Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_cfg.device_count truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent: UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int' Treat ch_count < device_count the same way as the existing "channels equal to output reference channels" case: apply the same ch_mask to every aggregated device instead of trying to split channels that can't be evenly divided.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0390a102cc18cb7456d6c1f15ac51f1af90fcf9c to < cad63a7798d6a6cac1fc68732595f0a3278ff6f0affected0390a102cc18cb7456d6c1f15ac51f1af90fcf9c to < 5e1322787c5e424a570e87c8c2c25e37552cbe3baffected0390a102cc18cb7456d6c1f15ac51f1af90fcf9c to < 746de48c3a250f0c264105dcbfcdf0c5001e970baffected
Linux Linux
Default version status: affected
6.3affected0 to < 6.3unaffected6.18.59 to ≤ 6.18.*unaffected7.2.13 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected