github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-10 07:32:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
48d8ad46cf
linux/sound/oss
History
Dan Rosenberg 815fc81407 sound: Prevent buffer overflow in OSS load_mixer_volumes 
commit d81a12bc29 upstream.

The load_mixer_volumes() function, which can be triggered by
unprivileged users via the SOUND_MIXER_SETLEVELS ioctl, is vulnerable to
a buffer overflow.  Because the provided "name" argument isn't
guaranteed to be NULL terminated at the expected 32 bytes, it's possible
to overflow past the end of the last element in the mixer_vols array.
Further exploitation can result in an arbitrary kernel write (via
subsequent calls to load_mixer_volumes()) leading to privilege
escalation, or arbitrary kernel reads via get_mixer_levels().  In
addition, the strcmp() may leak bytes beyond the mixer_vols array.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-01-07 14:43:16 -08:00
..
dmasound sound: Replace old style lock initializer 2009-11-07 09:44:52 +01:00
.gitignore kbuild: ignore all generated files for make allmodconfig (x86_64) 2006-02-26 20:15:58 +01:00
ac97_codec.c ALSA: ASoC: update email address for Liam Girdwood 2008-10-13 02:26:42 +02:00
ad1848_mixer.h fix file specification in comments 2006-10-03 23:01:26 +02:00
ad1848.c sound: OSS: ad1848 - Fix another typo 2009-02-17 08:02:16 +01:00
ad1848.h [PATCH] The scheduled removal of some OSS drivers 2006-10-04 07:55:32 -07:00
aedsp16.c sound: aedsp16: Buffer overflow 2009-07-29 14:37:12 +02:00
au1550_ac97.c Use f_lock to protect f_flags 2009-03-16 08:32:27 -06:00
audio.c Use f_lock to protect f_flags 2009-03-16 08:32:27 -06:00
bin2hex.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
CHANGELOG Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
coproc.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
dev_table.c [PATCH] kill sound/oss/*_syms.c 2006-10-04 07:55:32 -07:00
dev_table.h [PATCH] kill sound/oss/*_syms.c 2006-10-04 07:55:32 -07:00
dmabuf.c sound: OSS: dmabuf: too many loops 2009-02-11 14:12:04 +01:00
hex2hex.c oss: Mark loadhex static in hex2hex.c 2009-11-15 15:01:42 -08:00
kahlua.c sound: Use PCI_VDEVICE 2009-06-25 08:52:49 +02:00
Kconfig sound: oss: sh_dac_audio timer fixes. 2009-05-15 12:07:17 +09:00
Makefile sound: oss: remove driver for SGI HAL2 audio device 2008-08-25 09:57:08 +02:00
midi_ctrl.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
midi_synth.c [PATCH] kill sound/oss/*_syms.c 2006-10-04 07:55:32 -07:00
midi_synth.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
midibuf.c sound: fix OSS MIDI output data loss 2009-08-10 13:15:43 +02:00
mpu401.c sound: mpu401.c: Buffer overflow 2009-07-29 14:41:24 +02:00
mpu401.h IRQ: Maintain regs pointer globally rather than passing to IRQ handlers 2006-10-05 15:10:12 +01:00
msnd_classic.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
msnd_classic.h sound: sound/oss/: remove CVS keywords 2008-05-27 15:56:20 +02:00
msnd_pinnacle.c sound: sound/oss/: remove CVS keywords 2008-05-27 15:56:20 +02:00
msnd_pinnacle.h sound: sound/oss/: remove CVS keywords 2008-05-27 15:56:20 +02:00
msnd.c trivial: unnecessary (void*) cast removal in sound/oss/msnd.c 2009-06-12 18:01:48 +02:00
msnd.h [PATCH] introduce fmode_t, do annotations 2008-10-21 07:47:06 -04:00
opl3_hw.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
opl3.c more scheduled OSS driver removal 2007-07-16 09:05:40 -07:00
os.h [PATCH] mark struct file_operations const 9 2007-02-12 09:48:46 -08:00
pas2_card.c sound: OSS: missing parentheses in pas2_card.c 2009-02-18 11:37:51 +01:00
