ALSA: usb-audio: Fix out of bounds reads when finding clock sources

[jainanmol84]

• Commit Message Requirements
• Built against Vault/LTS Environment
• kABI Check Passed, where Valid (Pre 9.4 RT does not have kABI stability)
• Boot Test
• Kernel SelfTest results
• Additional Tests as determined relevant

Commit message

jira VULN-46534
cve CVE-2024-53150
commit-author Takashi Iwai <tiwai@suse.de>
commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6
The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.
For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop.
For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.
Reported-by: Benoît Sevens <bsevens@google.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
(cherry picked from commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6)
Signed-off-by: Anmol Jain <ajain@ciq.com>

Kernel build logs

/home/anmol/kernel-src-tree
CLEAN arch/x86/crypto
CLEAN arch/x86/entry/vdso
CLEAN arch/x86/kernel/cpu
CLEAN arch/x86/kernel
CLEAN arch/x86/purgatory
CLEAN arch/x86/realmode/rm
CLEAN arch/x86/lib
CLEAN certs
CLEAN crypto/asymmetric_keys
CLEAN drivers/firmware/efi/libstub
CLEAN drivers/gpu/drm/radeon
CLEAN drivers/scsi
CLEAN drivers/tty/vt
CLEAN drivers/video/logo
CLEAN kernel/debug/kdb
CLEAN kernel
CLEAN lib/raid6
CLEAN lib
CLEAN net/wireless
[--snip--]
STRIP /lib/modules/5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+/kernel/virt/lib/irqbypass.ko
SIGN /lib/modules/5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+/kernel/virt/lib/irqbypass.ko
DEPMOD /lib/modules/5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+
[TIMER]{MODULES}: 22s
Making Install
sh ./arch/x86/boot/install.sh \
5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+ arch/x86/boot/bzImage \
System.map "/boot"
[TIMER]{INSTALL}: 43s
Checking kABI
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+ and Index to 2
The default is /boot/loader/entries/c0d861f4dcc048a1831709161fca1f03-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+.conf with index 2 and kernel /boot/vmlinuz-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+
The default is /boot/loader/entries/c0d861f4dcc048a1831709161fca1f03-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+.conf with index 2 and kernel /boot/vmlinuz-5.14.0-_ajain__fips-9-compliant_5.14.0-284.30.1-0005f69a1+
Generating grub configuration file ...
Adding boot menu entry for UEFI Firmware Settings ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 5s
[TIMER]{BUILD}: 3215s
[TIMER]{MODULES}: 22s
[TIMER]{INSTALL}: 43s
[TIMER]{TOTAL} 3291s
Rebooting in 10 seconds

kernel-build.log

Kselftests

$ grep '^ok ' kselftest-before.log | wc -l && grep '^ok ' kselftest-after.log | wc -l
315
316
$ grep '^not ok ' kselftest-before.log | wc -l && grep '^not ok ' kselftest-after.log | wc -l
68
67

kselftest-before.log

kselftest-after.log

[bmastbergen]

🥌

[thefossguy-ciq]

🚤