Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Youngjun Lee 24ff7d465c ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() ... [ Upstream commit fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a ] In snd_usb_get_audioformat_uac3(), the length value returned from snd_usb_ctl_msg() is used directly for memory allocation without validation. This length is controlled by the USB device. The allocated buffer is cast to a uac3_cluster_header_descriptor and its fields are accessed without verifying that the buffer is large enough. If the device returns a smaller than expected length, this leads to an out-of-bounds read. Add a length check to ensure the buffer is large enough for uac3_cluster_header_descriptor. Signed-off-by: Youngjun Lee <yjjuny.lee@samsung.com> Fixes: 9a2fe9b801 ("ALSA: usb: initial USB Audio Device Class 3.0 support") Link: https://patch.msgid.link/20250623-uac3-oob-fix-v1-1-527303eaf40a@samsung.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-07-17 18:24:53 +02:00
..
6fire	ALSA: 6fire: Release resources at card release	2024-12-14 19:44:27 +01:00
bcd2000	ALSA: bcd2000: Fix a UAF bug on the error path of probing	2022-08-25 11:17:17 +02:00
caiaq	ALSA: caiaq: Use snd_card_free_when_closed() at disconnection	2024-12-14 19:44:27 +01:00
hiface
line6	ALSA: line6: Fix racy access to midibuf	2024-08-19 05:33:51 +02:00
misc	ALSA: ua101: fix division by zero at probe	2021-11-17 09:48:18 +01:00
usx2y	ALSA: us122l: Use snd_card_free_when_closed() at disconnection	2024-12-14 19:44:27 +01:00
card.c	ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls	2021-05-14 09:44:27 +02:00
card.h
clock.c	ALSA: usb-audio: Fix out of bounds reads when finding clock sources	2024-12-14 19:44:56 +01:00
clock.h
debug.h
endpoint.c	treewide: Remove uninitialized_var() usage	2023-06-09 10:29:01 +02:00
endpoint.h
format.c	sound: usb: format: don't warn that raw DSD is unsupported	2025-01-09 13:23:36 +01:00
format.h
helper.c	USB: move snd_usb_pipe_sanity_check into the USB core	2024-08-19 05:33:30 +02:00
helper.h	USB: move snd_usb_pipe_sanity_check into the USB core	2024-08-19 05:33:30 +02:00
Kconfig
Makefile
media.c
media.h
midi.c	ALSA: usb-audio: Fix CME quirk for UF series keyboards	2025-05-02 07:39:10 +02:00
midi.h
mixer.c	ALSA: usb: Fix UBSAN warning in parse_audio_unit()	2025-01-09 13:23:26 +01:00
mixer.h	ALSA: usb-audio: scarlett2: Fix wrong resume call	2021-07-14 16:52:59 +02:00
mixer_maps.c	ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset PC 8	2021-05-11 14:04:13 +02:00
mixer_quirks.c	ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names	2025-04-10 14:29:38 +02:00
mixer_quirks.h
mixer_scarlett.c	ALSA: usb-audio: More constifications	2021-05-11 14:04:13 +02:00
mixer_scarlett.h
mixer_scarlett_gen2.c	USB: move snd_usb_pipe_sanity_check into the USB core	2024-08-19 05:33:30 +02:00
mixer_scarlett_gen2.h	ALSA: usb-audio: scarlett2: Improve driver startup messages	2021-06-03 08:59:00 +02:00
mixer_us16x08.c	ALSA: usb-audio: US16x08: Initialize array before use	2025-01-09 13:23:35 +01:00
mixer_us16x08.h
pcm.c	ALSA: usb-audio: Fix PCM buffer allocation in non-vmalloc mode	2021-03-04 10:26:10 +01:00
pcm.h
power.c
power.h
proc.c	ALSA: usb-audio: More constifications	2021-05-11 14:04:13 +02:00
proc.h
quirks-table.h	ALSA: usb-audio: Support Yamaha P-125 quirk entry	2024-09-04 13:14:49 +02:00
quirks.c	ALSA: usb-audio: Fix a DMA to stack memory bug	2024-12-19 18:05:05 +01:00
quirks.h
stream.c	ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()	2025-07-17 18:24:53 +02:00
stream.h
usbaudio.h	ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant	2022-04-27 13:50:47 +02:00
validate.c	ALSA: usb-audio: More constifications	2021-05-11 14:04:13 +02:00