linux-toradex.git/sound/usb, branch v5.0

ALSA: usb-audio: Fix implicit fb endpoint setup by quirk

2019-02-07T19:04:43+00:00

The commit a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to
separate function") introduced an error in the handling of quirks for
implicit feedback endpoints. This commit fixes this.

If a quirk successfully sets up an implicit feedback endpoint, usb-audio
no longer tries to find the implicit fb endpoint itself.

Fixes: a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function")
Signed-off-by: Manuel Reinhardt 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: Add support for new T+A USB DAC

2019-02-05T16:21:55+00:00

This patch adds the T+A VID to the generic check in order to enable
native DSD support for T+A devices. This works with the new T+A USB
DAC model SD3100HV and will also work with future devices which
support the XMOS/Thesycon style DSD format.

Signed-off-by: Udo Eberhardt 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: Add Opus #3 to quirks for native DSD support

2019-01-25T18:45:42+00:00

This patch adds quirk VID/PID IDs for the Opus #3 DAP (made by 'The Bit')
in order to enable Native DSD support.

[ NOTE: this could be handled in the generic way with fp->dvd_raw if
  we add 0x10cb to the vendor whitelist, but since 0x10cb shows a
  different vendor name (Erantech), put to the individual entry at
  this time -- tiwai ]

Signed-off-by: Olek Poplavsky 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: fix CM6206 register definitions

2019-01-08T21:51:44+00:00

fix typo after a recent commit causing headphones to have no sound

Fixes: ad43d528a7ac (ALSA: usb-audio: Define registers for CM6206)
Signed-off-by: Amadeusz Sławiński 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks

2019-01-07T10:10:31+00:00

In `create_composite_quirk`, the terminating condition of for loops is
`quirk->ifnum < 0`. So any composite quirks should end with `struct
snd_usb_audio_quirk` object with ifnum < 0.

    for (quirk = quirk_comp->data; quirk->ifnum >= 0; ++quirk) {

    	.....
    }

the data field of Bower's & Wilkins PX headphones usb device device quirks
do not end with {.ifnum = -1}, wihch may result in out-of-bound read.

This Patch fix the bug by adding an ending quirk object.

Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
Signed-off-by: Hui Peng 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: Always check descriptor sizes in parser code

2019-01-07T10:10:17+00:00

There are a few places where we access the data without checking the
actual object size from the USB audio descriptor.  This may result in
OOB access, as recently reported.

This patch addresses these missing checks.  Most of added codes are
simple bLength checks in the caller side.  For the input and output
terminal parsers, we put the length check in the parser functions.
For the input terminal, a new argument is added to distinguish between
UAC1 and the rest, as they treat different objects.

Reported-by: Mathias Payer 
Reported-by: Hui Peng 
Tested-by: Hui Peng 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: Check mixer unit descriptors more strictly

2019-01-07T09:46:27+00:00

We've had some sanity checks of the mixer unit descriptors but they
are too loose and some corner cases are overlooked.  Add more strict
checks in uac_mixer_unit_get_channels() for avoiding possible OOB
accesses by malformed descriptors.

This also changes the semantics of uac_mixer_unit_get_channels()
slightly.  Now it returns zero for the cases where the descriptor
lacks of bmControls instead of -EINVAL.  Then the caller side skips
the mixer creation for such unit while it keeps parsing it.
This corresponds to the case like Maya44.

Cc: 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()

2019-01-07T09:46:26+00:00

The parser for the processing unit reads bNrInPins field before the
bLength sanity check, which may lead to an out-of-bound access when a
malformed descriptor is given.  Fix it by assignment after the bLength
check.

Cc: 
Signed-off-by: Takashi Iwai

Merge branch 'for-linus' into for-next

2018-12-07T10:40:04+00:00

Back-merge for applying the more HD-audio quirks on top of the latest
code.

Signed-off-by: Takashi Iwai

ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c

2018-12-03T15:09:38+00:00

If a USB sound card reports 0 interfaces, an error condition is triggered
and the function usb_audio_probe errors out. In the error path, there was a
use-after-free vulnerability where the memory object of the card was first
freed, followed by a decrement of the number of active chips. Moving the
decrement above the atomic_dec fixes the UAF.

[ The original problem was introduced in 3.1 kernel, while it was
  developed in a different form.  The Fixes tag below indicates the
  original commit but it doesn't mean that the patch is applicable
  cleanly. -- tiwai ]

Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit")
Reported-by: Hui Peng 
Reported-by: Mathias Payer 
Signed-off-by: Hui Peng 
Signed-off-by: Mathias Payer 
Cc: 
Signed-off-by: Takashi Iwai