From: Takashi Iwai <tiwai@xxxxxxx>
commit ac0d71ee534e67c7e53439e8e9cb45ed40731660 upstream.
When a UMP Stream Configuration message is received, the driver tries
to switch the protocol, but there was no sanity check of the protocol,
hence it can pass an invalid value. Add the check and bail out if a
wrong value is passed.
Fixes: a79807683781 ("ALSA: ump: Add helper to change MIDI protocol")
Cc: <stable@xxxxxxxxxxxxxxx>
Link: https://lore.kernel.org/r/20240529164723.18309-1-tiwai@xxxxxxx
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
sound/core/ump.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/sound/core/ump.c
+++ b/sound/core/ump.c
@@ -685,10 +685,17 @@ static void seq_notify_protocol(struct s
*/
int snd_ump_switch_protocol(struct snd_ump_endpoint *ump, unsigned int protocol)
{
+ unsigned int type;
+
protocol &= ump->info.protocol_caps;
if (protocol == ump->info.protocol)
return 0;
+ type = protocol & SNDRV_UMP_EP_INFO_PROTO_MIDI_MASK;
+ if (type != SNDRV_UMP_EP_INFO_PROTO_MIDI1 &&
+ type != SNDRV_UMP_EP_INFO_PROTO_MIDI2)
+ return 0;
+
ump->info.protocol = protocol;
ump_dbg(ump, "New protocol = %x (caps = %x)\n",
protocol, ump->info.protocol_caps);
Patches currently in stable-queue which might be from tiwai@xxxxxxx are
queue-6.6/alsa-ump-don-t-clear-bank-selection-after-sending-a-program-change.patch
queue-6.6/alsa-ump-don-t-accept-an-invalid-ump-protocol-number.patch
