mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-05 10:29:37 +00:00
4cc8d6505a
syzkaller reported an invalid access in PCM OSS read, and this seems to be an overflow of the internal buffer allocated for a plugin. Since the rate plugin adjusts its transfer size dynamically, the calculation for the chained plugin might be bigger than the given buffer size in some extreme cases, which lead to such an buffer overflow as caught by KASAN. Fix it by limiting the max transfer size properly by checking against the destination size in each plugin transfer callback. Reported-by: syzbot+f153bde47a62e0b05f83@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191204144824.17801-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
111 lines
3.1 KiB
C
111 lines
3.1 KiB
C
/*
|
|
* Route Plug-In
|
|
* Copyright (c) 2000 by Abramo Bagnara <abramo@alsa-project.org>
|
|
*
|
|
*
|
|
* This library is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU Library General Public License as
|
|
* published by the Free Software Foundation; either version 2 of
|
|
* the License, or (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Library General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Library General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*
|
|
*/
|
|
|
|
#include <linux/time.h>
|
|
#include <sound/core.h>
|
|
#include <sound/pcm.h>
|
|
#include "pcm_plugin.h"
|
|
|
|
static void zero_areas(struct snd_pcm_plugin_channel *dvp, int ndsts,
|
|
snd_pcm_uframes_t frames, snd_pcm_format_t format)
|
|
{
|
|
int dst = 0;
|
|
for (; dst < ndsts; ++dst) {
|
|
if (dvp->wanted)
|
|
snd_pcm_area_silence(&dvp->area, 0, frames, format);
|
|
dvp->enabled = 0;
|
|
dvp++;
|
|
}
|
|
}
|
|
|
|
static inline void copy_area(const struct snd_pcm_plugin_channel *src_channel,
|
|
struct snd_pcm_plugin_channel *dst_channel,
|
|
snd_pcm_uframes_t frames, snd_pcm_format_t format)
|
|
{
|
|
dst_channel->enabled = 1;
|
|
snd_pcm_area_copy(&src_channel->area, 0, &dst_channel->area, 0, frames, format);
|
|
}
|
|
|
|
static snd_pcm_sframes_t route_transfer(struct snd_pcm_plugin *plugin,
|
|
const struct snd_pcm_plugin_channel *src_channels,
|
|
struct snd_pcm_plugin_channel *dst_channels,
|
|
snd_pcm_uframes_t frames)
|
|
{
|
|
int nsrcs, ndsts, dst;
|
|
struct snd_pcm_plugin_channel *dvp;
|
|
snd_pcm_format_t format;
|
|
|
|
if (snd_BUG_ON(!plugin || !src_channels || !dst_channels))
|
|
return -ENXIO;
|
|
if (frames == 0)
|
|
return 0;
|
|
if (frames > dst_channels[0].frames)
|
|
frames = dst_channels[0].frames;
|
|
|
|
nsrcs = plugin->src_format.channels;
|
|
ndsts = plugin->dst_format.channels;
|
|
|
|
format = plugin->dst_format.format;
|
|
dvp = dst_channels;
|
|
if (nsrcs <= 1) {
|
|
/* expand to all channels */
|
|
for (dst = 0; dst < ndsts; ++dst) {
|
|
copy_area(src_channels, dvp, frames, format);
|
|
dvp++;
|
|
}
|
|
return frames;
|
|
}
|
|
|
|
for (dst = 0; dst < ndsts && dst < nsrcs; ++dst) {
|
|
copy_area(src_channels, dvp, frames, format);
|
|
dvp++;
|
|
src_channels++;
|
|
}
|
|
if (dst < ndsts)
|
|
zero_areas(dvp, ndsts - dst, frames, format);
|
|
return frames;
|
|
}
|
|
|
|
int snd_pcm_plugin_build_route(struct snd_pcm_substream *plug,
|
|
struct snd_pcm_plugin_format *src_format,
|
|
struct snd_pcm_plugin_format *dst_format,
|
|
struct snd_pcm_plugin **r_plugin)
|
|
{
|
|
struct snd_pcm_plugin *plugin;
|
|
int err;
|
|
|
|
if (snd_BUG_ON(!r_plugin))
|
|
return -ENXIO;
|
|
*r_plugin = NULL;
|
|
if (snd_BUG_ON(src_format->rate != dst_format->rate))
|
|
return -ENXIO;
|
|
if (snd_BUG_ON(src_format->format != dst_format->format))
|
|
return -ENXIO;
|
|
|
|
err = snd_pcm_plugin_build(plug, "route conversion",
|
|
src_format, dst_format, 0, &plugin);
|
|
if (err < 0)
|
|
return err;
|
|
|
|
plugin->transfer = route_transfer;
|
|
*r_plugin = plugin;
|
|
return 0;
|
|
}
|