From mboxrd@z Thu Jan 1 00:00:00 1970 From: Takashi Iwai Subject: Re: [PATCH] Fix an OOB bug in uac_mixer_unit_bmControls Date: Sat, 17 Aug 2019 19:59:25 +0200 Message-ID: References: <20190817043208.12433-1-benquike@gmail.com> Mime-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mx1.suse.de (mx2.suse.de [195.135.220.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 17120F801DA for ; Sat, 17 Aug 2019 19:59:26 +0200 (CEST) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" To: Hui Peng Cc: Mathias Payer , Wenwen Wang , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, Takashi Iwai , YueHaibing , security@kernel.org, Thomas Gleixner List-Id: alsa-devel@alsa-project.org T24gU2F0LCAxNyBBdWcgMjAxOSAxODo0NzowNSArMDIwMCwKSHVpIFBlbmcgd3JvdGU6Cj4gCj4g Tm8sIHRoZXJlIHdhcyBub3QgdHJpZ2dlcmluZy4gSSBmb3VuZCBpdCBhY2NpZGVudGFsbHkgd2hl biBJIHdhcyBnb2luZyB0aHJvdWdoCj4gdGhlIGNvZGUuCj4gCj4gWWVhaCwgeW91IGFyZSByaWdo dC4gaXQgaXMgaGFuZGxlZCBpbiB0aGUgbGFzdCBjaGVjay4gSXMgaXQgZGVmaW5lZCBpbiB0aGUK PiBzcGVjIHRoYXQgdGhlIGRlc2NyaXB0b3IgbmVlZHMgdG8gaGF2ZSA0LzYvMiBhZGRpdGlvbmFs IGJ5dGVzIGZvciB0aGUKPiBibUNvbnRyb2wgZmllbGQ/LCBpZiBzbywgaXQgaXMgZWFzaWVyIHRv IHVuZGVyc3RhbmQgdGhlIHVzaW5nIHRoZSBjb2RlIGluIHRoZQo+IHdheSBpbiBteSBmaXJzdCBw YXRjaC4KPiAKPiBJZiB5b3UgdGhpbmsgdGhpcyBpcyB1bm5lY2Vzc2FyeSwgd2UgY2FuIHNraXAg dGhpcyBwYXRjaC4KCldlbGwsIHRoZSBwYXRjaCBlc3NlbnRpYWxseSBvcGVuLWNvZGVzIHdoYXQg dGhlIGhlbHBlciBmdW5jdGlvbiBkb2VzCmFkZHMgb25lIG1vcmUgY2hlY2sgdW5uZWNlc3Nhcmls eSwgc28gSSBkb24ndCB0aGluayBpdCB3b3J0aC4KTGV0J3Mgc2tpcCBpdC4KCgp0aGFua3MsCgpU YWthc2hpCgo+IE9uIFNhdCwgQXVnIDE3LCAyMDE5IGF0IDEyOjE4IFBNIFRha2FzaGkgSXdhaSA8 dGl3YWlAc3VzZS5kZT4gd3JvdGU6Cj4gCj4gICAgIE9uIFNhdCwgMTcgQXVnIDIwMTkgMTc6NTc6 MzggKzAyMDAsCj4gICAgIEh1aSBQZW5nIHdyb3RlOgo+ICAgICA+Cj4gICAgID4gTG9va2luZyBh cm91bmQsIHRoZXJlIGFyZSBvdGhlciBzdXNwaWNpb3VzIGNvZGVzLiBFLmcuLCBpbiB0aGUgZm9s bG93aW5nCj4gICAgID4gZnVuY3Rpb24sIGl0IHNlZW1zIHRvIGJlIHRoZSBzYW1lIGFzIGB1YWNf bWl4ZXJfdW5pdF9ibUNvbnRyb2xzYCwgYnV0IGl0Cj4gICAgIGlzCj4gICAgID4gYWNjZXNzaW5n IGBkZXNjLT5iTnJJblBpbnMgKyA1YCwgaW4gY2FzZSBvZiBVQUNfVkVSU0lPTl8xLgo+ICAgICA+ IElzIHRoaXMgaW50ZW5kZWQ/Cj4gICAgCj4gICAgIFllcywgdGhpcyBpc24ndCBmb3IgdGhlIG1p eGVyIHVuaXQgYnV0IGZvciB0aGUgcHJvY2Vzc2luZyB1bml0Lgo+ICAgICBUaGV5IGhhdmUgZGlm ZmVyZW50IGRlZmluaXRpb25zLgo+ICAgIAo+ICAgICBOb3cgYmFjayB0byB0aGUgb3JpZ2luYWwg cmVwb3J0OiBJIHJlYWQgdGhlIGNvZGUgYWdhaW4gYnV0IGZhaWwgdG8gc2VlCj4gICAgIHdoZXJl IGlzIE9PQiBhY2Nlc3MuwqAgTGV0J3Mgc2VlIHRoZSBmdW5jdGlvbjoKPiAgICAKPiAgICAgc3Rh dGljIGludCB1YWNfbWl4ZXJfdW5pdF9nZXRfY2hhbm5lbHMoc3RydWN0IG1peGVyX2J1aWxkICpz dGF0ZSwKPiAgICAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqAgwqAgwqBzdHJ1Y3QgdWFjX21peGVyX3VuaXRfZGVzY3JpcHRvcgo+ICAgICAqZGVz