Re: [PATCH AUTOSEL 5.15 13/13] ALSA: usb: Fix UBSAN warning in parse_audio_unit()

[Harshit Mogalapalli <harshit.m.mogalapalli@xxxxxxxxxx>]

Hi Sasha,

On 28/07/24 21:38, Sasha Levin wrote:
> From: Takashi Iwai <tiwai@xxxxxxx>
>
> [ Upstream commit 2f38cf730caedaeacdefb7ff35b0a3c1168117f9 ]
>
> A malformed USB descriptor may pass the lengthy mixer description with
> a lot of channels, and this may overflow the 32bit integer shift
> size, as caught by syzbot UBSAN test.  Although this won't cause any
> real trouble, it's better to address.
>
> This patch introduces a sanity check of the number of channels to bail
> out the parsing when too many channels are found.
>
> Reported-by: syzbot+78d5b129a762182225aa@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://lore.kernel.org/0000000000000adac5061d3c7355@xxxxxxxxxx
> Link: https://patch.msgid.link/20240715123619.26612-1-tiwai@xxxxxxx
> Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

FYI: This 13 patch series and similar AUTOSEL sets for other stable 
kernels didn't go into stable yet.

Thanks,
Harshit

> ---
>   sound/usb/mixer.c | 7 +++++++
>   1 file changed, 7 insertions(+)
>
> diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
> index d818eee53c90a..f10634dc118d6 100644
> --- a/sound/usb/mixer.c
> +++ b/sound/usb/mixer.c
> @@ -1985,6 +1985,13 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
>   		bmaControls = ftr->bmaControls;
>   	}
>   
> +	if (channels > 32) {
> +		usb_audio_info(state->chip,
> +			       "usbmixer: too many channels (%d) in unit %d\n",
> +			       channels, unitid);
> +		return -EINVAL;
> +	}
> +
>   	/* parse the source unit */
>   	err = parse_audio_unit(state, hdr->bSourceID);
>   	if (err < 0)