From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-sn1nam02on0133.outbound.protection.outlook.com ([104.47.36.133]:15072 "EHLO NAM02-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032470AbeCAPfq (ORCPT ); Thu, 1 Mar 2018 10:35:46 -0500 From: Sasha Levin To: "stable@vger.kernel.org" , "stable-commits@vger.kernel.org" CC: Kirill Marinushkin , Takashi Iwai , Sasha Levin Subject: [added to the 4.1 stable tree] ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute Date: Thu, 1 Mar 2018 15:26:32 +0000 Message-ID: <20180301152116.1486-374-alexander.levin@microsoft.com> References: <20180301152116.1486-1-alexander.levin@microsoft.com> In-Reply-To: <20180301152116.1486-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Kirill Marinushkin This patch has been added to the 4.1 stable tree. If you have any objections, please let us know. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ Upstream commit 447cae58cecd69392b74a4a42cd0ab9cabd816af ] The layout of the UAC2 Control request and response varies depending on the request type. With the current implementation, only the Layout 2 Parameter Block (with the 2-byte sized RANGE attribute) is handled properly. For the Control requests with the 1-byte sized RANGE attribute (Bass Control, Mid Control, Tremble Control), the response is parsed incorrectly. This commit: * fixes the wLength field value in the request * fixes parsing the range values from the response Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0") Signed-off-by: Kirill Marinushkin Cc: Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/usb/mixer.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 5455efc8cf63..76f7c95b38af 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -343,17 +343,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_inf= o *cval, int request, int validx, int *value_ret) { struct snd_usb_audio *chip =3D cval->head.mixer->chip; - unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range *= / + /* enough space for one range */ + unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)]; unsigned char *val; - int idx =3D 0, ret, size; + int idx =3D 0, ret, val_size, size; __u8 bRequest; =20 + val_size =3D uac2_ctl_value_size(cval->val_type); + if (request =3D=3D UAC_GET_CUR) { bRequest =3D UAC2_CS_CUR; - size =3D uac2_ctl_value_size(cval->val_type); + size =3D val_size; } else { bRequest =3D UAC2_CS_RANGE; - size =3D sizeof(buf); + size =3D sizeof(__u16) + 3 * val_size; } =20 memset(buf, 0, sizeof(buf)); @@ -386,16 +389,17 @@ static int get_ctl_value_v2(struct usb_mixer_elem_inf= o *cval, int request, val =3D buf + sizeof(__u16); break; case UAC_GET_MAX: - val =3D buf + sizeof(__u16) * 2; + val =3D buf + sizeof(__u16) + val_size; break; case UAC_GET_RES: - val =3D buf + sizeof(__u16) * 3; + val =3D buf + sizeof(__u16) + val_size * 2; break; default: return -EINVAL; } =20 - *value_ret =3D convert_signed_value(cval, snd_usb_combine_bytes(val, size= of(__u16))); + *value_ret =3D convert_signed_value(cval, + snd_usb_combine_bytes(val, val_size)); =20 return 0; } --=20 2.14.1