ALSA: usb-audio: Fix out of bounds reads when finding clock sources

[jainanmol84]

• Commit Message Requirements
• Built against Vault/LTS Environment
• kABI Check Passed, where Valid (Pre 9.4 RT does not have kABI stability)
• Boot Test
• Kernel SelfTest results
• Additional Tests as determined relevant

Commit message

jira VULN-46534
cve CVE-2024-53150
commit-author Takashi Iwai <tiwai@suse.de>
commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6

The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors.  That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.

For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal.  When the descriptor length is shorter than expected, it's skipped in the loop.

For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

	Reported-by: Benoît Sevens <bsevens@google.com>
	Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de
	Signed-off-by: Takashi Iwai <tiwai@suse.de>
(cherry picked from commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6)
	Signed-off-by: Anmol Jain <ajain@ciq.com>
	

Kernel build logs

/home/anmol/kernel-src-tree
  CLEAN   arch/x86/crypto
  CLEAN   arch/x86/entry/vdso
  CLEAN   arch/x86/kernel/cpu
  CLEAN   arch/x86/kernel
  CLEAN   arch/x86/purgatory
  CLEAN   arch/x86/realmode/rm
  CLEAN   arch/x86/lib
  CLEAN   certs
  CLEAN   crypto/asymmetric_keys
  CLEAN   drivers/firmware/efi/libstub
  CLEAN   drivers/gpu/drm/radeon
  CLEAN   drivers/scsi
  CLEAN   drivers/tty/vt
  CLEAN   drivers/video/logo
  CLEAN   kernel/debug/kdb
  CLEAN   kernel
  CLEAN   lib/raid6
  CLEAN   lib
  CLEAN   net/wireless
  [--snip--]
  STRIP   /lib/modules/5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+/kernel/virt/lib/irqbypass.ko
  DEPMOD  /lib/modules/5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+
[TIMER]{MODULES}: 22s
Making Install
sh ./arch/x86/boot/install.sh \
	5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+ arch/x86/boot/bzImage \
	System.map "/boot"
[TIMER]{INSTALL}: 43s
Checking kABI
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+ and Index to 2
The default is /boot/loader/entries/c0d861f4dcc048a1831709161fca1f03-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+.conf with index 2 and kernel /boot/vmlinuz-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+
The default is /boot/loader/entries/c0d861f4dcc048a1831709161fca1f03-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+.conf with index 2 and kernel /boot/vmlinuz-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+
Generating grub configuration file ...
Adding boot menu entry for UEFI Firmware Settings ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 5s
[TIMER]{BUILD}: 3215s
[TIMER]{MODULES}: 22s
[TIMER]{INSTALL}: 43s
[TIMER]{TOTAL} 3291s
Rebooting in 10 seconds

kernel-build.log

Kselftests

$ grep '^ok ' kselftest-before.log | wc -l && grep '^ok ' kselftest-after.log | wc -l
315
316

$ grep '^not ok ' kselftest-before.log | wc -l && grep '^not ok ' kselftest-after.log | wc -l
68
67

kselftest-before.log

kselftest-after.log

[bmastbergen]

🥌

[thefossguy-ciq]

🚤