Skip to contentSkip to conversation

ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0

PATCH Applied Greg Kroah-Hartman 2 participants 2 messages Apr 9 Sound

lore
Share & tools
lore

Greg Kroah-Hartman

author
#0 lore raw

PATCH 1/1 ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0

A malicious USB device with the TASCAM US-144MKII device id can have a configuration containing bInterfaceNumber=1 but no interface 0. USB configuration descriptors are not required to assign interface numbers sequentially, so usb_ifnum_to_if(dev, 0) returns will NULL, which will then be dereferenced directly.

Fix this up by checking the return value properly.

Cc Jaroslav Kysela <[email protected]>
Cc Takashi Iwai <[email protected]>
Fixes dee1bcf28a3d ("ALSA: usx2y: Add native ALSA driver for TASCAM US-144MKII")
Cc stable <[email protected]>
Assisted-by gregkh_clanker_t1000
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 sound/usb/usx2y/us144mkii.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
sound/usb/usx2y/us144mkii.c +5 -1
index 0cf4fa74e210..94553b61013c 100644
@@ -420,7 +420,11 @@ static int tascam_probe(struct usb_interface *intf,
 
 	/* The device has two interfaces; we drive both from this driver. */
 	if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
-		tascam = usb_get_intfdata(usb_ifnum_to_if(dev, 0));
+		struct usb_interface *intf_zero = usb_ifnum_to_if(dev, 0);
+
+		if (!intf_zero)
+			return -ENODEV;
+		tascam = usb_get_intfdata(intf_zero);
 		if (tascam) {
 			usb_set_intfdata(intf, tascam);
 			tascam->iface1 = intf;
Signature · 1 line
2.53.0
Applied
#1 lore raw
Quoted 7 lines · Greg Kroah-Hartman

A malicious USB device with the TASCAM US-144MKII device id can have a configuration containing bInterfaceNumber=1 but no interface 0. USB configuration descriptors are not required to assign interface numbers sequentially, so usb_ifnum_to_if(dev, 0) returns will NULL, which will then be dereferenced directly.

Quoted 8 lines

Fix this up by checking the return value properly.

Cc Jaroslav Kysela <[email protected]>
Cc Takashi Iwai <[email protected]>
Fixes dee1bcf28a3d ("ALSA: usx2y: Add native ALSA driver for TASCAM US-144MKII")
Cc stable <[email protected]>
Assisted-by gregkh_clanker_t1000
Signed-off-by Greg Kroah-Hartman <[email protected]>

Applied to for-next branch now. Thanks.

Takashi