lkml.org 
[lkml]   [2019]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 202/243] ALSA: pcm: oss: Avoid potential buffer overflows
    Date
    From: Takashi Iwai <tiwai@suse.de>

    commit 4cc8d6505ab82db3357613d36e6c58a297f57f7c upstream.

    syzkaller reported an invalid access in PCM OSS read, and this seems
    to be an overflow of the internal buffer allocated for a plugin.
    Since the rate plugin adjusts its transfer size dynamically, the
    calculation for the chained plugin might be bigger than the given
    buffer size in some extreme cases, which lead to such an buffer
    overflow as caught by KASAN.

    Fix it by limiting the max transfer size properly by checking against
    the destination size in each plugin transfer callback.

    Reported-by: syzbot+f153bde47a62e0b05f83@syzkaller.appspotmail.com
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20191204144824.17801-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/core/oss/linear.c | 2 ++
    sound/core/oss/mulaw.c | 2 ++
    sound/core/oss/route.c | 2 ++
    3 files changed, 6 insertions(+)

    --- a/sound/core/oss/linear.c
    +++ b/sound/core/oss/linear.c
    @@ -107,6 +107,8 @@ static snd_pcm_sframes_t linear_transfer
    }
    }
    #endif
    + if (frames > dst_channels[0].frames)
    + frames = dst_channels[0].frames;
    convert(plugin, src_channels, dst_channels, frames);
    return frames;
    }
    --- a/sound/core/oss/mulaw.c
    +++ b/sound/core/oss/mulaw.c
    @@ -269,6 +269,8 @@ static snd_pcm_sframes_t mulaw_transfer(
    }
    }
    #endif
    + if (frames > dst_channels[0].frames)
    + frames = dst_channels[0].frames;
    data = (struct mulaw_priv *)plugin->extra_data;
    data->func(plugin, src_channels, dst_channels, frames);
    return frames;
    --- a/sound/core/oss/route.c
    +++ b/sound/core/oss/route.c
    @@ -57,6 +57,8 @@ static snd_pcm_sframes_t route_transfer(
    return -ENXIO;
    if (frames == 0)
    return 0;
    + if (frames > dst_channels[0].frames)
    + frames = dst_channels[0].frames;

    nsrcs = plugin->src_format.channels;
    ndsts = plugin->dst_format.channels;

    \
     
     \ /
      Last update: 2019-12-11 16:50    [W:3.999 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site