* FAILED: patch "[PATCH] ALSA: usbusx2y: validate URB actual_length in interrupt" failed to apply to 6.6-stable tree
@ 2026-09-16 9:14 gregkh
2026-09-16 15:49 ` [PATCH 6.6.y 1/3] ALSA: usx2y: Use standard print API Sasha Levin
0 siblings, 1 reply; 4+ messages in thread
From: gregkh @ 2026-09-16 9:14 UTC (permalink / raw)
To: tristan, tiwai; +Cc: stable
The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 8f5ef203abda9dd36b2af473c7b737d544f807bd
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026091645-humorist-crown-6882@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 8f5ef203abda9dd36b2af473c7b737d544f807bd Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Fri, 4 Sep 2026 20:58:26 +0000
Subject: [PATCH] ALSA: usbusx2y: validate URB actual_length in interrupt
callback
i_usx2y_in04_int() processes the interrupt URB data without checking
urb->actual_length. A short transfer from a malfunctioning device
would cause the handler to process uninitialized heap data from the
kmalloc-allocated in04_buf, which is then copied to the mmap-accessible
ctl_snapshot[] array.
Fix by using kzalloc() for in04_buf to zero-initialize the buffer,
and adding an actual_length check to skip processing on short
transfers while still resubmitting the URB.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Link: https://patch.msgid.link/20260904205826.4071119-2-tristmd@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
index 200b708aacd6..108f9bddf9aa 100644
--- a/sound/usb/usx2y/usbusx2y.c
+++ b/sound/usb/usx2y/usbusx2y.c
@@ -189,6 +189,9 @@ static void i_usx2y_in04_int(struct urb *urb)
return;
}
+ if (urb->actual_length < USX2Y_IN04_SIZE)
+ goto resubmit;
+
if (us428ctls) {
diff = -1;
if (us428ctls->ctl_snapshot_last == -2) {
@@ -253,6 +256,7 @@ static void i_usx2y_in04_int(struct urb *urb)
if (err)
dev_err(&urb->dev->dev, "in04_int() usb_submit_urb err=%i\n", err);
+resubmit:
urb->dev = usx2y->dev;
usb_submit_urb(urb, GFP_ATOMIC);
}
@@ -305,7 +309,7 @@ int usx2y_in04_init(struct usx2ydev *usx2y)
goto error;
}
- usx2y->in04_buf = kmalloc(USX2Y_IN04_SIZE, GFP_KERNEL);
+ usx2y->in04_buf = kzalloc(USX2Y_IN04_SIZE, GFP_KERNEL);
if (!usx2y->in04_buf) {
err = -ENOMEM;
goto error;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 6.6.y 1/3] ALSA: usx2y: Use standard print API
2026-09-16 9:14 FAILED: patch "[PATCH] ALSA: usbusx2y: validate URB actual_length in interrupt" failed to apply to 6.6-stable tree gregkh
@ 2026-09-16 15:49 ` Sasha Levin
2026-09-16 15:49 ` [PATCH 6.6.y 2/3] ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf Sasha Levin
2026-09-16 15:49 ` [PATCH 6.6.y 3/3] ALSA: usbusx2y: validate URB actual_length in interrupt callback Sasha Levin
0 siblings, 2 replies; 4+ messages in thread
From: Sasha Levin @ 2026-09-16 15:49 UTC (permalink / raw)
To: stable; +Cc: Takashi Iwai, Jaroslav Kysela, Sasha Levin
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit f8466d91f36d97e237ea1b3c6f19de980054a1b6 ]
Use the standard print API with dev_*() instead of the old house-baked
one. It gives better information and allows dynamically control of
debug prints.
Some superfluous debug prints are dropped, and some ambiguous messages
are slightly rephrased. The sk.dev pointer is set properly for
allowing to call dev_*() functions, too.
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20240807133452.9424-45-tiwai@suse.de
Stable-dep-of: 8f5ef203abda ("ALSA: usbusx2y: validate URB actual_length in interrupt callback")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/usx2y/us122l.c | 45 ++++++----------
sound/usb/usx2y/usX2Yhwdep.c | 25 +++------
sound/usb/usx2y/usb_stream.c | 92 +++++++++++++++------------------
sound/usb/usx2y/usb_stream.h | 1 +
sound/usb/usx2y/usbusx2y.c | 7 ++-
sound/usb/usx2y/usbusx2yaudio.c | 67 ++++++++++++++----------
sound/usb/usx2y/usx2yhwdeppcm.c | 54 ++++++++++---------
7 files changed, 141 insertions(+), 150 deletions(-)
diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index 612047ca5fe7a..ca5fac03ec798 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -84,12 +84,9 @@ static int us144_create_usbmidi(struct snd_card *card)
static void pt_info_set(struct usb_device *dev, u8 v)
{
- int ret;
-
- ret = usb_control_msg_send(dev, 0, 'I',
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- v, 0, NULL, 0, 1000, GFP_NOIO);
- snd_printdd(KERN_DEBUG "%i\n", ret);
+ usb_control_msg_send(dev, 0, 'I',
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ v, 0, NULL, 0, 1000, GFP_NOIO);
}
static void usb_stream_hwdep_vm_open(struct vm_area_struct *area)
@@ -97,7 +94,6 @@ static void usb_stream_hwdep_vm_open(struct vm_area_struct *area)
struct us122l *us122l = area->vm_private_data;
atomic_inc(&us122l->mmap_count);
- snd_printdd(KERN_DEBUG "%i\n", atomic_read(&us122l->mmap_count));
}
static vm_fault_t usb_stream_hwdep_vm_fault(struct vm_fault *vmf)
@@ -141,7 +137,6 @@ static void usb_stream_hwdep_vm_close(struct vm_area_struct *area)
struct us122l *us122l = area->vm_private_data;
atomic_dec(&us122l->mmap_count);
- snd_printdd(KERN_DEBUG "%i\n", atomic_read(&us122l->mmap_count));
}
static const struct vm_operations_struct usb_stream_hwdep_vm_ops = {
@@ -155,7 +150,6 @@ static int usb_stream_hwdep_open(struct snd_hwdep *hw, struct file *file)
struct us122l *us122l = hw->private_data;
struct usb_interface *iface;
