kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/sound/usb
History
Youngjun Lee 6eb211788e ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() 
[ Upstream commit fb4e2a6e8f ]

In snd_usb_get_audioformat_uac3(), the length value returned from
snd_usb_ctl_msg() is used directly for memory allocation without
validation. This length is controlled by the USB device.

The allocated buffer is cast to a uac3_cluster_header_descriptor
and its fields are accessed without verifying that the buffer
is large enough. If the device returns a smaller than expected
length, this leads to an out-of-bounds read.

Add a length check to ensure the buffer is large enough for
uac3_cluster_header_descriptor.

Signed-off-by: Youngjun Lee <yjjuny.lee@samsung.com>
Fixes: 9a2fe9b801 ("ALSA: usb: initial USB Audio Device Class 3.0 support")
Link: https://patch.msgid.link/20250623-uac3-oob-fix-v1-1-527303eaf40a@samsung.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-07-06 10:58:00 +02:00
..
6fire ALSA: 6fire: Release resources at card release 2024-12-14 19:53:34 +01:00
bcd2000 ALSA: bcd2000: Fix a UAF bug on the error path of probing 2022-07-15 08:58:36 +02:00
caiaq ALSA: caiaq: Use snd_card_free_when_closed() at disconnection 2024-12-14 19:53:34 +01:00
hiface ALSA: hiface: fix repeated words in comments 2022-07-25 08:28:37 +02:00
line6 ALSA: line6: add hw monitor volume control to POD HD500X 2024-10-17 15:21:52 +02:00
misc ALSA: ua101: fix division by zero at probe 2021-10-27 08:23:30 +02:00
usx2y ALSA: usx2y: validate nrpacks module parameter on probe 2025-03-13 12:53:17 +01:00
card.c ALSA: usb-audio: Add logitech Audio profile quirk 2024-10-17 15:21:40 +02:00
card.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2023-01-07 11:11:43 +01:00
clock.c ALSA: usb-audio: Fix out of bounds reads when finding clock sources 2024-12-14 19:53:54 +01:00
clock.h ALSA: usb-audio: Constify audioformat pointer references 2020-11-23 15:15:36 +01:00
endpoint.c ALSA: usb-audio: Notify xrun for low-latency mode 2024-12-14 19:54:30 +01:00
endpoint.h ALSA: usb-audio: Fix recursive locking at XRUN during syncing 2023-04-06 12:10:43 +02:00
format.c ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset 2025-05-09 09:41:33 +02:00
format.h ALSA: usb: initial USB Audio Device Class 3.0 support 2018-03-21 11:46:33 +01:00
helper.c ALSA: usb-audio: Add snd_usb_get_host_interface() helper 2020-11-23 15:13:47 +01:00
helper.h ALSA: usb-audio: Add snd_usb_get_host_interface() helper 2020-11-23 15:13:47 +01:00
implicit.c ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 2025-06-27 11:07:24 +01:00
implicit.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2023-01-07 11:11:43 +01:00
Kconfig sound: Fix Kconfig indentation 2019-10-07 03:53:03 +02:00
Makefile ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 2024-04-27 17:07:11 +02:00
media.c ALSA: usb-audio: fix spelling mistakes 2021-07-05 19:33:54 +02:00
media.h media: sound/usb: Use Media Controller API to share media resources 2019-04-22 11:21:06 -04:00
midi.c ALSA: usb-audio: Fix CME quirk for UF series keyboards 2025-04-25 10:43:29 +02:00
midi.h ALSA: usb-audio: generate midi streaming substream names from jack names 2021-03-01 09:21:54 +01:00
mixer.c ALSA: usb-audio: Make mic volume workarounds globally applicable 2024-12-14 19:54:44 +01:00
mixer.h ALSA: usb-audio: Add input value sanity checks for standard types 2024-10-17 15:21:40 +02:00
mixer_maps.c ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card 2025-06-27 11:07:37 +01:00
mixer_quirks.c ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names 2025-04-07 10:05:44 +02:00
mixer_quirks.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
mixer_s1810c.c ALSA: usb-audio: remove redundant assignment to variable c 2022-02-08 08:21:32 +01:00
mixer_s1810c.h ALSA: usb-audio: Add support for Presonus Studio 1810c 2020-02-15 09:46:16 +01:00
mixer_scarlett.c ALSA: usb-audio: fix spelling mistakes 2021-07-05 19:33:54 +02:00
mixer_scarlett.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mixer_scarlett2.c ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 2024-04-27 17:07:11 +02:00
mixer_scarlett2.h ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 2024-04-27 17:07:11 +02:00
mixer_us16x08.c ALSA: usb-audio: US16x08: Initialize array before use 2025-01-09 13:30:01 +01:00
mixer_us16x08.h ALSA: usb: Constify snd_kcontrol_new items 2020-01-03 09:24:34 +01:00
pcm.c ALSA: usb-audio: Fix broken resume due to UAC3 power state 2023-06-21 16:00:55 +02:00
pcm.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2023-01-07 11:11:43 +01:00
power.c ALSA: usb-audio: More validations of descriptor units 2019-08-22 10:35:59 +02:00
power.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
proc.c ALSA: usb-audio: Show sync endpoint information in proc outputs 2020-11-23 15:16:45 +01:00
proc.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
quirks-table.h ALSA: usb-audio: Fix Yamaha P-125 Quirk Entry 2024-12-14 19:53:11 +01:00
quirks.c ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock 2025-07-06 10:57:56 +02:00
quirks.h ALSA: usb-audio: Register card at the last interface 2022-09-06 11:04:56 +02:00
stream.c ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() 2025-07-06 10:58:00 +02:00
stream.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
usbaudio.h ALSA: usb-audio: Make mic volume workarounds globally applicable 2024-12-14 19:54:44 +01:00
validate.c ALSA: usb-audio: Fix endianess in descriptor validation 2020-02-01 09:06:11 +01:00