From 9062d50e75c24dc7911be05c9b1719b3b256af15 Mon Sep 17 00:00:00 2001 From: Liu Chao Date: Mon, 21 Sep 2026 15:25:51 +0800 Subject: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index into con->data[]: u8 cmd = (ctrl->bRequest & 0x0F); /* 0 .. 15 */ ... con->data[cmd] = value; /* OOB when cmd >= 5 */ struct usb_audio_control (include/linux/usb/audio.h) declares data as a 5-element array, so indices 5 through 15 write (or read) up to 44 bytes past the end of the array on the heap. A malicious USB host can craft a class-specific SET_CUR / GET_CUR request with an arbitrary bRequest value, triggering the out-of-bounds access from an IRQ completion handler with no further preconditions. Add an ARRAY_SIZE() guard to both functions. Fixes: c47d7b09891a ("USB: audio: add USB audio class definitions") Cc: stable Reviewed-by: Weibin Liu Signed-off-by: Liu Chao Reviewed-by: Ivy Lopez Link: https://patch.msgid.link/20260921072551.3708191-1-liuc63@xiaopeng.com Signed-off-by: Greg Kroah-Hartman --- include/sound/sof/pm.h | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 include/sound/sof/pm.h (limited to 'include/sound/sof/pm.h') diff --git a/include/sound/sof/pm.h b/include/sound/sof/pm.h new file mode 100644 index 000000000..df55bfe58 --- /dev/null +++ b/include/sound/sof/pm.h @@ -0,0 +1,56 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause) */ +/* + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. + * + * Copyright(c) 2018 Intel Corporation + */ + +#ifndef __INCLUDE_SOUND_SOF_PM_H__ +#define __INCLUDE_SOUND_SOF_PM_H__ + +#include + +/* + * PM + */ + +/* PM context element */ +struct sof_ipc_pm_ctx_elem { + struct sof_ipc_hdr hdr; + uint32_t type; + uint32_t size; + uint64_t addr; +} __packed; + +/* + * PM context - SOF_IPC_PM_CTX_SAVE, SOF_IPC_PM_CTX_RESTORE, + * SOF_IPC_PM_CTX_SIZE + */ +struct sof_ipc_pm_ctx { + struct sof_ipc_cmd_hdr hdr; + struct sof_ipc_host_buffer buffer; + uint32_t num_elems; + uint32_t size; + + /* reserved for future use */ + uint32_t reserved[8]; + + struct sof_ipc_pm_ctx_elem elems[]; +} __packed; + +/* enable or disable cores - SOF_IPC_PM_CORE_ENABLE */ +struct sof_ipc_pm_core_config { + struct sof_ipc_cmd_hdr hdr; + uint32_t enable_mask; +} __packed; + +struct sof_ipc_pm_gate { + struct sof_ipc_cmd_hdr hdr; + uint32_t flags; /* platform specific */ + + /* reserved for future use */ + uint32_t reserved[5]; +} __packed; + +#endif -- cgit v1.3.1