From: Takashi Iwai <tiwai@suse.de>
To: HyeongJun An <sammiee5311@gmail.com>
Cc: clemens@ladisch.de, tiwai@suse.com, perex@perex.cz,
linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH] ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
Date: Tue, 01 Sep 2026 12:37:14 +0200 [thread overview]
Message-ID: <875x0pdzqd.wl-tiwai@suse.de> (raw)
In-Reply-To: <20260901090409.1478573-1-sammiee5311@gmail.com>
On Tue, 01 Sep 2026 11:04:09 +0200,
HyeongJun An wrote:
>
> The snd_usbmidi_us122l_output() picks a count of 2 on anything slower
> than high speed and never relates it to ep->max_transfer. The URB
> buffer holds exactly max_transfer bytes, so a device declaring a one
> byte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the
> memset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX.
>
> Only 0x800e and 0x800f are pinned to nine bytes. The US-122MKII at
> 0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the
> USB core only clamps downward.
>
> The akai and novation output ops in this file were given the same guard
> recently. Do the same here.
>
> Fixes: 030a07e44129 ("ALSA: Add USB US122L driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Applied now. Thanks.
Takashi
prev parent reply other threads:[~2026-09-01 10:37 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-01 9:04 [PATCH] ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() HyeongJun An
2026-09-01 10:37 ` Takashi Iwai [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=875x0pdzqd.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=clemens@ladisch.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=perex@perex.cz \
--cc=sammiee5311@gmail.com \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.