4.14-stable patches

added patches:
	alsa-emux-avoid-potential-array-out-of-bound-in-snd_emux_xg_control.patch

diff --git a/queue-4.14/alsa-emux-avoid-potential-array-out-of-bound-in-snd_emux_xg_control.patch b/queue-4.14/alsa-emux-avoid-potential-array-out-of-bound-in-snd_emux_xg_control.patch
new file mode 100644 (file)
index 0000000..65dd5de
--- /dev/null
+++ b/queue-4.14/alsa-emux-avoid-potential-array-out-of-bound-in-snd_emux_xg_control.patch
@@ -0,0 +1,37 @@
+From 6a32425f953b955b4ff82f339d01df0b713caa5d Mon Sep 17 00:00:00 2001
+From: Artemii Karasev <karasev@ispras.ru>
+Date: Tue, 7 Feb 2023 18:20:26 +0500
+Subject: ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
+
+From: Artemii Karasev <karasev@ispras.ru>
+
+commit 6a32425f953b955b4ff82f339d01df0b713caa5d upstream.
+
+snd_emux_xg_control() can be called with an argument 'param' greater
+than size of 'control' array. It may lead to accessing 'control'
+array at a wrong index.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Artemii Karasev <karasev@ispras.ru>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20230207132026.2870-1-karasev@ispras.ru
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/synth/emux/emux_nrpn.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/synth/emux/emux_nrpn.c
++++ b/sound/synth/emux/emux_nrpn.c
+@@ -363,6 +363,9 @@ int
+ snd_emux_xg_control(struct snd_emux_port *port, struct snd_midi_channel *chan,
+                   int param)
+ {
++      if (param >= ARRAY_SIZE(chan->control))
++              return -EINVAL;
++
+       return send_converted_effect(xg_effects, ARRAY_SIZE(xg_effects),
+                                    port, chan, param,
+                                    chan->control[param],

diff --git a/queue-4.14/series b/queue-4.14/series
index 556ad5475d1854778b50da5c97497845b0d8699b..a5e5b96dd62ef2f87fb8d11e0510d99a8577e2e0 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -24,3 +24,4 @@ squashfs-fix-handling-and-sanity-checking-of-xattr_ids-count.patch
 serial-8250_dma-fix-dma-rx-completion-race.patch
 serial-8250_dma-fix-dma-rx-rearm-race.patch
 btrfs-limit-device-extents-to-the-device-size.patch
+alsa-emux-avoid-potential-array-out-of-bound-in-snd_emux_xg_control.patch