Commit 0be9a9a4 authored by Takashi Iwai's avatar Takashi Iwai Committed by Greg Kroah-Hartman

Revert "ALSA: usb-audio: purge needless variable length array"

commit 64188cfb upstream.

This reverts commit 89b593c3 ("ALSA: usb-audio: purge needless
variable length array").  The patch turned out to cause a severe
regression, triggering an Oops at snd_usb_ctl_msg().  It was overseen
that snd_usb_ctl_msg() writes back the response to the given buffer,
while the patch changed it to a read-only const buffer.  (One should
always double-check when an extra pointer cast is present...)

As a simple fix, just revert the affected commit.  It was merely a
cleanup.  Although it brings VLA again, it's clearer as a fix.  We'll
address the VLA later in another patch.

Fixes: 89b593c3 ("ALSA: usb-audio: purge needless variable length array")
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195875Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ffb97b00
...@@ -698,12 +698,12 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol, ...@@ -698,12 +698,12 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol,
struct snd_usb_audio *chip = elem->head.mixer->chip; struct snd_usb_audio *chip = elem->head.mixer->chip;
struct snd_us16x08_meter_store *store = elem->private_data; struct snd_us16x08_meter_store *store = elem->private_data;
u8 meter_urb[64]; u8 meter_urb[64];
char tmp[sizeof(mix_init_msg2)] = {0}; char tmp[max(sizeof(mix_init_msg1), sizeof(mix_init_msg2))];
switch (kcontrol->private_value) { switch (kcontrol->private_value) {
case 0: case 0:
snd_us16x08_send_urb(chip, (char *)mix_init_msg1, memcpy(tmp, mix_init_msg1, sizeof(mix_init_msg1));
sizeof(mix_init_msg1)); snd_us16x08_send_urb(chip, tmp, 4);
snd_us16x08_recv_urb(chip, meter_urb, snd_us16x08_recv_urb(chip, meter_urb,
sizeof(meter_urb)); sizeof(meter_urb));
kcontrol->private_value++; kcontrol->private_value++;
...@@ -721,7 +721,7 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol, ...@@ -721,7 +721,7 @@ static int snd_us16x08_meter_get(struct snd_kcontrol *kcontrol,
case 3: case 3:
memcpy(tmp, mix_init_msg2, sizeof(mix_init_msg2)); memcpy(tmp, mix_init_msg2, sizeof(mix_init_msg2));
tmp[2] = snd_get_meter_comp_index(store); tmp[2] = snd_get_meter_comp_index(store);
snd_us16x08_send_urb(chip, tmp, sizeof(mix_init_msg2)); snd_us16x08_send_urb(chip, tmp, 10);
snd_us16x08_recv_urb(chip, meter_urb, snd_us16x08_recv_urb(chip, meter_urb,
sizeof(meter_urb)); sizeof(meter_urb));
kcontrol->private_value = 0; kcontrol->private_value = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment