stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	syzbot+72732c532ac1454eeee9@syzkaller.appspotmail.com,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Takashi Iwai <tiwai@suse.de>
Subject: [PATCH 5.17 05/39] ALSA: oss: Fix PCM OSS buffer allocation overflow
Date: Fri, 25 Mar 2022 16:14:20 +0100	[thread overview]
Message-ID: <20220325150420.401576412@linuxfoundation.org> (raw)
In-Reply-To: <20220325150420.245733653@linuxfoundation.org>

From: Takashi Iwai <tiwai@suse.de>

commit efb6402c3c4a7c26d97c92d70186424097b6e366 upstream.

We've got syzbot reports hitting INT_MAX overflow at vmalloc()
allocation that is called from snd_pcm_plug_alloc().  Although we
apply the restrictions to input parameters, it's based only on the
hw_params of the underlying PCM device.  Since the PCM OSS layer
allocates a temporary buffer for the data conversion, the size may
become unexpectedly large when more channels or higher rates is given;
in the reported case, it went over INT_MAX, hence it hits WARN_ON().

This patch is an attempt to avoid such an overflow and an allocation
for too large buffers.  First off, it adds the limit of 1MB as the
upper bound for period bytes.  This must be large enough for all use
cases, and we really don't want to handle a larger temporary buffer
than this size.  The size check is performed at two places, where the
original period bytes is calculated and where the plugin buffer size
is calculated.

In addition, the driver uses array_size() and array3_size() for
multiplications to catch overflows for the converted period size and
buffer bytes.

Reported-by: syzbot+72732c532ac1454eeee9@syzkaller.appspotmail.com
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/00000000000085b1b305da5a66f3@google.com
Link: https://lore.kernel.org/r/20220318082036.29699-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/oss/pcm_oss.c    |   12 ++++++++----
 sound/core/oss/pcm_plugin.c |    5 ++++-
 2 files changed, 12 insertions(+), 5 deletions(-)

--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -774,6 +774,11 @@ static int snd_pcm_oss_period_size(struc
 
 	if (oss_period_size < 16)
 		return -EINVAL;
+
+	/* don't allocate too large period; 1MB period must be enough */
+	if (oss_period_size > 1024 * 1024)
+		return -ENOMEM;
+
 	runtime->oss.period_bytes = oss_period_size;
 	runtime->oss.period_frames = 1;
 	runtime->oss.periods = oss_periods;
@@ -1043,10 +1048,9 @@ static int snd_pcm_oss_change_params_loc
 			goto failure;
 	}
 #endif
-	oss_period_size *= oss_frame_size;
-
-	oss_buffer_size = oss_period_size * runtime->oss.periods;
-	if (oss_buffer_size < 0) {
+	oss_period_size = array_size(oss_period_size, oss_frame_size);
+	oss_buffer_size = array_size(oss_period_size, runtime->oss.periods);
+	if (oss_buffer_size <= 0) {
 		err = -EINVAL;
 		goto failure;
 	}
--- a/sound/core/oss/pcm_plugin.c
+++ b/sound/core/oss/pcm_plugin.c
@@ -62,7 +62,10 @@ static int snd_pcm_plugin_alloc(struct s
 	width = snd_pcm_format_physical_width(format->format);
 	if (width < 0)
 		return width;
-	size = frames * format->channels * width;
+	size = array3_size(frames, format->channels, width);
+	/* check for too large period size once again */
+	if (size > 1024 * 1024)
+		return -ENOMEM;
 	if (snd_BUG_ON(size % 8))
 		return -ENXIO;
 	size /= 8;



  parent reply	other threads:[~2022-03-25 15:26 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-25 15:14 [PATCH 5.17 00/39] 5.17.1-rc1 review Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 01/39] tpm: Fix error handling in async work Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 02/39] Bluetooth: btusb: Add another Realtek 8761BU Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 03/39] llc: fix netdevice reference leaks in llc_ui_bind() Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 04/39] ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call Greg Kroah-Hartman
2022-03-25 15:14 ` Greg Kroah-Hartman [this message]
2022-03-25 15:14 ` [PATCH 5.17 06/39] ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 07/39] ALSA: hda/realtek: Add quirk for Clevo NP70PNJ Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 08/39] ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 09/39] ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 10/39] ALSA: hda/realtek: Add quirk for ASUS GA402 Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 11/39] ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 12/39] ALSA: pcm: Fix races among concurrent read/write and buffer changes Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 13/39] ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 14/39] ALSA: pcm: Fix races among concurrent prealloc proc writes Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 15/39] ALSA: pcm: Add stream lock during PCM reset ioctl operations Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 16/39] ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 17/39] ALSA: cmipci: Restore aux vol on suspend/resume Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 18/39] ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 19/39] drivers: net: xgene: Fix regression in CRC stripping Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 20/39] netfilter: nf_tables: initialize registers in nft_do_chain() Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 21/39] netfilter: nf_tables: validate registers coming from userspace Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 22/39] ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 23/39] ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 24/39] ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 25/39] crypto: qat - disable registration of algorithms Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 26/39] Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 27/39] Bluetooth: hci_sync: Add a new quirk to skip HCI_FLT_CLEAR_ALL Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 28/39] Bluetooth: btusb: Use quirk to skip HCI_FLT_CLEAR_ALL on fake CSR controllers Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 29/39] Revert "ath: add support for special 0x0 regulatory domain" Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 30/39] drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 31/39] jbd2: fix use-after-free of transaction_t race Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 32/39] rcu: Dont deboost before reporting expedited quiescent state Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 33/39] uaccess: fix integer overflow on access_ok() Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 34/39] mac80211: fix potential double free on mesh join Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 35/39] tpm: fix reference counting for struct tpm_chip Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 36/39] tpm: use try_get_ops() in tpm-space.c Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 37/39] wcn36xx: Differentiate wcn3660 from wcn3620 Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 38/39] m68k: fix access_ok for coldfire Greg Kroah-Hartman
2022-03-25 15:14 ` [PATCH 5.17 39/39] nds32: fix access_ok() checks in get/put_user Greg Kroah-Hartman
2022-03-25 23:22 ` [PATCH 5.17 00/39] 5.17.1-rc1 review Shuah Khan
2022-03-26  1:22 ` Fox Chen
2022-03-26  2:53 ` Rudi Heitbaum
2022-03-26  3:07 ` Florian Fainelli
2022-03-26  4:54 ` Naresh Kamboju
2022-03-26  9:55   ` Greg Kroah-Hartman
2022-03-26 12:26     ` Naresh Kamboju
2022-03-26 12:19 ` Bagas Sanjaya
2022-03-27  0:13 ` Ron Economos
2022-03-27  0:52 ` Guenter Roeck
2022-03-27  1:37 ` Justin Forbes

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220325150420.401576412@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+72732c532ac1454eeee9@syzkaller.appspotmail.com \
    --cc=tiwai@suse.de \
    --cc=torvalds@linux-foundation.org \
    --subject='Re: [PATCH 5.17 05/39] ALSA: oss: Fix PCM OSS buffer allocation overflow' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).