summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChris Rorvick <chris@rorvick.com>2015-02-11 13:03:31 +0100
committerTakashi Iwai <tiwai@suse.de>2015-02-12 11:07:48 +0100
commit25a0707cf6bc20677aa2e0b889d69f9dee8c1f14 (patch)
tree586b4705812e2fe55101e421acc2364a44b61d44
parentMerge tag 'sound-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/t... (diff)
downloadlinux-25a0707cf6bc20677aa2e0b889d69f9dee8c1f14.tar.xz
linux-25a0707cf6bc20677aa2e0b889d69f9dee8c1f14.zip
ALSA: line6: Improve line6_read/write_data() interfaces
The address cannot be negative so make it unsigned. Also, an unsigned int is always sufficient for the length, so no need to overdo it with a size_t. Finally, add in range checks to see if the values passed in actually fit where they are used. Signed-off-by: Chris Rorvick <chris@rorvick.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
-rw-r--r--sound/usb/line6/driver.c14
-rw-r--r--sound/usb/line6/driver.h8
2 files changed, 14 insertions, 8 deletions
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
index 99b63a7902f3..81b7da8e56d3 100644
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -302,14 +302,17 @@ static void line6_data_received(struct urb *urb)
/*
Read data from device.
*/
-int line6_read_data(struct usb_line6 *line6, int address, void *data,
- size_t datalen)
+int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
+ unsigned datalen)
{
struct usb_device *usbdev = line6->usbdev;
int ret;
unsigned char len;
unsigned count;
+ if (address > 0xffff || datalen > 0xff)
+ return -EINVAL;
+
/* query the serial number: */
ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
@@ -370,14 +373,17 @@ EXPORT_SYMBOL_GPL(line6_read_data);
/*
Write data to device.
*/
-int line6_write_data(struct usb_line6 *line6, int address, void *data,
- size_t datalen)
+int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
+ unsigned datalen)
{
struct usb_device *usbdev = line6->usbdev;
int ret;
unsigned char status;
int count;
+ if (address > 0xffff || datalen > 0xffff)
+ return -EINVAL;
+
ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
0x0022, address, data, datalen,
diff --git a/sound/usb/line6/driver.h b/sound/usb/line6/driver.h
index 5d20294d64f4..7da643e79e3b 100644
--- a/sound/usb/line6/driver.h
+++ b/sound/usb/line6/driver.h
@@ -147,8 +147,8 @@ struct usb_line6 {
extern char *line6_alloc_sysex_buffer(struct usb_line6 *line6, int code1,
int code2, int size);
-extern int line6_read_data(struct usb_line6 *line6, int address, void *data,
- size_t datalen);
+extern int line6_read_data(struct usb_line6 *line6, unsigned address,
+ void *data, unsigned datalen);
extern int line6_read_serial_number(struct usb_line6 *line6,
u32 *serial_number);
extern int line6_send_raw_message_async(struct usb_line6 *line6,
@@ -161,8 +161,8 @@ extern void line6_start_timer(struct timer_list *timer, unsigned long msecs,
void (*function)(unsigned long),
unsigned long data);
extern int line6_version_request_async(struct usb_line6 *line6);
-extern int line6_write_data(struct usb_line6 *line6, int address, void *data,
- size_t datalen);
+extern int line6_write_data(struct usb_line6 *line6, unsigned address,
+ void *data, unsigned datalen);
int line6_probe(struct usb_interface *interface,
const struct usb_device_id *id,