From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.0 required=3.0 tests=INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6AD4C33CB1 for ; Tue, 14 Jan 2020 13:24:27 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 4D4DF222C4 for ; Tue, 14 Jan 2020 13:24:27 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4D4DF222C4 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=alsa-devel-bounces@alsa-project.org Received: from alsa1.perex.cz (unknown [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id BEB2A2D5F; Tue, 14 Jan 2020 09:40:13 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz BEB2A2D5F Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id 442A7F8014D; Tue, 14 Jan 2020 09:40:13 +0100 (CET) Received: by alsa1.perex.cz (Postfix, from userid 50401) id DBA78F8014E; Tue, 14 Jan 2020 09:40:11 +0100 (CET) Received: from mail-lj1-f194.google.com (mail-lj1-f194.google.com [209.85.208.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 1F43FF800B9 for ; Tue, 14 Jan 2020 09:40:08 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 1F43FF800B9 Received: by mail-lj1-f194.google.com with SMTP id a13so13315465ljm.10 for ; Tue, 14 Jan 2020 00:40:08 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=zm6dxfwwxxsUgoQx/Ixs6f65hoaWz7f2fI6es/3Ijns=; b=I48lflIKnL1dA84jDugYX/1FVmCiNXwcLRr5SIHEIJnqjSfVClpgIOYo2OJpRksdTl N/P3poAHbd7aNGd5VrwncZu1Wgqay1ANjxHx0HECWTrg/fZ8s605LmRaLMSRx5rpWN0u YBvl8TTvvLnh5CEAPzuaNLG8KB258XrBimOXYb4XELOOoi0PxLp+wVBDjsR4NFAKjyKW u4kCBZUhELh5eS+zMUk0jN74qmxAN3Hs510IHgr5/Tr1C7eo51exAEfJBq1aPnVHM2gA eu+kLYXKvO/JQS8Ec8LfxX3BS+7Q1plgm2Xxaj0vvDltcbsXFk6p0KDars1reWSjz375 lsVA== X-Gm-Message-State: APjAAAW5OgngPikSYkiHKQlqVsSXFdtSw0lgIURhJC1wrdH9MgSdh+oN fAfw8Y93i8zTMUDfEx+owV4= X-Google-Smtp-Source: APXvYqxK2dS7w47TFeRL1ZrMAWZXamRgxsgmqFsDFdxveqSAiv1L06WR5SP8UeZYWuXxDExwsvy0yQ== X-Received: by 2002:a2e:910b:: with SMTP id m11mr12819480ljg.213.1578991208043; Tue, 14 Jan 2020 00:40:08 -0800 (PST) Received: from xi.terra (c-14b8e655.07-184-6d6c6d4.bbcust.telenor.se. [85.230.184.20]) by smtp.gmail.com with ESMTPSA id b14sm6840893lff.68.2020.01.14.00.40.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jan 2020 00:40:07 -0800 (PST) Received: from johan by xi.terra with local (Exim 4.92.3) (envelope-from ) id 1irHk7-0000Ia-26; Tue, 14 Jan 2020 09:40:07 +0100 From: Johan Hovold To: Takashi Iwai Date: Tue, 14 Jan 2020 09:39:53 +0100 Message-Id: <20200114083953.1106-1-johan@kernel.org> X-Mailer: git-send-email 2.24.1 MIME-Version: 1.0 Cc: alsa-devel@alsa-project.org, Johan Hovold , linux-kernel@vger.kernel.org, stable Subject: [alsa-devel] [PATCH] ALSA: usb-audio: fix sync-ep altsetting sanity check X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" The altsetting sanity check in set_sync_ep_implicit_fb_quirk() was checking for there to be at least one altsetting but then went on to access the second one, which may not exist. This could lead to random slab data being used to initialise the sync endpoint in snd_usb_add_endpoint(). Fixes: c75a8a7ae565 ("ALSA: snd-usb: add support for implicit feedback") Fixes: ca10a7ebdff1 ("ALSA: usb-audio: FT C400 sync playback EP to capture EP") Fixes: 5e35dc0338d8 ("ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204") Fixes: 17f08b0d9aaf ("ALSA: usb-audio: add implicit fb quirk for Axe-Fx II") Fixes: 103e9625647a ("ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk") Cc: stable # 3.5 Signed-off-by: Johan Hovold --- sound/usb/pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index a11c8150af58..0e4eab96e23e 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -370,7 +370,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, add_sync_ep_from_ifnum: iface = usb_ifnum_to_if(dev, ifnum); - if (!iface || iface->num_altsetting == 0) + if (!iface || iface->num_altsetting < 2) return -EINVAL; alts = &iface->altsetting[1]; -- 2.24.1 _______________________________________________ Alsa-devel mailing list Alsa-devel@alsa-project.org https://mailman.alsa-project.org/mailman/listinfo/alsa-devel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B549C33CB2 for ; Tue, 14 Jan 2020 08:40:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2141B207FF for ; Tue, 14 Jan 2020 08:40:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578991212; bh=MXqdw4MTso3cXAd4+1sT9xEPuKYM/LCL2K4R2PuY9fk=; h=From:To:Cc:Subject:Date:List-ID:From; b=HsS+BjbcQAAFvZGVbiqVVC7+xrOSDb93/mwI58HoPgWIb9P7vIqGjXyn6ESpWmdaG 1zNyzMrioN0vYuBBzQh6Q9twVJ1J3rxPo5s6jug3Wg8ipY3a9DnBJyegtR8KV8qwpi ODEXxMPpQBstbN5auGx7jvAo2QD2mgVoa7M1wLbI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728808AbgANIkK (ORCPT ); Tue, 14 Jan 2020 03:40:10 -0500 Received: from mail-lj1-f193.google.com ([209.85.208.193]:40007 "EHLO mail-lj1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727083AbgANIkK (ORCPT ); Tue, 14 Jan 2020 03:40:10 -0500 Received: by mail-lj1-f193.google.com with SMTP id u1so13337663ljk.7; Tue, 14 Jan 2020 00:40:08 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=zm6dxfwwxxsUgoQx/Ixs6f65hoaWz7f2fI6es/3Ijns=; b=I1uARPBp9OUDNT5/Yyt0sZC7WOngXlM96UryfU3EkWeN8o8jJBFRAWrYi36UMdfyt7 gvEm+f9Eu3K7KDuJw7+5dmQpaA54K2oj9bg04iFcMMbDZOoQqvLmaIelS0KeGc19ZTVA OCJiV3wsL54ha95oB3fsc03FgcfhegKON+JfLuJa8t4kMxZ0KYNHqzyxS8IwzN/vwBCe c+S7DkpIkx+ziLX78jaY97LDAUsTc85fVBXVqQMWwqAYEhSl7uqH4oRWbfttaPZiJfGN bPMYkowbMBRAGJRNKkXZPeMDZLOZr8dMBvaIRZy1BwyLWMf/J3z1f7696ZSvD2hE3Ayi ch3g== X-Gm-Message-State: APjAAAW0vFxEXSfpD/T/HiPcFcS/4uKpsVZAmoQ/TFot5r2UIu0SOze4 zLHUZV9bddkQjdhMpOVYZ/u4LocO X-Google-Smtp-Source: APXvYqxK2dS7w47TFeRL1ZrMAWZXamRgxsgmqFsDFdxveqSAiv1L06WR5SP8UeZYWuXxDExwsvy0yQ== X-Received: by 2002:a2e:910b:: with SMTP id m11mr12819480ljg.213.1578991208043; Tue, 14 Jan 2020 00:40:08 -0800 (PST) Received: from xi.terra (c-14b8e655.07-184-6d6c6d4.bbcust.telenor.se. [85.230.184.20]) by smtp.gmail.com with ESMTPSA id b14sm6840893lff.68.2020.01.14.00.40.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jan 2020 00:40:07 -0800 (PST) Received: from johan by xi.terra with local (Exim 4.92.3) (envelope-from ) id 1irHk7-0000Ia-26; Tue, 14 Jan 2020 09:40:07 +0100 From: Johan Hovold To: Takashi Iwai Cc: Jaroslav Kysela , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, Johan Hovold , stable Subject: [PATCH] ALSA: usb-audio: fix sync-ep altsetting sanity check Date: Tue, 14 Jan 2020 09:39:53 +0100 Message-Id: <20200114083953.1106-1-johan@kernel.org> X-Mailer: git-send-email 2.24.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The altsetting sanity check in set_sync_ep_implicit_fb_quirk() was checking for there to be at least one altsetting but then went on to access the second one, which may not exist. This could lead to random slab data being used to initialise the sync endpoint in snd_usb_add_endpoint(). Fixes: c75a8a7ae565 ("ALSA: snd-usb: add support for implicit feedback") Fixes: ca10a7ebdff1 ("ALSA: usb-audio: FT C400 sync playback EP to capture EP") Fixes: 5e35dc0338d8 ("ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204") Fixes: 17f08b0d9aaf ("ALSA: usb-audio: add implicit fb quirk for Axe-Fx II") Fixes: 103e9625647a ("ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk") Cc: stable # 3.5 Signed-off-by: Johan Hovold --- sound/usb/pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index a11c8150af58..0e4eab96e23e 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -370,7 +370,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, add_sync_ep_from_ifnum: iface = usb_ifnum_to_if(dev, ifnum); - if (!iface || iface->num_altsetting == 0) + if (!iface || iface->num_altsetting < 2) return -EINVAL; alts = &iface->altsetting[1]; -- 2.24.1