lkml.org 
[lkml]   [2016]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 11/64] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
    Date
    From: Nicolas Boichat <drinkcat@chromium.org>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 43c54b8c7cfe22f868a751ba8a59abf1724160b1 upstream.

    This reverts one hunk of
    commit ef44a1ec6eee ("ALSA: sound/core: use memdup_user()"), which
    replaced a number of kmalloc followed by memcpy with memdup calls.

    In this case, we are copying from a struct snd_pcm_hw_params32 to
    a struct snd_pcm_hw_params, but the latter is 4 bytes longer than
    the 32-bit version, so we need to separate kmalloc and copy calls.

    This actually leads to an out-of-bounds memory access later on
    in sound/soc/soc-pcm.c:soc_pcm_hw_params() (detected using KASan).

    Fixes: ef44a1ec6eee ('ALSA: sound/core: use memdup_user()')
    Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    sound/core/pcm_compat.c | 13 +++++++++----
    1 file changed, 9 insertions(+), 4 deletions(-)

    diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
    index c4ac3c1e19af..1bb1a43c7d03 100644
    --- a/sound/core/pcm_compat.c
    +++ b/sound/core/pcm_compat.c
    @@ -236,10 +236,15 @@ static int snd_pcm_ioctl_hw_params_compat(struct snd_pcm_substream *substream,
    if (! (runtime = substream->runtime))
    return -ENOTTY;

    - /* only fifo_size is different, so just copy all */
    - data = memdup_user(data32, sizeof(*data32));
    - if (IS_ERR(data))
    - return PTR_ERR(data);
    + data = kmalloc(sizeof(*data), GFP_KERNEL);
    + if (!data)
    + return -ENOMEM;
    +
    + /* only fifo_size (RO from userspace) is different, so just copy all */
    + if (copy_from_user(data, data32, sizeof(*data32))) {
    + err = -EFAULT;
    + goto error;
    + }

    if (refine)
    err = snd_pcm_hw_refine(substream, data);
    --
    2.7.1
    \
     
     \ /
      Last update: 2016-02-11 16:21    [W:3.172 / U:0.564 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site