- snd_printdd(KERN_DEBUG "%p %p\n", hw, file);
if (hw->used >= 2)
return -EBUSY;
@@ -176,8 +170,6 @@ static int usb_stream_hwdep_release(struct snd_hwdep *hw, struct file *file)
struct us122l *us122l = hw->private_data;
struct usb_interface *iface;
- snd_printdd(KERN_DEBUG "%p %p\n", hw, file);
-
if (us122l->is_us144) {
iface = usb_ifnum_to_if(us122l->dev, 0);
usb_autopm_put_interface(iface);
@@ -213,12 +205,10 @@ static int usb_stream_hwdep_mmap(struct snd_hwdep *hw,
err = -EPERM;
goto out;
}
- snd_printdd(KERN_DEBUG "%lu %u\n", size,
- read ? s->read_size : s->write_size);
/* if userspace tries to mmap beyond end of our buffer, fail */
if (size > PAGE_ALIGN(read ? s->read_size : s->write_size)) {
- snd_printk(KERN_WARNING "%lu > %u\n", size,
- read ? s->read_size : s->write_size);
+ dev_warn(hw->card->dev, "%s: size %lu > %u\n", __func__,
+ size, read ? s->read_size : s->write_size);
err = -EINVAL;
goto out;
}
@@ -289,8 +279,8 @@ static int us122l_set_sample_rate(struct usb_device *dev, int rate)
UAC_EP_CS_ATTR_SAMPLE_RATE << 8, ep, data, 3,
1000, GFP_NOIO);
if (err)
- snd_printk(KERN_ERR "%d: cannot set freq %d to ep 0x%x\n",
- dev->devnum, rate, ep);
+ dev_err(&dev->dev, "%d: cannot set freq %d to ep 0x%x\n",
+ dev->devnum, rate, ep);
return err;
}
@@ -326,13 +316,13 @@ static bool us122l_start(struct us122l *us122l,
err = us122l_set_sample_rate(us122l->dev, rate);
if (err < 0) {
us122l_stop(us122l);
- snd_printk(KERN_ERR "us122l_set_sample_rate error\n");
+ dev_err(&us122l->dev->dev, "us122l_set_sample_rate error\n");
goto out;
}
err = usb_stream_start(&us122l->sk);
if (err < 0) {
us122l_stop(us122l);
- snd_printk(KERN_ERR "%s error %i\n", __func__, err);
+ dev_err(&us122l->dev->dev, "%s error %i\n", __func__, err);
goto out;
}
list_for_each(p, &us122l->midi_list)
@@ -445,13 +435,13 @@ static bool us122l_create_card(struct snd_card *card)
if (us122l->is_us144) {
err = usb_set_interface(us122l->dev, 0, 1);
if (err) {
- snd_printk(KERN_ERR "usb_set_interface error\n");
+ dev_err(card->dev, "usb_set_interface error\n");
return false;
}
}
err = usb_set_interface(us122l->dev, 1, 1);
if (err) {
- snd_printk(KERN_ERR "usb_set_interface error\n");
+ dev_err(card->dev, "usb_set_interface error\n");
return false;
}
@@ -466,7 +456,7 @@ static bool us122l_create_card(struct snd_card *card)
else
err = us122l_create_usbmidi(card);
if (err < 0) {
- snd_printk(KERN_ERR "us122l_create_usbmidi error %i\n", err);
+ dev_err(card->dev, "us122l_create_usbmidi error %i\n", err);
goto stop;
}
err = usb_stream_hwdep_new(card);
@@ -517,6 +507,7 @@ static int usx2y_create_card(struct usb_device *device,
card->private_free = snd_us122l_free;
US122L(card)->dev = device;
mutex_init(&US122L(card)->mutex);
+ US122L(card)->sk.dev = device;
init_waitqueue_head(&US122L(card)->sk.sleep);
US122L(card)->is_us144 = flags & US122L_FLAG_US144;
INIT_LIST_HEAD(&US122L(card)->midi_list);
@@ -572,12 +563,10 @@ static int snd_us122l_probe(struct usb_interface *intf,
if (id->driver_info & US122L_FLAG_US144 &&
device->speed == USB_SPEED_HIGH) {
- snd_printk(KERN_ERR "disable ehci-hcd to run US-144\n");
+ dev_err(&device->dev, "disable ehci-hcd to run US-144\n");
return -ENODEV;
}
- snd_printdd(KERN_DEBUG"%p:%i\n",
- intf, intf->cur_altsetting->desc.bInterfaceNumber);
if (intf->cur_altsetting->desc.bInterfaceNumber != 1)
return 0;
@@ -665,13 +654,13 @@ static int snd_us122l_resume(struct usb_interface *intf)
if (us122l->is_us144) {
err = usb_set_interface(us122l->dev, 0, 1);
if (err) {
- snd_printk(KERN_ERR "usb_set_interface error\n");
+ dev_err(&us122l->dev->dev, "usb_set_interface error\n");
goto unlock;
}
}
err = usb_set_interface(us122l->dev, 1, 1);
if (err) {
- snd_printk(KERN_ERR "usb_set_interface error\n");
+ dev_err(&us122l->dev->dev, "usb_set_interface error\n");
goto unlock;
}
@@ -681,7 +670,7 @@ static int snd_us122l_resume(struct usb_interface *intf)
err = us122l_set_sample_rate(us122l->dev,
us122l->sk.s->cfg.sample_rate);
if (err < 0) {
- snd_printk(KERN_ERR "us122l_set_sample_rate error\n");
+ dev_err(&us122l->dev->dev, "us122l_set_sample_rate error\n");
goto unlock;
}
err = usb_stream_start(&us122l->sk);
diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
index 34421b85838af..2cc0f90a23be3 100644
--- a/sound/usb/usx2y/usX2Yhwdep.c
+++ b/sound/usb/usx2y/usX2Yhwdep.c
@@ -24,10 +24,6 @@ static vm_fault_t snd_us428ctls_vm_fault(struct vm_fault *vmf)
struct page *page;
void *vaddr;
- snd_printdd("ENTER, start %lXh, pgoff %ld\n",
- vmf->vma->vm_start,
- vmf->pgoff);
-
offset = vmf->pgoff << PAGE_SHIFT;
if (offset >= US428_SHAREDMEM_PAGES)
return VM_FAULT_SIGBUS;
@@ -36,9 +32,6 @@ static vm_fault_t snd_us428ctls_vm_fault(struct vm_fault *vmf)
get_page(page);
vmf->page = page;
- snd_printdd("vaddr=%p made us428ctls_vm_fault() page %p\n",
- vaddr, page);
-
return 0;
}
@@ -58,7 +51,8 @@ static int snd_us428ctls_mmap(struct snd_hwdep *hw, struct file *filp, struct vm
/* if userspace tries to mmap beyond end of our buffer, fail */
if (size > US428_SHAREDMEM_PAGES) {
- snd_printd("%lu > %lu\n", size, (unsigned long)US428_SHAREDMEM_PAGES);
+ dev_dbg(hw->card->dev, "%s: mmap size %lu > %lu\n", __func__,
+ size, (unsigned long)US428_SHAREDMEM_PAGES);
return -EINVAL;
}
@@ -152,7 +146,6 @@ static int usx2y_create_usbmidi(struct snd_card *card)
le16_to_cpu(dev->descriptor.idProduct) == USB_ID_US428 ?
