diff mbox series

ALSA: usb-audio: Fix NULL pointer deref in snd_usb_power_domain_set()

Message ID AS8P190MB1285B563C6B5394DB274813FEC782@AS8P190MB1285.EURP190.PROD.OUTLOOK.COM (mailing list archive)
State New, archived
Headers show
Series ALSA: usb-audio: Fix NULL pointer deref in snd_usb_power_domain_set() | expand

Commit Message

Karol Kosik Oct. 10, 2024, 6:59 a.m. UTC
Commit adding support for multiple control interfaces expanded struct
snd_usb_power_domain with pointer to control interface for proper control
message routing but missed one initialization point of this structure,
which has left new field with NULL value.

Standard mandates that each device has at least one control interface and
code responsible for power domain does not check for NULL values when
querying for control interface. This caused some USB devices to crash
the kernel.

Fixes: 6aa8700150f7 ("ALSA: usb-audio: Support multiple control interfaces")

Signed-off-by: Karol Kosik <k.kosik@outlook.com>
---
 sound/usb/stream.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Takashi Iwai Oct. 10, 2024, 12:02 p.m. UTC | #1
On Thu, 10 Oct 2024 08:59:10 +0200,
Karol Kosik wrote:
> 
> Commit adding support for multiple control interfaces expanded struct
> snd_usb_power_domain with pointer to control interface for proper control
> message routing but missed one initialization point of this structure,
> which has left new field with NULL value.
> 
> Standard mandates that each device has at least one control interface and
> code responsible for power domain does not check for NULL values when
> querying for control interface. This caused some USB devices to crash
> the kernel.
> 
> Fixes: 6aa8700150f7 ("ALSA: usb-audio: Support multiple control interfaces")
> 
> Signed-off-by: Karol Kosik <k.kosik@outlook.com>

It seems that tabs got broken by your mailer, so I applied manually
now.  Please fix your mailer setup at the next time you submit.


thanks,

Takashi
diff mbox series

Patch

diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index d70c140813d6..c1ea8844a46f 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -1067,6 +1067,7 @@  snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip,
                                        UAC3_BADD_PD_ID10 : UAC3_BADD_PD_ID11;
                pd->pd_d1d0_rec = UAC3_BADD_PD_RECOVER_D1D0;
                pd->pd_d2d0_rec = UAC3_BADD_PD_RECOVER_D2D0;
+               pd->ctrl_iface = ctrl_intf;

        } else {
                fp->attributes = parse_uac_endpoint_attributes(chip, alts,