From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Johan Hovold <johan@kernel.org>,
Takashi Iwai <tiwai@suse.de>,
Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Subject: [PATCH 4.14 05/29] ALSA: usb-audio: fix sync-ep altsetting sanity check
Date: Thu, 7 Jan 2021 15:31:20 +0100 [thread overview]
Message-ID: <20210107143053.679074086@linuxfoundation.org> (raw)
In-Reply-To: <20210107143052.973437064@linuxfoundation.org>
From: Johan Hovold <johan@kernel.org>
commit 5d1b71226dc4d44b4b65766fa9d74492f9d4587b upstream
The altsetting sanity check in set_sync_ep_implicit_fb_quirk() was
checking for there to be at least one altsetting but then went on to
access the second one, which may not exist.
This could lead to random slab data being used to initialise the sync
endpoint in snd_usb_add_endpoint().
Fixes: c75a8a7ae565 ("ALSA: snd-usb: add support for implicit feedback")
Fixes: ca10a7ebdff1 ("ALSA: usb-audio: FT C400 sync playback EP to capture EP")
Fixes: 5e35dc0338d8 ("ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204")
Fixes: 17f08b0d9aaf ("ALSA: usb-audio: add implicit fb quirk for Axe-Fx II")
Fixes: 103e9625647a ("ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk")
Cc: stable <stable@vger.kernel.org> # 3.5
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20200114083953.1106-1-johan@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/pcm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -369,7 +369,7 @@ static int set_sync_ep_implicit_fb_quirk
add_sync_ep_from_ifnum:
iface = usb_ifnum_to_if(dev, ifnum);
- if (!iface || iface->num_altsetting == 0)
+ if (!iface || iface->num_altsetting < 2)
return -EINVAL;
alts = &iface->altsetting[1];
next prev parent reply other threads:[~2021-01-07 14:37 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-07 14:31 [PATCH 4.14 00/29] 4.14.214-rc1 review Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 01/29] x86/entry/64: Add instruction suffix Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 02/29] md/raid10: initialize r10_bio->read_slot before use Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 03/29] ALSA: hda/ca0132 - Fix work handling in delayed HP detection Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 04/29] ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk Greg Kroah-Hartman
2021-01-07 14:31 ` Greg Kroah-Hartman [this message]
2021-01-07 14:31 ` [PATCH 4.14 06/29] mm: memcontrol: eliminate raw access to stat and event counters Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 07/29] mm: memcontrol: implement lruvec stat functions on top of each other Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 08/29] mm: memcontrol: fix excessive complexity in memory.stat reporting Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 09/29] vfio/pci: Move dummy_resources_list init in vfio_pci_probe() Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 10/29] s390/dasd: fix hanging device offline processing Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 11/29] USB: serial: digi_acceleport: fix write-wakeup deadlocks Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 12/29] powerpc/bitops: Fix possible undefined behaviour with fls() and fls64() Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 13/29] uapi: move constants from <linux/kernel.h> to <linux/const.h> Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 14/29] of: fix linker-section match-table corruption Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 15/29] reiserfs: add check for an invalid ih_entry_count Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 16/29] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 17/29] media: gp8psk: initialize stats at power control logic Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 18/29] ALSA: seq: Use bool for snd_seq_queue internal flags Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 19/29] rtc: sun6i: Fix memleak in sun6i_rtc_clk_init Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 20/29] module: set MODULE_STATE_GOING state when a module fails to load Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 21/29] quota: Dont overflow quota file offsets Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 22/29] powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe() Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 23/29] module: delay kobject uevent until after module init call Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 24/29] ALSA: pcm: Clear the full allocated memory at hw_params Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 25/29] dm verity: skip verity work if I/O error when system is shutting down Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 26/29] kdev_t: always inline major/minor helper functions Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 27/29] iio:imu:bmi160: Fix alignment and data leak issues Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 28/29] iio:magnetometer:mag3110: " Greg Kroah-Hartman
2021-01-07 14:31 ` [PATCH 4.14 29/29] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start Greg Kroah-Hartman
2021-01-08 7:35 ` [PATCH 4.14 00/29] 4.14.214-rc1 review Naresh Kamboju
2021-01-08 17:38 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210107143053.679074086@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=sudipm.mukherjee@gmail.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox