Alsa-devel

Download

alsa-devel@alsa-project.org

September 2018

98 participants
232 discussions

[alsa-devel] [PATCH] ALSA: control: Make sure that id->index does not overflow in function snd_ctl_replace
by Xiao Yang 01 Sep '18

01 Sep '18

From: Young_X <YangX92(a)hotmail.com> The ALSA control code expects that the range of assigned indices to a control is continuous and does not overflow. Currently there are no checks to enforce this. If a control with a overflowing index range is created that control becomes effectively inaccessible and unremovable since snd_ctl_find_id() will not be able to find it. This patch adds a check that makes sure that controls with a overflowing index range can not be created. (same issue as CVE-2014-4656) Signed-off-by: Young_X <YangX92(a)hotmail.com> --- sound/core/control.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sound/core/control.c b/sound/core/control.c index 9aa15bf..6435772 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -441,6 +441,11 @@ int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol, goto error; } id = kcontrol->id; + if (id.index > UINT_MAX - kcontrol->count) { + ret = -EINVAL; + goto error; + } + down_write(&card->controls_rwsem); old = snd_ctl_find_id(card, &id); if (!old) { -- 2.7.4

2 1

[alsa-devel] [asoc:for-4.20 333/374] sound/pci/hda/patch_ca0132.c:7650:20: error: implicit declaration of function 'pci_iomap'; did you mean 'pcim_iomap'?
by kbuild test robot 31 Aug '18

31 Aug '18

tree: https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-4.20 head: 5fb6589acc3860304436aa436e7ea33712de6fc2 commit: 6bae5ea9498926440ffc883f3dbceb0adc65e492 [333/374] ASoC: hdac_hda: add asoc extension for legacy HDA codec drivers config: sh-allmodconfig (attached as .config) compiler: sh4-linux-gnu-gcc (Debian 7.2.0-11) 7.2.0 reproduce: wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross git checkout 6bae5ea9498926440ffc883f3dbceb0adc65e492 # save the attached .config to linux build tree GCC_VERSION=7.2.0 make.cross ARCH=sh All errors (new ones prefixed by >>): sound/pci/hda/patch_ca0132.c: In function 'patch_ca0132': >> sound/pci/hda/patch_ca0132.c:7650:20: error: implicit declaration of function 'pci_iomap'; did you mean 'pcim_iomap'? [-Werror=implicit-function-declaration] spec->mem_base = pci_iomap(codec->bus->pci, 2, 0xC20); ^~~~~~~~~ pcim_iomap sound/pci/hda/patch_ca0132.c:7650:18: warning: assignment makes pointer from integer without a cast [-Wint-conversion] spec->mem_base = pci_iomap(codec->bus->pci, 2, 0xC20); ^ cc1: some warnings being treated as errors vim +7650 sound/pci/hda/patch_ca0132.c d5c016b56 Gabriele Martino 2015-05-18 7581 95c6e9cb7 Ian Minett 2011-06-15 7582 static int patch_ca0132(struct hda_codec *codec) 95c6e9cb7 Ian Minett 2011-06-15 7583 { 95c6e9cb7 Ian Minett 2011-06-15 7584 struct ca0132_spec *spec; a73d511c4 Ian Minett 2012-12-20 7585 int err; d5c016b56 Gabriele Martino 2015-05-18 7586 const struct snd_pci_quirk *quirk; 95c6e9cb7 Ian Minett 2011-06-15 7587 4e76a8833 Takashi Iwai 2014-02-25 7588 codec_dbg(codec, "patch_ca0132\n"); 95c6e9cb7 Ian Minett 2011-06-15 7589 95c6e9cb7 Ian Minett 2011-06-15 7590 spec = kzalloc(sizeof(*spec), GFP_KERNEL); 95c6e9cb7 Ian Minett 2011-06-15 7591 if (!spec) 95c6e9cb7 Ian Minett 2011-06-15 7592 return -ENOMEM; 95c6e9cb7 Ian Minett 2011-06-15 7593 codec->spec = spec; 993884f6a Chih-Chung Chang 2013-03-25 7594 spec->codec = codec; 95c6e9cb7 Ian Minett 2011-06-15 7595 225068ab2 Takashi Iwai 2015-05-29 7596 codec->patch_ops = ca0132_patch_ops; 225068ab2 Takashi Iwai 2015-05-29 7597 codec->pcm_format_first = 1; 225068ab2 Takashi Iwai 2015-05-29 7598 codec->no_sticky_stream = 1; 225068ab2 Takashi Iwai 2015-05-29 7599 d5c016b56 Gabriele Martino 2015-05-18 7600 /* Detect codec quirk */ d5c016b56 Gabriele Martino 2015-05-18 7601 quirk = snd_pci_quirk_lookup(codec->bus->pci, ca0132_quirks); d5c016b56 Gabriele Martino 2015-05-18 7602 if (quirk) d5c016b56 Gabriele Martino 2015-05-18 7603 spec->quirk = quirk->value; d5c016b56 Gabriele Martino 2015-05-18 7604 else d5c016b56 Gabriele Martino 2015-05-18 7605 spec->quirk = QUIRK_NONE; d5c016b56 Gabriele Martino 2015-05-18 7606 e24aa0a4c Takashi Iwai 2014-08-10 7607 spec->dsp_state = DSP_DOWNLOAD_INIT; a7e76271b Ian Minett 2012-12-20 7608 spec->num_mixers = 1; 017310fbe Connor McAdams 2018-05-08 7609 017310fbe Connor McAdams 2018-05-08 7610 /* Set which mixers each quirk uses. */ 017310fbe Connor McAdams 2018-05-08 7611 switch (spec->quirk) { 017310fbe Connor McAdams 2018-05-08 7612 case QUIRK_SBZ: e25e34450 Connor McAdams 2018-08-08 7613 spec->mixers[0] = desktop_mixer; 017310fbe Connor McAdams 2018-05-08 7614 snd_hda_codec_set_name(codec, "Sound Blaster Z"); 017310fbe Connor McAdams 2018-05-08 7615 break; e25e34450 Connor McAdams 2018-08-08 7616 case QUIRK_R3D: e25e34450 Connor McAdams 2018-08-08 7617 spec->mixers[0] = desktop_mixer; e25e34450 Connor McAdams 2018-08-08 7618 snd_hda_codec_set_name(codec, "Recon3D"); e25e34450 Connor McAdams 2018-08-08 7619 break; 017310fbe Connor McAdams 2018-05-08 7620 case QUIRK_R3DI: 017310fbe Connor McAdams 2018-05-08 7621 spec->mixers[0] = r3di_mixer; 017310fbe Connor McAdams 2018-05-08 7622 snd_hda_codec_set_name(codec, "Recon3Di"); 017310fbe Connor McAdams 2018-05-08 7623 break; 017310fbe Connor McAdams 2018-05-08 7624 default: a7e76271b Ian Minett 2012-12-20 7625 spec->mixers[0] = ca0132_mixer; 017310fbe Connor McAdams 2018-05-08 7626 break; 017310fbe Connor McAdams 2018-05-08 7627 } a7e76271b Ian Minett 2012-12-20 7628 08eca6b1f Connor McAdams 2018-08-08 7629 /* Setup whether or not to use alt functions/controls/pci_mmio */ 009b8f979 Connor McAdams 2018-05-08 7630 switch (spec->quirk) { 009b8f979 Connor McAdams 2018-05-08 7631 case QUIRK_SBZ: e42c7c731 Connor McAdams 2018-08-08 7632 case QUIRK_R3D: 08eca6b1f Connor McAdams 2018-08-08 7633 spec->use_alt_controls = true; 08eca6b1f Connor McAdams 2018-08-08 7634 spec->use_alt_functions = true; 08eca6b1f Connor McAdams 2018-08-08 7635 spec->use_pci_mmio = true; 08eca6b1f Connor McAdams 2018-08-08 7636 break; 009b8f979 Connor McAdams 2018-05-08 7637 case QUIRK_R3DI: 47cdf76e4 Connor McAdams 2018-05-08 7638 spec->use_alt_controls = true; 009b8f979 Connor McAdams 2018-05-08 7639 spec->use_alt_functions = true; 08eca6b1f Connor McAdams 2018-08-08 7640 spec->use_pci_mmio = false; 009b8f979 Connor McAdams 2018-05-08 7641 break; 009b8f979 Connor McAdams 2018-05-08 7642 default: 47cdf76e4 Connor McAdams 2018-05-08 7643 spec->use_alt_controls = false; 009b8f979 Connor McAdams 2018-05-08 7644 spec->use_alt_functions = false; 08eca6b1f Connor McAdams 2018-08-08 7645 spec->use_pci_mmio = false; 009b8f979 Connor McAdams 2018-05-08 7646 break; 009b8f979 Connor McAdams 2018-05-08 7647 } 009b8f979 Connor McAdams 2018-05-08 7648 08eca6b1f Connor McAdams 2018-08-08 7649 if (spec->use_pci_mmio) { 08eca6b1f Connor McAdams 2018-08-08 @7650 spec->mem_base = pci_iomap(codec->bus->pci, 2, 0xC20); 08eca6b1f Connor McAdams 2018-08-08 7651 if (spec->mem_base == NULL) { 08eca6b1f Connor McAdams 2018-08-08 7652 codec_warn(codec, "pci_iomap failed! Setting quirk to QUIRK_NONE."); 08eca6b1f Connor McAdams 2018-08-08 7653 spec->quirk = QUIRK_NONE; 08eca6b1f Connor McAdams 2018-08-08 7654 } 08eca6b1f Connor McAdams 2018-08-08 7655 } 08eca6b1f Connor McAdams 2018-08-08 7656 5aaca44d8 Ian Minett 2012-12-20 7657 spec->base_init_verbs = ca0132_base_init_verbs; 5aaca44d8 Ian Minett 2012-12-20 7658 spec->base_exit_verbs = ca0132_base_exit_verbs; 5aaca44d8 Ian Minett 2012-12-20 7659 993884f6a Chih-Chung Chang 2013-03-25 7660 INIT_DELAYED_WORK(&spec->unsol_hp_work, ca0132_unsol_hp_delayed); 993884f6a Chih-Chung Chang 2013-03-25 7661 95c6e9cb7 Ian Minett 2011-06-15 7662 ca0132_init_chip(codec); 95c6e9cb7 Ian Minett 2011-06-15 7663 95c6e9cb7 Ian Minett 2011-06-15 7664 ca0132_config(codec); 95c6e9cb7 Ian Minett 2011-06-15 7665 d5c016b56 Gabriele Martino 2015-05-18 7666 err = ca0132_prepare_verbs(codec); d5c016b56 Gabriele Martino 2015-05-18 7667 if (err < 0) cc91ceaf3 Takashi Iwai 2017-09-04 7668 goto error; d5c016b56 Gabriele Martino 2015-05-18 7669 a73d511c4 Ian Minett 2012-12-20 7670 err = snd_hda_parse_pin_def_config(codec, &spec->autocfg, NULL); a73d511c4 Ian Minett 2012-12-20 7671 if (err < 0) cc91ceaf3 Takashi Iwai 2017-09-04 7672 goto error; a73d511c4 Ian Minett 2012-12-20 7673 95c6e9cb7 Ian Minett 2011-06-15 7674 return 0; cc91ceaf3 Takashi Iwai 2017-09-04 7675 cc91ceaf3 Takashi Iwai 2017-09-04 7676 error: cc91ceaf3 Takashi Iwai 2017-09-04 7677 ca0132_free(codec); cc91ceaf3 Takashi Iwai 2017-09-04 7678 return err; 95c6e9cb7 Ian Minett 2011-06-15 7679 } 95c6e9cb7 Ian Minett 2011-06-15 7680 :::::: The code at line 7650 was first introduced by commit :::::: 08eca6b1f1468a4021bac7b3929fd3eb491e2629 ALSA: hda/ca0132 - Add bool variable to enable/disable pci region2 mmio :::::: TO: Connor McAdams <conmanx360(a)gmail.com> :::::: CC: Takashi Iwai <tiwai(a)suse.de> --- 0-DAY kernel test infrastructure Open Source Technology Center https://lists.01.org/pipermail/kbuild-all Intel Corporation

1 0

Jump to page: