• Takashi Iwai's avatar
    ALSA: usb-audio: Fix OOB access of mixer element list · 220345e9
    Takashi Iwai authored
    The USB-audio mixer code holds a linked list of usb_mixer_elem_list,
    and several operations are performed for each mixer element.  A few of
    them (snd_usb_mixer_notify_id() and snd_usb_mixer_interrupt_v2())
    assume each mixer element being a usb_mixer_elem_info object that is a
    subclass of usb_mixer_elem_list, cast via container_of() and access it
    members.  This may result in an out-of-bound access when a
    non-standard list element has been added, as spotted by syzkaller
    recently.
    
    This patch adds a new field, is_std_info, in usb_mixer_elem_list to
    indicate that the element is the usb_mixer_elem_info type or not, and
    skip the access to such an element if needed.
    
    Reported-by: syzbot+fb14314433463ad51625@syzkaller.appspotmail.com
    Reported-by: syzbot+2405ca3401e943c538b5@syzkaller.appspotmail.com
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20200624122340.9615-1-tiwai@suse.deSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    220345e9
mixer.c 96.7 KB