[PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[Kirill Marinushkin]

The layout of the UAC2 Control request and response varies depending on
the request type. With the current implementation, only the Layout 2
Parameter Block (with the 2-byte sized RANGE attribute) is handled
properly. For the Control requests with the 1-byte sized RANGE attribute
(Bass Control, Mid Control, Tremble Control), the response is parsed
incorrectly.

This commit:
* fixes the wLength field value in the request
* fixes parsing the range values from the response

Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.com>
Cc: Jaejoong Kim <climbbb.kim@gmail.com>
Cc: Bhumika Goyal <bhumirks@gmail.com>
Cc: Stephen Barber <smbarber@chromium.org>
Cc: Julian Scheel <julian@jusst.de>
Cc: alsa-devel@alsa-project.org
Cc: linux-kernel@vger.kernel.org
---
 sound/usb/mixer.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 2b4ceda36291..20b28a5a1456 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -347,17 +347,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request,
 			    int validx, int *value_ret)
 {
 	struct snd_usb_audio *chip = cval->head.mixer->chip;
-	unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range */
+	/* enough space for one range */
+	unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)];
 	unsigned char *val;
-	int idx = 0, ret, size;
+	int idx = 0, ret, val_size, size;
 	__u8 bRequest;
 
+	val_size = uac2_ctl_value_size(cval->val_type);
+
 	if (request == UAC_GET_CUR) {
 		bRequest = UAC2_CS_CUR;
-		size = uac2_ctl_value_size(cval->val_type);
+		size = val_size;
 	} else {
 		bRequest = UAC2_CS_RANGE;
-		size = sizeof(buf);
+		size = sizeof(__u16) + 3 * val_size;
 	}
 
 	memset(buf, 0, sizeof(buf));
@@ -390,16 +393,17 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request,
 		val = buf + sizeof(__u16);
 		break;
 	case UAC_GET_MAX:
-		val = buf + sizeof(__u16) * 2;
+		val = buf + sizeof(__u16) + val_size;
 		break;
 	case UAC_GET_RES:
-		val = buf + sizeof(__u16) * 3;
+		val = buf + sizeof(__u16) + val_size * 2;
 		break;
 	default:
 		return -EINVAL;
 	}
 
-	*value_ret = convert_signed_value(cval, snd_usb_combine_bytes(val, sizeof(__u16)));
+	*value_ret = convert_signed_value(cval,
+					  snd_usb_combine_bytes(val, val_size));
 
 	return 0;
 }
-- 
2.13.6

Re: [PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[Takashi Iwai]

On Mon, 29 Jan 2018 06:37:55 +0100,
Kirill Marinushkin wrote:
> 
> The layout of the UAC2 Control request and response varies depending on
> the request type. With the current implementation, only the Layout 2
> Parameter Block (with the 2-byte sized RANGE attribute) is handled
> properly. For the Control requests with the 1-byte sized RANGE attribute
> (Bass Control, Mid Control, Tremble Control), the response is parsed
> incorrectly.
> 
> This commit:
> * fixes the wLength field value in the request
> * fixes parsing the range values from the response
> 
> Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
> Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
> Cc: Jaroslav Kysela <perex@perex.cz>
> Cc: Takashi Iwai <tiwai@suse.com>
> Cc: Jaejoong Kim <climbbb.kim@gmail.com>
> Cc: Bhumika Goyal <bhumirks@gmail.com>
> Cc: Stephen Barber <smbarber@chromium.org>
> Cc: Julian Scheel <julian@jusst.de>
> Cc: alsa-devel@alsa-project.org
> Cc: linux-kernel@vger.kernel.org

Sorry for the late reply, as I've been (and still) off.

Does this bug actually hit on any real devices, or is it only a
logical error so far?  In the former case, a Cc to stable is
mandatory.

In anyway, I'll review and merge it properly once after I back to
work.


thanks,

Takashi

Re: [PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[Takashi Iwai]

On Mon, 29 Jan 2018 06:37:55 +0100,
Kirill Marinushkin wrote:
> 
> The layout of the UAC2 Control request and response varies depending on
> the request type. With the current implementation, only the Layout 2
> Parameter Block (with the 2-byte sized RANGE attribute) is handled
> properly. For the Control requests with the 1-byte sized RANGE attribute
> (Bass Control, Mid Control, Tremble Control), the response is parsed
> incorrectly.
> 
> This commit:
> * fixes the wLength field value in the request
> * fixes parsing the range values from the response
> 
> Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
> Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
> Cc: Jaroslav Kysela <perex@perex.cz>
> Cc: Takashi Iwai <tiwai@suse.com>
> Cc: Jaejoong Kim <climbbb.kim@gmail.com>
> Cc: Bhumika Goyal <bhumirks@gmail.com>
> Cc: Stephen Barber <smbarber@chromium.org>
> Cc: Julian Scheel <julian@jusst.de>
> Cc: alsa-devel@alsa-project.org
> Cc: linux-kernel@vger.kernel.org

Sorry for the late reply, as I've been (and still) off.

Does this bug actually hit on any real devices, or is it only a
logical error so far?  In the former case, a Cc to stable is
mandatory.

In anyway, I'll review and merge it properly once after I back to
work.


thanks,

Takashi

Re: [PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[Kirill Marinushkin]

On 02/07/18 06:45, Takashi Iwai wrote:
> On Mon, 29 Jan 2018 06:37:55 +0100,
> Kirill Marinushkin wrote:
>> The layout of the UAC2 Control request and response varies depending on
>> the request type. With the current implementation, only the Layout 2
>> Parameter Block (with the 2-byte sized RANGE attribute) is handled
>> properly. For the Control requests with the 1-byte sized RANGE attribute
>> (Bass Control, Mid Control, Tremble Control), the response is parsed
>> incorrectly.
>>
>> This commit:
>> * fixes the wLength field value in the request
>> * fixes parsing the range values from the response
>>
>> Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
>> Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
>> Cc: Jaroslav Kysela <perex@perex.cz>
>> Cc: Takashi Iwai <tiwai@suse.com>
>> Cc: Jaejoong Kim <climbbb.kim@gmail.com>
>> Cc: Bhumika Goyal <bhumirks@gmail.com>
>> Cc: Stephen Barber <smbarber@chromium.org>
>> Cc: Julian Scheel <julian@jusst.de>
>> Cc: alsa-devel@alsa-project.org
>> Cc: linux-kernel@vger.kernel.org
> Sorry for the late reply, as I've been (and still) off.
>
> Does this bug actually hit on any real devices, or is it only a
> logical error so far?  In the former case, a Cc to stable is
> mandatory.
>
> In anyway, I'll review and merge it properly once after I back to
> work.
>
>
> thanks,
>
> Takashi

Hello Takashi,

Thank you for your answer. I will wait until you are back to work, don't 
worry about the late replies.

I did not hit the issue on a real device.

During my UAC2 experiments, I reproduced this issue on the development 
board, and then tested my solution on it.
 
Best Regards,
Kirill

Re: [PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[Takashi Iwai]

