Merge tag 'asoc-v5.3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie...

[sfrench/cifs-2.6.git] / sound / usb / helper.c

diff --git a/sound/usb/helper.c b/sound/usb/helper.c
index 84aa265dd802c7690a92d563498b05f3103c05fc..71d5f540334a23ea2904cb41e67d066c588ee932 100644 (file)
--- a/sound/usb/helper.c
+++ b/sound/usb/helper.c
@@ -63,6 +63,20 @@ void *snd_usb_find_csint_desc(void *buffer, int buflen, void *after, u8 dsubtype
        return NULL;
 }
 
+/* check the validity of pipe and EP types */
+int snd_usb_pipe_sanity_check(struct usb_device *dev, unsigned int pipe)
+{
+       static const int pipetypes[4] = {
+               PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
+       };
+       struct usb_host_endpoint *ep;
+
+       ep = usb_pipe_endpoint(dev, pipe);
+       if (usb_pipetype(pipe) != pipetypes[usb_endpoint_type(&ep->desc)])
+               return -EINVAL;
+       return 0;
+}
+
 /*
  * Wrapper for usb_control_msg().
  * Allocates a temp buffer to prevent dmaing from/to the stack.
@@ -75,6 +89,9 @@ int snd_usb_ctl_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
        void *buf = NULL;
        int timeout;
 
+       if (snd_usb_pipe_sanity_check(dev, pipe))
+               return -EINVAL;
+
        if (size > 0) {
                buf = kmemdup(data, size, GFP_KERNEL);
                if (!buf)