[PATCH 62/93] ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices
3.5.7.5 -stable review patch. If anyone has any objections, please let me know.
--
From: Clemens Ladisch
commit d56268fb108c7c21e19933588ca4d94652585183 upstream.
Commit 23caaf19b11e (ALSA: usb-mixer: Add support for Audio Class v2.0)
forgot to adjust the length check for UAC 2.0 feature unit descriptors.
This would make the code abort on encountering a feature unit without
per-channel controls, and thus prevented the driver to work with any
device having such a unit, such as the RME Babyface or Fireface UCX.
Reported-by: Florian Hanisch
Tested-by: Matthew Robbetts
Tested-by: Michael Beer
Cc: Daniel Mack
Signed-off-by: Clemens Ladisch
Signed-off-by: Takashi Iwai
Signed-off-by: Herton Ronaldo Krzesinski
---
sound/usb/mixer.c | 17 -
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 298070e..41e8bfb 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1259,16 +1259,23 @@ static int parse_audio_feature_unit(struct mixer_build
*state, int unitid, void
}
channels = (hdr->bLength - 7) / csize - 1;
bmaControls = hdr->bmaControls;
+ if (hdr->bLength < 7 + csize) {
+ snd_printk(KERN_ERR "usbaudio: unit %u: "
+ "invalid UAC_FEATURE_UNIT descriptor\n",
+ unitid);
+ return -EINVAL;
+ }
} else {
struct uac2_feature_unit_descriptor *ftr = _ftr;
csize = 4;
channels = (hdr->bLength - 6) / 4 - 1;
bmaControls = ftr->bmaControls;
- }
-
- if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) {
- snd_printk(KERN_ERR "usbaudio: unit %u: invalid
UAC_FEATURE_UNIT descriptor\n", unitid);
- return -EINVAL;
+ if (hdr->bLength < 6 + csize) {
+ snd_printk(KERN_ERR "usbaudio: unit %u: "
+ "invalid UAC_FEATURE_UNIT descriptor\n",
+ unitid);
+ return -EINVAL;
+ }
}
/* parse the source unit */
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[PATCH 62/93] ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices
3.5.7.5 -stable review patch. If anyone has any objections, please let me know.
--
From: Clemens Ladisch clem...@ladisch.de
commit d56268fb108c7c21e19933588ca4d94652585183 upstream.
Commit 23caaf19b11e (ALSA: usb-mixer: Add support for Audio Class v2.0)
forgot to adjust the length check for UAC 2.0 feature unit descriptors.
This would make the code abort on encountering a feature unit without
per-channel controls, and thus prevented the driver to work with any
device having such a unit, such as the RME Babyface or Fireface UCX.
Reported-by: Florian Hanisch fhani...@uni-potsdam.de
Tested-by: Matthew Robbetts wingfeath...@gmail.com
Tested-by: Michael Beer bee...@sigma6audio.de
Cc: Daniel Mack dan...@caiaq.de
Signed-off-by: Clemens Ladisch clem...@ladisch.de
Signed-off-by: Takashi Iwai ti...@suse.de
Signed-off-by: Herton Ronaldo Krzesinski herton.krzesin...@canonical.com
---
sound/usb/mixer.c | 17 -
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 298070e..41e8bfb 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1259,16 +1259,23 @@ static int parse_audio_feature_unit(struct mixer_build
*state, int unitid, void
}
channels = (hdr-bLength - 7) / csize - 1;
bmaControls = hdr-bmaControls;
+ if (hdr-bLength 7 + csize) {
+ snd_printk(KERN_ERR usbaudio: unit %u:
+ invalid UAC_FEATURE_UNIT descriptor\n,
+ unitid);
+ return -EINVAL;
+ }
} else {
struct uac2_feature_unit_descriptor *ftr = _ftr;
csize = 4;
channels = (hdr-bLength - 6) / 4 - 1;
bmaControls = ftr-bmaControls;
- }
-
- if (hdr-bLength 7 || !csize || hdr-bLength 7 + csize) {
- snd_printk(KERN_ERR usbaudio: unit %u: invalid
UAC_FEATURE_UNIT descriptor\n, unitid);
- return -EINVAL;
+ if (hdr-bLength 6 + csize) {
+ snd_printk(KERN_ERR usbaudio: unit %u:
+ invalid UAC_FEATURE_UNIT descriptor\n,
+ unitid);
+ return -EINVAL;
+ }
}
/* parse the source unit */
--
1.7.9.5
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
