linux-toradex.git/sound/usb/format.c, branch v3.2.47

ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk()

2013-06-19T01:16:42+00:00

commit 8866f405efd4171f9d9c91901d2dd02f01bacb60 upstream.

A malicious USB device could feed in a large nr_rates value.  This would
cause the subsequent call to kmemdup() to allocate a smaller buffer than
expected, leading to out-of-bounds access.

This patch validates the nr_rates value and reuses the limit introduced
in commit 4fa0e81b ("ALSA: usb-audio: fix possible hang and overflow
in parse_uac2_sample_rate_range()").

Signed-off-by: Xi Wang 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()

2013-06-19T01:16:41+00:00

commit 4fa0e81b83503900be277e6273a79651b375e288 upstream.

A malicious USB device may feed in carefully crafted min/max/res values,
so that the inner loop in parse_uac2_sample_rate_range() could run for
a long time or even never terminate, e.g., given max = INT_MAX.

Also nr_rates could be a large integer, which causes an integer overflow
in the subsequent call to kmalloc() in parse_audio_format_rates_v2().
Thus, kmalloc() would allocate a smaller buffer than expected, leading
to a memory corruption.

To exploit the two vulnerabilities, an attacker needs physical access
to the machine to plug in a malicious USB device.

This patch makes two changes.

1) The type of "rate" is changed to unsigned int, so that the loop could
   stop once "rate" is larger than INT_MAX.

2) Limit nr_rates to 1024.

Suggested-by: Takashi Iwai 
Signed-off-by: Xi Wang 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: usb-audio: increase control transfer timeout

2011-09-27T07:21:48+00:00

There are certain devices that are reportedly so slow that they need
more than 100 ms to handle control transfers.  Therefore, increase the
timeout in mixer(_quirks).c to 1000 ms.

The timeout parameter of snd_usb_ctl_msg() is now constant, so we can
drop it.

Reported-by: Felipe Balbi 
Signed-off-by: Clemens Ladisch 
Signed-off-by: Takashi Iwai

Merge branch 'topic/misc' into for-linus

2011-05-22T08:01:29+00:00

ALSA: usb-audio: include format.h in format.c

2011-05-18T09:44:41+00:00

Just in case a prototype changes, we'll be warned. This also fixes a
sparse warning.

Signed-off-by: Daniel Mack 
Signed-off-by: Takashi Iwai

ALSA: usb-audio - Terratec Aureon 7.1 USB ID as C-Media cm6206 quirks

2011-04-28T16:22:41+00:00

This patch adds support for the Terratec Aureon 7.1 USB which uses a
C-Media cm6206 and needs all the quirks already found in the past.

Signed-off-by: Wolfgang Breyha 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: add Edirol SD-90 PCM support

2011-01-10T15:47:10+00:00

Add support for the 24-bit audio I/Os of the Edirol SD-90 interface.

Reported-any-tested-by: Jim Grusendorf 
Signed-off-by: Clemens Ladisch 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: fix detection of vendor-specific device protocol settings

2010-09-03T20:36:39+00:00

The Audio Class v2 support code in 2.6.35 added checks for the
bInterfaceProtocol field.  However, there are devices (usually those
detected by vendor-specific quirks) that do not have one of the
predefined values in this field, which made the driver reject them.

To fix this regression, restore the old behaviour, i.e., assume that
a device with an unknown bInterfaceProtocol field (other than
UAC_VERSION_2) has more or less UAC-v1-compatible descriptors.

[compile warning fixes by tiwai]

Signed-off-by: Clemens Ladisch 
Cc: Daniel Mack 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: sound/usb/format: silence uninitialized variable warnings

2010-08-15T12:28:20+00:00

Gcc complains that ret might be used uninitialized:

sound/usb/format.c: In function ‘snd_usb_parse_audio_format’:
sound/usb/format.c:354: warning: ‘ret’ may be used uninitialized in this function
sound/usb/format.c:354: note: ‘ret’ was declared here
sound/usb/format.c:414: warning: ‘ret’ may be used uninitialized in this function
sound/usb/format.c:414: note: ‘ret’ was declared here

I suppose it could be uninitialized if there is ever a UAC_VERSION_3
released. Anyway this patch is worthwhile if only to silence the gcc
warning.

Signed-off-by: Dan Carpenter 
Acked-by: Daniel Mack 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: simplify control interface access

2010-06-23T14:10:23+00:00

As the control interface is now carried in struct snd_usb_audio, we can
simplify the API a little and also drop the private ctrlif field from
struct usb_mixer_interface.

Also remove a left-over function prototype in pcm.h.

Signed-off-by: Daniel Mack 
Signed-off-by: Takashi Iwai