linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-06 13:37:36 +02:00

Linux kernel source tree

Go to file

Tasos Sahanidis 39a90720f3 ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() commit `d29f59051d` upstream. The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 07/22/2010 Call Trace: <TASK> dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Signed-off-by: Tasos Sahanidis <tasos@tasossah.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/3707dcab-320a-62ff-63c0-73fc201ef756@tasossah.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-09-15 11:32:03 +02:00
arch	arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level	2022-09-15 11:32:03 +02:00
block	blk-mq: fix io hung due to missing commit_rqs	2022-08-31 17:15:24 +02:00
certs	certs/blacklist_hashes.c: fix const confusion in certs blacklist	2022-06-22 14:13:17 +02:00
crypto	KEYS: asymmetric: enforce SM2 signature use pkey algo	2022-08-21 15:16:22 +02:00
Documentation	Documentation/ABI: Mention retbleed vulnerability info file for sysfs	2022-08-31 17:15:23 +02:00
drivers	drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly	2022-09-15 11:32:03 +02:00
fs	NFSD: Fix verifier returned in stable WRITEs	2022-09-15 11:32:02 +02:00
include	fs: only do a memory barrier for the first set_buffer_uptodate()	2022-09-15 11:32:02 +02:00
init	Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug	2022-06-09 10:21:25 +02:00
ipc	ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()	2022-06-09 10:21:17 +02:00
kernel	bpf, cgroup: Fix kernel BUG in purge_effective_progs	2022-09-08 11:11:36 +02:00
lib	lib/vdso: Mark do_hres_timens() and do_coarse_timens() __always_inline()	2022-09-05 10:28:58 +02:00
LICENSES	LICENSES/deprecated: add Zlib license text	2020-09-16 14:33:49 +02:00
mm	Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"	2022-09-15 11:32:02 +02:00
net	net/core/skbuff: Check the return value of skb_copy_bits()	2022-09-15 11:32:03 +02:00
samples	x86: Prepare inline-asm for straight-line-speculation	2022-07-25 11:26:29 +02:00
scripts	kbuild: Fix include path in scripts/Makefile.modpost	2022-09-05 10:28:55 +02:00
security	apparmor: Fix memleak in aa_simple_write_to_buffer()	2022-08-25 11:37:53 +02:00
sound	ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()	2022-09-15 11:32:03 +02:00
tools	perf python: Fix build when PYTHON_CONFIG is user supplied	2022-08-31 17:15:24 +02:00
usr	usr/include/Makefile: add linux/nfc.h to the compile-test coverage	2022-02-01 17:25:48 +01:00
virt	KVM: Add infrastructure and macro to mark VM as bugged	2022-08-21 15:16:24 +02:00
.clang-format	RDMA 5.10 pull request	2020-10-17 11:18:18 -07:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	kbuild: generate Module.symvers only when vmlinux exists	2021-05-19 10:12:59 +02:00
.mailmap	mailmap: add two more addresses of Uwe Kleine-König	2020-12-06 10:19:07 -08:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Jason Cooper to CREDITS	2020-11-30 10:20:34 +01:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	MAINTAINERS: add Amir as xfs maintainer for 5.10.y	2022-07-02 16:39:22 +02:00
Makefile	Linux 5.10.142	2022-09-08 11:11:41 +02:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.