tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

sound: ua101: fix division by zero at probe

Add a missing sanity check for bNrChannels in detect_usb_format()
to prevent a division by zero in playback_urb_complete() and
capture_urb_complete().

USB core does not validate class-specific descriptor fields such
as bNrChannels, so drivers must verify them before use. If a
device provides bNrChannels = 0, frame_bytes becomes zero and is
later used as a divisor in the URB completion handlers, leading
to a kernel crash.

Fixes: 63978ab3e3e9 ("sound: add Edirol UA-101 support")
Cc: stable@vger.kernel.org
Signed-off-by: SeungJu Cheon <suunj1331@gmail.com>
Link: https://patch.msgid.link/20260426111239.103296-1-suunj1331@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>

authored by

SeungJu Cheon and committed by
Takashi Iwai d1f73f16 110189f0

+7
+7
sound/usb/misc/ua101.c
··· 974 974 975 975 ua->capture.channels = fmt_capture->bNrChannels; 976 976 ua->playback.channels = fmt_playback->bNrChannels; 977 + if (!ua->capture.channels || !ua->playback.channels) { 978 + dev_err(&ua->dev->dev, 979 + "invalid channel count: capture %u, playback %u\n", 980 + ua->capture.channels, ua->playback.channels); 981 + return -EINVAL; 982 + } 983 + 977 984 ua->capture.frame_bytes = 978 985 fmt_capture->bSubframeSize * ua->capture.channels; 979 986 ua->playback.frame_bytes =