On Thu, 08 Feb 2018 07:21:36 +0100,
Kirill Marinushkin wrote:
> 
> On 02/07/18 06:45, Takashi Iwai wrote:
> > On Mon, 29 Jan 2018 06:37:55 +0100,
> > Kirill Marinushkin wrote:
> >> The layout of the UAC2 Control request and response varies depending on
> >> the request type. With the current implementation, only the Layout 2
> >> Parameter Block (with the 2-byte sized RANGE attribute) is handled
> >> properly. For the Control requests with the 1-byte sized RANGE attribute
> >> (Bass Control, Mid Control, Tremble Control), the response is parsed
> >> incorrectly.
> >>
> >> This commit:
> >> * fixes the wLength field value in the request
> >> * fixes parsing the range values from the response
> >>
> >> Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
> >> Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
> >> Cc: Jaroslav Kysela <perex@perex.cz>
> >> Cc: Takashi Iwai <tiwai@suse.com>
> >> Cc: Jaejoong Kim <climbbb.kim@gmail.com>
> >> Cc: Bhumika Goyal <bhumirks@gmail.com>
> >> Cc: Stephen Barber <smbarber@chromium.org>
> >> Cc: Julian Scheel <julian@jusst.de>
> >> Cc: alsa-devel@alsa-project.org
> >> Cc: linux-kernel@vger.kernel.org
> > Sorry for the late reply, as I've been (and still) off.
> >
> > Does this bug actually hit on any real devices, or is it only a
> > logical error so far?  In the former case, a Cc to stable is
> > mandatory.
> >
> > In anyway, I'll review and merge it properly once after I back to
> > work.
> >
> >
> > thanks,
> >
> > Takashi
> 
> Hello Takashi,
> 
> Thank you for your answer. I will wait until you are back to work, don't 
> worry about the late replies.
> 
> I did not hit the issue on a real device.
> 
> During my UAC2 experiments, I reproduced this issue on the development 
> board, and then tested my solution on it.

OK, if it happened on a development system, it's a real issue, and we
should put Cc to stable.  Now I applied the patch.

Thanks!


Takashi

Re: [PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[Takashi Iwai]

On Thu, 08 Feb 2018 07:21:36 +0100,
Kirill Marinushkin wrote:
> 
> On 02/07/18 06:45, Takashi Iwai wrote:
> > On Mon, 29 Jan 2018 06:37:55 +0100,
> > Kirill Marinushkin wrote:
> >> The layout of the UAC2 Control request and response varies depending on
> >> the request type. With the current implementation, only the Layout 2
> >> Parameter Block (with the 2-byte sized RANGE attribute) is handled
> >> properly. For the Control requests with the 1-byte sized RANGE attribute
> >> (Bass Control, Mid Control, Tremble Control), the response is parsed
> >> incorrectly.
> >>
> >> This commit:
> >> * fixes the wLength field value in the request
> >> * fixes parsing the range values from the response
> >>
> >> Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
> >> Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
> >> Cc: Jaroslav Kysela <perex@perex.cz>
> >> Cc: Takashi Iwai <tiwai@suse.com>
> >> Cc: Jaejoong Kim <climbbb.kim@gmail.com>
> >> Cc: Bhumika Goyal <bhumirks@gmail.com>
> >> Cc: Stephen Barber <smbarber@chromium.org>
> >> Cc: Julian Scheel <julian@jusst.de>
> >> Cc: alsa-devel@alsa-project.org
> >> Cc: linux-kernel@vger.kernel.org
> > Sorry for the late reply, as I've been (and still) off.
> >
> > Does this bug actually hit on any real devices, or is it only a
> > logical error so far?  In the former case, a Cc to stable is
> > mandatory.
> >
> > In anyway, I'll review and merge it properly once after I back to
> > work.
> >
> >
> > thanks,
> >
> > Takashi
> 
> Hello Takashi,
> 
> Thank you for your answer. I will wait until you are back to work, don't 
> worry about the late replies.
> 
> I did not hit the issue on a real device.
> 
> During my UAC2 experiments, I reproduced this issue on the development 
> board, and then tested my solution on it.

OK, if it happened on a development system, it's a real issue, and we
should put Cc to stable.  Now I applied the patch.

Thanks!


Takashi

Re: [PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[Kirill Marinushkin]

Hello maintainers of <stable@vger.kernel.org>,


As discussed earlier in this thread, I propose this patch to stable.

It fixes the issue, which exists since v2.6.34.


