diff options
| author | Artem Egorkine <arteme@gmail.com> | 2022-12-25 12:57:28 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-01-07 12:07:35 +0100 |
| commit | b026af92b2cea907c780f7168c730c816cd33311 (patch) | |
| tree | ae2f05fa6f0c6e20205ed225dcf0cecaecbac14d | |
| parent | 0407e792783bff3d3fbc00cf660dc72ee3282afd (diff) | |
| download | linux-stable-b026af92b2cea907c780f7168c730c816cd33311.tar.gz linux-stable-b026af92b2cea907c780f7168c730c816cd33311.tar.bz2 linux-stable-b026af92b2cea907c780f7168c730c816cd33311.zip | |
ALSA: line6: fix stack overflow in line6_midi_transmit
commit b8800d324abb50160560c636bfafe2c81001b66c upstream.
Correctly calculate available space including the size of the chunk
buffer. This fixes a buffer overflow when multiple MIDI sysex
messages are sent to a PODxt device.
Signed-off-by: Artem Egorkine <arteme@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20221225105728.1153989-2-arteme@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | sound/usb/line6/midi.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c index 10cc3208d069..b908be4d347b 100644 --- a/sound/usb/line6/midi.c +++ b/sound/usb/line6/midi.c @@ -48,7 +48,8 @@ static void line6_midi_transmit(struct snd_rawmidi_substream *substream) int req, done; for (;;) { - req = min(line6_midibuf_bytes_free(mb), line6->max_packet_size); + req = min3(line6_midibuf_bytes_free(mb), line6->max_packet_size, + LINE6_FALLBACK_MAXPACKETSIZE); done = snd_rawmidi_transmit_peek(substream, chunk, req); if (done == 0) |