]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ALSA: usb: Fix UBSAN warning in parse_audio_unit()
authorTakashi Iwai <tiwai@suse.de>
Sun, 28 Jul 2024 16:09:44 +0000 (12:09 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 9 Jan 2025 12:24:51 +0000 (13:24 +0100)
commitdab416edff9d4425cbf1dff3ba3f99424c0b4dc2
tree080bbfd9dc201b76e09c957566abfa8cd271cd03
parentf9869f6772e3edb67ba75951e618620c364c5751
ALSA: usb: Fix UBSAN warning in parse_audio_unit()

[ Upstream commit 2f38cf730caedaeacdefb7ff35b0a3c1168117f9 ]

A malformed USB descriptor may pass the lengthy mixer description with
a lot of channels, and this may overflow the 32bit integer shift
size, as caught by syzbot UBSAN test.  Although this won't cause any
real trouble, it's better to address.

This patch introduces a sanity check of the number of channels to bail
out the parsing when too many channels are found.

Reported-by: syzbot+78d5b129a762182225aa@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/0000000000000adac5061d3c7355@google.com
Link: https://patch.msgid.link/20240715123619.26612-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
sound/usb/mixer.c