Best Regards,

Kirill

On 02/12/18 09:08, Takashi Iwai wrote:
> On Thu, 08 Feb 2018 07:21:36 +0100,
> Kirill Marinushkin wrote:
>> On 02/07/18 06:45, Takashi Iwai wrote:
>>> On Mon, 29 Jan 2018 06:37:55 +0100,
>>> Kirill Marinushkin wrote:
>>>> The layout of the UAC2 Control request and response varies depending on
>>>> the request type. With the current implementation, only the Layout 2
>>>> Parameter Block (with the 2-byte sized RANGE attribute) is handled
>>>> properly. For the Control requests with the 1-byte sized RANGE attribute
>>>> (Bass Control, Mid Control, Tremble Control), the response is parsed
>>>> incorrectly.
>>>>
>>>> This commit:
>>>> * fixes the wLength field value in the request
>>>> * fixes parsing the range values from the response
>>>>
>>>> Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
>>>> Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
>>>> Cc: Jaroslav Kysela <perex@perex.cz>
>>>> Cc: Takashi Iwai <tiwai@suse.com>
>>>> Cc: Jaejoong Kim <climbbb.kim@gmail.com>
>>>> Cc: Bhumika Goyal <bhumirks@gmail.com>
>>>> Cc: Stephen Barber <smbarber@chromium.org>
>>>> Cc: Julian Scheel <julian@jusst.de>
>>>> Cc: alsa-devel@alsa-project.org
>>>> Cc: linux-kernel@vger.kernel.org
>>> Sorry for the late reply, as I've been (and still) off.
>>>
>>> Does this bug actually hit on any real devices, or is it only a
>>> logical error so far?  In the former case, a Cc to stable is
>>> mandatory.
>>>
>>> In anyway, I'll review and merge it properly once after I back to
>>> work.
>>>
>>>
>>> thanks,
>>>
>>> Takashi
>> Hello Takashi,
>>
>> Thank you for your answer. I will wait until you are back to work, don't 
>> worry about the late replies.
>>
>> I did not hit the issue on a real device.
>>
>> During my UAC2 experiments, I reproduced this issue on the development 
>> board, and then tested my solution on it.
> OK, if it happened on a development system, it's a real issue, and we
> should put Cc to stable.  Now I applied the patch.
>
> Thanks!
>
>
> Takashi

Re: [PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[Takashi Iwai]

On Mon, 12 Feb 2018 20:32:53 +0100,
Kirill Marinushkin wrote:
> 
> Hello maintainers of <stable@vger.kernel.org>,
> 
> 
> As discussed earlier in this thread, I propose this patch to stable.
> 
> It fixes the issue, which exists since v2.6.34.

It's already marked in the applied patch, so you don't need to ping
stable kernel guys.


thanks,

Takashi

> 
> 
> Best Regards,
> 
> Kirill
> 
> On 02/12/18 09:08, Takashi Iwai wrote:
> > On Thu, 08 Feb 2018 07:21:36 +0100,
> > Kirill Marinushkin wrote:
> >> On 02/07/18 06:45, Takashi Iwai wrote:
> >>> On Mon, 29 Jan 2018 06:37:55 +0100,
> >>> Kirill Marinushkin wrote:
> >>>> The layout of the UAC2 Control request and response varies depending on
> >>>> the request type. With the current implementation, only the Layout 2
> >>>> Parameter Block (with the 2-byte sized RANGE attribute) is handled
> >>>> properly. For the Control requests with the 1-byte sized RANGE attribute
> >>>> (Bass Control, Mid Control, Tremble Control), the response is parsed
> >>>> incorrectly.
> >>>>
> >>>> This commit:
> >>>> * fixes the wLength field value in the request
> >>>> * fixes parsing the range values from the response
> >>>>
> >>>> Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
> >>>> Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
> >>>> Cc: Jaroslav Kysela <perex@perex.cz>
> >>>> Cc: Takashi Iwai <tiwai@suse.com>
> >>>> Cc: Jaejoong Kim <climbbb.kim@gmail.com>
> >>>> Cc: Bhumika Goyal <bhumirks@gmail.com>
> >>>> Cc: Stephen Barber <smbarber@chromium.org>
> >>>> Cc: Julian Scheel <julian@jusst.de>
> >>>> Cc: alsa-devel@alsa-project.org
> >>>> Cc: linux-kernel@vger.kernel.org
> >>> Sorry for the late reply, as I've been (and still) off.
> >>>
> >>> Does this bug actually hit on any real devices, or is it only a
> >>> logical error so far?  In the former case, a Cc to stable is
> >>> mandatory.
> >>>
> >>> In anyway, I'll review and merge it properly once after I back to
> >>> work.
> >>>
> >>>
> >>> thanks,
> >>>
> >>> Takashi
> >> Hello Takashi,
> >>
> >> Thank you for your answer. I will wait until you are back to work, don't 
> >> worry about the late replies.
> >>
> >> I did not hit the issue on a real device.
> >>
> >> During my UAC2 experiments, I reproduced this issue on the development 
> >> board, and then tested my solution on it.
> > OK, if it happened on a development system, it's a real issue, and we
> > should put Cc to stable.  Now I applied the patch.
> >
> > Thanks!
> >
> >
> > Takashi
> 

Re: [PATCH] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

[Kirill Marinushkin]

On 02/13/18 06:04, Takashi Iwai wrote:
> On Mon, 12 Feb 2018 20:32:53 +0100,
> Kirill Marinushkin wrote:
>> Hello maintainers of <stable@vger.kernel.org>,
>>
>>
>> As discussed earlier in this thread, I propose this patch to stable.
>>
>> It fixes the issue, which exists since v2.6.34.
> It's already marked in the applied patch, so you don't need to ping
> stable kernel guys.
>
>
> thanks,
>
> Takashi

Hello Takashi,

Thank you for the clarification

Best Regards,
Kirill
>
>>
>> Best Regards,
>>
>> Kirill
>>
>> On 02/12/18 09:08, Takashi Iwai wrote:
>>> On Thu, 08 Feb 2018 07:21:36 +0100,
>>> Kirill Marinushkin wrote:
>>>> On 02/07/18 06:45, Takashi Iwai wrote:
>>>>> On Mon, 29 Jan 2018 06:37:55 +0100,
>>>>> Kirill Marinushkin wrote:
>>>>>> The layout of the UAC2 Control request and response varies depending on
>>>>>> the request type. With the current implementation, only the Layout 2
>>>>>> Parameter Block (with the 2-byte sized RANGE attribute) is handled
>>>>>> properly. For the Control requests with the 1-byte sized RANGE attribute
>>>>>> (Bass Control, Mid Control, Tremble Control), the response is parsed
>>>>>> incorrectly.
>>>>>>
>>>>>> This commit:
>>>>>> * fixes the wLength field value in the request
>>>>>> * fixes parsing the range values from the response
>>>>>>
>>>>>> Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
>>>>>> Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
>>>>>> Cc: Jaroslav Kysela <perex@perex.cz>
>>>>>> Cc: Takashi Iwai <tiwai@suse.com>
>>>>>> Cc: Jaejoong Kim <climbbb.kim@gmail.com>
>>>>>> Cc: Bhumika Goyal <bhumirks@gmail.com>
>>>>>> Cc: Stephen Barber <smbarber@chromium.org>
>>>>>> Cc: Julian Scheel <julian@jusst.de>
>>>>>> Cc: alsa-devel@alsa-project.org
>>>>>> Cc: linux-kernel@vger.kernel.org
>>>>> Sorry for the late reply, as I've been (and still) off.
>>>>>
>>>>> Does this bug actually hit on any real devices, or is it only a
>>>>> logical error so far?  In the former case, a Cc to stable is
>>>>> mandatory.
>>>>>
>>>>> In anyway, I'll review and merge it properly once after I back to
>>>>> work.
>>>>>
>>>>>
>>>>> thanks,
>>>>>
>>>>> Takashi
>>>> Hello Takashi,
>>>>
>>>> Thank you for your answer. I will wait until you are back to work, don't 
>>>> worry about the late replies.
>>>>
>>>> I did not hit the issue on a real device.
>>>>
>>>> During my UAC2 experiments, I reproduced this issue on the development 
>>>> board, and then tested my solution on it.
>>> OK, if it happened on a development system, it's a real issue, and we
>>> should put Cc to stable.  Now I applied the patch.
>>>
>>> Thanks!
>>>
>>>
>>> Takashi