mirror of
https://github.com/torvalds/linux.git
synced 2026-09-26 10:02:02 +02:00
71c610aeb1
The hwdep mmap callback rejects read-buffer mappings that are initially
writable, but leaves VM_MAYWRITE set on mappings created with PROT_READ.
A process that can open the hwdep node O_RDWR can later use mprotect() to
make the mapping writable.
The read allocation begins with struct usb_stream. Its read_size member is
used by the fault handler to decide which pages belong to the read buffer.
The read VMA intentionally remains expandable because pcm_usb_stream uses
mremap() after reading that size. Changing read_size first can therefore
map and access pages beyond the allocation. The same member is also
consumed by usb_stream_free(), where changing it can make
free_pages_exact() release pages outside the allocation.
Clear VM_MAYWRITE for read-buffer mappings after rejecting an initially
writable VMA. This keeps the separate output-buffer mapping writable while
preventing later permission upgrades.
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| us122l.c | ||
| us122l.h | ||
| us144mkii_capture.c | ||
| us144mkii_controls.c | ||
| us144mkii_midi.c | ||
| us144mkii_pcm.c | ||
| us144mkii_pcm.h | ||
| us144mkii_playback.c | ||
| us144mkii.c | ||
| us144mkii.h | ||
| usb_stream.c | ||
| usb_stream.h | ||
| usbus428ctldefs.h | ||
| usbusx2y.c | ||
| usbusx2y.h | ||
| usbusx2yaudio.c | ||
| usx2y.h | ||
| usX2Yhwdep.c | ||
| usX2Yhwdep.h | ||
| usx2yhwdeppcm.c | ||
| usx2yhwdeppcm.h | ||