lkml.org 
[lkml]   [2019]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 4.19 062/125] ALSA: usb-audio: Fix possible NULL dereference at create_yamaha_midi_quirk()
    On Wed, 13 Nov 2019 11:19:54 +0100,
    Pavel Machek wrote:
    >
    > Hi!
    >
    > > From: Takashi Iwai <tiwai@suse.de>
    > >
    > > commit 60849562a5db4a1eee2160167e4dce4590d3eafe upstream.
    > >
    > > The previous addition of descriptor validation may lead to a NULL
    > > dereference at create_yamaha_midi_quirk() when either injd or outjd is
    > > NULL. Add proper non-NULL checks.
    >
    > This is wrong.
    >
    > > @@ -259,8 +259,8 @@ static int create_yamaha_midi_quirk(stru
    > > NULL, USB_MS_MIDI_OUT_JACK);
    > > if (!injd && !outjd)
    > > return -ENODEV;
    >
    > Clearly code wants to allow at most one of them to be NULL.
    >
    > > - if (!snd_usb_validate_midi_desc(injd) ||
    > > - !snd_usb_validate_midi_desc(outjd))
    > > + if (!(injd && snd_usb_validate_midi_desc(injd)) ||
    > > + !(outjd && snd_usb_validate_midi_desc(outjd)))
    > > return -ENODEV;
    >
    > Yet it will return here if it is. Correct check would be
    >
    > + if (!(!injd || snd_usb_validate_midi_desc(injd)) ||
    > + !(!outjd || snd_usb_validate_midi_desc(outjd)))
    >
    > AFAICT.

    Erm, right, but a better representation is:

    if ((injd && !snd_usb_validate_midi_desc(injd)) ||
    (outjd && !snd_usb_validate_midi_desc(injd)))


    thanks,

    Takashi

    \
     
     \ /
      Last update: 2019-11-13 11:36    [W:2.841 / U:0.308 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site