YykKPiAgICAgewo+ICAgICDCoCDCoCDCoCDCoCBpbnQgbXVfY2hhbm5lbHM7Cj4gICAgIMKgIMKg IMKgIMKgIHZvaWQgKmM7Cj4gICAgCj4gICAgIMKgIMKgIMKgIMKgIGlmIChkZXNjLT5iTGVuZ3Ro IDwgc2l6ZW9mKCpkZXNjKSkKPiAgICAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgcmV0dXJuIC1F SU5WQUw7Cj4gICAgIMKgIMKgIMKgIMKgIGlmICghZGVzYy0+Yk5ySW5QaW5zKQo+ICAgICDCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCByZXR1cm4gLUVJTlZBTDsKPiAgICAgwqAgwqAgwqAgwqAgaWYg KGRlc2MtPmJMZW5ndGggPCBzaXplb2YoKmRlc2MpICsgZGVzYy0+Yk5ySW5QaW5zKQo+ICAgICDC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCByZXR1cm4gLUVJTlZBTDsKPiAgICAKPiAgICAgwqAgwqAg wqAgwqAgc3dpdGNoIChzdGF0ZS0+bWl4ZXItPnByb3RvY29sKSB7Cj4gICAgIMKgIMKgIMKgIMKg IGNhc2UgVUFDX1ZFUlNJT05fMToKPiAgICAgwqAgwqAgwqAgwqAgY2FzZSBVQUNfVkVSU0lPTl8y Ogo+ICAgICDCoCDCoCDCoCDCoCBkZWZhdWx0Ogo+ICAgICDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCBpZiAoZGVzYy0+Ykxlbmd0aCA8IHNpemVvZigqZGVzYykgKyBkZXNjLT5iTnJJblBpbnMgKyAx KQo+ICAgICDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCByZXR1cm4gMDsgLyog bm8gYm1Db250cm9scyAtPiBza2lwICovCj4gICAgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIG11 X2NoYW5uZWxzID0gdWFjX21peGVyX3VuaXRfYk5yQ2hhbm5lbHMoZGVzYyk7Cj4gICAgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIGJyZWFrOwo+ICAgICDCoCDCoCDCoCDCoCBjYXNlIFVBQ19WRVJT SU9OXzM6Cj4gICAgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIG11X2NoYW5uZWxzID0gZ2V0X2Ns dXN0ZXJfY2hhbm5lbHNfdjMoc3RhdGUsCj4gICAgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgIHVhYzNfbWl4ZXJfdW5pdF93Q2x1c3RlckRlc2NySUQoZGVz YykpOwo+ICAgICDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCBicmVhazsKPiAgICAgwqAgwqAgwqAg wqAgfQo+ICAgIAo+ICAgICDCoCDCoCDCoCDCoCBpZiAoIW11X2NoYW5uZWxzKQo+ICAgICDCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCByZXR1cm4gMDsKPiAgICAKPiAgICAgLi4uIHVudGlsIHRoaXMg cG9pbnQsIG11X2NoYW5uZWxzIGlzIGNhbGN1bGF0ZWQgYnV0IG5vIGFjdHVhbCBhY2Nlc3MKPiAg ICAgaGFwcGVucy7CoCBUaGVuOgo+ICAgIAo+ICAgICDCoCDCoCDCoCDCoCBjID0gdWFjX21peGVy X3VuaXRfYm1Db250cm9scyhkZXNjLCBzdGF0ZS0+bWl4ZXItPnByb3RvY29sKTsKPiAgICAKPiAg ICAgLi4uIHRoaXMgcmV0dXJucyB0aGUgKmFkZHJlc3MqIG9mIHRoZSBibUNvbnRyb2xzIGJpdG1h cC7CoCBBdCB0aGlzCj4gICAgIHBvaW50LCBpdCdzIG5vdCBhY2Nlc3NlZCB5ZXQuwqAgTm93Ogo+ ICAgIAo+ICAgICDCoCDCoCDCoCDCoCBpZiAoYyAtICh2b2lkICopZGVzYyArIChtdV9jaGFubmVs cyAtIDEpIC8gOCA+PSBkZXNjLT5iTGVuZ3RoKQo+ICAgICDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCByZXR1cm4gMDsgLyogbm8gYm1Db250cm9scyAtPiBza2lwICovCj4gICAgCj4gICAgIC4uLiBo ZXJlIHdlIGNoZWNrIHdoZXRoZXIgdGhlIGFjdHVhbCBiaXRtYXAgYWRkcmVzcyBwbHVzIHRoZSBt YXgKPiAgICAgYml0bWFwIHNpemUgb3ZlcmZsb3dzIGJMZW5ndGguwqAgQW5kIGlmIGl0IG92ZXJm bG93cywgcmV0dXJucyAwLAo+ICAgICBpbmRpY2F0aW5nIG5vIGJpdG1hcCBhdmFpbGFibGUuCj4g