On Sat, Apr 27, 2019 at 08:07:28PM +0200, Greg KH wrote: > On Sat, Apr 27, 2019 at 11:34:03AM -0400, Alan Stern wrote: > > On Sat, 27 Apr 2019, Greg KH wrote: > > > > > On Fri, Apr 26, 2019 at 11:50:14AM +0200, Christo Gouws wrote: > > > > Hi, > > > > > > > > I have a Line6 Pod Studio UX1 card, but each time I plug it in, I get > > > > the following crash in dmesg on Ubuntu 18.04 > > > > Linux my-pc 4.20.8-042008-generic #201902121544 SMP Tue Feb 12 > > > > 20:46:50 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux > > > > > > > > I've also tested this with a Fedora 30 v5.0.6-300 kernel, but still > > > > seems to happen (using liveCD). > > > > > > > > > > > > The output on the card seems to work, but none of the inputs work. > > > > > > > > I've also now tested with latest kernel available on Arch Linux > > > > Linux my-pc 5.0.9-arch1-1-ARCH #1 SMP PREEMPT Sat Apr 20 15:00:46 UTC > > > > 2019 x86_64 GNU/Linux > > > > > > > > After some further testing, I found that this issue cropped in beween > > > > v4.8.17 and v4.9-rc1. > > > > > > > > v4.8.17 - Works fine. > > > > v4.9-rc1+ - Produces crash > > > > > > Any chance you can use 'git bisect' to find the exact commit that caused > > > the failure? > > > > No need. The bug is in line6_read_data() in sound/usb/line6/driver.c. > > That routine passes an invalid buffer to usb_control_message(). > > Instead it should allocate its own buffer for the USB transfer and then > > copy the value to the caller's buffer. > > > > There is a similar problem in line6_write_data(). Furthermore, both > > routines do DMA to/from a buffer on the stack. > > I have an old patch in my local tree for the dma buffer on the stack > issue, it's below. I should clean it up and send it correctly one of > these days :) But, in reading your response, it doesn't fix the reported issue here. Let me go audit the whole driver and fix it up and add it to my original patch...
