LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	syzbot+1dac3a4f6bc9c1c675d4@syzkaller.appspotmail.com,
	Takashi Iwai <tiwai@suse.de>
Subject: [PATCH 4.9 08/32] ALSA: pcm: Check PCM state at xfern compat ioctl
Date: Tue,  8 May 2018 10:10:48 +0200	[thread overview]
Message-ID: <20180508074010.126160355@linuxfoundation.org> (raw)
In-Reply-To: <20180508074008.800421598@linuxfoundation.org>

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit f13876e2c33a657a71bcbb10f767c0951b165020 upstream.

Since snd_pcm_ioctl_xfern_compat() has no PCM state check, it may go
further and hit the sanity check pcm_sanity_check() when the ioctl is
called right after open.  It may eventually spew a kernel warning, as
triggered by syzbot, depending on kconfig.

The lack of PCM state check there was just an oversight.  Although
it's no real crash, the spurious kernel warning is annoying, so let's
add the proper check.

Reported-by: syzbot+1dac3a4f6bc9c1c675d4@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/pcm_compat.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -426,6 +426,8 @@ static int snd_pcm_ioctl_xfern_compat(st
 		return -ENOTTY;
 	if (substream->stream != dir)
 		return -EINVAL;
+	if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN)
+		return -EBADFD;
 
 	if ((ch = substream->runtime->channels) > 128)
 		return -EINVAL;

  parent reply	other threads:[~2018-05-08  8:10 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-08  8:10 [PATCH 4.9 00/32] 4.9.99-stable review Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 01/32] perf/core: Fix the perf_cpu_time_max_percent check Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 02/32] percpu: include linux/sched.h for cond_resched() Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 03/32] bpf: map_get_next_key to return first key on NULL Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 04/32] arm/arm64: KVM: Add PSCI version selection API Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 05/32] crypto: talitos - fix IPsec cipher in length Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 06/32] serial: imx: ensure UCR3 and UFCR are setup correctly Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 07/32] USB: serial: option: Add support for Quectel EP06 Greg Kroah-Hartman
2018-05-08  8:10 ` Greg Kroah-Hartman [this message]
2018-05-08  8:10 ` [PATCH 4.9 09/32] ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 10/32] ALSA: aloop: Mark paused device as inactive Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 11/32] ALSA: aloop: Add missing cable lock to ctl API callbacks Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 12/32] tracepoint: Do not warn on ENOMEM Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 13/32] Input: leds - fix out of bound access Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 14/32] Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 15/32] xfs: prevent creating negative-sized file via INSERT_RANGE Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 16/32] RDMA/cxgb4: release hw resources on device removal Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 17/32] RDMA/ucma: Allow resolving address w/o specifying source address Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 18/32] RDMA/mlx5: Protect from shift operand overflow Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 19/32] NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 20/32] IB/mlx5: Use unlimited rate when static rate is not supported Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 21/32] IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 22/32] drm/vmwgfx: Fix a buffer object leak Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 23/32] drm/bridge: vga-dac: Fix edid memory leak Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 24/32] test_firmware: fix setting old custom fw path back on exit, second try Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 25/32] USB: serial: visor: handle potential invalid device configuration Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 26/32] USB: Accept bulk endpoints with 1024-byte maxpacket Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 27/32] USB: serial: option: reimplement interface masking Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 28/32] USB: serial: option: adding support for ublox R410M Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 29/32] usb: musb: host: fix potential NULL pointer dereference Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 30/32] usb: musb: trace: fix NULL pointer dereference in musb_g_tx() Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 31/32] platform/x86: asus-wireless: Fix NULL pointer dereference Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 32/32] s390/facilites: use stfle_fac_list array size for MAX_FACILITY_BIT Greg Kroah-Hartman
2018-05-08 14:25 ` [PATCH 4.9 00/32] 4.9.99-stable review kernelci.org bot
2018-05-08 16:21 ` Guenter Roeck
2018-05-08 18:13 ` Naresh Kamboju
2018-05-08 23:56 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180508074010.126160355@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+1dac3a4f6bc9c1c675d4@syzkaller.appspotmail.com \
    --cc=tiwai@suse.de \
    --subject='Re: [PATCH 4.9 08/32] ALSA: pcm: Check PCM state at xfern compat ioctl' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).