diff options
| author | Cássio Gabriel <cassiogabrielcontato@gmail.com> | 2026-04-15 12:04:53 -0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2026-04-16 10:33:19 +0200 |
| commit | 3c318f97dcc50b2e0556a1813bd6958678e881fd (patch) | |
| tree | 234adbe24279d36a59dc978befb28a1d1c442d66 /include/linux/timerqueue.h | |
| parent | eb90ae3cca783ebec65704597027811431465de4 (diff) | |
ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
parse_uac2_sample_rate_range() caps the number of enumerated
rates at MAX_NR_RATES, but it only breaks out of the current
rate loop. A malformed UAC2 RANGE response with additional
triplets continues parsing the remaining triplets and repeatedly
prints "invalid uac2 rates" while probe still holds
register_mutex.
Stop the whole parse once the cap is reached and return the
number of rates collected so far.
Fixes: 4fa0e81b8350 ("ALSA: usb-audio: fix possible hang and overflow in parse_uac2_sample_rate_range()")
Cc: stable@vger.kernel.org
Reported-by: syzbot+d56178c27a4710960820@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d56178c27a4710960820
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260415-usb-audio-uac2-rate-cap-v1-1-5ecbafc120d8@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'include/linux/timerqueue.h')
0 files changed, 0 insertions, 0 deletions