tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ALSA: pcm: Add sanity NULL check for the default mmap fault handler

Browse Source 
BugLink: https://bugs.launchpad.net/bugs/2101915

commit d2913a07d9037fe7aed4b7e680684163eaed6bc4 upstream.

A driver might allow the mmap access before initializing its
runtime->dma_area properly.  Add a proper NULL check before passing to
virt_to_page() for avoiding a panic.

Reported-by: syzbot+4bf62a7b1d0f4fdb7ae2@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20241120141104.7060-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CVE-2024-53180
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
This commit is contained in:
Takashi Iwai
2025-03-11 08:51:19 +09:00
committed by Stefan Bader
parent 5e1da88113
commit 2f678b09c5
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sound/core/pcm_native.c
+4 -2
View File
@@ -3850,9 +3850,11 @@ static vm_fault_t snd_pcm_mmap_data_fault(struct vm_fault *vmf)
return VM_FAULT_SIGBUS;
if (substream->ops->page)
page = substream->ops->page(substream, offset);
else if (!snd_pcm_get_dma_buf(substream))
else if (!snd_pcm_get_dma_buf(substream)) {
if (WARN_ON_ONCE(!runtime->dma_area))
return VM_FAULT_SIGBUS;
page = virt_to_page(runtime->dma_area + offset);
else
} else
page = snd_sgbuf_get_page(snd_pcm_get_dma_buf(substream), offset);
if (!page)
return VM_FAULT_SIGBUS;