ICAgCj4gICAgIFNvIHRoZSBjb2RlIGRvZXNuJ3QgYWNjZXNzIGJ1dCBjaGVja3MgcHJvcGVybHkg YmVmb3JlaGFuZCBhcyBmYXIgYXMgSQo+ICAgICB1bmRlcnN0YW5kLsKgIElzIHRoZSBhY3R1YWwg T09CIGFjY2VzcyB0cmlnZ2VyZWQgYnkgc29tZSBwcm9ncmFtPwo+IAo+ICAgICB0aGFua3MsCj4g ICAgCj4gICAgIFRha2FzaGkKPiAgICAKPiAgICAgPgo+ICAgICA+IHN0YXRpYyBpbmxpbmUgX191 OCAqdWFjX3Byb2Nlc3NpbmdfdW5pdF9ibUNvbnRyb2xzKHN0cnVjdAo+ICAgICB1YWNfcHJvY2Vz c2luZ191bml0X2Rlc2NyaXB0b3IgKmRlc2MsCj4gICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCBp bnQgcHJvdG9jb2wpCj4gICAgID4gewo+ICAgICA+wqAgwqAgwqAgwqAgwqBzd2l0Y2ggKHByb3Rv Y29sKSB7Cj4gICAgID7CoCDCoCDCoCDCoCDCoGNhc2UgVUFDX1ZFUlNJT05fMToKPiAgICAgPsKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgcmV0dXJuICZkZXNjLT5iYVNvdXJjZUlEW2Rlc2MtPmJO ckluUGlucyArIDVdOwo+ICAgICA+wqAgwqAgwqAgwqAgwqBjYXNlIFVBQ19WRVJTSU9OXzI6Cj4g ICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHJldHVybiAmZGVzYy0+YmFTb3VyY2VJRFtk ZXNjLT5iTnJJblBpbnMgKyA2XTsKPiAgICAgPsKgIMKgIMKgIMKgIMKgY2FzZSBVQUNfVkVSU0lP Tl8zOgo+ICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqByZXR1cm4gJmRlc2MtPmJhU291 cmNlSURbZGVzYy0+Yk5ySW5QaW5zICsgMl07Cj4gICAgID7CoCDCoCDCoCDCoCDCoGRlZmF1bHQ6 Cj4gICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHJldHVybiBOVUxMOwo+ICAgICA+wqAg wqAgwqAgwqAgwqB9Cj4gICAgID4gfQo+ICAgICA+Cj4gICAgID4gT24gU2F0LCBBdWcgMTcsIDIw MTkgYXQgMjo1NSBBTSBUYWthc2hpIEl3YWkgPHRpd2FpQHN1c2UuZGU+IHdyb3RlOgo+ICAgICA+ Cj4gICAgID7CoCDCoCDCoE9uIFNhdCwgMTcgQXVnIDIwMTkgMDY6MzI6MDcgKzAyMDAsCj4gICAg ID7CoCDCoCDCoEh1aSBQZW5nIHdyb3RlOgo+ICAgICA+wqAgwqAgwqA+Cj4gICAgID7CoCDCoCDC oD4gYHVhY19taXhlcl91bml0X2dldF9jaGFubmVsc2AgY2FsbHMgYHVhY19taXhlcl91bml0X2Jt Q29udHJvbHNgCj4gICAgID7CoCDCoCDCoD4gdG8gZ2V0IHBvaW50ZXIgdG8gYm1Db250cm9scyBm aWVsZC4gVGhlIGN1cnJlbnQgaW1wbGVtZW50YXRpb24gb2YKPiAgICAgPsKgIMKgIMKgPiBgdWFj X21peGVyX3VuaXRfZ2V0X2NoYW5uZWxzYCBkb2VzIHByb3Blcmx5IGNoZWNrIHRoZSBzaXplIG9m Cj4gICAgID7CoCDCoCDCoD4gdWFjX21peGVyX3VuaXRfZGVzY3JpcHRvciBkZXNjcmlwdG9yIGFu ZCBtYXkgYWxsb3cgT09CIGFjY2Vzcwo+ICAgICA+wqAgwqAgwqA+IGluIGB1YWNfbWl4ZXJfdW5p dF9ibUNvbnRyb2xzYC4KPiAgICAgPsKgIMKgIMKgPgo+ICAgICA+wqAgwqAgwqA+IFJlcG9ydGVk LWJ5OiBIdWkgUGVuZyA8YmVucXVpa2VAZ21haWwuY29tPgo+ICAgICA+wqAgwqAgwqA+IFJlcG9y dGVkLWJ5OiBNYXRoaWFzIFBheWVyIDxtYXRoaWFzLnBheWVyQG5lYmVsd2VsdC5uZXQ+Cj4gICAg ID7CoCDCoCDCoD4gU2lnbmVkLW9mZi1ieTogSHVpIFBlbmcgPGJlbnF1aWtlQGdtYWlsLmNvbT4K PiAgICAgPsKgIMKgCj4gICAgID7CoCDCoCDCoEFoIGEgZ29vZCBjYXRjaC4KPiAgICAgPsKgIMKg Cj4gICAgID7CoCDCoCDCoE9uZSBlYXNpZXIgZml4IGluIHRoaXMgY2FzZSB3b3VsZCBiZSB0byBn ZXQgdGhlIG9mZnNldCBmcm9tCj4gICAgID7CoCDCoCDCoHVhY19taXhlcl91bml0X2JtQ29udHJv bHMoKSwgZS5nLgo+ICAgICA+wqAgwqAKPiAgICAgPsKgIMKgIMKgwqAgwqAgwqAgwqAgLyogY2Fs Y3VsYXRlIHRoZSBvZmZzZXQgb2YgYm1Db250cm9scyBmaWVsZCAqLwo+ICAgICA+wqAgwqAgwqDC