kernel/drivers/usb/gadget/function/u_audio.c, branch linux-6.9.y

usb: gadget: u_audio: Clear uac pointer when freed.

2024-06-12T09:39:17Z

[ Upstream commit a2cf936ebef291ef7395172b9e2f624779fb6dc0 ] This prevents use of a stale pointer if functions are called after g_cleanup that shouldn't be. This doesn't fix any races, but converts a possibly silent kernel memory corruption into an obvious NULL pointer dereference report. Fixes: eb9fecb9e69b ("usb: gadget: f_uac2: split out audio core") Signed-off-by: Chris Wulff Link: https://lore.kernel.org/stable/CO1PR17MB54194226DA08BFC9EBD8C163E1172%40CO1PR17MB5419.namprd17.prod.outlook.com Link: https://lore.kernel.org/r/CO1PR17MB54194226DA08BFC9EBD8C163E1172@CO1PR17MB5419.namprd17.prod.outlook.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.

2024-06-12T09:39:17Z

[ Upstream commit 1b739388aa3f8dfb63a9fca777e6dfa6912d0464 ] Hang on to the control IDs instead of pointers since those are correctly handled with locks. Fixes: 8fe9a03f4331 ("usb: gadget: u_audio: Rate ctl notifies about current srate (0=stopped)") Fixes: c565ad07ef35 ("usb: gadget: u_audio: Support multiple sampling rates") Fixes: 02de698ca812 ("usb: gadget: u_audio: add bi-directional volume and mute support") Signed-off-by: Chris Wulff Link: https://lore.kernel.org/stable/CO1PR17MB5419C2BF44D400E4E620C1ADE1172%40CO1PR17MB5419.namprd17.prod.outlook.com Link: https://lore.kernel.org/r/CO1PR17MB5419C2BF44D400E4E620C1ADE1172@CO1PR17MB5419.namprd17.prod.outlook.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

usb: gadget: u_audio: don't let userspace block driver unbind

2023-03-09T13:56:32Z

In the unbind callback for f_uac1 and f_uac2, a call to snd_card_free() via g_audio_cleanup() will disconnect the card and then wait for all resources to be released, which happens when the refcount falls to zero. Since userspace can keep the refcount incremented by not closing the relevant file descriptor, the call to unbind may block indefinitely. This can cause a deadlock during reboot, as evidenced by the following blocked task observed on my machine: task:reboot state:D stack:0 pid:2827 ppid:569 flags:0x0000000c Call trace: __switch_to+0xc8/0x140 __schedule+0x2f0/0x7c0 schedule+0x60/0xd0 schedule_timeout+0x180/0x1d4 wait_for_completion+0x78/0x180 snd_card_free+0x90/0xa0 g_audio_cleanup+0x2c/0x64 afunc_unbind+0x28/0x60 ... kernel_restart+0x4c/0xac __do_sys_reboot+0xcc/0x1ec __arm64_sys_reboot+0x28/0x30 invoke_syscall+0x4c/0x110 ... The issue can also be observed by opening the card with arecord and then stopping the process through the shell before unbinding: # arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null Recording WAVE '/dev/null' : Signed 32 bit Little Endian, Rate 48000 Hz, Stereo ^Z[1]+ Stopped arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null # echo gadget.0 > /sys/bus/gadget/drivers/configfs-gadget/unbind (observe that the unbind command never finishes) Fix the problem by using snd_card_free_when_closed() instead, which will still disconnect the card as desired, but defer the task of freeing the resources to the core once userspace closes its file descriptor. Fixes: 132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver") Cc: stable@vger.kernel.org Signed-off-by: Alvin Šipraga Reviewed-by: Ruslan Bilovol Reviewed-by: John Keeping Link: https://lore.kernel.org/r/20230302163648.3349669-1-alvin@pqrs.dk Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: clean up some inconsistent indenting

2022-04-21T17:03:07Z

Eliminate the follow smatch warning: drivers/usb/gadget/function/u_audio.c:1182 g_audio_setup() warn: inconsistent indenting. Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/20220407062410.89214-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: Add suspend call

2022-01-26T13:06:09Z

Add exported method u_audio_suspend which sets stream status to inactive and sends notifications. The method does not free any resources. Signed-off-by: Pavel Hofman Link: https://lore.kernel.org/r/20220121155308.48794-9-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: Rate ctl notifies about current srate (0=stopped)

2022-01-26T13:06:09Z

The Playback/Capture ctl currently reports rate value set by USB control selector UAC2_CS_CONTROL_SAM_FREQ (fixed for UAC1). When the stops playback/capture, the reported value does not change. The gadget side has no information whether the host has started/stopped capture/playback. This patch sets the value reported by the respective rate ctl to zero when the host side has stopped playback/capture. Also, it calls snd_ctl_notify when start/stop occurs, so that a subscribed client can act appropriately. Tests have confirmed that USB hosts change UAC2_CS_CONTROL_SAM_FREQ before switching altsetting to activate playback/capture, resulting in correct order (params->c/p_srate is set to requested rate before u_audio_start_capture/playback is called). The gadget rate notifications are used by user-space audio gadget controller gaudio_ctl https://github.com/pavhofman/gaudio_ctl. Signed-off-by: Pavel Hofman Link: https://lore.kernel.org/r/20220121155308.48794-8-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: Add capture/playback srate getter

2022-01-26T13:06:08Z

UAC1/UAC2 functions will need to query u_audio about the currently set srate. Add the getter functions. Signed-off-by: Pavel Hofman Link: https://lore.kernel.org/r/20220121155308.48794-5-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: Move dynamic srate from params to rtd

2022-01-26T13:06:08Z

Parameters uac_params.p_srate/c_srate are dynamic now and are not part of parametric configuration anymore. Move them to the runtime struct uac_rtd_params for each stream. Suggested-by: John Keeping Signed-off-by: Pavel Hofman Link: https://lore.kernel.org/r/20220121155308.48794-4-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: Support multiple sampling rates

2022-01-26T13:06:08Z

Implement support for multiple sampling rates in u_audio part of the audio gadget. The currently configured rates are exposed through read-only amixer controls 'Capture Rate' and 'Playback Rate'. Signed-off-by: Julian Scheel Signed-off-by: Pavel Hofman Link: https://lore.kernel.org/r/20220121155308.48794-3-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman

usb: gadget: u_audio: Subdevice 0 for capture ctls

2022-01-06T14:31:02Z

Both capture and playback alsa devices use subdevice 0. Yet capture-side ctls are defined for subdevice 1. The patch sets subdevice 0 for them. Fixes: 02de698ca812 ("usb: gadget: u_audio: add bi-directional volume and mute support") Signed-off-by: Pavel Hofman Link: https://lore.kernel.org/r/20220105104643.90125-1-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman