Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]ASoC: DPCM: Don't pick up BE without substream[EOL][EOL]When DPCM tries to add valid BE connections at dpcm_add_paths(), it[EOL]doesn't check whether the picked BE actually supports for the given[EOL]stream direction.  Due to that, when an asymmetric BE stream is[EOL]present, it picks up wrongly and this may result in a NULL dereference[EOL]at a later point where the code assumes the existence of a[EOL]corresponding BE substream.[EOL][EOL]This patch adds the check for the presence of the substream for the[EOL]target BE for avoiding the problem above.[EOL][EOL]Note that we have already some fix for non-existing BE substream at[EOL]commit 6246f283d5e0 ("ASoC: dpcm: skip missing substream while[EOL]applying symmetry").  But the code path we've hit recently is rather[EOL]happening before the previous fix.  So this patch tries to fix at[EOL]picking up a BE instead of parsing BE lists.

CREATE(Triage):(User=lchen-cn) [CVE-2022-50049 (https://nvd.nist.gov/vuln/detail/CVE-2022-50049)