From mboxrd@z Thu Jan 1 00:00:00 1970 From: Juergen Kreileder Subject: [patch] Fix snd-usb-audio in 32-bit compat environemt Date: Sat, 18 Feb 2006 19:50:37 +0100 Message-ID: <878xs85wn6.fsf@blackdown.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Sender: alsa-devel-admin@lists.sourceforge.net Errors-To: alsa-devel-admin@lists.sourceforge.net List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , List-Archive: To: alsa-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org List-Id: alsa-devel@alsa-project.org Hi, I'm getting oopses with snd-usb-audio in 32-bit compat environments: control_compat.c:get_ctl_type() doesn't initialize 'info', so 'itemlist[uinfo->value.enumerated.item]' in usbmixer.c:mixer_ctl_selector_info() might access random memory (The 'if ((int)uinfo->value.enumerated.item >= cval->max)' doesn't fix all problems because of the unsigned -> signed conversion.) Here's a fix: Signed-off-by: Juergen Kreileder --- linux-mm-vanilla/sound/core/control_compat.c 2006-02-18 17:00:17.000000000 +0100 +++ linux-mm/sound/core/control_compat.c 2006-02-18 19:17:45.000000000 +0100 @@ -167,7 +167,7 @@ static int get_ctl_type(struct snd_card int *countp) { struct snd_kcontrol *kctl; - struct snd_ctl_elem_info info; + struct snd_ctl_elem_info *info; int err; down_read(&card->controls_rwsem); @@ -176,13 +176,19 @@ static int get_ctl_type(struct snd_card up_read(&card->controls_rwsem); return -ENXIO; } - info.id = *id; - err = kctl->info(kctl, &info); + info = kzalloc(sizeof(*info), GFP_KERNEL); + if (info == NULL) { + up_read(&card->controls_rwsem); + return -ENOMEM; + } + info->id = *id; + err = kctl->info(kctl, info); up_read(&card->controls_rwsem); if (err >= 0) { - err = info.type; - *countp = info.count; + err = info->type; + *countp = info->count; } + kfree(info); return err; } = Tested on ppc64. Juergen -- Juergen Kreileder, Blackdown Java-Linux Team http://blog.blackdown.de/ ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932117AbWBRSum (ORCPT ); Sat, 18 Feb 2006 13:50:42 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S932118AbWBRSum (ORCPT ); Sat, 18 Feb 2006 13:50:42 -0500 Received: from smtp.blackdown.de ([213.239.206.42]:15497 "EHLO smtp.blackdown.de") by vger.kernel.org with ESMTP id S932117AbWBRSul (ORCPT ); Sat, 18 Feb 2006 13:50:41 -0500 From: Juergen Kreileder To: alsa-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: [patch] Fix snd-usb-audio in 32-bit compat environemt X-PGP-Key: http://blackhole.pca.dfn.de:11371/pks/lookup?op=get&search=0x730A28A5 X-PGP-Fingerprint: 7C19 D069 9ED5 DC2E 1B10 9859 C027 8D5B 730A 28A5 Mail-Followup-To: alsa-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Date: Sat, 18 Feb 2006 19:50:37 +0100 Message-ID: <878xs85wn6.fsf@blackdown.de> Organization: Blackdown Java-Linux Team User-Agent: Gnus/5.110004 (No Gnus v0.4) Emacs/21.4 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Hi, I'm getting oopses with snd-usb-audio in 32-bit compat environments: control_compat.c:get_ctl_type() doesn't initialize 'info', so 'itemlist[uinfo->value.enumerated.item]' in usbmixer.c:mixer_ctl_selector_info() might access random memory (The 'if ((int)uinfo->value.enumerated.item >= cval->max)' doesn't fix all problems because of the unsigned -> signed conversion.) Here's a fix: Signed-off-by: Juergen Kreileder --- linux-mm-vanilla/sound/core/control_compat.c 2006-02-18 17:00:17.000000000 +0100 +++ linux-mm/sound/core/control_compat.c 2006-02-18 19:17:45.000000000 +0100 @@ -167,7 +167,7 @@ static int get_ctl_type(struct snd_card int *countp) { struct snd_kcontrol *kctl; - struct snd_ctl_elem_info info; + struct snd_ctl_elem_info *info; int err; down_read(&card->controls_rwsem); @@ -176,13 +176,19 @@ static int get_ctl_type(struct snd_card up_read(&card->controls_rwsem); return -ENXIO; } - info.id = *id; - err = kctl->info(kctl, &info); + info = kzalloc(sizeof(*info), GFP_KERNEL); + if (info == NULL) { + up_read(&card->controls_rwsem); + return -ENOMEM; + } + info->id = *id; + err = kctl->info(kctl, info); up_read(&card->controls_rwsem); if (err >= 0) { - err = info.type; - *countp = info.count; + err = info->type; + *countp = info->count; } + kfree(info); return err; } = Tested on ppc64. Juergen -- Juergen Kreileder, Blackdown Java-Linux Team http://blog.blackdown.de/