diff options
| author | Haein Lee <lhi0729@kaist.ac.kr> | 2025-11-12 00:37:54 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-11-24 10:35:55 +0100 |
| commit | cbdbfc756f2990942138ed0138da9303b4dbf9ff (patch) | |
| tree | c1ba18220a62b6405e7512047c03b6f051626f6a /sound | |
| parent | b2e4cda71ed062c87573b016d2d956a62f4258ed (diff) | |
| download | linux-cbdbfc756f2990942138ed0138da9303b4dbf9ff.tar.gz linux-cbdbfc756f2990942138ed0138da9303b4dbf9ff.tar.bz2 linux-cbdbfc756f2990942138ed0138da9303b4dbf9ff.zip | |
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
[ Upstream commit 632108ec072ad64c8c83db6e16a7efee29ebfb74 ]
In snd_usb_create_streams(), for UAC version 3 devices, the Interface
Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this
call fails, a fallback routine attempts to obtain the IAD from the next
interface and sets a BADD profile. However, snd_usb_mixer_controls_badd()
assumes that the IAD retrieved from usb_ifnum_to_if() is always valid,
without performing a NULL check. This can lead to a NULL pointer
dereference when usb_ifnum_to_if() fails to find the interface descriptor.
This patch adds a NULL pointer check after calling usb_ifnum_to_if() in
snd_usb_mixer_controls_badd() to prevent the dereference.
This issue was discovered by syzkaller, which triggered the bug by sending
a crafted USB device descriptor.
Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support")
Signed-off-by: Haein Lee <lhi0729@kaist.ac.kr>
Link: https://patch.msgid.link/vwhzmoba9j2f.vwhzmob9u9e2.g6@dooray.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/usb/mixer.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index ba9c6874915a..4853336f0e6b 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -3079,6 +3079,8 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer, int i; assoc = usb_ifnum_to_if(dev, ctrlif)->intf_assoc; + if (!assoc) + return -EINVAL; /* Detect BADD capture/playback channels from AS EP descriptors */ for (i = 0; i < assoc->bInterfaceCount; i++) { |