ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute

Web:        https://git.kernel.org/torvalds/c/447cae58cecd69392b74a4a42cd0ab9cabd816af
Commit:     447cae58cecd69392b74a4a42cd0ab9cabd816af
Parent:     2bda7141b89aa35308da69aac7f486fa81db73ba
Refname:    refs/heads/master
Author:     Kirill Marinushkin <[email protected]>
AuthorDate: Mon Jan 29 06:37:55 2018 +0100
Committer:  Takashi Iwai <[email protected]>
CommitDate: Mon Feb 12 09:07:29 2018 +0100

    ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute
    
    The layout of the UAC2 Control request and response varies depending on
    the request type. With the current implementation, only the Layout 2
    Parameter Block (with the 2-byte sized RANGE attribute) is handled
    properly. For the Control requests with the 1-byte sized RANGE attribute
    (Bass Control, Mid Control, Tremble Control), the response is parsed
    incorrectly.
    
    This commit:
    * fixes the wLength field value in the request
    * fixes parsing the range values from the response
    
    Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
    Signed-off-by: Kirill Marinushkin <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>
---
 sound/usb/mixer.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 9afb8ab524c7..06b22624ab7a 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -347,17 +347,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request,
 			    int validx, int *value_ret)
 {
 	struct snd_usb_audio *chip = cval->head.mixer->chip;
-	unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range */
+	/* enough space for one range */
+	unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)];
 	unsigned char *val;
-	int idx = 0, ret, size;
+	int idx = 0, ret, val_size, size;
 	__u8 bRequest;
 
+	val_size = uac2_ctl_value_size(cval->val_type);
+
 	if (request == UAC_GET_CUR) {
 		bRequest = UAC2_CS_CUR;
-		size = uac2_ctl_value_size(cval->val_type);
+		size = val_size;
 	} else {
 		bRequest = UAC2_CS_RANGE;
-		size = sizeof(buf);
+		size = sizeof(__u16) + 3 * val_size;
 	}
 
 	memset(buf, 0, sizeof(buf));
@@ -390,16 +393,17 @@ error:
 		val = buf + sizeof(__u16);
 		break;
 	case UAC_GET_MAX:
-		val = buf + sizeof(__u16) * 2;
+		val = buf + sizeof(__u16) + val_size;
 		break;
 	case UAC_GET_RES:
-		val = buf + sizeof(__u16) * 3;
+		val = buf + sizeof(__u16) + val_size * 2;
 		break;
 	default:
 		return -EINVAL;
 	}
 
-	*value_ret = convert_signed_value(cval, snd_usb_combine_bytes(val, sizeof(__u16)));
+	*value_ret = convert_signed_value(cval,
+					  snd_usb_combine_bytes(val, val_size));
 
 	return 0;
 }
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html