On Sat, 27 Apr 2019, Greg KH wrote: > On Fri, Apr 26, 2019 at 11:50:14AM +0200, Christo Gouws wrote: > > Hi, > > > > I have a Line6 Pod Studio UX1 card, but each time I plug it in, I get > > the following crash in dmesg on Ubuntu 18.04 > > Linux my-pc 4.20.8-042008-generic #201902121544 SMP Tue Feb 12 > > 20:46:50 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux > > > > I've also tested this with a Fedora 30 v5.0.6-300 kernel, but still > > seems to happen (using liveCD). > > > > > > The output on the card seems to work, but none of the inputs work. > > > > I've also now tested with latest kernel available on Arch Linux > > Linux my-pc 5.0.9-arch1-1-ARCH #1 SMP PREEMPT Sat Apr 20 15:00:46 UTC > > 2019 x86_64 GNU/Linux > > > > After some further testing, I found that this issue cropped in beween > > v4.8.17 and v4.9-rc1. > > > > v4.8.17 - Works fine. > > v4.9-rc1+ - Produces crash > > Any chance you can use 'git bisect' to find the exact commit that caused > the failure? No need. The bug is in line6_read_data() in sound/usb/line6/driver.c. That routine passes an invalid buffer to usb_control_message(). Instead it should allocate its own buffer for the USB transfer and then copy the value to the caller's buffer. There is a similar problem in line6_write_data(). Furthermore, both routines do DMA to/from a buffer on the stack. Alan Stern