&quirk_2 : &quirk_1;
- snd_printdd("%s\n", __func__);
return snd_usbmidi_create(card, iface, &usx2y(card)->midi_list, quirk);
}
@@ -162,7 +155,8 @@ static int usx2y_create_alsa_devices(struct snd_card *card)
err = usx2y_create_usbmidi(card);
if (err < 0) {
- snd_printk(KERN_ERR "%s: usx2y_create_usbmidi error %i\n", __func__, err);
+ dev_err(card->dev, "%s: usx2y_create_usbmidi error %i\n",
+ __func__, err);
return err;
}
err = usx2y_audio_create(card);
@@ -185,15 +179,13 @@ static int snd_usx2y_hwdep_dsp_load(struct snd_hwdep *hw,
int lret, err;
char *buf;
- snd_printdd("dsp_load %s\n", dsp->name);
-
buf = memdup_user(dsp->image, dsp->length);
if (IS_ERR(buf))
return PTR_ERR(buf);
err = usb_set_interface(dev, 0, 1);
if (err)
- snd_printk(KERN_ERR "usb_set_interface error\n");
+ dev_err(&dev->dev, "usb_set_interface error\n");
else
err = usb_bulk_msg(dev, usb_sndbulkpipe(dev, 2), buf, dsp->length, &lret, 6000);
kfree(buf);
@@ -203,21 +195,20 @@ static int snd_usx2y_hwdep_dsp_load(struct snd_hwdep *hw,
msleep(250); // give the device some time
err = usx2y_async_seq04_init(priv);
if (err) {
- snd_printk(KERN_ERR "usx2y_async_seq04_init error\n");
+ dev_err(&dev->dev, "usx2y_async_seq04_init error\n");
return err;
}
err = usx2y_in04_init(priv);
if (err) {
- snd_printk(KERN_ERR "usx2y_in04_init error\n");
+ dev_err(&dev->dev, "usx2y_in04_init error\n");
return err;
}
err = usx2y_create_alsa_devices(hw->card);
if (err) {
- snd_printk(KERN_ERR "usx2y_create_alsa_devices error %i\n", err);
+ dev_err(&dev->dev, "usx2y_create_alsa_devices error %i\n", err);
return err;
}
priv->chip_status |= USX2Y_STAT_CHIP_INIT;
- snd_printdd("%s: alsa all started\n", hw->name);
}
return err;
}
diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
index a4d32e8a1d366..66ea610aa433e 100644
--- a/sound/usb/usx2y/usb_stream.c
+++ b/sound/usb/usx2y/usb_stream.c
@@ -34,14 +34,11 @@ static void playback_prep_freqn(struct usb_stream_kernel *sk, struct urb *urb)
urb->iso_frame_desc[pack].length = l;
lb += l;
}
- snd_printdd(KERN_DEBUG "%i\n", lb);
check:
urb->number_of_packets = pack;
urb->transfer_buffer_length = lb;
s->idle_outsize += lb - s->period_size;
- snd_printdd(KERN_DEBUG "idle=%i ul=%i ps=%i\n", s->idle_outsize,
- lb, s->period_size);
}
static int init_pipe_urbs(struct usb_stream_kernel *sk,
@@ -191,14 +188,14 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk,
write_size = max_packsize * packets * USB_STREAM_URBDEPTH;
if (read_size >= 256*PAGE_SIZE || write_size >= 256*PAGE_SIZE) {
- snd_printk(KERN_WARNING "a size exceeds 128*PAGE_SIZE\n");
+ dev_warn(&dev->dev, "%s: a size exceeds 128*PAGE_SIZE\n", __func__);
goto out;
}
sk->s = alloc_pages_exact(read_size,
GFP_KERNEL | __GFP_ZERO | __GFP_NOWARN);
if (!sk->s) {
- pr_warn("us122l: couldn't allocate read buffer\n");
+ dev_warn(&dev->dev, "us122l: couldn't allocate read buffer\n");
goto out;
}
sk->s->cfg.version = USB_STREAM_INTERFACE_VERSION;
@@ -217,7 +214,7 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk,
sk->write_page = alloc_pages_exact(write_size,
GFP_KERNEL | __GFP_ZERO | __GFP_NOWARN);
if (!sk->write_page) {
- pr_warn("us122l: couldn't allocate write buffer\n");
+ dev_warn(&dev->dev, "us122l: couldn't allocate write buffer\n");
usb_stream_free(sk);
return NULL;
}
@@ -246,7 +243,8 @@ static bool balance_check(struct usb_stream_kernel *sk, struct urb *urb)
if (unlikely(urb->status)) {
if (urb->status != -ESHUTDOWN && urb->status != -ENOENT)
- snd_printk(KERN_WARNING "status=%i\n", urb->status);
+ dev_warn(&sk->dev->dev, "%s: status=%i\n", __func__,
+ urb->status);
sk->iso_frame_balance = 0x7FFFFFFF;
return false;
}
@@ -318,17 +316,18 @@ static int usb_stream_prepare_playback(struct usb_stream_kernel *sk,
check_ok:
s->sync_packet -= inurb->number_of_packets;
if (unlikely(s->sync_packet < -2 || s->sync_packet > 0)) {
- snd_printk(KERN_WARNING "invalid sync_packet = %i;"
- " p=%i nop=%i %i %x %x %x > %x\n",
- s->sync_packet, p, inurb->number_of_packets,
- s->idle_outsize + lb + l,
- s->idle_outsize, lb, l,
- s->period_size);
+ dev_warn(&sk->dev->dev,
+ "%s: invalid sync_packet = %i; p=%i nop=%i %i %x %x %x > %x\n",
+ __func__,
+ s->sync_packet, p, inurb->number_of_packets,
+ s->idle_outsize + lb + l,
+ s->idle_outsize, lb, l,
+ s->period_size);
return -1;
}
if (unlikely(lb % s->cfg.frame_size)) {
- snd_printk(KERN_WARNING"invalid outsize = %i\n",
- lb);
+ dev_warn(&sk->dev->dev, "%s: invalid outsize = %i\n",
+ __func__, lb);
return -1;
}
s->idle_outsize += lb - s->period_size;
@@ -337,7 +336,7 @@ static int usb_stream_prepare_playback(struct usb_stream_kernel *sk,
if (s->idle_outsize <= 0)
return 0;
- snd_printk(KERN_WARNING "idle=%i\n", s->idle_outsize);
+ dev_warn(&sk->dev->dev, "%s: idle=%i\n", __func__, s->idle_outsize);
return -1;
}
@@ -377,7 +376,7 @@ static int submit_urbs(struct usb_stream_kernel *sk,
return 0;
report_failure:
- snd_printk(KERN_ERR "%i\n", err);
+ dev_err(&sk->dev->dev, "%s error: %i\n", __func__, err);
return err;
}
@@ -424,8 +423,8 @@ static void loop_back(struct usb_stream *s)
}
if (iu == sk->completed_inurb) {
if (l != s->period_size)
- printk(KERN_DEBUG"%s:%i %i\n", __func__, __LINE__,
