Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 27 Oct 2021 08:23:56 +0200
Message-ID: <s5h7ddzx9xf.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     Johan Hovold <johan@kernel.org>
Cc:     Clemens Ladisch <clemens@ladisch.de>,
        Takashi Iwai <tiwai@suse.com>,
        Jaroslav Kysela <perex@perex.cz>, alsa-devel@alsa-project.org,
        linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org
Subject: Re: [PATCH] sound: ua101: fix division by zero at probe
In-Reply-To: <20211026095401.26522-1-johan@kernel.org>
References: <20211026095401.26522-1-johan@kernel.org>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka)
 FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3
 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk

On Tue, 26 Oct 2021 11:54:01 +0200,
Johan Hovold wrote:
> 
> Add the missing endpoint max-packet sanity check to probe() to avoid
> division by zero in alloc_stream_buffers() in case a malicious device
> has broken descriptors (or when doing descriptor fuzz testing).
> 
> Note that USB core will reject URBs submitted for endpoints with zero
> wMaxPacketSize but that drivers doing packet-size calculations still
> need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
> endpoint descriptors with maxpacket=0")).
> 
> Fixes: 63978ab3e3e9 ("sound: add Edirol UA-101 support")
> Cc: stable@vger.kernel.org      # 2.6.34
> Signed-off-by: Johan Hovold <johan@kernel.org>

Thanks, applied.


Takashi