[PATCH 16/31] ALSA: usb-audio: scarlett2: Add Gen 3 mixer support

[Takashi Iwai]

On Tue, 22 Jun 2021 09:44:54 +0200,
Geoffrey D. Bennett wrote:
> 
> On Tue, Jun 22, 2021 at 09:34:25AM +0200, Takashi Iwai wrote:
> > On Tue, 22 Jun 2021 09:07:20 +0200,
> > Vladimir Sadovnikov wrote:
> > > 
> > > Hello Takashi!
> > > 
> > > Since Focusrite devices are too advanced in settings, the overall
> > > amount of 256 controls is not enough for these devices (like 18i20).
> > > I would like also to extend this constant up to 1024 or even more
> > > since adding support of software configuration of the device also
> > > can exceed the amount of 512 control elements.
> > 
> > This define isn't for the total number of mixer elements.  Instead,
> > it's just a size of the bitmap table that contains the head of the
> > linked list for each unit id (in the sense of USB mixer spec).
> > So the number of mixer elements is unlimited.
> 
> Sorry I don't understand what's going on then. Am I calling
> snd_usb_mixer_add_control() wrong? Because when I called it more than
> MAX_ID_ELEMS times I got a buffer overflow in mixer->id_elems[] (from
> memory, I can confirm tonight).
> 
> snd_usb_create_mixer() has:
> 
>         mixer->id_elems = kcalloc(MAX_ID_ELEMS, sizeof(*mixer->id_elems),
>                                   GFP_KERNEL);
> 
> snd_usb_mixer_add_control() called from mixer_scarlett_gen2.c ends up
> at snd_usb_mixer_add_list() which does:
> 
>         list->next_id_elem = mixer->id_elems[list->id];
>         mixer->id_elems[list->id] = list;
> 
> And list->id was going over MAX_ID_ELEMS.

Here, list->id is the *USB* mixer unit id, not the ALSA control id or
whatever the internal index.  The former should be a byte, hence it
can't be over 256.

That said, the scarlett2 code calls the function in a wrong way.  It
has worked casually, so far, just because the core code doesn't use
the unit id number for significant roles.

So, as a quick workaround, simply pass 0 or any fixed number under 256
to list->id (i.e. elem->head.id in scarlett2_add_new_ctl()).  That's
all, and the elements are chained in the linked list.


Takashi