oCDCoCDCoCDCoCBzaXplX3QgYm1jX29mZnNldCA9IHVhY19taXhlcl91bml0X2JtQ29udHJvbHMo TlVMTCwKPiAgICAgcHJvdG9jb2wpIC0KPiAgICAgPsKgIMKgIMKgTlVMTDsKPiAgICAgPsKgIMKg IMKgwqAgwqAgwqAgwqAgLi4uLgo+ICAgICA+wqAgwqAgwqDCoCDCoCDCoCDCoCBpZiAoZGVzYy0+ Ykxlbmd0aCA8IGJtY19vZmZzZXQpCj4gICAgID7CoCDCoCDCoMKgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIHJldHVybiAwOwo+ICAgICA+wqAgwqAKPiAgICAgPsKgIMKgIMKgdGhhbmtzLAo+ICAgICA+ wqAgwqAKPiAgICAgPsKgIMKgIMKgVGFrYXNoaQo+ICAgICA+Cj4gICAgID7CoCDCoCDCoD4gLS0t Cj4gICAgID7CoCDCoCDCoD7CoCBzb3VuZC91c2IvbWl4ZXIuYyB8IDI1ICsrKysrKysrKysrKysr KysrKy0tLS0tLS0KPiAgICAgPsKgIMKgIMKgPsKgIDEgZmlsZSBjaGFuZ2VkLCAxOCBpbnNlcnRp b25zKCspLCA3IGRlbGV0aW9ucygtKQo+ICAgICA+wqAgwqAgwqA+Cj4gICAgID7CoCDCoCDCoD4g ZGlmZiAtLWdpdCBhL3NvdW5kL3VzYi9taXhlci5jIGIvc291bmQvdXNiL21peGVyLmMKPiAgICAg PsKgIMKgIMKgPiBpbmRleCBiNTkyN2MzZDViYzAuLjAwZTYyNzRhNjNjMyAxMDA2NDQKPiAgICAg PsKgIMKgIMKgPiAtLS0gYS9zb3VuZC91c2IvbWl4ZXIuYwo+ICAgICA+wqAgwqAgwqA+ICsrKyBi L3NvdW5kL3VzYi9taXhlci5jCj4gICAgID7CoCDCoCDCoD4gQEAgLTczOCwyOCArNzM4LDM5IEBA IHN0YXRpYyBpbnQgZ2V0X2NsdXN0ZXJfY2hhbm5lbHNfdjMoc3RydWN0Cj4gICAgID7CoCDCoCDC oG1peGVyX2J1aWxkICpzdGF0ZSwgdW5zaWduZWQgaW50IGNsdXN0Cj4gICAgID7CoCDCoCDCoD7C oCBzdGF0aWMgaW50IHVhY19taXhlcl91bml0X2dldF9jaGFubmVscyhzdHJ1Y3QgbWl4ZXJfYnVp bGQgKnN0YXRlLAo+ICAgICA+wqAgwqAgwqA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgc3RydWN0Cj4gICAgIHVhY19taXhlcl91bml0X2Rl c2NyaXB0b3IKPiAgICAgPsKgIMKgIMKgKmRlc2MpCj4gICAgID7CoCDCoCDCoD7CoCB7Cj4gICAg ID7CoCDCoCDCoD4gLcKgIMKgIMKgaW50IG11X2NoYW5uZWxzOwo+ICAgICA+wqAgwqAgwqA+ICvC oCDCoCDCoGludCBtdV9jaGFubmVscyA9IDA7Cj4gICAgID7CoCDCoCDCoD7CoCDCoCDCoCDCoHZv aWQgKmM7Cj4gICAgID7CoCDCoCDCoD7CoAo+ICAgICA+wqAgwqAgwqA+IC3CoCDCoCDCoGlmIChk ZXNjLT5iTGVuZ3RoIDwgc2l6ZW9mKCpkZXNjKSkKPiAgICAgPsKgIMKgIMKgPiAtwqAgwqAgwqAg wqAgwqAgwqAgwqByZXR1cm4gLUVJTlZBTDsKPiAgICAgPsKgIMKgIMKgPsKgIMKgIMKgIMKgaWYg KCFkZXNjLT5iTnJJblBpbnMpCj4gICAgID7CoCDCoCDCoD7CoCDCoCDCoCDCoCDCoCDCoCDCoCDC oHJldHVybiAtRUlOVkFMOwo+ICAgICA+wqAgwqAgwqA+IC3CoCDCoCDCoGlmIChkZXNjLT5iTGVu Z3RoIDwgc2l6ZW9mKCpkZXNjKSArIGRlc2MtPmJOckluUGlucykKPiAgICAgPsKgIMKgIMKgPiAt wqAgwqAgwqAgwqAgwqAgwqAgwqByZXR1cm4gLUVJTlZBTDsKPiAgICAgPsKgIMKgIMKgPsKgCj4g ICAgID7CoCDCoCDCoD7CoCDCoCDCoCDCoHN3aXRjaCAoc3RhdGUtPm1peGVyLT5wcm90b2NvbCkg ewo+ICAgICA+wqAgwqAgwqA+wqAgwqAgwqAgwqBjYXNlIFVBQ19WRVJTSU9OXzE6Cj4gICAgID7C oCDCoCDCoD4gK8KgIMKgIMKgIMKgIMKgIMKgIMKgLy8gbGltaXQgZGVyaXZlZCBmcm9tIHVhY19t aXhlcl91bml0X2JtQ29udHJvbHMKPiAgICAgPsKgIMKgIMKgPiArwqAgwqAgwqAgwqAgwqAgwqAg wqBpZiAoZGVzYy0+Ykxlbmd0aCA8IHNpemVvZigqZGVzYykgKyBkZXNjLT5iTnJJblBpbnMKPiAg ICAgKyA0KQo+ICAgICA+wqAgwqAgwqA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oHJldHVybiAwOwo+ICAgICA+wqAgwqAgwqA+ICsKPiAgICAgPsKgIMKgIMKgPiArwqAgwqAgwqAg