| From 976a68f06b2ea49e2ab67a5f84919a8b105db8be Mon Sep 17 00:00:00 2001 |
| From: Takashi Iwai <tiwai@suse.de> |
| Date: Thu, 14 Nov 2019 17:56:12 +0100 |
| Subject: ALSA: usb-audio: Fix incorrect size check for processing/extension units |
| |
| From: Takashi Iwai <tiwai@suse.de> |
| |
| commit 976a68f06b2ea49e2ab67a5f84919a8b105db8be upstream. |
| |
| The recently introduced unit descriptor validation had some bug for |
| processing and extension units, it counts a bControlSize byte twice so |
| it expected a bigger size than it should have been. This seems |
| resulting in a probe error on a few devices. |
| |
| Fix the calculation for proper checks of PU and EU. |
| |
| Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") |
| Cc: <stable@vger.kernel.org> |
| Link: https://lore.kernel.org/r/20191114165613.7422-1-tiwai@suse.de |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| sound/usb/validate.c | 6 +++--- |
| 1 file changed, 3 insertions(+), 3 deletions(-) |
| |
| --- a/sound/usb/validate.c |
| +++ b/sound/usb/validate.c |
| @@ -81,9 +81,9 @@ static bool validate_processing_unit(con |
| switch (v->protocol) { |
| case UAC_VERSION_1: |
| default: |
| - /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */ |
| - len += 1 + 2 + 1 + 1; |
| - if (d->bLength < len) /* bControlSize */ |
| + /* bNrChannels, wChannelConfig, iChannelNames */ |
| + len += 1 + 2 + 1; |
| + if (d->bLength < len + 1) /* bControlSize */ |
| return false; |
| m = hdr[len]; |
| len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */ |
