• Takashi Iwai's avatar
    ALSA: caiaq: Add a sanity check for invalid EPs · b43a3e21
    Takashi Iwai authored
    commit 58fc7f73 upstream.
    
    As syzkaller spotted, currently caiaq driver submits a URB with the
    fixed EP without checking whether it's actually available, which may
    result in a kernel warning like:
      usb 1-1: BOGUS urb xfer, pipe 3 != type 1
      ------------[ cut here ]------------
      WARNING: CPU: 1 PID: 1150 at drivers/usb/core/urb.c:449
      usb_submit_urb+0xf8a/0x11d0
      Modules linked in:
      CPU: 1 PID: 1150 Comm: kworker/1:1 Not tainted
      4.14.0-rc2-42660-g24b7bd59eec0 #277
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
      Workqueue: usb_hub_wq hub_event
      Call Trace:
       init_card sound/usb/caiaq/device.c:467
       snd_probe+0x81c/0x1150 sound/usb/caiaq/device.c:525
       usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
       ....
    
    This patch adds a sanity check of validity of EPs at the device
    initialization phase for avoiding the call with an invalid EP.
    Reported-by: 's avatarAndrey Konovalov <andreyknvl@google.com>
    Tested-by: 's avatarAndrey Konovalov <andreyknvl@google.com>
    Signed-off-by: 's avatarTakashi Iwai <tiwai@suse.de>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    b43a3e21
Name
Last commit
Last update
..
Makefile Loading commit data...
audio.c Loading commit data...
audio.h Loading commit data...
control.c Loading commit data...
control.h Loading commit data...
device.c Loading commit data...
device.h Loading commit data...
input.c Loading commit data...
input.h Loading commit data...
midi.c Loading commit data...
midi.h Loading commit data...