Merge tag 'sound-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound updates from Takashi Iwai:
 "Many updates in this development cycle are found in ASoC where it got
  a wide range of changes for the continued refactoring.

  Some highlights are below.

  ASoC:

   - Continued refactoring work by Morimoto-san toward the full
     componentization; the changes are seen allover the places

   - Support for force disconnecting muxes in DAPM

   - Continued development of ASoC Intel SOF stuff

   - New drivers for Cirrus Logic CS47L35, CS47L85 and CS47L90, Conexant
     CX2072X, Realtek RT1011 and RT1308

  HD-audio:

   - More fixes and adjustments for ASoC SOF HD-audio

   - Fix for resume problem on some Realtek codecs

  USB-audio:

   - A few fixes for the issues reported by syzbot USB fuzzer

   - Fix for UAC2 extension unit parser

   - Quirks for Line6 Helix, Emgaic Unitor 8

  FireWire:

   - Lots of code refactoring and fixes in most of its components"

* tag 'sound-5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (626 commits)
  ALSA: firewire-lib: code refactoring for local variables
  ALSA: firewire-lib: code refactoring for post operation to data block counter
  ALSA: firewire-lib: code refactoring for error path of parser for CIP header
  ALSA: firewire-lib: fix different data block counter between probed event and transferred isochronous packet
  ALSA: firewire-lib: fix initial value of data block count for IR context without CIP_DBC_IS_END_EVENT
  ALSA: firewire-lib/fireface: fix initial value of data block counter for IR context with CIP_NO_HEADER
  ALSA: firewire-lib: fix invalid length of rx packet payload for tracepoint events
  ALSA: usb-audio: fix Line6 Helix audio format rates
  firewire-motu: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: firewire-digi00x: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: dice: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: oxfw: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: fireworks: fix wrong reference count for stream functionality at error path of rawmidi interface
  ALSA: bebob: fix wrong reference count for stream functionality at error path of rawmidi interface
  ASoC: SOF: Intel: implement runtime idle for CNL/APL
  ASoC: SOF: add runtime idle callback
  ASoC: hdac_hdmi: report codec link up/down status to bus
  ASoC: SOF: debug: fix possible memory leak in sof_dfsentry_write()
  ASoC: sunxi: sun50i-codec-analog: Add earpiece
  ASoC: rt5665: remove redundant assignment to variable idx
  ...

1 files changed, 17 insertions, 0 deletions

diff --git a/sound/usb/helper.c b/sound/usb/helper.c
index 84aa265dd802..71d5f540334a 100644
--- a/sound/usb/helper.c
+++ b/sound/usb/helper.c
@@ -63,6 +63,20 @@ void *snd_usb_find_csint_desc(void *buffer, int buflen, void *after, u8 dsubtype
 	return NULL;
 }
 
+/* check the validity of pipe and EP types */
+int snd_usb_pipe_sanity_check(struct usb_device *dev, unsigned int pipe)
+{
+	static const int pipetypes[4] = {
+		PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
+	};
+	struct usb_host_endpoint *ep;
+
+	ep = usb_pipe_endpoint(dev, pipe);
+	if (usb_pipetype(pipe) != pipetypes[usb_endpoint_type(&ep->desc)])
+		return -EINVAL;
+	return 0;
+}
+
 /*
  * Wrapper for usb_control_msg().
  * Allocates a temp buffer to prevent dmaing from/to the stack.
@@ -75,6 +89,9 @@ int snd_usb_ctl_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
 	void *buf = NULL;
 	int timeout;
 
+	if (snd_usb_pipe_sanity_check(dev, pipe))
+		return -EINVAL;
+
 	if (size > 0) {
 		buf = kmemdup(data, size, GFP_KERNEL);
 		if (!buf)