kernel.git/sound/core/control.c, branch linux-2.6.33.y

ALSA: prevent heap corruption in snd_ctl_new()

2011-03-21T19:43:11Z

commit 5591bf07225523600450edd9e6ad258bb877b779 upstream. The snd_ctl_new() function in sound/core/control.c allocates space for a snd_kcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC* device (on many distros, this is group "audio") via the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls. Signed-off-by: Dan Rosenberg Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

Merge branch 'topic/misc' into for-linus

2009-12-04T15:22:37Z

ALSA: remove unnecessary null check

2009-11-18T08:59:40Z

This function is only called from snd_ctl_ioctl() and the file parameter can never be null so there is no need to check it here. We dereference file at the start of the function: struct snd_card *card = file->card; and it confuses static checkers to dereference a pointer before checking it. Signed-off-by: Dan Carpenter Signed-off-by: Takashi Iwai

control: use reference-counted pid

2009-11-06T13:32:06Z

Instead of storing the PID number, take a reference to the task's pid structure. This protects against duplicates due to PID overflows, and using pid_vnr() ensures that the PID returned by snd_ctl_elem_info() is correct as seen from the current namespace. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai

control: remove snd_konctrol_volatile::owner_pid field

2009-11-06T13:32:03Z

We do not need to save the ID of the process that locked a control because that information is already available in the owner's file data. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai

sound: snd_ctl_remove_user_ctl: prevent removal of kernel controls

2009-08-17T10:48:21Z

Ensure that userspace can remove only user controls. Controls created by kernel drivers must not be removed because they might be referenced in calls to snd_ctl_notify(). Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai

sound: snd_ctl_remove_unlocked_id: simplify user control counting

2009-08-17T10:48:15Z

Move the decrementing of the user controls counter from snd_ctl_elem_remove to snd_ctl_remove_unlocked_id; this saves the separate locking of the controls semaphore, and therefore removes a harmless race. Since the purpose of the function is to operate on user controls (the control being unlocked is just a prerequisite), rename it to snd_ctl_remove_user_ctl. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai

sound: snd_ctl_remove_unlocked_id: simplify error paths

2009-08-17T10:48:06Z

Use a common exit path to release the mutex and to return a possible error. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai

sound: snd_ctl_elem_add: fix value count check

2009-08-17T10:48:00Z

Make sure that no user element that has no values can be added. The check for count>1024 is not needed because the count is checked later for the individual control types. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai

ALSA: sound/core: use memdup_user()

2009-04-14T10:39:12Z

Remove open-coded memdup_user(). Signed-off-by: Li Zefan Signed-off-by: Takashi Iwai