diff options
Diffstat (limited to 'ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch')
| -rw-r--r-- | ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch | 80 |
1 files changed, 0 insertions, 80 deletions
diff --git a/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch b/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch deleted file mode 100644 index 801434a26..000000000 --- a/ALSA-usb-audio-Add-sanity-checks-for-endpoint-access.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 873156565ca67779bbf5a3475ccd08ea3bb92522 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 15 Mar 2016 15:20:58 +0100 -Subject: [PATCH 2/2] ALSA: usb-audio: Add sanity checks for endpoint accesses - -Add some sanity check codes before actually accessing the endpoint via -get_endpoint() in order to avoid the invalid access through a -malformed USB descriptor. Mostly just checking bNumEndpoints, but in -one place (snd_microii_spdif_default_get()), the validity of iface and -altsetting index is checked as well. - -Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125 -Cc: <stable@vger.kernel.org> -Signed-off-by: Takashi Iwai <tiwai@suse.de> ---- - sound/usb/clock.c | 2 ++ - sound/usb/endpoint.c | 3 +++ - sound/usb/mixer_quirks.c | 4 ++++ - sound/usb/pcm.c | 2 ++ - 4 files changed, 11 insertions(+) - -diff --git a/sound/usb/clock.c b/sound/usb/clock.c -index 2ed260b10f6d..7ccbcaf6a147 100644 ---- a/sound/usb/clock.c -+++ b/sound/usb/clock.c -@@ -285,6 +285,8 @@ static int set_sample_rate_v1(struct snd_usb_audio *chip, int iface, - unsigned char data[3]; - int err, crate; - -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - /* if endpoint doesn't have sampling rate control, bail out */ -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index e6f71894ecdc..c2131b851602 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -415,6 +415,9 @@ exit_clear: - * - * New endpoints will be added to chip->ep_list and must be freed by - * calling snd_usb_endpoint_free(). -+ * -+ * For SND_USB_ENDPOINT_TYPE_SYNC, the caller needs to guarantee that -+ * bNumEndpoints > 1 beforehand. - */ - struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip, - struct usb_host_interface *alts, -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index d3608c0a29f3..2d724e3c4cc0 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -1518,7 +1518,11 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol, - - /* use known values for that card: interface#1 altsetting#1 */ - iface = usb_ifnum_to_if(chip->dev, 1); -+ if (!iface || iface->num_altsetting < 2) -+ return -EINVAL; - alts = &iface->altsetting[1]; -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - err = snd_usb_ctl_msg(chip->dev, -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index cdac5179db3f..4da64896df6d 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -159,6 +159,8 @@ static int init_pitch_v1(struct snd_usb_audio *chip, int iface, - unsigned char data[1]; - int err; - -+ if (get_iface_desc(alts)->bNumEndpoints < 1) -+ return -EINVAL; - ep = get_endpoint(alts, 0)->bEndpointAddress; - - data[0] = 1; --- -2.5.0 - |