| From 46a8eb0c54c99afe85757708227b2da362a6bc13 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Tue, 14 Jan 2020 09:39:53 +0100 |
| Subject: [PATCH] ALSA: usb-audio: fix sync-ep altsetting sanity check |
| |
| commit 5d1b71226dc4d44b4b65766fa9d74492f9d4587b upstream. |
| |
| The altsetting sanity check in set_sync_ep_implicit_fb_quirk() was |
| checking for there to be at least one altsetting but then went on to |
| access the second one, which may not exist. |
| |
| This could lead to random slab data being used to initialise the sync |
| endpoint in snd_usb_add_endpoint(). |
| |
| Fixes: c75a8a7ae565 ("ALSA: snd-usb: add support for implicit feedback") |
| Fixes: ca10a7ebdff1 ("ALSA: usb-audio: FT C400 sync playback EP to capture EP") |
| Fixes: 5e35dc0338d8 ("ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204") |
| Fixes: 17f08b0d9aaf ("ALSA: usb-audio: add implicit fb quirk for Axe-Fx II") |
| Fixes: 103e9625647a ("ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk") |
| Cc: stable <stable@vger.kernel.org> # 3.5 |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Link: https://lore.kernel.org/r/20200114083953.1106-1-johan@kernel.org |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c |
| index a04c727dcd19..fa24bd491cf6 100644 |
| --- a/sound/usb/pcm.c |
| +++ b/sound/usb/pcm.c |
| @@ -370,7 +370,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, |
| add_sync_ep_from_ifnum: |
| iface = usb_ifnum_to_if(dev, ifnum); |
| |
| - if (!iface || iface->num_altsetting == 0) |
| + if (!iface || iface->num_altsetting < 2) |
| return -EINVAL; |
| |
| alts = &iface->altsetting[1]; |
| -- |
| 2.7.4 |
| |