Skip to content

Commit

Permalink
ALSA: usx2y: validate nrpacks module parameter on probe
Browse files Browse the repository at this point in the history
The module parameter defines number of iso packets per one URB. User is
allowed to set any value to the parameter of type int, which can lead to
various kinds of weird and incorrect behavior like integer overflows,
truncations, etc. Number of packets should be a small non-negative number.

Since this parameter is read-only, its value can be validated on driver
probe.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
Link: https://patch.msgid.link/20250303100413.835-1-m.masimov@mt-integration.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Murad Masimov authored and Takashi Iwai committed Mar 3, 2025
1 parent f603b15 commit 172a0f5
Show file tree
Hide file tree
Showing 3 changed files with 37 additions and 27 deletions.
11 changes: 11 additions & 0 deletions sound/usb/usx2y/usbusx2y.c
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,12 @@ static int snd_usx2y_card_used[SNDRV_CARDS];
static void snd_usx2y_card_private_free(struct snd_card *card);
static void usx2y_unlinkseq(struct snd_usx2y_async_seq *s);

#ifdef USX2Y_NRPACKS_VARIABLE
int nrpacks = USX2Y_NRPACKS; /* number of packets per urb */
module_param(nrpacks, int, 0444);
MODULE_PARM_DESC(nrpacks, "Number of packets per URB.");
#endif

/*
* pipe 4 is used for switching the lamps, setting samplerate, volumes ....
*/
Expand Down Expand Up @@ -432,6 +438,11 @@ static int snd_usx2y_probe(struct usb_interface *intf,
struct snd_card *card;
int err;

#ifdef USX2Y_NRPACKS_VARIABLE
if (nrpacks < 0 || nrpacks > USX2Y_NRPACKS_MAX)
return -EINVAL;
#endif

if (le16_to_cpu(device->descriptor.idVendor) != 0x1604 ||
(le16_to_cpu(device->descriptor.idProduct) != USB_ID_US122 &&
le16_to_cpu(device->descriptor.idProduct) != USB_ID_US224 &&
Expand Down
26 changes: 26 additions & 0 deletions sound/usb/usx2y/usbusx2y.h
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,32 @@

#define NRURBS 2

/* Default value used for nr of packs per urb.
* 1 to 4 have been tested ok on uhci.
* To use 3 on ohci, you'd need a patch:
* look for "0000425-linux-2.6.9-rc4-mm1_ohci-hcd.patch.gz" on
* "https://bugtrack.alsa-project.org/alsa-bug/bug_view_page.php?bug_id=0000425"
*
* 1, 2 and 4 work out of the box on ohci, if I recall correctly.
* Bigger is safer operation, smaller gives lower latencies.
*/
#define USX2Y_NRPACKS 4

#define USX2Y_NRPACKS_MAX 1024

/* If your system works ok with this module's parameter
* nrpacks set to 1, you might as well comment
* this define out, and thereby produce smaller, faster code.
* You'd also set USX2Y_NRPACKS to 1 then.
*/
#define USX2Y_NRPACKS_VARIABLE 1

#ifdef USX2Y_NRPACKS_VARIABLE
extern int nrpacks;
#define nr_of_packs() nrpacks
#else
#define nr_of_packs() USX2Y_NRPACKS
#endif

#define URBS_ASYNC_SEQ 10
#define URB_DATA_LEN_ASYNC_SEQ 32
Expand Down
27 changes: 0 additions & 27 deletions sound/usb/usx2y/usbusx2yaudio.c
Original file line number Diff line number Diff line change
Expand Up @@ -28,33 +28,6 @@
#include "usx2y.h"
#include "usbusx2y.h"

/* Default value used for nr of packs per urb.
* 1 to 4 have been tested ok on uhci.
* To use 3 on ohci, you'd need a patch:
* look for "0000425-linux-2.6.9-rc4-mm1_ohci-hcd.patch.gz" on
* "https://bugtrack.alsa-project.org/alsa-bug/bug_view_page.php?bug_id=0000425"
*
* 1, 2 and 4 work out of the box on ohci, if I recall correctly.
* Bigger is safer operation, smaller gives lower latencies.
*/
#define USX2Y_NRPACKS 4

/* If your system works ok with this module's parameter
* nrpacks set to 1, you might as well comment
* this define out, and thereby produce smaller, faster code.
* You'd also set USX2Y_NRPACKS to 1 then.
*/
#define USX2Y_NRPACKS_VARIABLE 1

#ifdef USX2Y_NRPACKS_VARIABLE
static int nrpacks = USX2Y_NRPACKS; /* number of packets per urb */
#define nr_of_packs() nrpacks
module_param(nrpacks, int, 0444);
MODULE_PARM_DESC(nrpacks, "Number of packets per URB.");
#else
#define nr_of_packs() USX2Y_NRPACKS
#endif

static int usx2y_urb_capt_retire(struct snd_usx2y_substream *subs)
{
struct urb *urb = subs->completed_urb;
Expand Down

0 comments on commit 172a0f5

Please sign in to comment.