* [PATCH AUTOSEL 5.4 7/7] ALSA: usb: Fix UBSAN warning in parse_audio_unit()
[not found] <20240728161033.2054341-1-sashal@kernel.org>
@ 2024-07-28 16:10 ` Sasha Levin
0 siblings, 0 replies; only message in thread
From: Sasha Levin @ 2024-07-28 16:10 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Takashi Iwai, syzbot+78d5b129a762182225aa, Sasha Levin, perex,
tiwai, kl, peter.ujfalusi, xristos.thes, linux-sound
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 2f38cf730caedaeacdefb7ff35b0a3c1168117f9 ]
A malformed USB descriptor may pass the lengthy mixer description with
a lot of channels, and this may overflow the 32bit integer shift
size, as caught by syzbot UBSAN test. Although this won't cause any
real trouble, it's better to address.
This patch introduces a sanity check of the number of channels to bail
out the parsing when too many channels are found.
Reported-by: syzbot+78d5b129a762182225aa@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/0000000000000adac5061d3c7355@google.com
Link: https://patch.msgid.link/20240715123619.26612-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 67eb1293fa155..1374a4e093b3f 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1906,6 +1906,13 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
bmaControls = ftr->bmaControls;
}
+ if (channels > 32) {
+ usb_audio_info(state->chip,
+ "usbmixer: too many channels (%d) in unit %d\n",
+ channels, unitid);
+ return -EINVAL;
+ }
+
/* parse the source unit */
err = parse_audio_unit(state, hdr->bSourceID);
if (err < 0)
--
2.43.0
^ permalink raw reply related [flat|nested] only message in thread