wqAgwqAgwqAgwqBtdV9jaGFubmVscyA9IHVhY19taXhlcl91bml0X2JOckNoYW5uZWxzKGRlc2Mp Owo+ICAgICA+wqAgwqAgwqA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoGJyZWFrOwo+ICAgICA+wqAg wqAgwqA+ICsKPiAgICAgPsKgIMKgIMKgPsKgIMKgIMKgIMKgY2FzZSBVQUNfVkVSU0lPTl8yOgo+ ICAgICA+wqAgwqAgwqA+IC3CoCDCoCDCoGRlZmF1bHQ6Cj4gICAgID7CoCDCoCDCoD4gLcKgIMKg IMKgIMKgIMKgIMKgIMKgaWYgKGRlc2MtPmJMZW5ndGggPCBzaXplb2YoKmRlc2MpICsgZGVzYy0+ Yk5ySW5QaW5zCj4gICAgICsgMSkKPiAgICAgPsKgIMKgIMKgPiArwqAgwqAgwqAgwqAgwqAgwqAg wqAvLyBsaW1pdCBkZXJpdmVkIGZyb20gdWFjX21peGVyX3VuaXRfYm1Db250cm9scwo+ICAgICA+ wqAgwqAgwqA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoGlmIChkZXNjLT5iTGVuZ3RoIDwgc2l6ZW9m KCpkZXNjKSArIGRlc2MtPmJOckluUGlucwo+ICAgICArIDYpCj4gICAgID7CoCDCoCDCoD7CoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHJldHVybiAwOyAvKiBubyBibUNvbnRyb2xz IC0+IHNraXAgKi8KPiAgICAgPsKgIMKgIMKgPiArCj4gICAgID7CoCDCoCDCoD7CoCDCoCDCoCDC oCDCoCDCoCDCoCDCoG11X2NoYW5uZWxzID0gdWFjX21peGVyX3VuaXRfYk5yQ2hhbm5lbHMoZGVz Yyk7Cj4gICAgID7CoCDCoCDCoD7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGJyZWFrOwo+ICAgICA+ wqAgwqAgwqA+wqAgwqAgwqAgwqBjYXNlIFVBQ19WRVJTSU9OXzM6Cj4gICAgID7CoCDCoCDCoD4g K8KgIMKgIMKgIMKgIMKgIMKgIMKgLy8gbGltaXQgZGVyaXZlZCBmcm9tIHVhY19taXhlcl91bml0 X2JtQ29udHJvbHMKPiAgICAgPsKgIMKgIMKgPiArwqAgwqAgwqAgwqAgwqAgwqAgwqBpZiAoZGVz Yy0+Ykxlbmd0aCA8IHNpemVvZigqZGVzYykgKyBkZXNjLT5iTnJJblBpbnMKPiAgICAgKyAyKQo+ ICAgICA+wqAgwqAgwqA+ICvCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHJldHVybiAw OyAvKiBubyBibUNvbnRyb2xzIC0+IHNraXAgKi8KPiAgICAgPsKgIMKgIMKgPiArCj4gICAgID7C oCDCoCDCoD7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoG11X2NoYW5uZWxzID0gZ2V0X2NsdXN0ZXJf Y2hhbm5lbHNfdjMoc3RhdGUsCj4gICAgID7CoCDCoCDCoD7CoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHVhYzNfbWl4ZXJfdW5pdF93Q2x1c3RlckRlc2NySUQK PiAgICAgKGRlc2MpKTsKPiAgICAgPsKgIMKgIMKgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgYnJl YWs7Cj4gICAgID7CoCDCoCDCoD4gKwo+ICAgICA+wqAgwqAgwqA+ICvCoCDCoCDCoGRlZmF1bHQ6 Cj4gICAgID7CoCDCoCDCoD4gK8KgIMKgIMKgIMKgIMKgIMKgIMKgYnJlYWs7Cj4gICAgID7CoCDC oCDCoD7CoCDCoCDCoCDCoH0KPiAgICAgPsKgIMKgIMKgPsKgCj4gICAgID7CoCDCoCDCoD7CoCDC oCDCoCDCoGlmICghbXVfY2hhbm5lbHMpCj4gICAgID7CoCDCoCDCoD4gLS0KPiAgICAgPsKgIMKg IMKgPiAyLjIyLjEKPiAgICAgPsKgIMKgIMKgPgo+ICAgICA+wqAgwqAgwqA+Cj4gICAgID4KPiAg ICAgPgo+IAo+IApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwpBbHNhLWRldmVsIG1haWxpbmcgbGlzdApBbHNhLWRldmVsQGFsc2EtcHJvamVjdC5vcmcKaHR0 cHM6Ly9tYWlsbWFuLmFsc2EtcHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby9hbHNhLWRldmVs Cg== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.7 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B560C3A59B for ; Sat, 17 Aug 2019 18:02:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 