- l/(int)s->cfg.frame_size);
+ dev_dbg(&sk->dev->dev, "%s:%i %i\n", __func__, __LINE__,
+ l/(int)s->cfg.frame_size);
return;
}
@@ -460,8 +459,8 @@ static void stream_idle(struct usb_stream_kernel *sk,
l = id[p].actual_length;
if (unlikely(l == 0 || id[p].status)) {
- snd_printk(KERN_WARNING "underrun, status=%u\n",
- id[p].status);
+ dev_warn(&sk->dev->dev, "%s: underrun, status=%u\n",
+ __func__, id[p].status);
goto err_out;
}
s->inpacket_head++;
@@ -482,8 +481,8 @@ static void stream_idle(struct usb_stream_kernel *sk,
}
s->idle_insize += urb_size - s->period_size;
if (s->idle_insize < 0) {
- snd_printk(KERN_WARNING "%i\n",
- (s->idle_insize)/(int)s->cfg.frame_size);
+ dev_warn(&sk->dev->dev, "%s error: %i\n", __func__,
+ (s->idle_insize)/(int)s->cfg.frame_size);
goto err_out;
}
s->insize_done += urb_size;
@@ -558,19 +557,15 @@ static void stream_start(struct usb_stream_kernel *sk,
min_frames += frames_per_packet;
diff = urb_size -
(min_frames >> 8) * s->cfg.frame_size;
- if (diff < max_diff) {
- snd_printdd(KERN_DEBUG "%i %i %i %i\n",
- s->insize_done,
- urb_size / (int)s->cfg.frame_size,
- inurb->number_of_packets, diff);
+ if (diff < max_diff)
max_diff = diff;
- }
}
s->idle_insize -= max_diff - max_diff_0;
s->idle_insize += urb_size - s->period_size;
if (s->idle_insize < 0) {
- snd_printk(KERN_WARNING "%i %i %i\n",
- s->idle_insize, urb_size, s->period_size);
+ dev_warn(&sk->dev->dev, "%s idle_insize: %i %i %i\n",
+ __func__,
+ s->idle_insize, urb_size, s->period_size);
return;
} else if (s->idle_insize == 0) {
s->next_inpacket_split =
@@ -620,7 +615,7 @@ static void i_capture_start(struct urb *urb)
int empty = 0;
if (urb->status) {
- snd_printk(KERN_WARNING "status=%i\n", urb->status);
+ dev_warn(&sk->dev->dev, "%s: status=%i\n", __func__, urb->status);
return;
}
@@ -630,7 +625,7 @@ static void i_capture_start(struct urb *urb)
if (l < s->cfg.frame_size) {
++empty;
if (s->state >= usb_stream_sync0) {
- snd_printk(KERN_WARNING "%i\n", l);
+ dev_warn(&sk->dev->dev, "%s: length %i\n", __func__, l);
return;
}
}
@@ -642,8 +637,8 @@ static void i_capture_start(struct urb *urb)
}
#ifdef SHOW_EMPTY
if (empty) {
- printk(KERN_DEBUG"%s:%i: %i", __func__, __LINE__,
- urb->iso_frame_desc[0].actual_length);
+ dev_dbg(&sk->dev->dev, "%s:%i: %i", __func__, __LINE__,
+ urb->iso_frame_desc[0].actual_length);
for (pack = 1; pack < urb->number_of_packets; ++pack) {
int l = urb->iso_frame_desc[pack].actual_length;
@@ -710,38 +705,38 @@ int usb_stream_start(struct usb_stream_kernel *sk)
}
err = usb_submit_urb(inurb, GFP_ATOMIC);
if (err < 0) {
- snd_printk(KERN_ERR
- "usb_submit_urb(sk->inurb[%i]) returned %i\n",
- u, err);
+ dev_err(&sk->dev->dev,
+ "%s: usb_submit_urb(sk->inurb[%i]) returned %i\n",
+ __func__, u, err);
return err;
}
err = usb_submit_urb(outurb, GFP_ATOMIC);
if (err < 0) {
- snd_printk(KERN_ERR
- "usb_submit_urb(sk->outurb[%i]) returned %i\n",
- u, err);
+ dev_err(&sk->dev->dev,
+ "%s: usb_submit_urb(sk->outurb[%i]) returned %i\n",
+ __func__, u, err);
return err;
}
if (inurb->start_frame != outurb->start_frame) {
- snd_printd(KERN_DEBUG
- "u[%i] start_frames differ in:%u out:%u\n",
- u, inurb->start_frame, outurb->start_frame);
+ dev_dbg(&sk->dev->dev,
+ "%s: u[%i] start_frames differ in:%u out:%u\n",
+ __func__, u, inurb->start_frame, outurb->start_frame);
goto check_retry;
}
}
- snd_printdd(KERN_DEBUG "%i %i\n", frame, iters);
try = 0;
check_retry:
if (try) {
usb_stream_stop(sk);
if (try < 5) {
msleep(1500);
- snd_printd(KERN_DEBUG "goto dotry;\n");
+ dev_dbg(&sk->dev->dev, "goto dotry;\n");
goto dotry;
}
- snd_printk(KERN_WARNING
- "couldn't start all urbs on the same start_frame.\n");
+ dev_warn(&sk->dev->dev,
+ "%s: couldn't start all urbs on the same start_frame.\n",
+ __func__);
return -EFAULT;
}
@@ -755,7 +750,6 @@ int usb_stream_start(struct usb_stream_kernel *sk)
int wait_ms = 3000;
while (s->state != usb_stream_ready && wait_ms > 0) {
- snd_printdd(KERN_DEBUG "%i\n", s->state);
msleep(200);
wait_ms -= 200;
}
diff --git a/sound/usb/usx2y/usb_stream.h b/sound/usb/usx2y/usb_stream.h
index 73e57b341adc8..2ed10add49f1a 100644
--- a/sound/usb/usx2y/usb_stream.h
+++ b/sound/usb/usx2y/usb_stream.h
@@ -9,6 +9,7 @@
struct usb_stream_kernel {
struct usb_stream *s;
+ struct usb_device *dev;
void *write_page;
diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
index 0fe989a633769..5756ff3528a2d 100644
--- a/sound/usb/usx2y/usbusx2y.c
+++ b/sound/usb/usx2y/usbusx2y.c
@@ -169,7 +169,7 @@ static void i_usx2y_out04_int(struct urb *urb)
for (i = 0; i < 10 && usx2y->as04.urb[i] != urb; i++)
;
- snd_printdd("%s urb %i status=%i\n", __func__, i, urb->status);
+ dev_dbg(&urb->dev->dev, "%s urb %i status=%i\n", __func__, i, urb->status);
}
#endif
}
@@ -185,11 +185,10 @@ static void i_usx2y_in04_int(struct urb *urb)
usx2y->in04_int_calls++;
if (urb->status) {
- snd_printdd("Interrupt Pipe 4 came back with status=%i\n", urb->status);
+ dev_dbg(&urb->dev->dev, "Interrupt Pipe 4 came back with status=%i\n", urb->status);
return;
}
- // printk("%i:0x%02X ", 8, (int)((unsigned char*)usx2y->in04_buf)[8]); Master volume shows 0 here if fader is at max during boot ?!?
