mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
9fe49dbc02
The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence it's found in urb.iso_frame_desc[] instead. The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect. No functional changes, only compile-tested. Link: https://lore.kernel.org/20260903130757.0668310a.michal.pecio@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260903160458.1938392-4-tiwai@suse.de |
History
|
|
|---|---|---|
| .. | ||
| chip.c | ||
| chip.h | ||
| comm.c | ||
| comm.h | ||
| common.h | ||
| control.c | ||
| control.h | ||
| firmware.c | ||
| firmware.h | ||
| Makefile | ||
| midi.c | ||
| midi.h | ||
| pcm.c | ||
| pcm.h | ||