]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
authorCássio Gabriel <cassiogabrielcontato@gmail.com>
Wed, 15 Apr 2026 15:04:53 +0000 (12:04 -0300)
committerTakashi Iwai <tiwai@suse.de>
Thu, 16 Apr 2026 08:33:19 +0000 (10:33 +0200)
commit3c318f97dcc50b2e0556a1813bd6958678e881fd
tree234adbe24279d36a59dc978befb28a1d1c442d66
parenteb90ae3cca783ebec65704597027811431465de4
ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES

parse_uac2_sample_rate_range() caps the number of enumerated
rates at MAX_NR_RATES, but it only breaks out of the current
rate loop. A malformed UAC2 RANGE response with additional
triplets continues parsing the remaining triplets and repeatedly
prints "invalid uac2 rates" while probe still holds
register_mutex.

Stop the whole parse once the cap is reached and return the
number of rates collected so far.

Fixes: 4fa0e81b8350 ("ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()")
Cc: stable@vger.kernel.org
Reported-by: syzbot+d56178c27a4710960820@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d56178c27a4710960820
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260415-usb-audio-uac2-rate-cap-v1-1-5ecbafc120d8@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/usb/format.c