public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org,
	akpm@linux-foundation.org, torvalds@linux-foundation.org,
	stable-review@kernel.org
Cc: Clemens Ladisch <clemens@ladisch.de>, Takashi Iwai <tiwai@suse.de>
Subject: [13/39] sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer
Date: Tue, 05 Jan 2010 12:02:09 -0800	[thread overview]
Message-ID: <20100105200300.684152179@mini.kroah.org> (raw)
In-Reply-To: <20100105195007.GA23952@kroah.com>

2.6.31-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Clemens Ladisch <clemens@ladisch.de>

commit 3e85fd614c7b6bb7f33bb04a0dcb5a3bfca4c0fe upstream.

When allocating the PCM buffer, use vmalloc_user() instead of vmalloc().
Otherwise, it would be possible for applications to play the previous
contents of the kernel memory to the speakers, or to read it directly if
the buffer is exported to userspace.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 sound/mips/sgio2audio.c                |    2 +-
 sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c |    2 +-
 sound/usb/usbaudio.c                   |    2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

--- a/sound/mips/sgio2audio.c
+++ b/sound/mips/sgio2audio.c
@@ -609,7 +609,7 @@ static int snd_sgio2audio_pcm_hw_params(
 	/* alloc virtual 'dma' area */
 	if (runtime->dma_area)
 		vfree(runtime->dma_area);
-	runtime->dma_area = vmalloc(size);
+	runtime->dma_area = vmalloc_user(size);
 	if (runtime->dma_area == NULL)
 		return -ENOMEM;
 	runtime->dma_bytes = size;
--- a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
+++ b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
@@ -51,7 +51,7 @@ static int snd_pcm_alloc_vmalloc_buffer(
 			return 0; /* already enough large */
 		vfree(runtime->dma_area);
 	}
-	runtime->dma_area = vmalloc_32(size);
+	runtime->dma_area = vmalloc_32_user(size);
 	if (! runtime->dma_area)
 		return -ENOMEM;
 	runtime->dma_bytes = size;
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -752,7 +752,7 @@ static int snd_pcm_alloc_vmalloc_buffer(
 			return 0; /* already large enough */
 		vfree(runtime->dma_area);
 	}
-	runtime->dma_area = vmalloc(size);
+	runtime->dma_area = vmalloc_user(size);
 	if (!runtime->dma_area)
 		return -ENOMEM;
 	runtime->dma_bytes = size;



  parent reply	other threads:[~2010-01-05 20:13 UTC|newest]

Thread overview: 63+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-01-05 19:50 [00/10] 2.6.27.43 stable review Greg KH
2010-01-05 19:47 ` [01/10] Libertas: fix buffer overflow in lbs_get_essid() Greg KH
2010-01-05 19:47 ` [02/10] pata_cmd64x: fix overclocking of UDMA0-2 modes Greg KH
2010-01-05 19:47 ` [03/10] sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer Greg KH
2010-01-05 19:47 ` [04/10] i2c/tsl2550: Fix lux value in extended mode Greg KH
2010-01-05 19:47 ` [05/10] ipv6: reassembly: use seperate reassembly queues for conntrack and local delivery Greg KH
2010-01-05 19:47 ` [06/10] S390: dasd: support DIAG access for read-only devices Greg KH
2010-01-05 19:47 ` [07/10] x86/ptrace: make genregs[32]_get/set more robust Greg KH
2010-01-05 19:47 ` [08/10] rt2x00: Disable powersaving for rt61pci and rt2800pci Greg KH
2010-01-05 20:58   ` Gertjan van Wingerde
2010-01-05 21:21     ` Greg KH
2010-01-05 19:48 ` [09/10] generic_permission: MAY_OPEN is not write access Greg KH
2010-01-05 19:48 ` [10/10] Revert: KVM: MMU: do not free active mmu pages in free_mmu_pages() Greg KH
2010-01-05 20:01 ` [01/39] acerhdf: limit modalias matching to supported Greg KH
2010-01-05 20:01 ` [02/39] ASoC: Do not write to invalid registers on the wm9712 Greg KH
2010-01-05 20:01 ` [03/39] cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals Greg KH
2010-01-05 20:02 ` [04/39] clockevents: Prevent clockevent_devices list corruption on cpu hotplug Greg KH
2010-01-05 20:02 ` [05/39] dma: at_hdmac: correct incompatible type for argument 1 of spin_lock_bh Greg KH
2010-01-05 20:02 ` [06/39] drivers/net/usb: Correct code taking the size of a pointer Greg KH
2010-01-05 20:02 ` [07/39] iwmc3200wifi: fix array out-of-boundary access Greg KH
2010-01-06  2:52   ` Zhu Yi
2010-01-06 18:01     ` Greg KH
2010-01-06 18:27       ` [stable] " Greg KH
2010-01-05 20:02 ` [08/39] Libertas: fix buffer overflow in lbs_get_essid() Greg KH
2010-01-05 20:02 ` [09/39] md: Fix unfortunate interaction with evms Greg KH
2010-01-05 20:02 ` [10/39] pata_cmd64x: fix overclocking of UDMA0-2 modes Greg KH
2010-01-05 20:02 ` [11/39] pata_hpt3x2n: fix clock turnaround Greg KH
2010-01-05 20:02 ` [12/39] SCSI: fc class: fix fc_transport_init error handling Greg KH
2010-01-05 20:02 ` Greg KH [this message]
2010-01-05 20:02 ` [14/39] USB: emi62: fix crash when trying to load EMI 6|2 firmware Greg KH
2010-01-05 20:02 ` [15/39] USB: Fix a bug on appledisplay.c regarding signedness Greg KH
2010-01-05 20:02 ` [16/39] USB: musb: gadget_ep0: avoid SetupEnd interrupt Greg KH
2010-01-05 20:02 ` [17/39] USB: option: support hi speed for modem Haier CE100 Greg KH
2010-01-05 20:02 ` [18/39] x86, cpuid: Add "volatile" to asm in native_cpuid() Greg KH
2010-01-05 20:02 ` [19/39] e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failure Greg KH
2010-03-15 21:29   ` [Stable-review] " Stephen Hemminger
2010-03-15 21:32     ` David Miller
2010-03-15 21:36       ` Stephen Hemminger
2010-03-15 21:39         ` David Miller
2010-03-15 22:20           ` David Miller
2010-03-15 22:25             ` Stephen Hemminger
2010-01-05 20:02 ` [20/39] e100: Fix broken cbs accounting due to missing memset Greg KH
2010-01-05 20:02 ` [21/39] hostap: Revert a toxic part of the conversion to net_device_ops Greg KH
2010-01-05 20:02 ` [22/39] hwmon: (fschmd) Fix check on unsigned in watchdog_write() Greg KH
2010-01-05 20:02 ` [23/39] hwmon: (sht15) Off-by-one error in array index + incorrect constants Greg KH
2010-01-05 20:02 ` [24/39] i2c/tsl2550: Fix lux value in extended mode Greg KH
2010-01-05 20:02 ` [25/39] ipv6: reassembly: use seperate reassembly queues for conntrack and local delivery Greg KH
2010-01-05 20:02 ` [26/39] S390: dasd: support DIAG access for read-only devices Greg KH
2010-01-05 20:02 ` [27/39] udf: Try harder when looking for VAT inode Greg KH
2010-01-05 20:02 ` [28/39] V4L/DVB (13596): ov511.c typo: lock => unlock Greg KH
2010-01-05 20:02 ` [29/39] x86/ptrace: make genregs[32]_get/set more robust Greg KH
2010-01-05 20:02 ` [30/39] XFS bug in log recover with quota (bugzilla id 855) Greg KH
2010-01-05 20:02 ` [31/39] generic_permission: MAY_OPEN is not write access Greg KH
2010-01-05 20:02 ` [32/39] rt2x00: Disable powersaving for rt61pci and rt2800pci Greg KH
2010-01-05 20:59   ` Gertjan van Wingerde
2010-01-05 21:21     ` Greg KH
2010-01-05 20:02 ` [33/39] memcg: avoid oom-killing innocent task in case of use_hierarchy Greg KH
2010-01-05 20:02 ` [34/39] Input: atkbd - add force relese key quirk for Samsung R59P/R60P/R61P Greg KH
2010-01-05 20:02 ` [35/39] Add unlocked version of inode_add_bytes() function Greg KH
2010-01-05 20:02 ` [36/39] quota: decouple fs reserved space from quota reservation Greg KH
2010-01-05 20:02 ` [37/39] ext4: Convert to generic reserved quotas space management Greg KH
2010-01-05 20:02 ` [38/39] ext4: Fix potential quota deadlock Greg KH
2010-01-05 20:02 ` [39/39] ext4: fix sleep inside spinlock issue with quota and dealloc (#14739) Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20100105200300.684152179@mini.kroah.org \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=clemens@ladisch.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable-review@kernel.org \
    --cc=stable@kernel.org \
    --cc=tiwai@suse.de \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox