Commit a48c00f6 authored by Takashi Iwai's avatar Takashi Iwai Committed by Khalid Elmously

ALSA: pcm: Add missing copy ops check before clearing buffer

BugLink: https://bugs.launchpad.net/bugs/1864774

[ this is a fix specific to 4.4.y and 4.9.y stable trees;
  4.14.y and older already contain the right fix ]

The stable 4.4.y and 4.9.y backports of the upstream commit
add9d56d ("ALSA: pcm: Avoid possible info leaks from PCM stream
buffers") dropped the check of substream->ops->copy_user as copy_user
is a new member that isn't present in the older kernels.
Although upstream drivers should work without this NULL check, it may
cause a regression with a downstream driver that sets some
inaccessible address to runtime->dma_area, leading to a crash at
worst.

Since such drivers must have ops->copy member on older kernels instead
of ops->copy_user, this patch adds the missing check of ops->copy for
fixing the regression.
Reported-and-tested-by: default avatarAndreas Schneider <asn@cryptomilk.org>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarKhalid Elmously <khalid.elmously@canonical.com>
Signed-off-by: default avatarKleber Sacilotto de Souza <kleber.souza@canonical.com>
parent d91009ce
...@@ -588,7 +588,7 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, ...@@ -588,7 +588,7 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
runtime->boundary *= 2; runtime->boundary *= 2;
/* clear the buffer for avoiding possible kernel info leaks */ /* clear the buffer for avoiding possible kernel info leaks */
if (runtime->dma_area) if (runtime->dma_area && !substream->ops->copy)
memset(runtime->dma_area, 0, runtime->dma_bytes); memset(runtime->dma_area, 0, runtime->dma_bytes);
snd_pcm_timer_resolution_change(substream); snd_pcm_timer_resolution_change(substream);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment