From 9062d50e75c24dc7911be05c9b1719b3b256af15 Mon Sep 17 00:00:00 2001 From: Liu Chao Date: Mon, 21 Sep 2026 15:25:51 +0800 Subject: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index into con->data[]: u8 cmd = (ctrl->bRequest & 0x0F); /* 0 .. 15 */ ... con->data[cmd] = value; /* OOB when cmd >= 5 */ struct usb_audio_control (include/linux/usb/audio.h) declares data as a 5-element array, so indices 5 through 15 write (or read) up to 44 bytes past the end of the array on the heap. A malicious USB host can craft a class-specific SET_CUR / GET_CUR request with an arbitrary bRequest value, triggering the out-of-bounds access from an IRQ completion handler with no further preconditions. Add an ARRAY_SIZE() guard to both functions. Fixes: c47d7b09891a ("USB: audio: add USB audio class definitions") Cc: stable Reviewed-by: Weibin Liu Signed-off-by: Liu Chao Reviewed-by: Ivy Lopez Link: https://patch.msgid.link/20260921072551.3708191-1-liuc63@xiaopeng.com Signed-off-by: Greg Kroah-Hartman --- scripts/stackdelta | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100755 scripts/stackdelta (limited to 'scripts/stackdelta') diff --git a/scripts/stackdelta b/scripts/stackdelta new file mode 100755 index 000000000..44d2dfd62 --- /dev/null +++ b/scripts/stackdelta @@ -0,0 +1,60 @@ +#!/usr/bin/env perl +# SPDX-License-Identifier: GPL-2.0 + +# Read two files produced by the stackusage script, and show the +# delta between them. +# +# Currently, only shows changes for functions listed in both files. We +# could add an option to show also functions which have vanished or +# appeared (which would often be due to gcc making other inlining +# decisions). +# +# Another possible option would be a minimum absolute value for the +# delta. +# +# A third possibility is for sorting by delta, but that can be +# achieved by piping to sort -k5,5g. + +sub read_stack_usage_file { + my %su; + my $f = shift; + open(my $fh, '<', $f) + or die "cannot open $f: $!"; + while (<$fh>) { + chomp; + my ($file, $func, $size, $type) = split; + # Old versions of gcc (at least 4.7) have an annoying quirk in + # that a (static) function whose name has been changed into + # for example ext4_find_unwritten_pgoff.isra.11 will show up + # in the .su file with a name of just "11". Since such a + # numeric suffix is likely to change across different + # commits/compilers/.configs or whatever else we're trying to + # tweak, we can't really track those functions, so we just + # silently skip them. + # + # Newer gcc (at least 5.0) report the full name, so again, + # since the suffix is likely to change, we strip it. + next if $func =~ m/^[0-9]+$/; + $func =~ s/\..*$//; + # Line numbers are likely to change; strip those. + $file =~ s/:[0-9]+$//; + $su{"${file}\t${func}"} = {size => $size, type => $type}; + } + close($fh); + return \%su; +} + +@ARGV == 2 + or die "usage: $0 "; + +my $old = read_stack_usage_file($ARGV[0]); +my $new = read_stack_usage_file($ARGV[1]); +my @common = sort grep {exists $new->{$_}} keys %$old; +for (@common) { + my $x = $old->{$_}{size}; + my $y = $new->{$_}{size}; + my $delta = $y - $x; + if ($delta) { + printf "%s\t%d\t%d\t%+d\n", $_, $x, $y, $delta; + } +} -- cgit v1.3.1