kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/sound/usb
History
Jun Seo 1e5753ff4c ALSA: usb-audio: Use correct version for UAC3 header validation 
commit 54f9d645a5 upstream.

The entry of the validators table for UAC3 AC header descriptor is
defined with the wrong protocol version UAC_VERSION_2, while it should
have been UAC_VERSION_3.  This results in the validator never matching
for actual UAC3 devices (protocol == UAC_VERSION_3), causing their
header descriptors to bypass validation entirely.  A malicious USB
device presenting a truncated UAC3 header could exploit this to cause
out-of-bounds reads when the driver later accesses unvalidated
descriptor fields.

The bug was introduced in the same commit as the recently fixed UAC3
feature unit sub-type typo, and appears to be from the same copy-paste
error when the UAC3 section was created from the UAC2 section.

Fixes: 57f8770620 ("ALSA: usb-audio: More validations of descriptor units")
Cc: <stable@vger.kernel.org>
Signed-off-by: Jun Seo <jun.seo.93@proton.me>
Link: https://patch.msgid.link/20260226010820.36529-1-jun.seo.93@proton.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-03-12 07:09:38 -04:00
..
6fire ALSA: 6fire: Clean ups with guard() 2025-08-12 08:36:16 +02:00
bcd2000 ALSA: bcd2000: Use guard() for mutex locks 2025-09-01 13:54:06 +02:00
caiaq ALSA: caiaq: Use guard() for spin locks 2025-09-01 13:54:06 +02:00
hiface ALSA: hiface: Use guard() for spin locks 2025-09-01 13:54:06 +02:00
line6 ALSA: line6: Use guard() for spin locks 2025-09-10 13:20:01 +02:00
misc ALSA: ua101: Use guard() for spin locks 2025-09-01 13:54:05 +02:00
qcom ALSA: usb: qcom: Correct parameter comment for uaudio_transfer_buffer_setup() 2026-03-12 07:09:21 -04:00
usx2y ALSA: usx2y: Use guard() for mutex locks 2025-09-01 13:54:05 +02:00
card.c ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card 2025-10-15 10:17:09 +02:00
card.h ALSA: usb-audio: Allow for rediscovery of connected USB SND devices 2025-04-11 13:02:31 +02:00
clock.c ALSA: usb-audio: Fix out of bounds reads when finding clock sources 2024-11-25 15:48:22 +01:00
clock.h ALSA: usb-audio: Constify audioformat pointer references 2020-11-23 15:15:36 +01:00
endpoint.c ALSA: usb-audio: Use inclusive terms 2026-03-12 07:09:17 -04:00
endpoint.h ALSA: usb-audio: Remove unused function declaration 2023-08-01 16:56:57 +02:00
fcp.c ALSA: usb: fpc: replace kmalloc_array followed by copy_from_user with memdup_array_user 2025-10-07 14:14:32 +02:00
fcp.h ALSA: FCP: Add Focusrite Control Protocol driver 2025-01-18 12:00:38 +01:00
format.c ALSA: usb-audio: Allow Focusrite devices to use low samplerates 2025-09-01 13:14:52 +02:00
format.h ALSA: usb: initial USB Audio Device Class 3.0 support 2018-03-21 11:46:33 +01:00
helper.c ALSA: usb-audio: Export USB SND APIs for modules 2025-04-11 13:02:30 +02:00
helper.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
implicit.c ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 2025-06-02 16:50:04 +02:00
implicit.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
Kconfig ALSA: usb-audio: Add infrastructure for TASCAM US-144MKII 2025-08-15 17:53:47 +02:00
Makefile ALSA: usb-audio: qcom: Introduce QC USB SND offloading support 2025-04-11 13:02:32 +02:00
media.c ALSA: usb-audio: Replace manual mutex/spinlock with guard() 2025-08-12 08:36:17 +02:00
media.h media: sound/usb: Use Media Controller API to share media resources 2019-04-22 11:21:06 -04:00
midi.c Merge branch 'for-linus' into for-next 2025-09-28 08:34:58 +02:00
midi.h ALSA: usb-audio: Manage number of rawmidis globally 2023-05-23 12:11:00 +02:00
midi2.c ALSA: usb-audio: Replace manual mutex/spinlock with guard() 2025-08-12 08:36:17 +02:00
midi2.h ALSA: usb-audio: USB MIDI 2.0 UMP support 2023-05-23 12:11:02 +02:00
mixer.c ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() 2026-01-30 10:32:23 +01:00
mixer.h ALSA: usb-audio: Add input value sanity checks for standard types 2024-08-06 18:27:08 +02:00
mixer_maps.c ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card 2025-06-13 10:18:10 +02:00
mixer_quirks.c ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() 2026-02-11 13:41:59 +01:00
mixer_quirks.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
mixer_s1810c.c ALSA: usb-audio: presonus s18xx uses little-endian 2026-03-04 07:19:59 -05:00
mixer_s1810c.h ALSA: usb-audio: Add support for Presonus Studio 1810c 2020-02-15 09:46:16 +01:00
mixer_scarlett.c ALSA: usb-audio: Copy string more safely 2025-07-11 09:53:36 +02:00
mixer_scarlett.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mixer_scarlett2.c ALSA: scarlett2: Fix DSP filter control array handling 2026-03-12 07:09:10 -04:00
mixer_scarlett2.h ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 2023-10-27 11:22:59 +02:00
mixer_us16x08.c ALSA: usb-mixer: us16x08: validate meter packet indices 2026-01-02 12:56:58 +01:00
mixer_us16x08.h ALSA: usb: Constify snd_kcontrol_new items 2020-01-03 09:24:34 +01:00
pcm.c ALSA: usb-audio: Use the right limit for PCM OOB check 2026-02-11 13:42:01 +01:00
pcm.h ALSA: usb-audio: Export USB SND APIs for modules 2025-04-11 13:02:30 +02:00
power.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
power.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
proc.c ALSA: usb-audio: Replace manual mutex/spinlock with guard() 2025-08-12 08:36:17 +02:00
proc.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
quirks-table.h ALSA: usb-audio: Add Pioneer DJ DJM-V10 support 2025-04-22 15:00:48 +02:00
quirks.c ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP 2026-03-12 07:09:11 -04:00
quirks.h ALSA: usb-audio: improve module param quirk_flags 2025-09-28 08:35:29 +02:00
stream.c ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP 2026-03-12 07:09:11 -04:00
stream.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
usbaudio.h ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP 2026-03-12 07:09:11 -04:00
validate.c ALSA: usb-audio: Use correct version for UAC3 header validation 2026-03-12 07:09:38 -04:00