diff options
| author | Hui Peng | 2019-08-15 06:31:34 +0200 |
|---|---|---|
| committer | Takashi Iwai | 2019-08-15 21:48:52 +0200 |
| commit | 19bce474c45be69a284ecee660aa12d8f1e88f18 (patch) | |
| tree | 9a58decee9c325aa1dc879780b3bc778d6793e36 /lib/iommu-helper.c | |
| parent | ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit (diff) | |
| download | kernel-qcow2-linux-19bce474c45be69a284ecee660aa12d8f1e88f18.tar.gz kernel-qcow2-linux-19bce474c45be69a284ecee660aa12d8f1e88f18.tar.xz kernel-qcow2-linux-19bce474c45be69a284ecee660aa12d8f1e88f18.zip | |
ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
`check_input_term` recursively calls itself with input from
device side (e.g., uac_input_terminal_descriptor.bCSourceID)
as argument (id). In `check_input_term`, if `check_input_term`
is called with the same `id` argument as the caller, it triggers
endless recursive call, resulting kernel space stack overflow.
This patch fixes the bug by adding a bitmap to `struct mixer_build`
to keep track of the checked ids and stop the execution if some id
has been checked (similar to how parse_audio_unit handles unitid
argument).
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'lib/iommu-helper.c')
0 files changed, 0 insertions, 0 deletions