Skip to content

Commit 61006c5

Browse files
committed
ALSA: ctxfi: Fix potential OOB access in audio mixer handling
In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()). As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]' After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field. This patch addresses those OOB accesses by adding the proper initializations of the loop indices. Reported-by: Salvatore Bonaccorso <carnil@debian.org> Tested-by: Karsten Hohmeier <linux@hohmatik.de> Closes: https://bugs.debian.org/1121535 Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/all/aSk8KJI35H7gFru6@eldamar.lan/ Link: https://patch.msgid.link/20260119133212.189129-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent 1deecf7 commit 61006c5

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

sound/pci/ctxfi/ctamixer.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,7 @@ static int amixer_rsc_init(struct amixer *amixer,
205205

206206
/* Set amixer specific operations */
207207
amixer->rsc.ops = &amixer_basic_rsc_ops;
208+
amixer->rsc.conj = 0;
208209
amixer->ops = &amixer_ops;
209210
amixer->input = NULL;
210211
amixer->sum = NULL;
@@ -367,6 +368,7 @@ static int sum_rsc_init(struct sum *sum,
367368
return err;
368369

369370
sum->rsc.ops = &sum_basic_rsc_ops;
371+
sum->rsc.conj = 0;
370372

371373
return 0;
372374
}

0 commit comments

Comments
 (0)