Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-09-21 23:43:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

ALSA: firewire-motu: fix null pointer dereference when polling hwdep character device

Browse Source 
ALSA firewire-motu driver recently got support for event notification via
ALSA HwDep interface for register DSP models. However, when polling ALSA
HwDep cdev, the driver can cause null pointer dereference for the other
models due to accessing to unallocated memory or uninitialized memory.

This commit fixes the bug by check the type of model before accessing to
the memory.

Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Takashi Iwai <tiwai@suse.de>
Fixes: 634ec0b290 ("ALSA: firewire-motu: notify event for parameter change in register DSP model")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20211027125529.54295-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Sakamoto 2021-10-27 21:55:27 +09:00 committed by Takashi Iwai
parent 375f8426ed
commit d593f78e3b
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
sound/firewire/motu/motu-hwdep.c
View File

@ -16,6 +16,14 @@
#include "motu.h"
static bool has_dsp_event(struct snd_motu *motu)
{
if (motu->spec->flags & SND_MOTU_SPEC_REGISTER_DSP)
return (snd_motu_register_dsp_message_parser_count_event(motu) > 0);
else
return false;
}
static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
loff_t *offset)
{
@ -25,8 +33,7 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
spin_lock_irq(&motu->lock);
while (!motu->dev_lock_changed && motu->msg == 0 &&
snd_motu_register_dsp_message_parser_count_event(motu) == 0) {
while (!motu->dev_lock_changed && motu->msg == 0 && !has_dsp_event(motu)) {
prepare_to_wait(&motu->hwdep_wait, &wait, TASK_INTERRUPTIBLE);
spin_unlock_irq(&motu->lock);
schedule();
@ -55,7 +62,7 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
count = min_t(long, count, sizeof(event));
if (copy_to_user(buf, &event, count))
return -EFAULT;
} else if (snd_motu_register_dsp_message_parser_count_event(motu) > 0) {
} else if (has_dsp_event(motu)) {
size_t consumed = 0;
u32 __user *ptr;
u32 ev;
@ -94,8 +101,7 @@ static __poll_t hwdep_poll(struct snd_hwdep *hwdep, struct file *file,
poll_wait(file, &motu->hwdep_wait, wait);
spin_lock_irq(&motu->lock);
if (motu->dev_lock_changed || motu->msg ||
snd_motu_register_dsp_message_parser_count_event(motu) > 0)
if (motu->dev_lock_changed || motu->msg || has_dsp_event(motu))
events = EPOLLIN | EPOLLRDNORM;
else
events = 0;