ‘ret’ was declared here
sound/usb/format.c:414: warning: ‘ret’ may be used uninitialized in this function
sound/usb/format.c:414: note: ‘ret’ was declared here

I suppose it could be uninitialized if there is ever a UAC_VERSION_3
released. Anyway this patch is worthwhile if only to silence the gcc
warning.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-08-15 14:28:20 +02:00
Daniel Mack 3d8d4dcfd4 ALSA: usb-audio: simplify control interface access
As the control interface is now carried in struct snd_usb_audio, we can
simplify the API a little and also drop the private ctrlif field from
struct usb_mixer_interface.

Also remove a left-over function prototype in pcm.h.

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-06-23 16:10:23 +02:00
Daniel Mack 67c103664a ALSA: usb-audio: parse UAC2 sample rate ranges correctly
A device may report its supported sample rates in ranges rather than in
discrete triplets. The code used to only parse the MIN field instead of
properly paying attention to the MAX and RES values.

Also, handle RES values of 1 correctly and announce a continous sample
rate range in this case.

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Reported-by: Alex Lee <alexlee188@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-06-11 18:06:12 +02:00
Daniel Mack 11bcbc443a ALSA: usb-audio: fix control messages for USB_RECIP_INTERFACE
Control messages directed to an interface must have the interface number
set in the lower 8 bits of wIndex. This wasn't done correctly for some
clock and mixer messages.

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Reported-by: Alex Lee <alexlee188@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-06-11 18:05:38 +02:00
Daniel Mack d07140ba7f ALSA: usb-audio: add check for faulty clock in parse_audio_format_rates_v2()
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-06-11 18:05:05 +02:00
Daniel Mack 79f920fbff ALSA: usb-audio: parse clock topology of UAC2 devices
Audio devices which comply to the UAC2 standard can export complex clock
topologies in its descriptors and set up links between them.

The entities that are defined are

 - clock sources, which define the end-leafs.
 - clock selectors, which act as switch to select one out of many
   possible clocks sources.
 - clock multipliers, which have an input clock source, and act as clock
   source again. They can be used to derive one clock from another.

All sample rate changes, clock validity queries and the like must go to
clock source elements, while clock selectors and multipliers can be used
as terminal clock source.

The following patch adds a parser for these elements and functions to
iterate over the tree and find the leaf nodes (clock sources).

The samplerate set functions were moved to the new clock.c file.

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-05-31 18:16:59 +02:00
Daniel Mack 8d09124271 ALSA: usb-audio: fix return values
-1 is not a good return value as it means -EPERM, "not permitted".
Choose -ENOTSUPP instead, which is what the code really wants to tell
its callers.

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-05-27 09:48:47 +02:00
Daniel Mack 74754f974b ALSA: usb-audio: parse more format descriptors with structs
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-05-27 09:48:31 +02:00
Stephen Rothwell 36db045658 ALSA: usb - use of kmalloc/kfree requires the include of slab.h
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-29 08:23:27 +02:00
Daniel Mack 45d760567a ALSA: usb-mixer: use defines from audio.h
No need for the private enum.

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-12 12:20:07 +01:00
Daniel Mack 7e84789403 linux/usb/audio.h: split header
- Split the audio.h file in two to clearly denote the differences
  between the standards.
- Add many more defines to audio-v2.h. Most of them are not currently
  used.
- Replaced a magic value with a proper define

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-12 12:19:49 +01:00
Clemens Ladisch 29088fef3e ALSA: usb-audio: support multiple formats with audio class v2 devices
Change the parser to correctly handle v2 descriptors with multiple
format bits set.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-05 08:18:54 +01:00
Clemens Ladisch 015eb0b081 ALSA: usb-audio: use a format bitmask per alternate setting
In preparation for USB audio 2.0 support, change the audioformat
structure so that it uses a bitmask to specify possible formats.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-05 08:18:32 +01:00
Daniel Mack e5779998bf ALSA: usb-audio: refactor code
Clean up the usb audio driver by factoring out a lot of functions to
separate files. Code for procfs, quirks, urbs, format parsers etc all
got a new home now.

Moved almost all special quirk handling to quirks.c and introduced new
generic functions to handle them, so the exceptions do not pollute the
whole driver.

Renamed usbaudio.c to card.c because this is what it actually does now.
Renamed usbmidi.c to midi.c for namespace clarity.
Removed more things from usbaudio.h.

The non-standard drivers were adopted accordingly.

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Cc: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2010-03-05 08:17:14 +01:00