linux/sound
Takashi Iwai ba3021b2c7 ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT
snd_timer_user_tselect() reallocates the queue buffer dynamically, but
it forgot to reset its indices.  Since the read may happen
concurrently with ioctl and snd_timer_user_tselect() allocates the
buffer via kmalloc(), this may lead to the leak of uninitialized
kernel-space data, as spotted via KMSAN:

  BUG: KMSAN: use of unitialized memory in snd_timer_user_read+0x6c4/0xa10
  CPU: 0 PID: 1037 Comm: probe Not tainted 4.11.0-rc5+ #2739
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  Call Trace:
   __dump_stack lib/dump_stack.c:16
   dump_stack+0x143/0x1b0 lib/dump_stack.c:52
   kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:1007
   kmsan_check_memory+0xc2/0x140 mm/kmsan/kmsan.c:1086
   copy_to_user ./arch/x86/include/asm/uaccess.h:725
   snd_timer_user_read+0x6c4/0xa10 sound/core/timer.c:2004
   do_loop_readv_writev fs/read_write.c:716
   __do_readv_writev+0x94c/0x1380 fs/read_write.c:864
   do_readv_writev fs/read_write.c:894
   vfs_readv fs/read_write.c:908
   do_readv+0x52a/0x5d0 fs/read_write.c:934
   SYSC_readv+0xb6/0xd0 fs/read_write.c:1021
   SyS_readv+0x87/0xb0 fs/read_write.c:1018

This patch adds the missing reset of queue indices.  Together with the
previous fix for the ioctl/read race, we cover the whole problem.

Reported-by: Alexander Potapenko <glider@google.com>
Tested-by: Alexander Potapenko <glider@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-06-07 10:25:23 +02:00
..
aoa
arm
atmel
core ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT 2017-06-07 10:25:23 +02:00
drivers Annotation of module parameters that specify device settings 2017-05-10 19:13:03 -07:00
firewire
hda ALSA: hda: Fix cpu lockup when stopping the cmd dmas 2017-05-10 08:47:17 +02:00
i2c
isa Annotation of module parameters that specify device settings 2017-05-10 19:13:03 -07:00
mips
oss
parisc
pci ALSA: hda/realtek - Reorder ALC269 ASUS quirk entries 2017-06-06 12:33:17 +02:00
pcmcia
ppc
sh
soc Merge remote-tracking branch 'asoc/fix/rt286' into asoc-linus 2017-05-26 12:42:28 +01:00
sparc
spi
synth
usb ALSA: usb: Avoid VLA in mixer_us16x08.c 2017-05-31 08:46:19 +02:00
x86 drm/i915: Fix runtime PM for LPE audio 2017-05-15 14:44:11 +03:00
ac97_bus.c
Kconfig sound: Disable the build of OSS drivers 2017-05-12 09:57:20 +02:00
last.c
Makefile
sound_core.c