ASoC: SOF: backport CVE-2023-54233 to 6.1.y

[PATCH 6.1.y 0/2] ASoC: SOF: backport CVE-2023-54233 to 6.1.y

Posted by Artem Dinaburg 2 days, 21 hours ago

Hi Greg, Sasha, and SOF maintainers,

I am working through the smaller CVE backports that 6.1.y still needs.
This series handles CVE-2023-54233. Patch 1 adds the missing module-info
guards; patch 2 is its immediate diagnostic follow-up.

The stable tag on patch 1 says 6.2+, but the same unsafe dereference is in
6.1.y. I kept the pair together and did not bring in the later topology
refactors.

Could you please queue this series for 6.1.y?

Thanks,
Artem Dinaburg

AI assistance: An LLM helped find the missing CVE fix, adapt
it, and prepare the draft; I reviewed the code and build output.

Guennadi Liakhovetski (1):
  ASoC: SOF: avoid a NULL dereference with unsupported widgets

Peter Ujfalusi (1):
  ASoC: SOF: ipc4-topology: Clarify bind failure caused by missing
    fw_module

 sound/soc/sof/ipc4-topology.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

-- 
2.39.5

Re: [PATCH 6.1.y 0/2] ASoC: SOF: backport CVE-2023-54233 to 6.1.y

Posted by Sasha Levin 2 days, 1 hour ago

> The stable tag on patch 1 says 6.2+, but the same unsafe dereference is in
> 6.1.y. I kept the pair together and did not bring in the later topology
> refactors.
>
> Could you please queue this series for 6.1.y?

Queued the series for 6.1, thanks. Keeping the pair together was the
right call.

-- 
Thanks,
Sasha