linux/sound/core/oss
Takashi Iwai ca0214ee28 ALSA: pcm: Fix possible OOB access in PCM oss plugins
The PCM OSS emulation converts and transfers the data on the fly via
"plugins".  The data is converted over the dynamically allocated
buffer for each plugin, and recently syzkaller caught OOB in this
flow.

Although the bisection by syzbot pointed out to the commit
65766ee0bf ("ALSA: oss: Use kvzalloc() for local buffer
allocations"), this is merely a commit to replace vmalloc() with
kvmalloc(), hence it can't be the cause.  The further debug action
revealed that this happens in the case where a slave PCM doesn't
support only the stereo channels while the OSS stream is set up for a
mono channel.  Below is a brief explanation:

At each OSS parameter change, the driver sets up the PCM hw_params
again in snd_pcm_oss_change_params_lock().  This is also the place
where plugins are created and local buffers are allocated.  The
problem is that the plugins are created before the final hw_params is
determined.  Namely, two snd_pcm_hw_param_near() calls for setting the
period size and periods may influence on the final result of channels,
rates, etc, too, while the current code has already created plugins
beforehand with the premature values.  So, the plugin believes that
channels=1, while the actual I/O is with channels=2, which makes the
driver reading/writing over the allocated buffer size.

The fix is simply to move the plugin allocation code after the final
hw_params call.

Reported-by: syzbot+d4503ae45b65c5bc1194@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2019-03-22 16:27:03 +01:00
..
copy.c ALSA: Kill snd_assert() in sound/core/* 2008-08-13 11:46:35 +02:00
io.c ALSA: pcm: Build OSS writev/readv helpers conditionally 2017-06-02 19:38:26 +02:00
linear.c ALSA: core: remove unused variables. 2011-05-26 08:19:04 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mixer_oss.c sound: Use octal not symbolic permissions 2018-05-28 11:27:20 +02:00
mulaw.c ALSA: core: sparse cleanups 2011-02-14 17:10:11 +01:00
pcm_oss.c ALSA: pcm: Fix possible OOB access in PCM oss plugins 2019-03-22 16:27:03 +01:00
pcm_plugin.c ALSA: oss: Use kvzalloc() for local buffer allocations 2018-11-09 14:12:04 +01:00
pcm_plugin.h ALSA: pcm: Build OSS writev/readv helpers conditionally 2017-06-02 19:38:26 +02:00
rate.c ALSA: fix excessive background noise introduced by OSS emulation rate shrink 2009-02-23 07:49:04 +01:00
route.c ALSA: core: sparse cleanups 2011-02-14 17:10:11 +01:00