• Takashi Iwai's avatar
    ALSA: usx2y: Fix invalid stream URBs · f9a1c372
    Takashi Iwai authored
    The us122l driver creates URBs per the fixed endpoints, and this may
    end up with URBs with inconsistent pipes when a fuzzer or a malicious
    program deals with the manipulated endpoints.  It ends up with a
    kernel warning like:
    
      usb 1-1: BOGUS urb xfer, pipe 0 != type 3
      ------------[ cut here ]------------
      WARNING: CPU: 0 PID: 24 at drivers/usb/core/urb.c:471
      usb_submit_urb+0x113e/0x1400
      Call Trace:
       usb_stream_start+0x48a/0x9f0 sound/usb/usx2y/usb_stream.c:690
       us122l_start+0x116/0x290 sound/usb/usx2y/us122l.c:365
       us122l_create_card sound/usb/usx2y/us122l.c:502
       us122l_usb_probe sound/usb/usx2y/us122l.c:588
       ....
    
    For avoiding the bad access, this patch adds a few sanity checks of
    the validity of created URBs like previous similar fixes using the new
    usb_urb_ep_type_check() helper function.
    Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Tested-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    f9a1c372
usb_stream.c 19.2 KB