pas2_midi.c fix file specification in comments 2006-10-03 23:01:26 +02:00
pas2_mixer.c fix file specification in comments 2006-10-03 23:01:26 +02:00
pas2_pcm.c time: move PIT_TICK_RATE to linux/timex.h 2009-06-16 19:47:27 -07:00
pas2.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
pss.c trivial: Fix misspelling of firmware 2009-03-30 15:21:59 +02:00
README.FIRST Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sb_audio.c fix file specification in comments 2006-10-03 23:01:26 +02:00
sb_card.c ALSA: more section mismatches 2007-07-01 12:29:44 -07:00
sb_card.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sb_common.c sound: Use KERN_WARNING instead of KERN_WARN, which does not exist 2009-11-05 09:09:55 +01:00
sb_ess.c sound: Use KERN_WARNING instead of KERN_WARN, which does not exist 2009-11-05 09:09:55 +01:00
sb_ess.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sb_midi.c [PATCH] getting rid of all casts of k[cmz]alloc() calls 2006-12-13 09:05:58 -08:00
sb_mixer.c [PATCH] getting rid of all casts of k[cmz]alloc() calls 2006-12-13 09:05:58 -08:00
sb_mixer.h fix file specification in comments 2006-10-03 23:01:26 +02:00
sb.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sequencer.c sound/oss: fix sparse warning: symbol shadows an earlier one 2009-02-26 09:55:30 +01:00
sh_dac_audio.c sound: oss: sh_dac_audio timer fixes. 2009-05-15 12:07:17 +09:00
sound_calls.h [PATCH] kill sound/oss/*_syms.c 2006-10-04 07:55:32 -07:00
sound_config.h [PATCH] introduce fmode_t, do annotations 2008-10-21 07:47:06 -04:00
sound_firmware.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sound_timer.c [PATCH] kill sound/oss/*_syms.c 2006-10-04 07:55:32 -07:00
soundcard.c sound: Prevent buffer overflow in OSS load_mixer_volumes 2011-01-07 14:43:16 -08:00
soundvers.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sscape.c [PATCH] severing poll.h -> mm.h 2006-12-04 02:00:36 -05:00
swarm_cs4297a.c trivial: Remove commented out usage of dead MODULE_PARM() in swarm_cs4297a 2009-09-21 15:14:54 +02:00
sys_timer.c trivial: remove unnecessary semicolons 2009-09-21 15:14:58 +02:00
trix.c fix file specification in comments 2006-10-03 23:01:26 +02:00
tuning.h [PATCH] The scheduled removal of some OSS drivers 2006-10-04 07:55:32 -07:00
uart401.c IRQ: Maintain regs pointer globally rather than passing to IRQ handlers 2006-10-05 15:10:12 +01:00
uart6850.c IRQ: Maintain regs pointer globally rather than passing to IRQ handlers 2006-10-05 15:10:12 +01:00
ulaw.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
v_midi.c [PATCH] getting rid of all casts of k[cmz]alloc() calls 2006-12-13 09:05:58 -08:00
v_midi.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
vidc_fill.S [ARM] Move include/asm-arm/arch-* to arch/arm/*/include/mach 2008-08-07 09:55:48 +01:00
vidc.c [ARM] Move include/asm-arm/arch-* to arch/arm/*/include/mach 2008-08-07 09:55:48 +01:00
vidc.h IRQ: Maintain regs pointer globally rather than passing to IRQ handlers 2006-10-05 15:10:12 +01:00
vwsnd.c sound: vwsnd: Fix setting of cfgval and ctlval in li_setup_dma() 2009-08-26 12:42:43 +02:00
waveartist.c [ARM] netwinder: clean up GPIO naming 2008-12-13 09:12:07 +00:00
waveartist.h fix file specification in comments 2006-10-03 23:01:26 +02:00

README.FIRST 

The modular sound driver patches were funded by Red Hat Software 
(www.redhat.com). The sound driver here is thus a modified version of 
Hannu's code. Please bear that in mind when considering the appropriate
forums for bug reporting. 

Alan Cox