if (us428ctls) {
diff = -1;
if (us428ctls->ctl_snapshot_last == -2) {
@@ -245,7 +244,7 @@ static void i_usx2y_in04_int(struct urb *urb)
}
if (err)
- snd_printk(KERN_ERR "in04_int() usb_submit_urb err=%i\n", err);
+ dev_err(&urb->dev->dev, "in04_int() usb_submit_urb err=%i\n", err);
urb->dev = usx2y->dev;
usb_submit_urb(urb, GFP_ATOMIC);
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index 98d0e8edc9832..e8c7a9ba4e51d 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -40,14 +40,15 @@ static int usx2y_urb_capt_retire(struct snd_usx2y_substream *subs)
for (i = 0; i < nr_of_packs(); i++) {
cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset;
if (urb->iso_frame_desc[i].status) { /* active? hmm, skip this */
- snd_printk(KERN_ERR
- "active frame status %i. Most probably some hardware problem.\n",
- urb->iso_frame_desc[i].status);
+ dev_err(&usx2y->dev->dev,
+ "%s: active frame status %i. Most probably some hardware problem.\n",
+ __func__,
+ urb->iso_frame_desc[i].status);
return urb->iso_frame_desc[i].status;
}
len = urb->iso_frame_desc[i].actual_length / usx2y->stride;
if (!len) {
- snd_printd("0 == len ERROR!\n");
+ dev_dbg(&usx2y->dev->dev, "%s: 0 == len ERROR!\n", __func__);
continue;
}
@@ -101,7 +102,8 @@ static int usx2y_urb_play_prepare(struct snd_usx2y_substream *subs,
counts = cap_urb->iso_frame_desc[pack].actual_length / usx2y->stride;
count += counts;
if (counts < 43 || counts > 50) {
- snd_printk(KERN_ERR "should not be here with counts=%i\n", counts);
+ dev_err(&usx2y->dev->dev, "%s: should not be here with counts=%i\n",
+ __func__, counts);
return -EPIPE;
}
/* set up descriptor */
@@ -169,7 +171,8 @@ static int usx2y_urb_submit(struct snd_usx2y_substream *subs, struct urb *urb, i
urb->dev = subs->usx2y->dev; /* we need to set this at each time */
err = usb_submit_urb(urb, GFP_ATOMIC);
if (err < 0) {
- snd_printk(KERN_ERR "usb_submit_urb() returned %i\n", err);
+ dev_err(&urb->dev->dev, "%s: usb_submit_urb() returned %i\n",
+ __func__, err);
return err;
}
return 0;
@@ -237,7 +240,8 @@ static void usx2y_clients_stop(struct usx2ydev *usx2y)
for (s = 0; s < 4; s++) {
subs = usx2y->subs[s];
if (subs) {
- snd_printdd("%i %p state=%i\n", s, subs, atomic_read(&subs->state));
+ dev_dbg(&usx2y->dev->dev, "%s: %i %p state=%i\n",
+ __func__, s, subs, atomic_read(&subs->state));
atomic_set(&subs->state, STATE_STOPPED);
}
}
@@ -249,8 +253,9 @@ static void usx2y_clients_stop(struct usx2ydev *usx2y)
for (u = 0; u < NRURBS; u++) {
urb = subs->urb[u];
if (urb)
- snd_printdd("%i status=%i start_frame=%i\n",
- u, urb->status, urb->start_frame);
+ dev_dbg(&usx2y->dev->dev,
+ "%s: %i status=%i start_frame=%i\n",
+ __func__, u, urb->status, urb->start_frame);
}
}
}
@@ -261,7 +266,8 @@ static void usx2y_clients_stop(struct usx2ydev *usx2y)
static void usx2y_error_urb_status(struct usx2ydev *usx2y,
struct snd_usx2y_substream *subs, struct urb *urb)
{
- snd_printk(KERN_ERR "ep=%i stalled with status=%i\n", subs->endpoint, urb->status);
+ dev_err(&usx2y->dev->dev, "%s: ep=%i stalled with status=%i\n",
+ __func__, subs->endpoint, urb->status);
urb->status = 0;
usx2y_clients_stop(usx2y);
}
@@ -273,10 +279,12 @@ static void i_usx2y_urb_complete(struct urb *urb)
struct snd_usx2y_substream *capsubs, *playbacksubs;
if (unlikely(atomic_read(&subs->state) < STATE_PREPARED)) {
- snd_printdd("hcd_frame=%i ep=%i%s status=%i start_frame=%i\n",
- usb_get_current_frame_number(usx2y->dev),
- subs->endpoint, usb_pipein(urb->pipe) ? "in" : "out",
- urb->status, urb->start_frame);
+ dev_dbg(&usx2y->dev->dev,
+ "%s: hcd_frame=%i ep=%i%s status=%i start_frame=%i\n",
+ __func__,
+ usb_get_current_frame_number(usx2y->dev),
+ subs->endpoint, usb_pipein(urb->pipe) ? "in" : "out",
+ urb->status, urb->start_frame);
return;
}
if (unlikely(urb->status)) {
@@ -296,7 +304,6 @@ static void i_usx2y_urb_complete(struct urb *urb)
if (!usx2y_usbframe_complete(capsubs, playbacksubs, urb->start_frame)) {
usx2y->wait_iso_frame += nr_of_packs();
} else {
- snd_printdd("\n");
usx2y_clients_stop(usx2y);
}
}
@@ -346,8 +353,9 @@ static void i_usx2y_subs_startup(struct urb *urb)
static void usx2y_subs_prepare(struct snd_usx2y_substream *subs)
{
- snd_printdd("usx2y_substream_prepare(%p) ep=%i urb0=%p urb1=%p\n",
- subs, subs->endpoint, subs->urb[0], subs->urb[1]);
+ dev_dbg(&subs->usx2y->dev->dev,
+ "%s(%p) ep=%i urb0=%p urb1=%p\n",
+ __func__, subs, subs->endpoint, subs->urb[0], subs->urb[1]);
/* reset the pointer */
subs->hwptr = 0;
subs->hwptr_done = 0;
@@ -372,7 +380,7 @@ static void usx2y_urbs_release(struct snd_usx2y_substream *subs)
{
int i;
- snd_printdd("%s %i\n", __func__, subs->endpoint);
+ dev_dbg(&subs->usx2y->dev->dev, "%s %i\n", __func__, subs->endpoint);
for (i = 0; i < NRURBS; i++)
usx2y_urb_release(subs->urb + i,
subs != subs->usx2y->subs[SNDRV_PCM_STREAM_PLAYBACK]);
@@ -478,7 +486,8 @@ static int usx2y_urbs_start(struct snd_usx2y_substream *subs)
