Skip to content

[ciqlts8_6] Multiple patches tested (2 commits) #1725

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bmastbergen merged 2 commits into from
Oct 23, 2026
Merged

[ciqlts8_6] Multiple patches tested (2 commits) #1725

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f8a68b7
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and M…
bmastbergen Oct 21, 2026
11b9a78
ALSA: usb-audio: Fix a DMA to stack memory bug
bmastbergen Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 25 additions & 4 deletions sound/usb/quirks.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -591,6 +591,7 @@ int snd_usb_create_quirk(struct snd_usb_audio *chip,
static int snd_usb_extigy_boot_quirk(struct usb_device *dev, struct usb_interface *intf)
{
struct usb_host_config *config = dev->actconfig;
struct usb_device_descriptor *new_device_descriptor = NULL;
int err;

if (le16_to_cpu(get_cfg_desc(config)->wTotalLength) == EXTIGY_FIRMWARE_SIZE_OLD ||
Expand All @@ -601,11 +602,20 @@ static int snd_usb_extigy_boot_quirk(struct usb_device *dev, struct usb_interfac
0x10, 0x43, 0x0001, 0x000a, NULL, 0);
if (err < 0)
dev_dbg(&dev->dev, "error sending boot message: %d\n", err);

new_device_descriptor = kmalloc(sizeof(*new_device_descriptor), GFP_KERNEL);
if (!new_device_descriptor)
return -ENOMEM;
err = usb_get_descriptor(dev, USB_DT_DEVICE, 0,
&dev->descriptor, sizeof(dev->descriptor));
config = dev->actconfig;
new_device_descriptor, sizeof(*new_device_descriptor));
if (err < 0)
dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err);
if (new_device_descriptor->bNumConfigurations > dev->descriptor.bNumConfigurations)
dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n",
new_device_descriptor->bNumConfigurations);
else
memcpy(&dev->descriptor, new_device_descriptor, sizeof(dev->descriptor));
kfree(new_device_descriptor);
err = usb_reset_configuration(dev);
if (err < 0)
dev_dbg(&dev->dev, "error usb_reset_configuration: %d\n", err);
Expand Down Expand Up @@ -937,6 +947,7 @@ static void mbox2_setup_48_24_magic(struct usb_device *dev)
static int snd_usb_mbox2_boot_quirk(struct usb_device *dev)
{
struct usb_host_config *config = dev->actconfig;
struct usb_device_descriptor *new_device_descriptor = NULL;
int err;
u8 bootresponse[0x12];
int fwsize;
Expand Down Expand Up @@ -971,11 +982,21 @@ static int snd_usb_mbox2_boot_quirk(struct usb_device *dev)

dev_dbg(&dev->dev, "device initialised!\n");

new_device_descriptor = kmalloc(sizeof(*new_device_descriptor), GFP_KERNEL);
if (!new_device_descriptor)
return -ENOMEM;

err = usb_get_descriptor(dev, USB_DT_DEVICE, 0,
&dev->descriptor, sizeof(dev->descriptor));
config = dev->actconfig;
new_device_descriptor, sizeof(*new_device_descriptor));
if (err < 0)
dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err);
if (new_device_descriptor->bNumConfigurations > dev->descriptor.bNumConfigurations)
dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n",
new_device_descriptor->bNumConfigurations);
else
memcpy(&dev->descriptor, new_device_descriptor, sizeof(dev->descriptor));

kfree(new_device_descriptor);

err = usb_reset_configuration(dev);
if (err < 0)
Expand Down
Loading