From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "Eldad Zack" <eldad@fogrefinery.com>,
"Takashi Iwai" <tiwai@suse.de>, "Daniel Mack" <zonque@gmail.com>
Subject: [24/75] ALSA: usb-audio: fix endianness bug in snd_nativeinstruments_*
Date: Mon, 22 Apr 2013 15:25:59 +0100 [thread overview]
Message-ID: <lsq.1366640759.986123913@decadent.org.uk> (raw)
In-Reply-To: <lsq.1366640759.151900666@decadent.org.uk>
3.2.44-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eldad Zack <eldad@fogrefinery.com>
commit 889d66848b12d891248b03abcb2a42047f8e172a upstream.
The usb_control_msg() function expects __u16 types and performs
the endianness conversions by itself.
However, in three places, a conversion is performed before it is
handed over to usb_control_msg(), which leads to a double conversion
(= no conversion):
* snd_usb_nativeinstruments_boot_quirk()
* snd_nativeinstruments_control_get()
* snd_nativeinstruments_control_put()
Caught by sparse:
sound/usb/mixer_quirks.c:512:38: warning: incorrect type in argument 6 (different base types)
sound/usb/mixer_quirks.c:512:38: expected unsigned short [unsigned] [usertype] index
sound/usb/mixer_quirks.c:512:38: got restricted __le16 [usertype] <noident>
sound/usb/mixer_quirks.c:543:35: warning: incorrect type in argument 5 (different base types)
sound/usb/mixer_quirks.c:543:35: expected unsigned short [unsigned] [usertype] value
sound/usb/mixer_quirks.c:543:35: got restricted __le16 [usertype] <noident>
sound/usb/mixer_quirks.c:543:56: warning: incorrect type in argument 6 (different base types)
sound/usb/mixer_quirks.c:543:56: expected unsigned short [unsigned] [usertype] index
sound/usb/mixer_quirks.c:543:56: got restricted __le16 [usertype] <noident>
sound/usb/quirks.c:502:35: warning: incorrect type in argument 5 (different base types)
sound/usb/quirks.c:502:35: expected unsigned short [unsigned] [usertype] value
sound/usb/quirks.c:502:35: got restricted __le16 [usertype] <noident>
Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
Acked-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/usb/mixer_quirks.c | 4 ++--
sound/usb/quirks.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -396,7 +396,7 @@ static int snd_nativeinstruments_control
else
ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
- 0, cpu_to_le16(wIndex),
+ 0, wIndex,
&tmp, sizeof(tmp), 1000);
up_read(&mixer->chip->shutdown_rwsem);
@@ -427,7 +427,7 @@ static int snd_nativeinstruments_control
else
ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), bRequest,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
- cpu_to_le16(wValue), cpu_to_le16(wIndex),
+ wValue, wIndex,
NULL, 0, 1000);
up_read(&mixer->chip->shutdown_rwsem);
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -482,7 +482,7 @@ static int snd_usb_nativeinstruments_boo
{
int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- cpu_to_le16(1), 0, NULL, 0, 1000);
+ 1, 0, NULL, 0, 1000);
if (ret < 0)
return ret;
next prev parent reply other threads:[~2013-04-22 14:32 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-04-22 14:25 [00/75] 3.2.44-rc1 review Ben Hutchings
2013-04-22 14:25 ` [69/75] fbcon: fix locking harder Ben Hutchings
2013-04-22 14:25 ` [13/75] USB: pl2303: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [46/75] can: sja1000: fix handling on dt properties on little endian systems Ben Hutchings
2013-04-22 14:25 ` [71/75] KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) Ben Hutchings
2013-04-22 14:25 ` [58/75] drm/i915: panel: invert brightness acer aspire 5734z Ben Hutchings
2013-04-22 14:25 ` [28/75] ftrace: Consistently restore trace function on sysctl enabling Ben Hutchings
2013-04-22 14:25 ` [32/75] spinlocks and preemption points need to be at least compiler barriers Ben Hutchings
2013-04-22 14:25 ` [64/75] ALSA: hda - Enabling Realtek ALC 671 codec Ben Hutchings
2013-04-22 14:25 ` [02/75] USB: serial: fix hang when opening port Ben Hutchings
2013-04-22 14:25 ` [48/75] ARM: 7696/1: Fix kexec by setting outer_cache.inv_all for Feroceon Ben Hutchings
2013-04-22 14:25 ` [16/75] USB: ti_usb_3410_5052: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [15/75] USB: ssu100: " Ben Hutchings
2013-04-22 14:25 ` [54/75] writeback: fix dirtied pages accounting on redirty Ben Hutchings
2013-04-22 14:25 ` [25/75] alpha: Add irongate_io to PCI bus resources Ben Hutchings
2013-04-22 14:25 ` [44/75] ath9k_htc: accept 1.x firmware newer than 1.3 Ben Hutchings
2013-04-22 14:25 ` [68/75] mtd: Disable mtdchar mmap on MMU systems Ben Hutchings
2013-04-22 14:25 ` [35/75] x86, mm: Patch out arch_flush_lazy_mmu_mode() when running on bare metal Ben Hutchings
2013-04-22 14:25 ` [07/75] USB: io_edgeport: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [53/75] thermal: return an error on failure to register thermal class Ben Hutchings
2013-04-22 14:25 ` [20/75] libata: Use integer return value for atapi_command_packet_set Ben Hutchings
2013-04-22 14:25 ` [08/75] USB: io_ti: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [49/75] ARM: 7698/1: perf: fix group validation when using enable_on_exec Ben Hutchings
2013-04-22 14:25 ` [67/75] r8169: fix auto speed down issue Ben Hutchings
