5.4-stable patches

added patches:
	alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch

diff --git a/queue-5.4/alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch b/queue-5.4/alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch
new file mode 100644 (file)
index 0000000..b9af74b
--- /dev/null
+++ b/queue-5.4/alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch
@@ -0,0 +1,88 @@
+From b909df18ce2a998afef81d58bbd1a05dc0788c40 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Beno=C3=AEt=20Sevens?= <bsevens@google.com>
+Date: Wed, 20 Nov 2024 12:41:44 +0000
+Subject: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Benoît Sevens <bsevens@google.com>
+
+commit b909df18ce2a998afef81d58bbd1a05dc0788c40 upstream.
+
+A bogus device can provide a bNumConfigurations value that exceeds the
+initial value used in usb_get_configuration for allocating dev->config.
+
+This can lead to out-of-bounds accesses later, e.g. in
+usb_destroy_configuration.
+
+Signed-off-by: Benoît Sevens <bsevens@google.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@kernel.org
+Link: https://patch.msgid.link/20241120124144.3814457-1-bsevens@google.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c |   19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -585,6 +585,7 @@ int snd_usb_create_quirk(struct snd_usb_
+ static int snd_usb_extigy_boot_quirk(struct usb_device *dev, struct usb_interface *intf)
+ {
+       struct usb_host_config *config = dev->actconfig;
++      struct usb_device_descriptor new_device_descriptor;
+       int err;
+ 
+       if (le16_to_cpu(get_cfg_desc(config)->wTotalLength) == EXTIGY_FIRMWARE_SIZE_OLD ||
+@@ -596,10 +597,14 @@ static int snd_usb_extigy_boot_quirk(str
+               if (err < 0)
+                       dev_dbg(&dev->dev, "error sending boot message: %d\n", err);
+               err = usb_get_descriptor(dev, USB_DT_DEVICE, 0,
+-                              &dev->descriptor, sizeof(dev->descriptor));
+-              config = dev->actconfig;
++                              &new_device_descriptor, sizeof(new_device_descriptor));
+               if (err < 0)
+                       dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err);
++              if (new_device_descriptor.bNumConfigurations > dev->descriptor.bNumConfigurations)
++                      dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n",
++                              new_device_descriptor.bNumConfigurations);
++              else
++                      memcpy(&dev->descriptor, &new_device_descriptor, sizeof(dev->descriptor));
+               err = usb_reset_configuration(dev);
+               if (err < 0)
+                       dev_dbg(&dev->dev, "error usb_reset_configuration: %d\n", err);
+@@ -933,6 +938,7 @@ static void mbox2_setup_48_24_magic(stru
+ static int snd_usb_mbox2_boot_quirk(struct usb_device *dev)
+ {
+       struct usb_host_config *config = dev->actconfig;
++      struct usb_device_descriptor new_device_descriptor;
+       int err;
+       u8 bootresponse[0x12];
+       int fwsize;
+@@ -968,10 +974,14 @@ static int snd_usb_mbox2_boot_quirk(stru
+       dev_dbg(&dev->dev, "device initialised!\n");
+ 
+       err = usb_get_descriptor(dev, USB_DT_DEVICE, 0,
+-              &dev->descriptor, sizeof(dev->descriptor));
+-      config = dev->actconfig;
++              &new_device_descriptor, sizeof(new_device_descriptor));
+       if (err < 0)
+               dev_dbg(&dev->dev, "error usb_get_descriptor: %d\n", err);
++      if (new_device_descriptor.bNumConfigurations > dev->descriptor.bNumConfigurations)
++              dev_dbg(&dev->dev, "error too large bNumConfigurations: %d\n",
++                      new_device_descriptor.bNumConfigurations);
++      else
++              memcpy(&dev->descriptor, &new_device_descriptor, sizeof(dev->descriptor));
+ 
+       err = usb_reset_configuration(dev);
+       if (err < 0)
+@@ -1018,7 +1028,6 @@ static int snd_usb_axefx3_boot_quirk(str
+       return 0;
+ }
+ 
+-
+ #define MICROBOOK_BUF_SIZE 128
+ 
+ static int snd_usb_motu_microbookii_communicate(struct usb_device *dev, u8 *buf,

diff --git a/queue-5.4/series b/queue-5.4/series
index b5cd31c63fe8b43af23e631d1a51c33a95837ea3..d543d3580c6f2e61146b48719cbc2485c1fa581d 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -145,3 +145,4 @@ usb-ehci-spear-fix-call-balance-of-sehci-clk-handling-routines.patch
 cgroup-make-operations-on-the-cgroup-root_list-rcu-safe.patch
 cgroup-move-rcu_head-up-near-the-top-of-cgroup_root.patch
 soc-qcom-socinfo-fix-revision-check-in-qcom_socinfo_probe.patch
+alsa-usb-audio-fix-potential-out-of-bound-accesses-for-extigy-and-mbox-devices.patch