From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Mark Pearson <markpearson@lenovo.com>, Philipp Leskovitz <philipp.leskovitz@secunet.com>, Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>, Takashi Iwai <tiwai@suse.de>, Sasha Levin <sashal@kernel.org>, alsa-devel@alsa-project.org Subject: [PATCH AUTOSEL 5.10 08/54] ALSA: hda: ignore invalid NHLT table Date: Tue, 16 Mar 2021 20:56:07 -0400 [thread overview] Message-ID: <20210317005654.724862-8-sashal@kernel.org> (raw) In-Reply-To: <20210317005654.724862-1-sashal@kernel.org> From: Mark Pearson <markpearson@lenovo.com> [ Upstream commit a14a6219996ee6f6e858d83b11affc7907633687 ] On some Lenovo systems if the microphone is disabled in the BIOS only the NHLT table header is created, with no data. This means the endpoints field is not correctly set to zero - leading to an unintialised variable and hence invalid descriptors are parsed leading to page faults. The Lenovo firmware team is addressing this, but adding a check preventing invalid tables being parsed is worthwhile. Tested on a Lenovo T14. Tested-by: Philipp Leskovitz <philipp.leskovitz@secunet.com> Reported-by: Philipp Leskovitz <philipp.leskovitz@secunet.com> Signed-off-by: Mark Pearson <markpearson@lenovo.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20210302141003.7342-1-markpearson@lenovo.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> --- sound/hda/intel-nhlt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c index d053beccfaec..e2237239d922 100644 --- a/sound/hda/intel-nhlt.c +++ b/sound/hda/intel-nhlt.c @@ -39,6 +39,11 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) if (!nhlt) return 0; + if (nhlt->header.length <= sizeof(struct acpi_table_header)) { + dev_warn(dev, "Invalid DMIC description table\n"); + return 0; + } + for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++, epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) { -- 2.30.1
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sasha Levin <sashal@kernel.org>, alsa-devel@alsa-project.org, Takashi Iwai <tiwai@suse.de>, Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>, Philipp Leskovitz <philipp.leskovitz@secunet.com>, Mark Pearson <markpearson@lenovo.com> Subject: [PATCH AUTOSEL 5.10 08/54] ALSA: hda: ignore invalid NHLT table Date: Tue, 16 Mar 2021 20:56:07 -0400 [thread overview] Message-ID: <20210317005654.724862-8-sashal@kernel.org> (raw) In-Reply-To: <20210317005654.724862-1-sashal@kernel.org> From: Mark Pearson <markpearson@lenovo.com> [ Upstream commit a14a6219996ee6f6e858d83b11affc7907633687 ] On some Lenovo systems if the microphone is disabled in the BIOS only the NHLT table header is created, with no data. This means the endpoints field is not correctly set to zero - leading to an unintialised variable and hence invalid descriptors are parsed leading to page faults. The Lenovo firmware team is addressing this, but adding a check preventing invalid tables being parsed is worthwhile. Tested on a Lenovo T14. Tested-by: Philipp Leskovitz <philipp.leskovitz@secunet.com> Reported-by: Philipp Leskovitz <philipp.leskovitz@secunet.com> Signed-off-by: Mark Pearson <markpearson@lenovo.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20210302141003.7342-1-markpearson@lenovo.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> --- sound/hda/intel-nhlt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c index d053beccfaec..e2237239d922 100644 --- a/sound/hda/intel-nhlt.c +++ b/sound/hda/intel-nhlt.c @@ -39,6 +39,11 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) if (!nhlt) return 0; + if (nhlt->header.length <= sizeof(struct acpi_table_header)) { + dev_warn(dev, "Invalid DMIC description table\n"); + return 0; + } + for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++, epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) { -- 2.30.1
next prev parent reply other threads:[~2021-03-17 0:59 UTC|newest] Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-03-17 0:56 [PATCH AUTOSEL 5.10 01/54] mt76: fix tx skb error handling in mt76_dma_tx_queue_skb Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 02/54] net: stmmac: fix dma physical address of descriptor when display ring Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 03/54] net: fec: ptp: avoid register access when ipg clock is disabled Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 04/54] powerpc/4xx: Fix build errors from mfdcr() Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 05/54] atm: eni: dont release is never initialized Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 06/54] atm: lanai: dont run lanai_dev_close if not open Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 07/54] Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" Sasha Levin 2021-03-17 0:56 ` Sasha Levin [this message] 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 08/54] ALSA: hda: ignore invalid NHLT table Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 09/54] ixgbe: Fix memleak in ixgbe_configure_clsu32 Sasha Levin 2021-03-17 0:56 ` [Intel-wired-lan] " Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 10/54] scsi: ufs: ufs-qcom: Disable interrupt in reset path Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 11/54] blk-cgroup: Fix the recursive blkg rwstat Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 12/54] net: tehuti: fix error return code in bdx_probe() Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 13/54] net: intel: iavf: fix error return code of iavf_init_get_resources() Sasha Levin 2021-03-17 0:56 ` [Intel-wired-lan] " Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 14/54] sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 15/54] gianfar: fix jumbo packets+napi+rx overrun crash Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 16/54] cifs: ask for more credit on async read/write code paths Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 17/54] gfs2: fix use-after-free in trans_drain Sasha Levin 2021-03-17 0:56 ` [Cluster-devel] " Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 18/54] cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 19/54] gpiolib: acpi: Add missing IRQF_ONESHOT Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 20/54] nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 21/54] NFS: Correct size calculation for create reply length Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 22/54] net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 23/54] net: wan: fix error return code of uhdlc_init() Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 24/54] net: davicom: Use platform_get_irq_optional() Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 25/54] net: enetc: set MAC RX FIFO to recommended value Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 26/54] atm: uPD98402: fix incorrect allocation Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 27/54] atm: idt77252: fix null-ptr-dereference Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 28/54] cifs: change noisy error message to FYI Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 29/54] irqchip/ingenic: Add support for the JZ4760 Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 30/54] kbuild: add image_name to no-sync-config-targets Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 31/54] kbuild: dummy-tools: fix inverted tests for gcc Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 32/54] umem: fix error return code in mm_pci_probe() Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 33/54] sparc64: Fix opcode filtering in handling of no fault loads Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 34/54] habanalabs: Call put_pid() when releasing control device Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 35/54] staging: rtl8192e: fix kconfig dependency on CRYPTO Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 36/54] u64_stats,lockdep: Fix u64_stats_init() vs lockdep Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 37/54] kselftest: arm64: Fix exit code of sve-ptrace Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 38/54] regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 39/54] block: Fix REQ_OP_ZONE_RESET_ALL handling Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 40/54] drm/amd/display: Revert dram_clock_change_latency for DCN2.1 Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 41/54] drm/amdgpu: fb BO should be ttm_bo_type_device Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 42/54] drm/radeon: fix AGP dependency Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 43/54] nvme: simplify error logic in nvme_validate_ns() Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 44/54] nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 45/54] nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange() Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 46/54] nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 47/54] nvme-core: check ctrl css before setting up zns Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 48/54] nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 49/54] nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 50/54] nfs: we don't support removing system.nfs4_acl Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 51/54] block: Suppress uevent for hidden device when removed Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 52/54] mm/fork: clear PASID for new mm Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 53/54] ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls Sasha Levin 2021-03-17 0:56 ` Sasha Levin 2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 54/54] ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign Sasha Levin 2021-03-17 0:56 ` Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210317005654.724862-8-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=alsa-devel@alsa-project.org \ --cc=linux-kernel@vger.kernel.org \ --cc=markpearson@lenovo.com \ --cc=philipp.leskovitz@secunet.com \ --cc=pierre-louis.bossart@linux.intel.com \ --cc=stable@vger.kernel.org \ --cc=tiwai@suse.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.