Commit 172a0f50 authored by Murad Masimov's avatar Murad Masimov Committed by Takashi Iwai
Browse files

ALSA: usx2y: validate nrpacks module parameter on probe 



The module parameter defines number of iso packets per one URB. User is
allowed to set any value to the parameter of type int, which can lead to
various kinds of weird and incorrect behavior like integer overflows,
truncations, etc. Number of packets should be a small non-negative number.

Since this parameter is read-only, its value can be validated on driver
probe.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarMurad Masimov <m.masimov@mt-integration.ru>
Link: https://patch.msgid.link/20250303100413.835-1-m.masimov@mt-integration.ru


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent f603b159

sound/usb/usx2y/usbusx2y.c

+11 −0
Original line number Diff line number Diff line
@@ -151,6 +151,12 @@ static int snd_usx2y_card_used[SNDRV_CARDS]; 
static void snd_usx2y_card_private_free(struct snd_card *card);

static void usx2y_unlinkseq(struct snd_usx2y_async_seq *s);



#ifdef USX2Y_NRPACKS_VARIABLE

int nrpacks = USX2Y_NRPACKS; /* number of packets per urb */

module_param(nrpacks, int, 0444);

MODULE_PARM_DESC(nrpacks, "Number of packets per URB.");

#endif



/*

 * pipe 4 is used for switching the lamps, setting samplerate, volumes ....

 */
@@ -432,6 +438,11 @@ static int snd_usx2y_probe(struct usb_interface *intf, 
	struct snd_card *card;

	int err;



#ifdef USX2Y_NRPACKS_VARIABLE

	if (nrpacks < 0 || nrpacks > USX2Y_NRPACKS_MAX)

		return -EINVAL;

#endif



	if (le16_to_cpu(device->descriptor.idVendor) != 0x1604 ||

	    (le16_to_cpu(device->descriptor.idProduct) != USB_ID_US122 &&

	     le16_to_cpu(device->descriptor.idProduct) != USB_ID_US224 &&

sound/usb/usx2y/usbusx2y.h

+26 −0
Original line number Diff line number Diff line
@@ -7,6 +7,32 @@ 


#define NRURBS	        2



/* Default value used for nr of packs per urb.

 * 1 to 4 have been tested ok on uhci.

 * To use 3 on ohci, you'd need a patch:

 * look for "0000425-linux-2.6.9-rc4-mm1_ohci-hcd.patch.gz" on

 * "https://bugtrack.alsa-project.org/alsa-bug/bug_view_page.php?bug_id=0000425"

 *

 * 1, 2 and 4 work out of the box on ohci, if I recall correctly.

 * Bigger is safer operation, smaller gives lower latencies.

 */

#define USX2Y_NRPACKS 4



#define USX2Y_NRPACKS_MAX 1024



/* If your system works ok with this module's parameter

 * nrpacks set to 1, you might as well comment

 * this define out, and thereby produce smaller, faster code.

 * You'd also set USX2Y_NRPACKS to 1 then.

 */

#define USX2Y_NRPACKS_VARIABLE 1



#ifdef USX2Y_NRPACKS_VARIABLE

extern int nrpacks;

#define nr_of_packs() nrpacks

#else

#define nr_of_packs() USX2Y_NRPACKS

#endif



#define URBS_ASYNC_SEQ 10

#define URB_DATA_LEN_ASYNC_SEQ 32

sound/usb/usx2y/usbusx2yaudio.c

+0 −27
Original line number Diff line number Diff line
@@ -28,33 +28,6 @@ 
#include "usx2y.h"

#include "usbusx2y.h"



/* Default value used for nr of packs per urb.

 * 1 to 4 have been tested ok on uhci.

 * To use 3 on ohci, you'd need a patch:

 * look for "0000425-linux-2.6.9-rc4-mm1_ohci-hcd.patch.gz" on

 * "https://bugtrack.alsa-project.org/alsa-bug/bug_view_page.php?bug_id=0000425"

 *

 * 1, 2 and 4 work out of the box on ohci, if I recall correctly.

 * Bigger is safer operation, smaller gives lower latencies.

 */

#define USX2Y_NRPACKS 4



/* If your system works ok with this module's parameter

 * nrpacks set to 1, you might as well comment

 * this define out, and thereby produce smaller, faster code.

 * You'd also set USX2Y_NRPACKS to 1 then.

 */

#define USX2Y_NRPACKS_VARIABLE 1



#ifdef USX2Y_NRPACKS_VARIABLE

static int nrpacks = USX2Y_NRPACKS; /* number of packets per urb */

#define  nr_of_packs() nrpacks

module_param(nrpacks, int, 0444);

MODULE_PARM_DESC(nrpacks, "Number of packets per URB.");

#else

#define nr_of_packs() USX2Y_NRPACKS

#endif



static int usx2y_urb_capt_retire(struct snd_usx2y_substream *subs)

{

	struct urb	*urb = subs->completed_urb;