Mark Brown

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a reference count leak in the `uniphier spi probe()` function. This occurs when either `dma get slave caps()` or `devm spi register master()` returns an error code, causing the function to forget to decrease the refcount of both `dma rx` and `dma tx` objects. This may lead to refcount leaks. The issue happens in several error paths in `uniphier spi probe()`. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue occurs when the system is suspended while audio is active, causing the `sof ipc4 pcm hw free()` function to reset the pipelines. If the firmware crashes during audio playback or when resetting the stream before suspend, the `sof ipc4 set multi pipeline state()` function will fail with an IPC error, interrupting the state change. This misalignment between the kernel and firmware state can result in errors returned by firmware for IPC messages, eventually failing the audio resume. The kernel state will be corrected on the next DSP boot after the DSP panic.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the ASoC: ops component of the Linux kernel, where it fails to validate that the values being set are within the range advertised to userspace as being valid. This can lead to out-of-bounds values being accepted, potentially causing issues. The problem is resolved by rejecting any values that are out of range in the `snd soc put volsw()` function. There is also a mention of a potential buffer overflow error, which could allow an attacker to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the Linux kernel, specifically with the ASoC: ops, where the bounds checks in the `snd soc put volsw sx()` function are only applied to the first channel. This means it is possible to write out of bounds values to the second channel in stereo controls. The fix involves adding appropriate checks to prevent this.