Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chengfeng Ye <cyeaa@connect.ust.hk>
To:     perex@perex.cz, tiwai@suse.com, chihhao.chen@mediatek.com,
        damien@zamaudio.com
Cc:     alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org,
        Chengfeng Ye <cyeaa@connect.ust.hk>
Subject: [PATCH] sound/usb: fix null pointer dereference on pointer cs_desc
Date:   Sun, 24 Oct 2021 04:17:36 -0700
Message-Id: <20211024111736.11342-1-cyeaa@connect.ust.hk>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?sd0LS/nRirHgoz5dWOoGtD2gVQGlpytbRG2mOrIRfVda7qiSFES4nK+CrKDP?=
 =?us-ascii?Q?nMiXmpbEFDLgcnvYmrpGl9a0RZoKa83OybaRzw4/Sx9SQ0SIngZqQdfPx+MF?=
 =?us-ascii?Q?KEcgjk3Z4M5LUZOFwocG/2IiUXwJXcXznt5XIeA6QZ/rnfIyacBN7GuI6VIO?=
 =?us-ascii?Q?xR7fmA1JLGM2k2PMm/j+8h9QmXwNXpPb1nq9BPDGqneHJPfiRK3rqKu7dBJt?=
 =?us-ascii?Q?KcNT4lI1DXqjcMk+ybo4I9oe3X6BmyyoaXGEAUbaG34ggCu/GUMJq289ZkdZ?=
 =?us-ascii?Q?UVKJs2H6XIFZv4YXoX4K/80ArBp7cl7NZc/Qv/QQYKl+3FJWMODc91arJExd?=
 =?us-ascii?Q?7+ljfvZlpNkJJNduiq38qMTL6e5uFzdTo3K+EzqxleHGnHG/wlFGTDNYBEZr?=
 =?us-ascii?Q?LRqE+0643lvWWdl+VtgLjxDYBFb093G2bEKImitFccqcNUqVZPgUSTO99Iaq?=
 =?us-ascii?Q?7Zk+cI9QFNKmlHsbzuHqUpFTNwZLky7ZzIust7x9L27Rit+j8sagQ/w68lc/?=
 =?us-ascii?Q?UcjPWODroMyOrpEsuagx2CmRfn5N/+JJBkJXKW/sWSui7sLK+fIW/IiYoKFU?=
 =?us-ascii?Q?NhyXXtGdhkGBCL/ELhFrUIpv4i+I2O50KeIHwb+3PxQAqZ56v39EHW+7JtxQ?=
 =?us-ascii?Q?eot868gjdhYrBkuccAP4BVLWsF4oOe6FcWMVhjezwaBmwvYxIP2xhHR8rF2A?=
 =?us-ascii?Q?03CV4XH0kIf7ioMzMiwXkOH8k7ojW4DeCBFqjjz/fjiXLWn6A/A4Ldnda+VJ?=
 =?us-ascii?Q?9NMbYhQB7oCSQMrTNLrlLQIWsQX06DCVTW39RbvrtYfEHUeZHbB98hiLWDXg?=
 =?us-ascii?Q?mw00ERlXk4IsmtcTc7SZBwBsPVHzsRfs3mDFzoLetdwX2xlNDD1e9qYjR2Ul?=
 =?us-ascii?Q?ILkXD7assMlmf4mb+umMmOTCxKLsH1yBpXK7O8wz2Um9S3JPPgjOcDPzVM+k?=
 =?us-ascii?Q?7kIAxb2EaSSm8+hPZJkOV5zoNzf6txJQULRRnmDw684g6Ppa/nA0p3V7hq6X?=
 =?us-ascii?Q?0uBLalQBLBtHGLVi09/whjybI/8QzJ/xvBTaLK1wpyw/TOBZE/qCyYN9giKy?=
 =?us-ascii?Q?9t5pMuaeQqtPe/8JILaatgAr4noipYMxBOb+AKp+yuVTDnIyYArTauvDXUKL?=
 =?us-ascii?Q?p0xrmtNzN5SHJBEdNJDR9hbF4/LIheUNFPVKf8cWAT28ZKBw+s3806jkfIGm?=
 =?us-ascii?Q?WApFdfvFq4X8ghlqCttuhSrN6XJbZC1XiwN8/1iQf+ayOLqqjjrCUFrSsT9Y?=
 =?us-ascii?Q?7Z2NRxsWbwhJI8XXp7hEQTgGgwmSJlUfumBVHyYlHx5q26/HqeL5jjhnuJWI?=
 =?us-ascii?Q?L3TXutNBjExyYA5s14FXEW17D28Q4yvUlPGJj9MEFYYPW009uKdUy5l1WR9u?=
 =?us-ascii?Q?xVjeWHMkVr1GvyqSj9Ik0aOf0HaFanOAmTGJZMm5oV+XwtbUAMp6DR3Tg0GK?=
 =?us-ascii?Q?C1D2JpOXX8J6NRqbPF4cLYFVByF9K+PsSLmQCsHDTQapql4Tt1DUXRilDNO3?=
 =?us-ascii?Q?oZiBeZnrkkmh/RAJKunAtuNd7wpi2jOgfDaRWHY/ZRiOuRgsuSp83Ug6PtR2?=
 =?us-ascii?Q?h1GFHaUoBGKmqObA9GocW1EVdy6K/Lpbz+O5/SDSijK/sUzYrULENqn+wy9c?=
 =?us-ascii?Q?XgVnLVvtU1gVCP6x6qafNow=3D?=
X-OriginatorOrg: connect.ust.hk
X-MS-Exchange-CrossTenant-Network-Message-Id: 6b8b3645-d0df-400c-e56c-08d996dfe8c6
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Oct 2021 11:17:47.8580
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6c1d4152-39d0-44ca-88d9-b8d6ddca0708
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: BtGDMmDGhcmOTxZrP7PTpspMhDwLh8g14YFI42c9cXXDY6L8k1djZVRYMPXxmSqd+FdCGNKGBLnts7o0Cgh0KQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYYP286MB1099
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The pointer cs_desc return from snd_usb_find_clock_source could
be null, so there is a potential null pointer dereference issue.
Fix this by adding a null check before dereference.

Fixes: 9ec73005 ("ALSA: usb-audio: Refactoring UAC2/3 clock setup code")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
 sound/usb/clock.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/usb/clock.c b/sound/usb/clock.c
index 81d5ce07d548..98345a695dcc 100644
--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -496,6 +496,10 @@ int snd_usb_set_sample_rate_v2v3(struct snd_usb_audio *chip,
 	union uac23_clock_source_desc *cs_desc;
 
 	cs_desc = snd_usb_find_clock_source(chip, clock, fmt->protocol);
+
+	if (!cs_desc)
+		return 0;
+
 	if (fmt->protocol == UAC_VERSION_3)
 		bmControls = le32_to_cpu(cs_desc->v3.bmControls);
 	else
-- 
2.17.1