Takashi Iwai 93cad0348a ALSA: pcm: Fix race of buffer access at PCM OSS layer ...

commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream.

The PCM OSS layer tries to clear the buffer with the silence data at
initialization (or reconfiguration) of a stream with the explicit call
of snd_pcm_format_set_silence() with runtime->dma_area.  But this may
lead to a UAF because the accessed runtime->dma_area might be freed
concurrently, as it's performed outside the PCM ops.

For avoiding it, move the code into the PCM core and perform it inside
the buffer access lock, so that it won't be changed during the
operation.

Reported-by: syzbot+32d4647f551007595173@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>

2025-12-24 11:23:55 +00:00

..

oss

ALSA: pcm: Fix race of buffer access at PCM OSS layer

2025-12-24 11:23:55 +00:00

seq

ALSA: seq: fix function cast warnings

2025-12-24 11:17:35 +00:00

compress_offload.c

ALSA: compress: fix partial_drain completion state

2020-07-22 09:22:17 +02:00

control_compat.c

treewide: Remove uninitialized_var() usage

2023-08-11 11:33:32 +02:00

control.c

ALSA: ctl: fix error path at adding user-defined element set

2020-11-24 13:05:51 +01:00

ctljack.c

…

device.c

…

hrtimer.c

…

hwdep_compat.c

…

hwdep.c

ALSA: hwdep: fix a left shifting 1 by 31 UB bug

2020-06-03 08:18:01 +02:00

info_oss.c

…

info.c

ALSA: info: Fix potential deadlock at disconnection

2023-11-28 16:45:45 +00:00

init.c

ALSA: core: add isascii() check to card ID generator

2025-12-24 11:21:59 +00:00

isadma.c

…

jack.c

ALSA: jack: Fix mutex call in snd_jack_report()

2025-12-24 11:17:41 +00:00

Kconfig

…

Makefile

ALSA: Drop leftover snd-rtctimer stuff from Makefile

2025-12-24 11:17:20 +00:00

memalloc.c

ALSA: memalloc: Align buffer allocations in page size

2022-07-29 17:06:51 +02:00

memory.c

…

misc.c

ALSA: core: Add async signal helpers

2022-08-25 11:11:37 +02:00

pcm_compat.c

ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl

2023-09-23 10:46:59 +02:00

pcm_dmaengine.c

ALSA: dmaengine_pcm: terminate dmaengine before synchronize

2025-12-24 11:21:02 +00:00

pcm_drm_eld.c

…

pcm_iec958.c

…

pcm_lib.c

ALSA: pcm: Return 0 when size < start_threshold in capture

2025-12-24 11:22:15 +00:00

pcm_local.h

…

pcm_memory.c

ALSA: pcm: Fix races among concurrent prealloc proc writes

2022-05-15 19:40:27 +02:00

pcm_misc.c

ALSA: pcm: Test for "silence" field in struct "pcm_format_data"

2022-04-20 09:08:32 +02:00

pcm_native.c

ALSA: pcm: Fix race of buffer access at PCM OSS layer

2025-12-24 11:23:55 +00:00

pcm_param_trace.h

…

pcm_timer.c

…

pcm_trace.h

…

pcm.c

ALSA: pcm: fix out-of-bounds in snd_pcm_state_names

2023-12-13 16:46:16 +01:00

rawmidi_compat.c

…

rawmidi.c

ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()

2022-10-26 13:16:55 +02:00

seq_device.c

ALSA: seq: Fix a potential UAF by wrong private_free call order

2021-10-20 10:42:02 +02:00

sgbuf.c

…

sound_oss.c

ALSA: oss: Fix potential deadlock at unregistration

2022-10-26 13:16:55 +02:00

sound.c

…

timer_compat.c

…

timer.c

ALSA: timer: Relax start tick time check for slave timer elements

2025-12-24 11:21:30 +00:00

vmaster.c

…