1 files changed, 10 insertions, 1 deletions

diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index 137e1e8718d6..c9c604f0e1ff 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -1211,6 +1211,7 @@ static void snd_usbmidi_output_drain(struct snd_rawmidi_substream *substream)
                 } while (drain_urbs && timeout);
                 finish_wait(&ep->drain_wait, &wait);
         }
+        port->active = 0;
         spin_unlock_irq(&ep->buffer_lock);
 }
 
@@ -1333,7 +1334,7 @@ static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi *umidi,
 
  error:
         snd_usbmidi_in_endpoint_delete(ep);
-        return -ENOMEM;
+        return err;
 }
 
 /*
@@ -1890,6 +1891,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi,
                 ms_ep = find_usb_ms_endpoint_descriptor(hostep);
                 if (!ms_ep)
                         continue;
+                if (ms_ep->bLength <= sizeof(*ms_ep))
+                        continue;
+                if (ms_ep->bNumEmbMIDIJack > 0x10)
+                        continue;
+                if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack)
+                        continue;
                 if (usb_endpoint_dir_out(ep)) {
                         if (endpoints[epidx].out_ep) {
                                 if (++epidx >= MIDI_MAX_ENDPOINTS) {
@@ -2142,6 +2149,8 @@ static int snd_usbmidi_detect_roland(struct snd_usb_midi *umidi,
                     cs_desc[1] == USB_DT_CS_INTERFACE &&
                     cs_desc[2] == 0xf1 &&
                     cs_desc[3] == 0x02) {
+                        if (cs_desc[4] > 0x10 || cs_desc[5] > 0x10)
+                                continue;
                         endpoint->in_cables  = (1 << cs_desc[4]) - 1;
                         endpoint->out_cables = (1 << cs_desc[5]) - 1;
                         return snd_usbmidi_detect_endpoints(umidi, endpoint, 1);