2013-04-22 14:25 ` [29/75] PM / reboot: call syscore_shutdown() after disable_nonboot_cpus() Ben Hutchings
2013-04-22 14:25 ` [39/75] Btrfs: make sure nbytes are right after log replay Ben Hutchings
2013-04-22 14:25 ` [47/75] ath9k_hw: change AR9580 initvals to fix a stability issue Ben Hutchings
2013-04-22 14:25 ` [61/75] drm/i915: add quirk to invert brightness on eMachines e725 Ben Hutchings
2013-04-22 14:25 ` [30/75] can: gw: use kmem_cache_free() instead of kfree() Ben Hutchings
2013-04-22 14:25 ` [43/75] ARM: Do 15e0d9e37c (ARM: pm: let platforms select cpu_suspend support) properly Ben Hutchings
2013-04-22 14:25 ` [33/75] tracing: Fix double free when function profile init failed Ben Hutchings
2013-04-22 14:25 ` [05/75] USB: cypress_m8: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [52/75] net: fix incorrect credentials passing Ben Hutchings
2013-04-22 14:25 ` [27/75] sched_clock: Prevent 64bit inatomicity on 32bit systems Ben Hutchings
2013-04-22 14:25 ` [65/75] ALSA: hda - fix typo in proc output Ben Hutchings
2013-04-22 14:25 ` [70/75] hfsplus: fix potential overflow in hfsplus_file_truncate() Ben Hutchings
2013-04-22 14:25 ` [01/75] USB: serial: add modem-status-change wait queue Ben Hutchings
2013-04-22 14:25 ` Ben Hutchings [this message]
2013-04-22 14:25 ` [34/75] x86, mm, paravirt: Fix vmalloc_fault oops during lazy MMU updates Ben Hutchings
2013-04-22 14:25 ` [40/75] kref: Implement kref_get_unless_zero v3 Ben Hutchings
2013-04-22 14:25 ` [19/75] rt2x00: rt2x00pci_regbusy_read() - only print register access failure once Ben Hutchings
2013-04-22 14:25 ` [14/75] USB: spcp8x5: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [22/75] ata_piix: Fix DVD not dectected at some Haswell platforms Ben Hutchings
2013-04-22 14:25 ` [04/75] USB: ch341: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [59/75] DRM/i915: Add QUIRK_INVERT_BRIGHTNESS for NCR machines Ben Hutchings
2013-04-22 14:25 ` [03/75] USB: ark3116: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [63/75] msi-wmi: Fix memory leak Ben Hutchings
2013-04-22 14:25 ` [26/75] powerpc: pSeries_lpar_hpte_remove fails from Adjunct partition being performed before the ANDCOND test Ben Hutchings
2013-04-22 14:25 ` [11/75] USB: mos7840: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [51/75] kernel/signal.c: stop info leak via the tkill and the tgkill syscalls Ben Hutchings
2013-04-22 14:25 ` [36/75] target: Fix MAINTENANCE_IN service action CDB checks to use lower 5 bits Ben Hutchings
2013-04-22 14:25 ` [09/75] USB: mct_u232: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [75/75] sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s Ben Hutchings
2013-04-22 14:25 ` [66/75] block: avoid using uninitialized value in from queue_var_store Ben Hutchings
2013-04-22 14:25 ` [57/75] drm/i915: panel: invert brightness via quirk Ben Hutchings
2013-04-22 14:25 ` [74/75] KVM: Allow cross page reads and writes from cached translations Ben Hutchings
2013-04-22 14:25 ` [45/75] of: introduce helper to manage boolean Ben Hutchings
2013-04-22 14:25 ` [50/75] hugetlbfs: add swap entry check in follow_hugetlb_page() Ben Hutchings
2013-04-22 14:25 ` [56/75] drm/i915: panel: invert brightness via parameter Ben Hutchings
2013-04-22 14:25 ` [72/75] KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797) Ben Hutchings
2013-04-22 14:25 ` [60/75] drm/i915: add quirk to invert brightness on eMachines G725 Ben Hutchings
2013-04-22 14:25 ` [12/75] USB: oti6858: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [23/75] hwspinlock: fix __hwspin_lock_request error path Ben Hutchings
2013-04-22 14:25 ` [18/75] crypto: gcm - fix assumption that assoc has one segment Ben Hutchings
2013-04-22 14:25 ` [21/75] libata: Set max sector to 65535 for Slimtype DVD A DS8A8SH drive Ben Hutchings
2013-04-22 14:25 ` [06/75] USB: ftdi_sio: fix use-after-free in TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [55/75] Btrfs: fix race between mmap writes and compression Ben Hutchings
2013-04-22 14:25 ` [42/75] vfs: Revert spurious fix to spinning prevention in prune_icache_sb Ben Hutchings
2013-04-22 14:25 ` [37/75] target: Fix incorrect fallthrough of ALUA Standby/Offline/Transition CDBs Ben Hutchings
2013-04-22 14:25 ` [41/75] kobject: fix kset_find_obj() race with concurrent last kobject_put() Ben Hutchings
2013-04-22 14:25 ` [62/75] drm/i915: add quirk to invert brightness on Packard Bell NCL20 Ben Hutchings
2013-04-22 14:25 ` [17/75] hrtimer: Don't reinitialize a cpu_base lock on CPU_UP Ben Hutchings
2013-04-22 14:25 ` [38/75] tracing: Fix possible NULL pointer dereferences Ben Hutchings
2013-04-22 14:25 ` [73/75] KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) Ben Hutchings
2013-04-22 14:25 ` [10/75] USB: mos7840: fix broken TIOCMIWAIT Ben Hutchings
2013-04-22 14:25 ` [31/75] ASoC: wm8903: Fix the bypass to HP/LINEOUT when no DAC or ADC is running Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1366640759.986123913@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=eldad@fogrefinery.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
--cc=zonque@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®