diff options
| author | Linus Torvalds | 2017-12-06 19:49:14 +0100 |
|---|---|---|
| committer | Linus Torvalds | 2017-12-06 19:49:14 +0100 |
| commit | f9efc944474742ad952c15c092a901d88ed83c71 (patch) | |
| tree | cbd6e7b4ce3a81301340195385604a62251f309d /sound/usb | |
| parent | x86: don't hash faulting address in oops printout (diff) | |
| parent | ALSA: pcm: prevent UAF in snd_pcm_info (diff) | |
| download | kernel-qcow2-linux-f9efc944474742ad952c15c092a901d88ed83c71.tar.gz kernel-qcow2-linux-f9efc944474742ad952c15c092a901d88ed83c71.tar.xz kernel-qcow2-linux-f9efc944474742ad952c15c092a901d88ed83c71.zip | |
Merge tag 'sound-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"All fixes are small and for stable:
- a PCM ioctl race fix
- yet another USB-audio hardening for malicious descriptors
- Realtek ALC257 codec support"
* tag 'sound-4.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: pcm: prevent UAF in snd_pcm_info
ALSA: hda/realtek - New codec support for ALC257
ALSA: usb-audio: Add check return value for usb_string()
ALSA: usb-audio: Fix out-of-bound error
ALSA: seq: Remove spurious WARN_ON() at timer check
Diffstat (limited to 'sound/usb')
| -rw-r--r-- | sound/usb/mixer.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 61b348383de8..7c9e361b2200 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -204,6 +204,10 @@ static int snd_usb_copy_string_desc(struct mixer_build *state, int index, char *buf, int maxlen) { int len = usb_string(state->chip->dev, index, buf, maxlen - 1); + + if (len < 0) + return 0; + buf[len] = 0; return len; } @@ -2174,13 +2178,14 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, if (len) ; else if (nameid) - snd_usb_copy_string_desc(state, nameid, kctl->id.name, + len = snd_usb_copy_string_desc(state, nameid, kctl->id.name, sizeof(kctl->id.name)); - else { + else len = get_term_name(state, &state->oterm, kctl->id.name, sizeof(kctl->id.name), 0); - if (!len) - strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); + + if (!len) { + strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) append_ctl_name(kctl, " Clock Source"); |