]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ALSA: usb: Fix UBSAN warning in parse_audio_unit()
authorTakashi Iwai <tiwai@suse.de>
Mon, 15 Jul 2024 12:35:54 +0000 (14:35 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 19 Aug 2024 04:05:39 +0000 (06:05 +0200)
commitbbc521aac2b3847cc847f6f1f63172bb4d8e9be6
treea78f1cf0e7cc8d20d72e61b0d9b40c0fc3b0f529
parente8473e125aad45a798f67df96709dc890c835302
ALSA: usb: Fix UBSAN warning in parse_audio_unit()

[ Upstream commit 2f38cf730caedaeacdefb7ff35b0a3c1168117f9 ]

A malformed USB descriptor may pass the lengthy mixer description with
a lot of channels, and this may overflow the 32bit integer shift
size, as caught by syzbot UBSAN test.  Although this won't cause any
real trouble, it's better to address.

This patch introduces a sanity check of the number of channels to bail
out the parsing when too many channels are found.

Reported-by: syzbot+78d5b129a762182225aa@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/0000000000000adac5061d3c7355@google.com
Link: https://patch.msgid.link/20240715123619.26612-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
sound/usb/mixer.c