diff options
| author | Haein Lee <lhi0729@kaist.ac.kr> | 2025-11-12 00:37:54 +0900 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2025-11-11 17:57:44 +0100 |
| commit | 632108ec072ad64c8c83db6e16a7efee29ebfb74 (patch) | |
| tree | 59f68593fe76ba7716edf5d4943cc7ede0462a1a /net/unix/af_unix.c | |
| parent | 05a1fc5efdd8560f34a3af39c9cf1e1526cc3ddf (diff) | |
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
In snd_usb_create_streams(), for UAC version 3 devices, the Interface
Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this
call fails, a fallback routine attempts to obtain the IAD from the next
interface and sets a BADD profile. However, snd_usb_mixer_controls_badd()
assumes that the IAD retrieved from usb_ifnum_to_if() is always valid,
without performing a NULL check. This can lead to a NULL pointer
dereference when usb_ifnum_to_if() fails to find the interface descriptor.
This patch adds a NULL pointer check after calling usb_ifnum_to_if() in
snd_usb_mixer_controls_badd() to prevent the dereference.
This issue was discovered by syzkaller, which triggered the bug by sending
a crafted USB device descriptor.
Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support")
Signed-off-by: Haein Lee <lhi0729@kaist.ac.kr>
Link: https://patch.msgid.link/vwhzmoba9j2f.vwhzmob9u9e2.g6@dooray.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions