Merge tag 'sound-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound updates from Takashi Iwai:
 "Many updates in this development cycle are found in ASoC where it got
  a wide range of changes for the continued refactoring.

  Some highlights are below.

  ASoC:

   - Continued refactoring work by Morimoto-san toward the full
     componentization; the changes are seen allover the places

   - Support for force disconnecting muxes in DAPM

   - Continued development of ASoC Intel SOF stuff

   - New drivers for Cirrus Logic CS47L35, CS47L85 and CS47L90, Conexant
     CX2072X, Realtek RT1011 and RT1308

  HD-audio:

   - More fixes and adjustments for ASoC SOF HD-audio

   - Fix for resume problem on some Realtek codecs

  USB-audio:

   - A few fixes for the issues reported by syzbot USB fuzzer

   - Fix for UAC2 extension unit parser

   - Quirks for Line6 Helix, Emgaic Unitor 8

  FireWire:

   - Lots of code refactoring and fixes in most of its components"

* tag 'sound-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (626 commits)
  ALSA: firewire-lib: code refactoring for local variables
  ALSA: firewire-lib: code refactoring for post operation to data block counter
  ALSA: firewire-lib: code refactoring for error path of parser for CIP header
  ALSA: firewire-lib: fix different data block counter between probed event and transferred isochronous packet
  ALSA: firewire-lib: fix initial value of data block count for IR context without CIP_DBC_IS_END_EVENT
  ALSA: firewire-lib/fireface: fix initial value of data block counter for IR context with CIP_NO_HEADER
  ALSA: firewire-lib: fix invalid length of rx packet payload for tracepoint events
  ALSA: usb-audio: fix Line6 Helix audio format rates
  firewire-motu: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: firewire-digi00x: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: dice: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: oxfw: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: fireworks: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: bebob: fix wrong reference count for stream functionality at error path of rawmidi interface
  ASoC: SOF: Intel: implement runtime idle for CNL/APL
  ASoC: SOF: add runtime idle callback
  ASoC: hdac_hdmi: report codec link up/down status to bus
  ASoC: SOF: debug: fix possible memory leak in sof_dfsentry_write()
  ASoC: sunxi: sun50i-codec-analog: Add earpiece
  ASoC: rt5665: remove redundant assignment to variable idx
  ...

1 files changed, 15 insertions, 3 deletions

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index cf5cff10c08e..78858918cbc1 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -828,11 +828,13 @@ static int snd_usb_novation_boot_quirk(struct usb_device *dev)
 static int snd_usb_accessmusic_boot_quirk(struct usb_device *dev)
 {
 	int err, actual_length;
-
 	/* "midi send" enable */
 	static const u8 seq[] = { 0x4e, 0x73, 0x52, 0x01 };
+	void *buf;
 
-	void *buf = kmemdup(seq, ARRAY_SIZE(seq), GFP_KERNEL);
+	if (snd_usb_pipe_sanity_check(dev, usb_sndintpipe(dev, 0x05)))
+		return -EINVAL;
+	buf = kmemdup(seq, ARRAY_SIZE(seq), GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 	err = usb_interrupt_msg(dev, usb_sndintpipe(dev, 0x05), buf,
@@ -857,7 +859,11 @@ static int snd_usb_accessmusic_boot_quirk(struct usb_device *dev)
 
 static int snd_usb_nativeinstruments_boot_quirk(struct usb_device *dev)
 {
-	int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+	int ret;
+
+	if (snd_usb_pipe_sanity_check(dev, usb_sndctrlpipe(dev, 0)))
+		return -EINVAL;
+	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
 				  0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 				  1, 0, NULL, 0, 1000);
 
@@ -964,6 +970,8 @@ static int snd_usb_axefx3_boot_quirk(struct usb_device *dev)
 
 	dev_dbg(&dev->dev, "Waiting for Axe-Fx III to boot up...\n");
 
+	if (snd_usb_pipe_sanity_check(dev, usb_sndctrlpipe(dev, 0)))
+		return -EINVAL;
 	/* If the Axe-Fx III has not fully booted, it will timeout when trying
 	 * to enable the audio streaming interface. A more generous timeout is
 	 * used here to detect when the Axe-Fx III has finished booting as the
@@ -996,6 +1004,8 @@ static int snd_usb_motu_microbookii_communicate(struct usb_device *dev, u8 *buf,
 {
 	int err, actual_length;
 
+	if (snd_usb_pipe_sanity_check(dev, usb_sndintpipe(dev, 0x01)))
+		return -EINVAL;
 	err = usb_interrupt_msg(dev, usb_sndintpipe(dev, 0x01), buf, *length,
 				&actual_length, 1000);
 	if (err < 0)
@@ -1006,6 +1016,8 @@ static int snd_usb_motu_microbookii_communicate(struct usb_device *dev, u8 *buf,
 
 	memset(buf, 0, buf_size);
 
+	if (snd_usb_pipe_sanity_check(dev, usb_rcvintpipe(dev, 0x82)))
+		return -EINVAL;
 	err = usb_interrupt_msg(dev, usb_rcvintpipe(dev, 0x82), buf, buf_size,
 				&actual_length, 1000);
 	if (err < 0)