linux/sound
Takashi Iwai ba3021b2c7 ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT
snd_timer_user_tselect() reallocates the queue buffer dynamically, but
it forgot to reset its indices.  Since the read may happen
concurrently with ioctl and snd_timer_user_tselect() allocates the
buffer via kmalloc(), this may lead to the leak of uninitialized
kernel-space data, as spotted via KMSAN:

  BUG: KMSAN: use of unitialized memory in snd_timer_user_read+0x6c4/0xa10
  CPU: 0 PID: 1037 Comm: probe Not tainted 4.11.0-rc5+ #2739
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  Call Trace:
   __dump_stack lib/dump_stack.c:16
   dump_stack+0x143/0x1b0 lib/dump_stack.c:52
   kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:1007
   kmsan_check_memory+0xc2/0x140 mm/kmsan/kmsan.c:1086
   copy_to_user ./arch/x86/include/asm/uaccess.h:725
   snd_timer_user_read+0x6c4/0xa10 sound/core/timer.c:2004
   do_loop_readv_writev fs/read_write.c:716
   __do_readv_writev+0x94c/0x1380 fs/read_write.c:864
   do_readv_writev fs/read_write.c:894
   vfs_readv fs/read_write.c:908
   do_readv+0x52a/0x5d0 fs/read_write.c:934
   SYSC_readv+0xb6/0xd0 fs/read_write.c:1021
   SyS_readv+0x87/0xb0 fs/read_write.c:1018

This patch adds the missing reset of queue indices.  Together with the
previous fix for the ioctl/read race, we cover the whole problem.

Reported-by: Alexander Potapenko <glider@google.com>
Tested-by: Alexander Potapenko <glider@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-06-07 10:25:23 +02:00
..
aoa powerpc updates for 4.9 2016-10-07 20:19:31 -07:00
arm ALSA: arm: Fix empty menuconfig SND_ARM 2016-08-01 16:07:53 +02:00
atmel
core ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT 2017-06-07 10:25:23 +02:00
drivers Annotation of module parameters that specify device settings 2017-05-10 19:13:03 -07:00
firewire ALSA: fireface: obsolete usage of ktime_set() for zero assignment 2017-04-20 15:00:54 +02:00
hda ALSA: hda: Fix cpu lockup when stopping the cmd dmas 2017-05-10 08:47:17 +02:00
i2c ALSA: ak4114: remove redundant check on err being < 0 2016-07-12 12:28:04 +02:00
isa Annotation of module parameters that specify device settings 2017-05-10 19:13:03 -07:00
mips ALSA: mips: avoid potential uninitialized variable use 2017-01-16 14:33:42 +01:00
oss Annotate hardware config module parameters in sound/oss/ 2017-04-20 12:02:32 +01:00
parisc
pci ALSA: hda/realtek - Reorder ALC269 ASUS quirk entries 2017-06-06 12:33:17 +02:00
pcmcia lib/vsprintf.c: remove %Z support 2017-02-27 18:43:47 -08:00
ppc scripts/spelling.txt: add "followings" pattern and fix typo instances 2017-02-27 18:43:47 -08:00
sh ktime: Cleanup ktime_set() usage 2016-12-25 17:21:22 +01:00
soc Merge remote-tracking branch 'asoc/fix/rt286' into asoc-linus 2017-05-26 12:42:28 +01:00
sparc dbri: move dereference after check for NULL 2016-12-06 12:18:22 -05:00
spi
synth ALSA: emux: stop if copy_from_user() fails 2017-03-31 16:23:52 +02:00
usb ALSA: usb: Avoid VLA in mixer_us16x08.c 2017-05-31 08:46:19 +02:00
x86 drm/i915: Fix runtime PM for LPE audio 2017-05-15 14:44:11 +03:00
ac97_bus.c
Kconfig sound: Disable the build of OSS drivers 2017-05-12 09:57:20 +02:00
last.c
Makefile ALSA: add Intel HDMI LPE audio driver for BYT/CHT-T 2017-01-25 14:23:46 +01:00
sound_core.c