]> git.baikalelectronics.ru Git - kernel.git/commit
ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
authorHui Peng <benquike@gmail.com>
Thu, 15 Aug 2019 04:31:34 +0000 (00:31 -0400)
committerTakashi Iwai <tiwai@suse.de>
Thu, 15 Aug 2019 19:48:52 +0000 (21:48 +0200)
commitdc0702805938a6d5dca0016b3a98f0fa9826ce0c
tree9a58decee9c325aa1dc879780b3bc778d6793e36
parent15be7fe5fee583465db9f4bb4745dd21b11771d8
ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term

`check_input_term` recursively calls itself with input from
device side (e.g., uac_input_terminal_descriptor.bCSourceID)
as argument (id). In `check_input_term`, if `check_input_term`
is called with the same `id` argument as the caller, it triggers
endless recursive call, resulting kernel space stack overflow.

This patch fixes the bug by adding a bitmap to `struct mixer_build`
to keep track of the checked ids and stop the execution if some id
has been checked (similar to how parse_audio_unit handles unitid
argument).

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/usb/mixer.c