This is a note to let you know that I've just added the patch titled
ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-emux-avoid-potential-array-out-of-bound-in-snd_emux_xg_control.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 6a32425f953b955b4ff82f339d01df0b713caa5d Mon Sep 17 00:00:00 2001
From: Artemii Karasev <karasev@xxxxxxxxx>
Date: Tue, 7 Feb 2023 18:20:26 +0500
Subject: ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
From: Artemii Karasev <karasev@xxxxxxxxx>
commit 6a32425f953b955b4ff82f339d01df0b713caa5d upstream.
snd_emux_xg_control() can be called with an argument 'param' greater
than size of 'control' array. It may lead to accessing 'control'
array at a wrong index.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Artemii Karasev <karasev@xxxxxxxxx>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: <stable@xxxxxxxxxxxxxxx>
Link: https://lore.kernel.org/r/20230207132026.2870-1-karasev@xxxxxxxxx
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
sound/synth/emux/emux_nrpn.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/synth/emux/emux_nrpn.c
+++ b/sound/synth/emux/emux_nrpn.c
@@ -363,6 +363,9 @@ int
snd_emux_xg_control(struct snd_emux_port *port, struct snd_midi_channel *chan,
int param)
{
+ if (param >= ARRAY_SIZE(chan->control))
+ return -EINVAL;
+
return send_converted_effect(xg_effects, ARRAY_SIZE(xg_effects),
port, chan, param,
chan->control[param],
Patches currently in stable-queue which might be from karasev@xxxxxxxxx are
queue-4.14/alsa-hda-via-avoid-potential-array-out-of-bound-in-a.patch
queue-4.14/alsa-emux-avoid-potential-array-out-of-bound-in-snd_emux_xg_control.patch
