Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1320362

Re: sound: heap out-of-bounds write in dummy_systimer_prepare

Show all headers | View raw

On Thu, 28 Jan 2016 07:38:08 +0100,
Takashi Iwai wrote:
> 
> The easiest fix for this is obviously to disable the switch via
> sysfs like below.  Meanwhile we may copy the ops to the runtime
> instance so that it won't affect the running stream.  This can be done
> for 4.6, while disabling sysfs for 4.5 and stable.

FWIW, below is the patch with a proper description.


Takashi

-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] ALSA: dummy: Disable switching timer backend via sysfs

ALSA dummy driver can switch the timer backend between system timer
and hrtimer via its hrtimer module option.  This can be also switched
dynamically via sysfs, but it may lead to a memory corruption when
switching is done while a PCM stream is running; the stream instance
for the newly switched timer method tries to access the memory that
was allocated by another timer method although the sizes differ.

As the simplest fix, this patch just disables the switch via sysfs by
dropping the writable bit.

BugLink: http://lkml.kernel.org/r/CACT4Y+ZGEeEBntHW5WHn2GoeE0G_kRrCmUh6=dWyy-wfzvuJLg@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/drivers/dummy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
index 75b74850c005..bde33308f0d6 100644
--- a/sound/drivers/dummy.c
+++ b/sound/drivers/dummy.c
@@ -87,7 +87,7 @@ MODULE_PARM_DESC(pcm_substreams, "PCM substreams # (1-128) for dummy driver.");
 module_param(fake_buffer, bool, 0444);
 MODULE_PARM_DESC(fake_buffer, "Fake buffer allocations.");
 #ifdef CONFIG_HIGH_RES_TIMERS
-module_param(hrtimer, bool, 0644);
+module_param(hrtimer, bool, 0444);
 MODULE_PARM_DESC(hrtimer, "Use hrtimer as the timer source.");
 #endif
 
-- 
2.7.0

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

sound: heap out-of-bounds write in dummy_systimer_prepare Dmitry Vyukov <dvyukov@google.com> - 2016-01-27 11:00 +0100
  Re: sound: heap out-of-bounds write in dummy_systimer_prepare Takashi Iwai <tiwai@suse.de> - 2016-01-28 07:40 +0100
    Re: sound: heap out-of-bounds write in dummy_systimer_prepare Takashi Iwai <tiwai@suse.de> - 2016-01-28 08:20 +0100

csiph-web