urb->transfer_buffer_length = subs->maxpacksize * nr_of_packs();
err = usb_submit_urb(urb, GFP_ATOMIC);
if (err < 0) {
- snd_printk(KERN_ERR "cannot submit datapipe for urb %d, err = %d\n", i, err);
+ dev_err(&urb->dev->dev, "%s: cannot submit datapipe for urb %d, err = %d\n",
+ __func__, i, err);
err = -EPIPE;
goto cleanup;
} else {
@@ -523,17 +532,16 @@ static int snd_usx2y_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
switch (cmd) {
case SNDRV_PCM_TRIGGER_START:
- snd_printdd("%s(START)\n", __func__);
+ dev_dbg(&subs->usx2y->dev->dev, "%s(START)\n", __func__);
if (atomic_read(&subs->state) == STATE_PREPARED &&
atomic_read(&subs->usx2y->subs[SNDRV_PCM_STREAM_CAPTURE]->state) >= STATE_PREPARED) {
atomic_set(&subs->state, STATE_PRERUNNING);
} else {
- snd_printdd("\n");
return -EPIPE;
}
break;
case SNDRV_PCM_TRIGGER_STOP:
- snd_printdd("%s(STOP)\n", __func__);
+ dev_dbg(&subs->usx2y->dev->dev, "%s(STOP)\n", __func__);
if (atomic_read(&subs->state) >= STATE_PRERUNNING)
atomic_set(&subs->state, STATE_PREPARED);
break;
@@ -634,7 +642,8 @@ static void i_usx2y_04int(struct urb *urb)
struct usx2ydev *usx2y = urb->context;
if (urb->status)
- snd_printk(KERN_ERR "snd_usx2y_04int() urb->status=%i\n", urb->status);
+ dev_err(&urb->dev->dev, "%s() urb->status=%i\n",
+ __func__, urb->status);
if (!--usx2y->us04->len)
wake_up(&usx2y->in04_wait_queue);
}
@@ -724,7 +733,8 @@ static int usx2y_format_set(struct usx2ydev *usx2y, snd_pcm_format_t format)
usb_kill_urb(usx2y->in04_urb);
err = usb_set_interface(usx2y->dev, 0, alternate);
if (err) {
- snd_printk(KERN_ERR "usb_set_interface error\n");
+ dev_err(&usx2y->dev->dev, "%s: usb_set_interface error\n",
+ __func__);
return err;
}
usx2y->in04_urb->dev = usx2y->dev;
@@ -751,7 +761,7 @@ static int snd_usx2y_pcm_hw_params(struct snd_pcm_substream *substream,
int i;
mutex_lock(&usx2y(card)->pcm_mutex);
- snd_printdd("snd_usx2y_hw_params(%p, %p)\n", substream, hw_params);
+ dev_dbg(&dev->dev->dev, "%s(%p, %p)\n", __func__, substream, hw_params);
/* all pcm substreams off one usx2y have to operate at the same
* rate & format
*/
@@ -787,7 +797,7 @@ static int snd_usx2y_pcm_hw_free(struct snd_pcm_substream *substream)
struct snd_usx2y_substream *cap_subs, *playback_subs;
mutex_lock(&subs->usx2y->pcm_mutex);
- snd_printdd("snd_usx2y_hw_free(%p)\n", substream);
+ dev_dbg(&subs->usx2y->dev->dev, "%s(%p)\n", __func__, substream);
if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
cap_subs = subs->usx2y->subs[SNDRV_PCM_STREAM_CAPTURE];
@@ -823,7 +833,7 @@ static int snd_usx2y_pcm_prepare(struct snd_pcm_substream *substream)
struct snd_usx2y_substream *capsubs = subs->usx2y->subs[SNDRV_PCM_STREAM_CAPTURE];
int err = 0;
- snd_printdd("%s(%p)\n", __func__, substream);
+ dev_dbg(&usx2y->dev->dev, "%s(%p)\n", __func__, substream);
mutex_lock(&usx2y->pcm_mutex);
usx2y_subs_prepare(subs);
@@ -840,7 +850,8 @@ static int snd_usx2y_pcm_prepare(struct snd_pcm_substream *substream)
if (err < 0)
goto up_prepare_mutex;
}
- snd_printdd("starting capture pipe for %s\n", subs == capsubs ? "self" : "playpipe");
+ dev_dbg(&usx2y->dev->dev, "%s: starting capture pipe for %s\n",
+ __func__, subs == capsubs ? "self" : "playpipe");
err = usx2y_urbs_start(capsubs);
if (err < 0)
goto up_prepare_mutex;
diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
index 54290caa9fadc..0b8dd9e3f984e 100644
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -59,13 +59,13 @@ static int usx2y_usbpcm_urb_capt_retire(struct snd_usx2y_substream *subs)
if (head >= ARRAY_SIZE(usx2y->hwdep_pcm_shm->captured_iso))
head = 0;
usx2y->hwdep_pcm_shm->capture_iso_start = head;
- snd_printdd("cap start %i\n", head);
+ dev_dbg(&usx2y->dev->dev, "cap start %i\n", head);
}
for (i = 0; i < nr_of_packs(); i++) {
if (urb->iso_frame_desc[i].status) { /* active? hmm, skip this */
- snd_printk(KERN_ERR
- "active frame status %i. Most probably some hardware problem.\n",
- urb->iso_frame_desc[i].status);
+ dev_err(&usx2y->dev->dev,
+ "active frame status %i. Most probably some hardware problem.\n",
+ urb->iso_frame_desc[i].status);
return urb->iso_frame_desc[i].status;
}
lens += urb->iso_frame_desc[i].actual_length / usx2y->stride;
@@ -120,7 +120,7 @@ static int usx2y_hwdep_urb_play_prepare(struct snd_usx2y_substream *subs,
/* calculate the size of a packet */
counts = shm->captured_iso[shm->playback_iso_head].length / usx2y->stride;
if (counts < 43 || counts > 50) {
- snd_printk(KERN_ERR "should not be here with counts=%i\n", counts);
+ dev_err(&usx2y->dev->dev, "should not be here with counts=%i\n", counts);
return -EPIPE;
}
/* set up descriptor */
@@ -234,10 +234,11 @@ static void i_usx2y_usbpcm_urb_complete(struct urb *urb)
struct snd_usx2y_substream *capsubs, *capsubs2, *playbacksubs;
if (unlikely(atomic_read(&subs->state) < STATE_PREPARED)) {
- snd_printdd("hcd_frame=%i ep=%i%s status=%i start_frame=%i\n",
- usb_get_current_frame_number(usx2y->dev),
