mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-28 11:18:45 +07:00
220345e98f
The USB-audio mixer code holds a linked list of usb_mixer_elem_list, and several operations are performed for each mixer element. A few of them (snd_usb_mixer_notify_id() and snd_usb_mixer_interrupt_v2()) assume each mixer element being a usb_mixer_elem_info object that is a subclass of usb_mixer_elem_list, cast via container_of() and access it members. This may result in an out-of-bound access when a non-standard list element has been added, as spotted by syzkaller recently. This patch adds a new field, is_std_info, in usb_mixer_elem_list to indicate that the element is the usb_mixer_elem_info type or not, and skip the access to such an element if needed. Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com Reported-by: syzbot+2405ca3401e943c538b5@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200624122340.9615-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| 6fire | ||
| bcd2000 | ||
| caiaq | ||
| hiface | ||
| line6 | ||
| misc | ||
| usx2y | ||
| card.c | ||
| card.h | ||
| clock.c | ||
| clock.h | ||
| debug.h | ||
| endpoint.c | ||
| endpoint.h | ||
| format.c | ||
| format.h | ||
| helper.c | ||
| helper.h | ||
| Kconfig | ||
| Makefile | ||
| media.c | ||
| media.h | ||
| midi.c | ||
| midi.h | ||
| mixer_maps.c | ||
| mixer_quirks.c | ||
| mixer_quirks.h | ||
| mixer_s1810c.c | ||
| mixer_s1810c.h | ||
| mixer_scarlett_gen2.c | ||
| mixer_scarlett_gen2.h | ||
| mixer_scarlett.c | ||
| mixer_scarlett.h | ||
| mixer_us16x08.c | ||
| mixer_us16x08.h | ||
| mixer.c | ||
| mixer.h | ||
| pcm.c | ||
| pcm.h | ||
| power.c | ||
| power.h | ||
| proc.c | ||
| proc.h | ||
| quirks-table.h | ||
| quirks.c | ||
| quirks.h | ||
| stream.c | ||
| stream.h | ||
| usbaudio.h | ||
| validate.c | ||