linux/sound/core
Takashi Iwai bd55842ed9 ALSA: pcm: Fix potential data race at PCM memory allocation helpers
The PCM memory allocation helpers have a sanity check against too many
buffer allocations.  However, the check is performed without a proper
lock and the allocation isn't serialized; this allows user to allocate
more memories than predefined max size.

Practically seen, this isn't really a big problem, as it's more or
less some "soft limit" as a sanity check, and it's not possible to
allocate unlimitedly.  But it's still better to address this for more
consistent behavior.

The patch covers the size check in do_alloc_pages() with the
card->memory_mutex, and increases the allocated size there for
preventing the further overflow.  When the actual allocation fails,
the size is decreased accordingly.

Reported-by: BassCheck <bass@buaa.edu.cn>
Reported-by: Tuo Li <islituo@gmail.com>
Link: https://lore.kernel.org/r/CADm8Tek6t0WedK+3Y6rbE5YEt19tML8BUL45N2ji4ZAz1KcN_A@mail.gmail.com
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230703112430.30634-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2023-07-03 14:52:27 +02:00
..
oss ALSA: oss: avoid missing-prototype warnings 2023-05-17 16:56:09 +02:00
seq Merge branch 'for-next' into for-linus 2023-06-26 15:23:23 +02:00
compress_offload.c ALSA: compress: allow setting codec params after next track 2023-06-21 07:28:31 +02:00
control_compat.c ALSA: compat_ioctl: use correct snd_ctl_elem_type_t type 2023-05-17 17:01:51 +02:00
control_led.c sound: make all 'class' structures const 2023-06-21 07:29:10 +02:00
control.c ALSA: control: Keep the previous numid at snd_ctl_rename_id() 2023-06-06 14:34:30 +02:00
ctljack.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
device.c ALSA: core: Fix missing return value comments for kernel docs 2022-07-13 13:42:38 +02:00
hrtimer.c ALSA: timer: Replace tasklet with work 2020-09-09 18:32:52 +02:00
hwdep_compat.c ALSA: compat_ioctl: avoid compat_alloc_user_space 2020-09-21 10:37:07 +02:00
hwdep.c ALSA: core: Fix assignment in if condition 2021-06-09 17:30:22 +02:00
info_oss.c ALSA: oss: remove useless NULL check before kfree 2021-12-06 10:08:13 +01:00
info.c ALSA: info: Fix llseek return value when using callback 2022-08-17 15:13:30 +02:00
init.c sound: make all 'class' structures const 2023-06-21 07:29:10 +02:00
isadma.c sound updates for 6.0-rc1 2022-08-06 10:19:51 -07:00
jack.c ALSA: jack: Access input_dev under mutex 2022-04-12 12:19:05 +02:00
Kconfig ALSA: ump: Add legacy raw MIDI support 2023-05-23 12:11:09 +02:00
Makefile ALSA: ump: Add legacy raw MIDI support 2023-05-23 12:11:09 +02:00
memalloc_local.h ALSA: memalloc: remove snd_dma_sg_ops declaration 2022-09-09 09:09:40 +02:00
memalloc.c ALSA: memalloc: Workaround for Xen PV 2023-01-27 09:16:24 +01:00
memory.c
misc.c ALSA: core: Add async signal helpers 2022-07-29 12:57:10 +02:00
pcm_compat.c ALSA: pcm: Avoid reference to status->state 2022-09-27 08:44:05 +02:00
pcm_dmaengine.c ALSA: dmaengine: increment buffer pointer atomically 2022-09-27 08:55:05 +02:00
pcm_drm_eld.c ALSA: pcm: fix ELD constraints for (E)AC3, DTS(-HD) and MLP formats 2023-06-25 08:42:53 +02:00
pcm_iec958.c ALSA: iec958: Split status creation and fill 2021-06-08 17:05:41 +02:00
pcm_lib.c ALSA: pcm: use exit controlled loop in snd_pcm_playback_silence() 2023-05-05 18:23:53 +02:00
pcm_local.h ALSA: pcm: Revert "ALSA: pcm: rewrite snd_pcm_playback_silence()" 2023-05-05 18:23:48 +02:00
pcm_memory.c ALSA: pcm: Fix potential data race at PCM memory allocation helpers 2023-07-03 14:52:27 +02:00
pcm_misc.c ALSA: pcm: Test for "silence" field in struct "pcm_format_data" 2022-04-11 09:27:56 +02:00
pcm_native.c Revert "ALSA: emu10k1 - delay the PCM interrupts (add pcm_irq_delay parameter)" 2023-05-18 07:29:41 +02:00
pcm_param_trace.h
pcm_timer.c
pcm_trace.h ALSA: pcm: fix tracing reason in hw_ptr_error 2022-11-28 14:55:41 +01:00
pcm.c ALSA: pcm: Avoid reference to status->state 2022-09-27 08:44:05 +02:00
rawmidi_compat.c ALSA: rawmidi: UMP support 2023-05-23 12:10:54 +02:00
rawmidi.c ALSA: ump: Additional proc output 2023-05-23 12:10:59 +02:00
seq_device.c ALSA: seq: Fix a potential UAF by wrong private_free call order 2021-09-30 14:13:22 +02:00
sound_oss.c ALSA: oss: Fix potential deadlock at unregistration 2022-10-11 09:02:43 +02:00
sound.c ALSA: core: Fix assignment in if condition 2021-06-09 17:30:22 +02:00
timer_compat.c ALSA: Convert strlcpy to strscpy when return value is unused 2021-01-08 09:30:05 +01:00
timer.c ALSA: timer: minimize open-coded access to hw.resolution 2023-06-13 07:43:38 +02:00
ump_convert.c ALSA: ump: Correct wrong byte size at converting a UMP System message 2023-06-28 11:44:30 +02:00
ump.c ALSA: ump: Export MIDI1 / UMP conversion helpers 2023-06-23 09:56:11 +02:00
vmaster.c ALSA: core: Fix missing return value comments for kernel docs 2022-07-13 13:42:38 +02:00