From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA356C433F5 for ; Tue, 26 Oct 2021 06:11:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D0E3160FD7 for ; Tue, 26 Oct 2021 06:11:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235173AbhJZGN2 (ORCPT ); Tue, 26 Oct 2021 02:13:28 -0400 Received: from smtp-out1.suse.de ([195.135.220.28]:41362 "EHLO smtp-out1.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232721AbhJZGNP (ORCPT ); Tue, 26 Oct 2021 02:13:15 -0400 Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out1.suse.de (Postfix) with ESMTP id AEDBC21956; Tue, 26 Oct 2021 06:10:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1635228651; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=h90ltgfyz9gJ7g53ayzW06q3/x4siV5IgMDlL4cLdgY=; b=Nnh83/h0IOC3tiifeoGDzm5jQtGWCrvFnSFMC3ku8QrZ/H2fQOU0wW76H3qY4qJgibtMi/ sTiH9G562tdbNHd6C9TALoPfEq/VWDxmVCPuf5vy7UQhzu+hlQtdxRJcQQFrju9ecz+Xa+ S3yijVAXJY/pSReSKm3em1Ywis19EgM= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1635228651; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=h90ltgfyz9gJ7g53ayzW06q3/x4siV5IgMDlL4cLdgY=; b=r8MkTxlBz5HhltV2kgBZtzpv9R14zObtJ0mmlgsPyRF5mWNGAJH3hgvcrfCY6AaXH7w10O Tb/4FOjqOG+zufAA== Received: from alsa1.suse.de (alsa1.suse.de [10.160.4.42]) by relay2.suse.de (Postfix) with ESMTP id 67C8EA3B81; Tue, 26 Oct 2021 06:10:51 +0000 (UTC) Date: Tue, 26 Oct 2021 08:10:51 +0200 Message-ID: From: Takashi Iwai To: YE Chengfeng Cc: "perex@perex.cz" , "tiwai@suse.com" , "chihhao.chen@mediatek.com" , "damien@zamaudio.com" , "alsa-devel@alsa-project.org" , "linux-kernel@vger.kernel.org" Subject: Re: =?UTF-8?B?5Zue5aSNOg==?= [PATCH] sound/usb: fix null pointer dereference on pointer cs_desc In-Reply-To: References: <20211024111736.11342-1-cyeaa@connect.ust.hk> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, 24 Oct 2021 13:20:48 +0200, YE Chengfeng wrote: > > Hi, > > I found another potential null-ptr-dereference problem in this file, and not > sure whether it is true. I send this patch to you just for reference, thinks > a lot if you could spare some time to look at it. The Fixes tag doesn't look correct (the code before the refactoring also didn't have NULL checks), so applied without it now. thanks, Takashi > > Thanks so much, > Chengfeng > ------------------------------------------------------------------------------ > 发件人: YE Chengfeng > 发送时间: 2021年10月24日 19:17 > 收件人: perex@perex.cz ; tiwai@suse.com ; > chihhao.chen@mediatek.com ; damien@zamaudio.com > > 抄送: alsa-devel@alsa-project.org ; > linux-kernel@vger.kernel.org ; YE Chengfeng > > 主题: [PATCH] sound/usb: fix null pointer dereference on pointer cs_desc > > The pointer cs_desc return from snd_usb_find_clock_source could > be null, so there is a potential null pointer dereference issue. > Fix this by adding a null check before dereference. > > Fixes: 9ec73005 ("ALSA: usb-audio: Refactoring UAC2/3 clock setup code") > Signed-off-by: Chengfeng Ye > --- > sound/usb/clock.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/sound/usb/clock.c b/sound/usb/clock.c > index 81d5ce07d548..98345a695dcc 100644 > --- a/sound/usb/clock.c > +++ b/sound/usb/clock.c > @@ -496,6 +496,10 @@ int snd_usb_set_sample_rate_v2v3(struct snd_usb_audio > *chip, > union uac23_clock_source_desc *cs_desc; > > cs_desc = snd_usb_find_clock_source(chip, clock, fmt->protocol); > + > + if (!cs_desc) > + return 0; > + > if (fmt->protocol == UAC_VERSION_3) > bmControls = le32_to_cpu(cs_desc->v3.bmControls); > else > -- > 2.17.1 > >