15A6920880 for ; Sat, 17 Aug 2019 18:02:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726203AbfHQR72 (ORCPT ); Sat, 17 Aug 2019 13:59:28 -0400 Received: from mx2.suse.de ([195.135.220.15]:45804 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725784AbfHQR72 (ORCPT ); Sat, 17 Aug 2019 13:59:28 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id D48AAAF94; Sat, 17 Aug 2019 17:59:25 +0000 (UTC) Date: Sat, 17 Aug 2019 19:59:25 +0200 Message-ID: From: Takashi Iwai To: Hui Peng Cc: security@kernel.org, alsa-devel@alsa-project.org, YueHaibing , Thomas Gleixner , Mathias Payer , Jaroslav Kysela , Takashi Iwai , Wenwen Wang , linux-kernel@vger.kernel.org Subject: Re: [PATCH] Fix an OOB bug in uac_mixer_unit_bmControls In-Reply-To: References: <20190817043208.12433-1-benquike@gmail.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 17 Aug 2019 18:47:05 +0200, Hui Peng wrote: > > No, there was not triggering. I found it accidentally when I was going through > the code. > > Yeah, you are right. it is handled in the last check. Is it defined in the > spec that the descriptor needs to have 4/6/2 additional bytes for the > bmControl field?, if so, it is easier to understand the using the code in the > way in my first patch. > > If you think this is unnecessary, we can skip this patch. Well, the patch essentially open-codes what the helper function does adds one more check unnecessarily, so I don't think it worth. Let's skip it. thanks, Takashi > On Sat, Aug 17, 2019 at 12:18 PM Takashi Iwai wrote: > > On Sat, 17 Aug 2019 17:57:38 +0200, > Hui Peng wrote: > > > > Looking around, there are other suspicious codes. E.g., in the following > > function, it seems to be the same as `uac_mixer_unit_bmControls`, but it > is > > accessing `desc->bNrInPins + 5`, in case of UAC_VERSION_1. > > Is this intended? > > Yes, this isn't for the mixer unit but for the processing unit. > They have different definitions. > > Now back to the original report: I read the code again but fail to see > where is OOB access.  Let's see the function: > > static int uac_mixer_unit_get_channels(struct mixer_build *state, >                                        struct uac_mixer_unit_descriptor > *desc) > { >         int mu_channels; >         void *c; > >         if (desc->bLength < sizeof(*desc)) >                 return -EINVAL; >         if (!desc->bNrInPins) >                 return -EINVAL; >         if (desc->bLength < sizeof(*desc) + desc->bNrInPins) >                 return -EINVAL; > >         switch (state->mixer->protocol) { >         case UAC_VERSION_1: >         case UAC_VERSION_2: >         default: >                 if (desc->bLength < sizeof(*desc) + desc->bNrInPins + 1) >                         return 0; /* no bmControls -> skip */ >                 mu_channels = uac_mixer_unit_bNrChannels(desc); >                 break; >         case UAC_VERSION_3: >                 mu_channels = get_cluster_channels_v3(state, >                                 uac3_mixer_unit_wClusterDescrID(desc)); >                 break; >         } > >         if (!mu_channels) >                 return 0; > > ... until this point, mu_channels is calculated but no actual access > happens.  Then: > >         c = uac_mixer_unit_bmControls(desc, state->mixer->protocol); > > ... this returns the *address* of the bmControls bitmap.  At this > point, it's not accessed yet.  Now: > >         if (c - (void *)desc + (mu_channels - 1) / 8 >= desc->bLength) >                 return 0; /* no bmControls -> skip */ > > ... here we check whether the actual bitmap address plus the max > bitmap size overflows bLength.  And if it overflows, returns 0, > indicating no bitmap available. > > So the code doesn't access but checks properly beforehand as far as I > understand.  Is the actual OOB access triggered by some program? > > thanks, > > Takashi > > > > > static inline __u8 *uac_processing_unit_bmControls(struct > uac_processing_unit_descriptor *desc, > >                                                    int protocol) > > { > >         switch (protocol) { > >         case UAC_VERSION_1: > >                 return &desc->baSourceID[desc->bNrInPins + 5]; > >         case UAC_VERSION_2: > >                 return &desc->baSourceID[desc->bNrInPins + 6]; > >         case UAC_VERSION_3: > >                 return &desc->baSourceID[desc->bNrInPins + 2]; > >         default: > >                 return NULL; > >         } > > } > > > > On Sat, Aug 17, 2019 at 2:55 AM Takashi Iwai wrote: > > > >     On Sat, 17 Aug 2019 06:32:07 +0200, > >     Hui Peng wrote: > >     > > >     > `uac_mixer_unit_get_channels` calls `uac_mixer_unit_bmControls` > >     > to get pointer to bmControls field. The current implementation of > >     > `uac_mixer_unit_get_channels` does properly check the size of > >     > uac_mixer_unit_descriptor descriptor and may allow OOB access > >     > in `uac_mixer_unit_bmControls`. > >     > > >     > Reported-by: Hui Peng > >     > Reported-by: Mathias Payer > >     > Signed-off-by: Hui Peng > >    > >     Ah a good catch. > >    > >     One easier fix in this case would be to get the offset from > >     uac_mixer_unit_bmControls(), e.g. > >    > >             /* calculate the offset of bmControls field */ > >             size_t bmc_offset = uac_mixer_unit_bmControls(NULL, > protocol) - > >     NULL; > >             .... > >             