diff options
| author | Youngjun Lee <yjjuny.lee@samsung.com> | 2025-06-23 20:05:25 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-07-17 18:24:53 +0200 |
| commit | 24ff7d465c4284529bbfa207757bffb6f44b6403 (patch) | |
| tree | ebeda167e98a1c1a97f3051c7d90289a2c90c3e1 /sound | |
| parent | 585be561e512b91622c2b965d0d0cb67f279a2df (diff) | |
| download | linux-24ff7d465c4284529bbfa207757bffb6f44b6403.tar.gz linux-24ff7d465c4284529bbfa207757bffb6f44b6403.tar.bz2 linux-24ff7d465c4284529bbfa207757bffb6f44b6403.zip | |
ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
[ Upstream commit fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a ]
In snd_usb_get_audioformat_uac3(), the length value returned from
snd_usb_ctl_msg() is used directly for memory allocation without
validation. This length is controlled by the USB device.
The allocated buffer is cast to a uac3_cluster_header_descriptor
and its fields are accessed without verifying that the buffer
is large enough. If the device returns a smaller than expected
length, this leads to an out-of-bounds read.
Add a length check to ensure the buffer is large enough for
uac3_cluster_header_descriptor.
Signed-off-by: Youngjun Lee <yjjuny.lee@samsung.com>
Fixes: 9a2fe9b801f5 ("ALSA: usb: initial USB Audio Device Class 3.0 support")
Link: https://patch.msgid.link/20250623-uac3-oob-fix-v1-1-527303eaf40a@samsung.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/usb/stream.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/usb/stream.c b/sound/usb/stream.c index 1c4ff5799324..d698b609fe52 100644 --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -979,6 +979,8 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip, * and request Cluster Descriptor */ wLength = le16_to_cpu(hc_header.wLength); + if (wLength < sizeof(cluster)) + return NULL; cluster = kzalloc(wLength, GFP_KERNEL); if (!cluster) return ERR_PTR(-ENOMEM); |