- subs->endpoint, usb_pipein(urb->pipe) ? "in" : "out",
- urb->status, urb->start_frame);
+ dev_dbg(&usx2y->dev->dev,
+ "hcd_frame=%i ep=%i%s status=%i start_frame=%i\n",
+ usb_get_current_frame_number(usx2y->dev),
+ subs->endpoint, usb_pipein(urb->pipe) ? "in" : "out",
+ urb->status, urb->start_frame);
return;
}
if (unlikely(urb->status)) {
@@ -255,7 +256,6 @@ static void i_usx2y_usbpcm_urb_complete(struct urb *urb)
if (!usx2y_usbpcm_usbframe_complete(capsubs, capsubs2, playbacksubs, urb->start_frame)) {
usx2y->wait_iso_frame += nr_of_packs();
} else {
- snd_printdd("\n");
usx2y_clients_stop(usx2y);
}
}
@@ -275,7 +275,8 @@ static void usx2y_usbpcm_urbs_release(struct snd_usx2y_substream *subs)
{
int i;
- snd_printdd("snd_usx2y_urbs_release() %i\n", subs->endpoint);
+ dev_dbg(&subs->usx2y->dev->dev,
+ "snd_usx2y_urbs_release() %i\n", subs->endpoint);
for (i = 0; i < NRURBS; i++)
usx2y_hwdep_urb_release(subs->urb + i);
}
@@ -365,7 +366,7 @@ static int snd_usx2y_usbpcm_hw_free(struct snd_pcm_substream *substream)
struct snd_usx2y_substream *cap_subs2;
mutex_lock(&subs->usx2y->pcm_mutex);
- snd_printdd("%s(%p)\n", __func__, substream);
+ dev_dbg(&subs->usx2y->dev->dev, "%s(%p)\n", __func__, substream);
cap_subs2 = subs->usx2y->subs[SNDRV_PCM_STREAM_CAPTURE + 2];
if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
@@ -456,11 +457,12 @@ static int usx2y_usbpcm_urbs_start(struct snd_usx2y_substream *subs)
urb->transfer_buffer_length = subs->maxpacksize * nr_of_packs();
err = usb_submit_urb(urb, GFP_KERNEL);
if (err < 0) {
- snd_printk(KERN_ERR "cannot usb_submit_urb() for urb %d, err = %d\n", u, err);
+ dev_err(&urb->dev->dev,
+ "cannot usb_submit_urb() for urb %d, err = %d\n",
+ u, err);
err = -EPIPE;
goto cleanup;
} else {
- snd_printdd("%i\n", urb->start_frame);
if (!u)
usx2y->wait_iso_frame = urb->start_frame;
}
@@ -500,7 +502,7 @@ static int snd_usx2y_usbpcm_prepare(struct snd_pcm_substream *substream)
struct snd_usx2y_substream *capsubs = subs->usx2y->subs[SNDRV_PCM_STREAM_CAPTURE];
int err = 0;
- snd_printdd("snd_usx2y_pcm_prepare(%p)\n", substream);
+ dev_dbg(&usx2y->dev->dev, "snd_usx2y_pcm_prepare(%p)\n", substream);
mutex_lock(&usx2y->pcm_mutex);
@@ -528,8 +530,9 @@ static int snd_usx2y_usbpcm_prepare(struct snd_pcm_substream *substream)
if (err < 0)
goto up_prepare_mutex;
}
- snd_printdd("starting capture pipe for %s\n", subs == capsubs ?
- "self" : "playpipe");
+ dev_dbg(&usx2y->dev->dev,
+ "starting capture pipe for %s\n", subs == capsubs ?
+ "self" : "playpipe");
err = usx2y_usbpcm_urbs_start(capsubs);
if (err < 0)
goto up_prepare_mutex;
@@ -540,9 +543,10 @@ static int snd_usx2y_usbpcm_prepare(struct snd_pcm_substream *substream)
if (atomic_read(&subs->state) < STATE_PREPARED) {
while (usx2y_iso_frames_per_buffer(runtime, usx2y) >
usx2y->hwdep_pcm_shm->captured_iso_frames) {
- snd_printdd("Wait: iso_frames_per_buffer=%i,captured_iso_frames=%i\n",
- usx2y_iso_frames_per_buffer(runtime, usx2y),
- usx2y->hwdep_pcm_shm->captured_iso_frames);
+ dev_dbg(&usx2y->dev->dev,
+ "Wait: iso_frames_per_buffer=%i,captured_iso_frames=%i\n",
+ usx2y_iso_frames_per_buffer(runtime, usx2y),
+ usx2y->hwdep_pcm_shm->captured_iso_frames);
if (msleep_interruptible(10)) {
err = -ERESTARTSYS;
goto up_prepare_mutex;
@@ -552,9 +556,10 @@ static int snd_usx2y_usbpcm_prepare(struct snd_pcm_substream *substream)
if (err < 0)
goto up_prepare_mutex;
}
- snd_printdd("Ready: iso_frames_per_buffer=%i,captured_iso_frames=%i\n",
- usx2y_iso_frames_per_buffer(runtime, usx2y),
- usx2y->hwdep_pcm_shm->captured_iso_frames);
+ dev_dbg(&usx2y->dev->dev,
+ "Ready: iso_frames_per_buffer=%i,captured_iso_frames=%i\n",
+ usx2y_iso_frames_per_buffer(runtime, usx2y),
+ usx2y->hwdep_pcm_shm->captured_iso_frames);
} else {
usx2y->hwdep_pcm_shm->capture_iso_start = -1;
}
@@ -700,7 +705,8 @@ static int snd_usx2y_hwdep_pcm_mmap(struct snd_hwdep *hw, struct file *filp, str
/* if userspace tries to mmap beyond end of our buffer, fail */
if (size > USX2Y_HWDEP_PCM_PAGES) {
- snd_printd("%lu > %lu\n", size, (unsigned long)USX2Y_HWDEP_PCM_PAGES);
+ dev_dbg(hw->card->dev, "%s: %lu > %lu\n", __func__,
+ size, (unsigned long)USX2Y_HWDEP_PCM_PAGES);
return -EINVAL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 6.6.y 2/3] ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
2026-09-16 15:49 ` [PATCH 6.6.y 1/3] ALSA: usx2y: Use standard print API Sasha Levin
@ 2026-09-16 15:49 ` Sasha Levin
2026-09-16 15:49 ` [PATCH 6.6.y 3/3] ALSA: usbusx2y: validate URB actual_length in interrupt callback Sasha Levin
1 sibling, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2026-09-16 15:49 UTC (permalink / raw)
To: stable; +Cc: Tristan Madani, Takashi Iwai, Sasha Levin
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 861111a14740e12c36d363e9830f8daa734279c9 ]
The in04_last array in struct usx2ydev is declared as char[24], but
in04_buf is allocated as sizeof(struct us428_ctls) which is 21 bytes.
