mirror of
https://github.com/torvalds/linux.git
synced 2026-09-19 00:58:02 +02:00
aba30af07d
usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes. Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260705084601.56400-1-pengpeng@iscas.ac.cn Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| audio.c | ||
| audio.h | ||
| control.c | ||
| control.h | ||
| device.c | ||
| device.h | ||
| input.c | ||
| input.h | ||
| Makefile | ||
| midi.c | ||
| midi.h | ||