summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2020-04-03 09:38:18 +0200
committerTakashi Iwai <tiwai@suse.de>2020-04-03 09:38:50 +0200
commitff7e06a55676931ab32db54f69189482a948c5ec (patch)
tree665a9c4f4615b71f0d9ac12c9c6947565410ecd4
parentdbdd24eaac4ecc482e2d433175c0e82b9f107bef (diff)
downloadlinux-ff7e06a55676931ab32db54f69189482a948c5ec.tar.bz2
ALSA: pcm: oss: Fix regression by buffer overflow fix (again)
[ This is essentially the same fix as commit ae769d355664, but it's adapted to the latest code for 5.7; hence it contains no Fixes or other tags for avoid backport confusion -- tiwai ] The recent fix for the OOB access in PCM OSS plugins (commit f2ecf903ef06: "ALSA: pcm: oss: Avoid plugin buffer overflow") caused a regression on OSS applications. The patch introduced the size check in client and slave size calculations to limit to each plugin's buffer size, but I overlooked that some code paths call those without allocating the buffer but just for estimation. This patch fixes the bug by skipping the size check for those code paths while keeping checking in the actual transfer calls. Link: https://lore.kernel.org/r/20200403073818.27943-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
-rw-r--r--sound/core/oss/pcm_plugin.c22
1 files changed, 12 insertions, 10 deletions
diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
index fbda4ebf38b3..59d62f05658f 100644
--- a/sound/core/oss/pcm_plugin.c
+++ b/sound/core/oss/pcm_plugin.c
@@ -197,7 +197,8 @@ int snd_pcm_plugin_free(struct snd_pcm_plugin *plugin)
}
static snd_pcm_sframes_t calc_dst_frames(struct snd_pcm_substream *plug,
- snd_pcm_sframes_t frames)
+ snd_pcm_sframes_t frames,
+ bool check_size)
{
struct snd_pcm_plugin *plugin, *plugin_next;
@@ -209,7 +210,7 @@ static snd_pcm_sframes_t calc_dst_frames(struct snd_pcm_substream *plug,
if (frames < 0)
return frames;
}
- if (frames > plugin->buf_frames)
+ if (check_size && frames > plugin->buf_frames)
frames = plugin->buf_frames;
plugin = plugin_next;
}
@@ -217,13 +218,14 @@ static snd_pcm_sframes_t calc_dst_frames(struct snd_pcm_substream *plug,
}
static snd_pcm_sframes_t calc_src_frames(struct snd_pcm_substream *plug,
- snd_pcm_sframes_t frames)
+ snd_pcm_sframes_t frames,
+ bool check_size)
{
struct snd_pcm_plugin *plugin, *plugin_prev;
plugin = snd_pcm_plug_last(plug);
while (plugin && frames > 0) {
- if (frames > plugin->buf_frames)
+ if (check_size && frames > plugin->buf_frames)
frames = plugin->buf_frames;
plugin_prev = plugin->prev;
if (plugin->src_frames) {
@@ -242,9 +244,9 @@ snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *plug, snd_p
return -ENXIO;
switch (snd_pcm_plug_stream(plug)) {
case SNDRV_PCM_STREAM_PLAYBACK:
- return calc_src_frames(plug, drv_frames);
+ return calc_src_frames(plug, drv_frames, false);
case SNDRV_PCM_STREAM_CAPTURE:
- return calc_dst_frames(plug, drv_frames);
+ return calc_dst_frames(plug, drv_frames, false);
default:
snd_BUG();
return -EINVAL;
@@ -257,9 +259,9 @@ snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *plug, snd_pc
return -ENXIO;
switch (snd_pcm_plug_stream(plug)) {
case SNDRV_PCM_STREAM_PLAYBACK:
- return calc_dst_frames(plug, clt_frames);
+ return calc_dst_frames(plug, clt_frames, false);
case SNDRV_PCM_STREAM_CAPTURE:
- return calc_src_frames(plug, clt_frames);
+ return calc_src_frames(plug, clt_frames, false);
default:
snd_BUG();
return -EINVAL;
@@ -622,7 +624,7 @@ snd_pcm_sframes_t snd_pcm_plug_write_transfer(struct snd_pcm_substream *plug, st
src_channels = dst_channels;
plugin = next;
}
- return snd_pcm_plug_client_size(plug, frames);
+ return calc_src_frames(plug, frames, true);
}
snd_pcm_sframes_t snd_pcm_plug_read_transfer(struct snd_pcm_substream *plug, struct snd_pcm_plugin_channel *dst_channels_final, snd_pcm_uframes_t size)
@@ -632,7 +634,7 @@ snd_pcm_sframes_t snd_pcm_plug_read_transfer(struct snd_pcm_substream *plug, str
snd_pcm_sframes_t frames = size;
int err;
- frames = snd_pcm_plug_slave_size(plug, frames);
+ frames = calc_src_frames(plug, frames, true);
if (frames < 0)
return frames;