In i_usx2y_in04_int(), when ctl_snapshot_last == -2 (initialization
path):
memcpy(usx2y->in04_last, usx2y->in04_buf, sizeof(usx2y->in04_last));
This copies 24 bytes from a 21-byte slab allocation, reading 3 bytes
past the end of the source object.
Introduce a USX2Y_IN04_SIZE constant defined as sizeof(struct
us428_ctls) and use it consistently for the in04_last array, the
in04_buf allocation, the URB transfer length, and the comparison loop,
replacing the bare 24 and 21 literals throughout.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Link: https://patch.msgid.link/20260904205826.4071119-1-tristmd@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Stable-dep-of: 8f5ef203abda ("ALSA: usbusx2y: validate URB actual_length in interrupt callback")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/usx2y/usbusx2y.c | 6 +++---
sound/usb/usx2y/usbusx2y.h | 4 +++-
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
index 5756ff3528a2d..5aa373d1edab1 100644
--- a/sound/usb/usx2y/usbusx2y.c
+++ b/sound/usb/usx2y/usbusx2y.c
@@ -196,7 +196,7 @@ static void i_usx2y_in04_int(struct urb *urb)
memcpy(usx2y->in04_last, usx2y->in04_buf, sizeof(usx2y->in04_last));
us428ctls->ctl_snapshot_last = -1;
} else {
- for (i = 0; i < 21; i++) {
+ for (i = 0; i < USX2Y_IN04_SIZE; i++) {
if (usx2y->in04_last[i] != ((char *)usx2y->in04_buf)[i]) {
if (diff < 0)
diff = i;
@@ -298,7 +298,7 @@ int usx2y_in04_init(struct usx2ydev *usx2y)
goto error;
}
- usx2y->in04_buf = kmalloc(21, GFP_KERNEL);
+ usx2y->in04_buf = kmalloc(USX2Y_IN04_SIZE, GFP_KERNEL);
if (!usx2y->in04_buf) {
err = -ENOMEM;
goto error;
@@ -306,7 +306,7 @@ int usx2y_in04_init(struct usx2ydev *usx2y)
init_waitqueue_head(&usx2y->in04_wait_queue);
usb_fill_int_urb(usx2y->in04_urb, usx2y->dev, usb_rcvintpipe(usx2y->dev, 0x4),
- usx2y->in04_buf, 21,
+ usx2y->in04_buf, USX2Y_IN04_SIZE,
i_usx2y_in04_int, usx2y,
10);
if (usb_urb_ep_type_check(usx2y->in04_urb)) {
diff --git a/sound/usb/usx2y/usbusx2y.h b/sound/usb/usx2y/usbusx2y.h
index 0538c457921e6..a2f1e3755eb91 100644
--- a/sound/usb/usx2y/usbusx2y.h
+++ b/sound/usb/usx2y/usbusx2y.h
@@ -5,6 +5,8 @@
#include "../midi.h"
#include "usbus428ctldefs.h"
+#define USX2Y_IN04_SIZE sizeof(struct us428_ctls)
+
#define NRURBS 2
/* Default value used for nr of packs per urb.
@@ -55,7 +57,7 @@ struct usx2ydev {
int stride;
struct urb *in04_urb;
void *in04_buf;
- char in04_last[24];
+ char in04_last[USX2Y_IN04_SIZE];
unsigned int in04_int_calls;
struct snd_usx2y_urb_seq *us04;
wait_queue_head_t in04_wait_queue;
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 6.6.y 3/3] ALSA: usbusx2y: validate URB actual_length in interrupt callback
2026-09-16 15:49 ` [PATCH 6.6.y 1/3] ALSA: usx2y: Use standard print API Sasha Levin
2026-09-16 15:49 ` [PATCH 6.6.y 2/3] ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf Sasha Levin
@ 2026-09-16 15:49 ` Sasha Levin
1 sibling, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2026-09-16 15:49 UTC (permalink / raw)
To: stable; +Cc: Tristan Madani, Takashi Iwai, Sasha Levin
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 8f5ef203abda9dd36b2af473c7b737d544f807bd ]
i_usx2y_in04_int() processes the interrupt URB data without checking
urb->actual_length. A short transfer from a malfunctioning device
would cause the handler to process uninitialized heap data from the
kmalloc-allocated in04_buf, which is then copied to the mmap-accessible
ctl_snapshot[] array.
Fix by using kzalloc() for in04_buf to zero-initialize the buffer,
and adding an actual_length check to skip processing on short
transfers while still resubmitting the URB.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Link: https://patch.msgid.link/20260904205826.4071119-2-tristmd@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/usx2y/usbusx2y.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
index 5aa373d1edab1..d1e907dc773c1 100644
--- a/sound/usb/usx2y/usbusx2y.c
+++ b/sound/usb/usx2y/usbusx2y.c
@@ -189,6 +189,9 @@ static void i_usx2y_in04_int(struct urb *urb)
return;
}
+ if (urb->actual_length < USX2Y_IN04_SIZE)
+ goto resubmit;
+
if (us428ctls) {
diff = -1;
if (us428ctls->ctl_snapshot_last == -2) {
@@ -246,6 +249,7 @@ static void i_usx2y_in04_int(struct urb *urb)
if (err)
dev_err(&urb->dev->dev, "in04_int() usb_submit_urb err=%i\n", err);
+resubmit:
urb->dev = usx2y->dev;
usb_submit_urb(urb, GFP_ATOMIC);
}
@@ -298,7 +302,7 @@ int usx2y_in04_init(struct usx2ydev *usx2y)
goto error;
}
- usx2y->in04_buf = kmalloc(USX2Y_IN04_SIZE, GFP_KERNEL);
+ usx2y->in04_buf = kzalloc(USX2Y_IN04_SIZE, GFP_KERNEL);
if (!usx2y->in04_buf) {
err = -ENOMEM;
goto error;
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-16 15:49 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-16 9:14 FAILED: patch "[PATCH] ALSA: usbusx2y: validate URB actual_length in interrupt" failed to apply to 6.6-stable tree gregkh
2026-09-16 15:49 ` [PATCH 6.6.y 1/3] ALSA: usx2y: Use standard print API Sasha Levin
2026-09-16 15:49 ` [PATCH 6.6.y 2/3] ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf Sasha Levin
2026-09-16 15:49 ` [PATCH 6.6.y 3/3] ALSA: usbusx2y: validate URB actual_length in interrupt callback Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox