kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/sound/core
History
Takashi Iwai f3e14d706e ALSA: pcm: Fix race of buffer access at PCM OSS layer 
commit 93a81ca065 upstream.

The PCM OSS layer tries to clear the buffer with the silence data at
initialization (or reconfiguration) of a stream with the explicit call
of snd_pcm_format_set_silence() with runtime->dma_area.  But this may
lead to a UAF because the accessed runtime->dma_area might be freed
concurrently, as it's performed outside the PCM ops.

For avoiding it, move the code into the PCM core and perform it inside
the buffer access lock, so that it won't be changed during the
operation.

Reported-by: syzbot+32d4647f551007595173@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-06-04 14:40:20 +02:00
..
oss ALSA: pcm: Fix race of buffer access at PCM OSS layer 2025-06-04 14:40:20 +02:00
seq ALSA: seq: Improve data consistency at polling 2025-06-04 14:40:08 +02:00
compress_offload.c ALSA: compress: Fix kernel doc warnings 2022-07-13 13:42:36 +02:00
control.c ALSA: control: Apply sanity check of input values for user elements 2024-09-12 11:10:19 +02:00
control_compat.c x86: Remove toolchain check for X32 ABI capability 2022-03-15 10:32:48 +01:00
control_led.c ALSA: control-led: use strscpy in set_led_id() 2023-01-18 11:58:09 +01:00
ctljack.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
device.c ALSA: core: Fix missing return value comments for kernel docs 2022-07-13 13:42:38 +02:00
hrtimer.c ALSA: timer: Replace tasklet with work 2020-09-09 18:32:52 +02:00
hwdep.c ALSA: core: Fix assignment in if condition 2021-06-09 17:30:22 +02:00
hwdep_compat.c ALSA: compat_ioctl: avoid compat_alloc_user_space 2020-09-21 10:37:07 +02:00
info.c ALSA: info: Fix potential deadlock at disconnection 2023-11-28 17:07:15 +00:00
info_oss.c ALSA: oss: remove useless NULL check before kfree 2021-12-06 10:08:13 +01:00
init.c ALSA: core: add isascii() check to card ID generator 2024-10-17 15:21:52 +02:00
isadma.c sound updates for 6.0-rc1 2022-08-06 10:19:51 -07:00
jack.c ALSA: core: Remove debugfs at disconnection 2024-06-12 11:03:55 +02:00
Kconfig ALSA: control: Add input validation 2022-06-15 07:45:28 +02:00
Makefile ALSA: Drop leftover snd-rtctimer stuff from Makefile 2024-03-06 14:45:09 +00:00
memalloc.c ALSA: memalloc: Workaround for Xen PV 2023-02-09 11:28:02 +01:00
memalloc_local.h ALSA: memalloc: remove snd_dma_sg_ops declaration 2022-09-09 09:09:40 +02:00
memory.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
misc.c ALSA: core: Add async signal helpers 2022-07-29 12:57:10 +02:00
pcm.c ALSA: pcm: fix out-of-bounds in snd_pcm_state_names 2023-12-13 18:39:18 +01:00
pcm_compat.c ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl 2023-09-13 09:42:59 +02:00
pcm_dmaengine.c ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused 2024-07-27 11:32:19 +02:00
pcm_drm_eld.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
pcm_iec958.c ALSA: iec958: Split status creation and fill 2021-06-08 17:05:41 +02:00
pcm_lib.c ALSA: usb-audio: Fix recursive locking at XRUN during syncing 2023-04-06 12:10:43 +02:00
pcm_local.h ALSA: memalloc: Support for non-contiguous page allocation 2021-10-18 13:32:10 +02:00
pcm_memory.c ALSA: pcm: Fix potential data race at PCM memory allocation helpers 2023-07-19 16:21:47 +02:00
pcm_misc.c ALSA: pcm: Test for "silence" field in struct "pcm_format_data" 2022-04-11 09:27:56 +02:00
pcm_native.c ALSA: pcm: Fix race of buffer access at PCM OSS layer 2025-06-04 14:40:20 +02:00
pcm_param_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pcm_timer.c ALSA: timer: Constify snd_timer_hardware definitions 2020-01-03 09:24:07 +01:00
pcm_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rawmidi.c ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() 2022-10-11 09:02:32 +02:00
rawmidi_compat.c ALSA: rawmidi: Add framing mode 2021-05-17 16:02:44 +02:00
seq_device.c ALSA: seq: Fix a potential UAF by wrong private_free call order 2021-09-30 14:13:22 +02:00
sound.c ALSA: core: Fix assignment in if condition 2021-06-09 17:30:22 +02:00
sound_oss.c ALSA: oss: Fix potential deadlock at unregistration 2022-10-11 09:02:43 +02:00
timer.c ALSA: timer: Relax start tick time check for slave timer elements 2024-08-29 17:30:51 +02:00
timer_compat.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
vmaster.c ALSA: core: Fix missing return value comments for kernel docs 2022-07-13 13:42:38 +02:00