From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63FA42192F9 for ; Thu, 25 Jun 2026 13:49:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782395385; cv=none; b=CfOFMKjZjBfOUpsqUAABSbeuiwgAVEmkKFfN/8xuYFfj8C6IZzJBS+GTbhFocVtiL4c9I1baeYbQtzVN7P4HXuZmUFVm+44HB8IPbUvC3Q2OVzx7/1JleObSyn69/l5khJ/5yjIaTDqHFqGCorUY5ecZjtty8VZkzf0HXKPkB8I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782395385; c=relaxed/simple; bh=0j10HpgS7g5Mv8FnqnJHchW/TDiJpokSZ0cwx3BiuqM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qP0icLUkTm3ikDoEboras1Q+z1+vI38N8MyvabtIkVF6WxJWgtLo6p1+15WW2sffp0rsBllkS/D819iorbmAVZAoyYNjKqYUmh3HgmUherNYA5h1Aa3W20W4yhSIIqZbIB6tKCAFhI336I+/d5NJI6eTG/I9K+vz3fNzbsSzG/w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eRXn9b1X; arc=none smtp.client-ip=209.85.215.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eRXn9b1X" Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-c89370405aaso911712a12.0 for ; Thu, 25 Jun 2026 06:49:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782395384; x=1783000184; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Gpk5mEcSHW0k3CQKLZOt1G55CYbzQ3Yr6RfffLmInkM=; b=eRXn9b1XRBqaLaLez4Hv7R/PkWvjoqGEnvJr+LiKgWmjRvo4Oh3miOn+N+gG/quXSc 7ZtGC0VIPpf36WBIS1jrAsRMjF0Ko89UHO488wxM39v0EwbBqM+waCj0cXH6gp58F7FW jNXug8i+NsjdT0YUKbq/8f/nwoE/t4ytLXe5xnAgRMgUSY4ycIuztm1zSqoEfkA6DeoC JGhYzw/exKyh2TOmMjGste0XyoZWmuAVHp5ix2zxx9MDSxsqXchMzeRDlkxONy4qje/D n+ivIB9jtH8/6IZxTqukswLZ5jdYTXNBqCjeKTayFUs8TwbP26S2xjzQbX7KLLqKaj55 UZVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782395384; x=1783000184; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Gpk5mEcSHW0k3CQKLZOt1G55CYbzQ3Yr6RfffLmInkM=; b=Zyd5TGvjBPgahZ+T1B/op4syJO+4rOu6wqnmQF+V8pFdePBtMQM9cOBufq7QVC2UK5 fL4EgpaxKvppvHEJbC69hh5es8W0ytRpSG9yM1NJL5U5P1cnc+UeT8MJDUc+lbIcBCUo zT4DtYDAQnTJksiQbz2BMzufnAUtP9jIPQLgO1CkZbBQuJTBmj7mzmZBWUkgIuyGAebs NBgXdbAPyQbLwht0NL+Em6tHIUc6EYj+KErzKWdl6MjJC2AlJJo+37BkYo65KbibbKoy JxUl45ylM8Mggvz0oI4nHnIotbTzHoSAjJEh2t6080EKv+kBacLgkzCVh/f6M9Dnq8+Y jfAQ== X-Forwarded-Encrypted: i=1; AHgh+RrW6YxrjW7bKfWqijskck0T11XwMBAX+AAeiNfxzj/mK70U0XdXE+/oM4mjCXtnYFNfi0Dz7RVrS05fvng=@vger.kernel.org X-Gm-Message-State: AOJu0YwBe/roXV2h3zFYdMP8cGezWuvEJYrmLpTaxBVWRoQ7VmKTgZrE Yq88t0LZkSQomdCTY0PW0rg/mPD6LF9TGBF3KQNPGo/VabJZa84+tMcD X-Gm-Gg: AfdE7cnR66iRLhn2lsE4cmGwJ8tlCLTI4yJH7TYpgY2XKVHPfyaqy5BcgaCVHzdXiRj DxgarqQ336CVRctcHL35gd/hbf/MkkqNdA5QDpoxG43sYEnxkBFtPPU4OxLyIhLyj5vqCJNi7I1 YAtThJGN5XAPm3OIH4sPX+YMFoDF85ka7WkhXtAymkwnAFjl6kmcJLw1StLAh1nzHlQclCufI6/ LI/4X/DXYg3oJL3avcrrpoahcZYvz4e+EuCj+fF43s9J7YetMv9Xu2S/q5uatlrZ5R3h3buo9Ek SjMm3eN70EPNkIFCAY0mhAqgnHX9Jv6piky5vv9pyM++wGewOODXFThl52y9XAzLOKEu/qp2IJo 8BO7s6ApE1ZUx8oyD5ju2zNzq3Ueee4BC9SqF0xlCmqMOn0jd10MHJXGzQIWvju59ib4Bj6Gpwd IG+gBtor+vi1ZgW+CBT4WU6uXo X-Received: by 2002:a17:902:e78e:b0:2c4:608:167c with SMTP id d9443c01a7336-2c7fc663951mr27342185ad.6.1782395383335; Thu, 25 Jun 2026 06:49:43 -0700 (PDT) Received: from ustb520lab-MS-7E07.. ([123.124.147.27]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c7f6509ca0sm20329075ad.81.2026.06.25.06.49.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jun 2026 06:49:42 -0700 (PDT) From: Jiaming Zhang To: tiwai@suse.de Cc: g@b4.vu, linux-kernel@vger.kernel.org, linux-sound@vger.kernel.org, perex@perex.cz, r772577952@gmail.com, syzkaller@googlegroups.com, tiwai@suse.com Subject: [PATCH] ALSA: FCP: Fix NULL pointer dereference in interface lookup Date: Thu, 25 Jun 2026 21:49:33 +0800 Message-ID: <20260625134933.425785-1-r772577952@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <87echuvo7x.wl-tiwai@suse.de> References: <87echuvo7x.wl-tiwai@suse.de> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcp_find_fc_interface() currently selects the first vendor-specific interface and reads endpoint 0 from it, without checking whether the interface actually has any endpoints. When bNumEndpoints is zero, no endpoint array is allocated for the parsed alternate setting, so get_endpoint(..., 0) yields an invalid endpoint descriptor pointer. Dereferencing it through usb_endpoint_num() then triggers a NULL pointer dereference. Skip vendor-specific interfaces that do not have any endpoints. Fixes: 46757a3e7d50 ("ALSA: FCP: Add Focusrite Control Protocol driver") Reported-by: Jiaming Zhang Closes: https://lore.kernel.org/lkml/CANypQFb1EHj0xX8bA1WxSOSK-5xca6ZNKzOQcp12=s=puY7VFw@mail.gmail.com/ Signed-off-by: Jiaming Zhang --- sound/usb/fcp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/usb/fcp.c b/sound/usb/fcp.c index ea746bdb36ff..6f5dcd35e1d4 100644 --- a/sound/usb/fcp.c +++ b/sound/usb/fcp.c @@ -1083,6 +1083,8 @@ static int fcp_find_fc_interface(struct usb_mixer_interface *mixer) if (desc->bInterfaceClass != 255) continue; + if (desc->bNumEndpoints < 1) + continue; epd = get_endpoint(intf->altsetting, 0); private->bInterfaceNumber = desc->bInterfaceNumber; base-commit: ab9de95c9cf952332ab79453b4b5d1bfca8e514f -- 2.43.0