[ 3.5.y.z extended stable ] Patch "ALSA: usb-audio: fix invalid length check for RME and other" has been added to staging queue
Herton Ronaldo Krzesinski
herton.krzesinski at canonical.com
Thu Jan 31 22:11:22 UTC 2013
This is a note to let you know that I have just added a patch titled
ALSA: usb-audio: fix invalid length check for RME and other
to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree
which can be found at:
http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue
If you, or anyone else, feels it should not be added to this tree, please
reply to this email.
For more information about the 3.5.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable
Thanks.
-Herton
------
>From 23bef2be1f2e27b09d4186009285bc6bd0742568 Mon Sep 17 00:00:00 2001
From: Clemens Ladisch <clemens at ladisch.de>
Date: Thu, 29 Nov 2012 17:04:23 +0100
Subject: [PATCH] ALSA: usb-audio: fix invalid length check for RME and other
UAC 2 devices
commit d56268fb108c7c21e19933588ca4d94652585183 upstream.
Commit 23caaf19b11e (ALSA: usb-mixer: Add support for Audio Class v2.0)
forgot to adjust the length check for UAC 2.0 feature unit descriptors.
This would make the code abort on encountering a feature unit without
per-channel controls, and thus prevented the driver to work with any
device having such a unit, such as the RME Babyface or Fireface UCX.
Reported-by: Florian Hanisch <fhanisch at uni-potsdam.de>
Tested-by: Matthew Robbetts <wingfeathera at gmail.com>
Tested-by: Michael Beer <beerml at sigma6audio.de>
Cc: Daniel Mack <daniel at caiaq.de>
Signed-off-by: Clemens Ladisch <clemens at ladisch.de>
Signed-off-by: Takashi Iwai <tiwai at suse.de>
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski at canonical.com>
---
sound/usb/mixer.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 298070e..41e8bfb 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1259,16 +1259,23 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
}
channels = (hdr->bLength - 7) / csize - 1;
bmaControls = hdr->bmaControls;
+ if (hdr->bLength < 7 + csize) {
+ snd_printk(KERN_ERR "usbaudio: unit %u: "
+ "invalid UAC_FEATURE_UNIT descriptor\n",
+ unitid);
+ return -EINVAL;
+ }
} else {
struct uac2_feature_unit_descriptor *ftr = _ftr;
csize = 4;
channels = (hdr->bLength - 6) / 4 - 1;
bmaControls = ftr->bmaControls;
- }
-
- if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) {
- snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid);
- return -EINVAL;
+ if (hdr->bLength < 6 + csize) {
+ snd_printk(KERN_ERR "usbaudio: unit %u: "
+ "invalid UAC_FEATURE_UNIT descriptor\n",
+ unitid);
+ return -EINVAL;
+ }
}
/* parse the source unit */
--
1.7.9.5
More information about the kernel-team
mailing list