samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

Browse Source 
[ Upstream commit fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a ]

In snd_usb_get_audioformat_uac3(), the length value returned from
snd_usb_ctl_msg() is used directly for memory allocation without
validation. This length is controlled by the USB device.

The allocated buffer is cast to a uac3_cluster_header_descriptor
and its fields are accessed without verifying that the buffer
is large enough. If the device returns a smaller than expected
length, this leads to an out-of-bounds read.

Add a length check to ensure the buffer is large enough for
uac3_cluster_header_descriptor.

Signed-off-by: Youngjun Lee <yjjuny.lee@samsung.com>
Fixes: 9a2fe9b801 ("ALSA: usb: initial USB Audio Device Class 3.0 support")
Link: https://patch.msgid.link/20250623-uac3-oob-fix-v1-1-527303eaf40a@samsung.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Youngjun Lee
2025-06-23 20:05:25 +09:00
committed by Greg Kroah-Hartman
parent 3c709dce16
commit 74fcb3852a
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
sound/usb/stream.c
View File

@@ -982,6 +982,8 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip,
* and request Cluster Descriptor * and request Cluster Descriptor
*/ */
wLength = le16_to_cpu(hc_header.wLength); wLength = le16_to_cpu(hc_header.wLength);
if (wLength < sizeof(cluster))
return NULL;
cluster = kzalloc(wLength, GFP_KERNEL); cluster = kzalloc(wLength, GFP_KERNEL);
if (!cluster) if (!cluster)
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);