| b8800d32 | 25-Dec-2022 |
Artem Egorkine <arteme@gmail.com> |
ALSA: line6: fix stack overflow in line6_midi_transmit
Correctly calculate available space including the size of the chunk
buffer. This fixes a buffer overflow when multiple MIDI sysex
messages are
ALSA: line6: fix stack overflow in line6_midi_transmit
Correctly calculate available space including the size of the chunk
buffer. This fixes a buffer overflow when multiple MIDI sysex
messages are sent to a PODxt device.
Signed-off-by: Artem Egorkine <arteme@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20221225105728.1153989-2-arteme@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
show more ...
|
| 6d2d427e | 23-Sep-2020 |
Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
sound: line6: move to use usb_control_msg_send() and usb_control_msg_recv()
The usb_control_msg_send() and usb_control_msg_recv() calls can return
an error if a "short" write/read happens, and they
sound: line6: move to use usb_control_msg_send() and usb_control_msg_recv()
The usb_control_msg_send() and usb_control_msg_recv() calls can return
an error if a "short" write/read happens, and they can handle data off
of the stack, so move the driver over to using those calls instead,
saving some logic when dynamically allocating memory.
v2: API change of use usb_control_msg_send() and usb_control_msg_recv()
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Vasily Khoruzhick <anarsoul@gmail.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200914153756.3412156-9-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20200923134348.23862-13-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| 68359a1a | 10-Jul-2020 |
Takashi Iwai <tiwai@suse.de> |
ALSA: line6: Sync the pending work cancel at disconnection
Recently syzkaller reported a UAF in LINE6 driver, and it's likely
because we call cancel_delayed_work() at the disconnect callback
instead
ALSA: line6: Sync the pending work cancel at disconnection
Recently syzkaller reported a UAF in LINE6 driver, and it's likely
because we call cancel_delayed_work() at the disconnect callback
instead of cancel_delayed_work_sync(). Let's use the correct one
instead.
Reported-by: syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/s5hlfjr4gio.wl-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
show more ...
|
| c55f5692 | 02-May-2020 |
Vasily Khoruzhick <anarsoul@gmail.com> |
ALSA: line6: Add poll callback for hwdep
At least POD HD500 uses message-based communication, both sides can
send messages. Add poll callback so application can wait for device
messages without usin
ALSA: line6: Add poll callback for hwdep
At least POD HD500 uses message-based communication, both sides can
send messages. Add poll callback so application can wait for device
messages without using busy loop.
Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
Link: https://lore.kernel.org/r/20200502193120.79115-3-anarsoul@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
show more ...
|