if (desc->bLength < bmc_offset) > >                     return 0; > >    > >     thanks, > >    > >     Takashi > > > >     > --- > >     >  sound/usb/mixer.c | 25 ++++++++++++++++++------- > >     >  1 file changed, 18 insertions(+), 7 deletions(-) > >     > > >     > diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c > >     > index b5927c3d5bc0..00e6274a63c3 100644 > >     > --- a/sound/usb/mixer.c > >     > +++ b/sound/usb/mixer.c > >     > @@ -738,28 +738,39 @@ static int get_cluster_channels_v3(struct > >     mixer_build *state, unsigned int clust > >     >  static int uac_mixer_unit_get_channels(struct mixer_build *state, > >     >                                      struct > uac_mixer_unit_descriptor > >     *desc) > >     >  { > >     > -     int mu_channels; > >     > +     int mu_channels = 0; > >     >       void *c; > >     >  > >     > -     if (desc->bLength < sizeof(*desc)) > >     > -             return -EINVAL; > >     >       if (!desc->bNrInPins) > >     >               return -EINVAL; > >     > -     if (desc->bLength < sizeof(*desc) + desc->bNrInPins) > >     > -             return -EINVAL; > >     >  > >     >       switch (state->mixer->protocol) { > >     >       case UAC_VERSION_1: > >     > +             // limit derived from uac_mixer_unit_bmControls > >     > +             if (desc->bLength < sizeof(*desc) + desc->bNrInPins > + 4) > >     > +                     return 0; > >     > + > >     > +             mu_channels = uac_mixer_unit_bNrChannels(desc); > >     > +             break; > >     > + > >     >       case UAC_VERSION_2: > >     > -     default: > >     > -             if (desc->bLength < sizeof(*desc) + desc->bNrInPins > + 1) > >     > +             // limit derived from uac_mixer_unit_bmControls > >     > +             if (desc->bLength < sizeof(*desc) + desc->bNrInPins > + 6) > >     >                       return 0; /* no bmControls -> skip */ > >     > + > >     >               mu_channels = uac_mixer_unit_bNrChannels(desc); > >     >               break; > >     >       case UAC_VERSION_3: > >     > +             // limit derived from uac_mixer_unit_bmControls > >     > +             if (desc->bLength < sizeof(*desc) + desc->bNrInPins > + 2) > >     > +                     return 0; /* no bmControls -> skip */ > >     > + > >     >               mu_channels = get_cluster_channels_v3(state, > >     >                               uac3_mixer_unit_wClusterDescrID > (desc)); > >     >               break; > >     > + > >     > +     default: > >     > +             break; > >     >       } > >     >  > >     >       if (!mu_channels) > >     > -- > >     > 2.22.1 > >     > > >     > > > > > > >