diff options
| author | Takashi Iwai <tiwai@suse.de> | 2024-11-20 15:11:02 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-12-09 10:32:51 +0100 |
| commit | bc200027ee92fba84f1826494735ed675f3aa911 (patch) | |
| tree | cdf96913be499c34485f7033bd61d4f552c761ea /sound/core | |
| parent | 0357abf951c419bce9ea5c08ce16231bd927e82e (diff) | |
| download | linux-bc200027ee92fba84f1826494735ed675f3aa911.tar.gz linux-bc200027ee92fba84f1826494735ed675f3aa911.tar.bz2 linux-bc200027ee92fba84f1826494735ed675f3aa911.zip | |
ALSA: pcm: Add sanity NULL check for the default mmap fault handler
commit d2913a07d9037fe7aed4b7e680684163eaed6bc4 upstream.
A driver might allow the mmap access before initializing its
runtime->dma_area properly. Add a proper NULL check before passing to
virt_to_page() for avoiding a panic.
Reported-by: syzbot+4bf62a7b1d0f4fdb7ae2@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20241120141104.7060-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'sound/core')
| -rw-r--r-- | sound/core/pcm_native.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index cc21c483c4a5..e40de64ec85c 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -3794,9 +3794,11 @@ static vm_fault_t snd_pcm_mmap_data_fault(struct vm_fault *vmf) return VM_FAULT_SIGBUS; if (substream->ops->page) page = substream->ops->page(substream, offset); - else if (!snd_pcm_get_dma_buf(substream)) + else if (!snd_pcm_get_dma_buf(substream)) { + if (WARN_ON_ONCE(!runtime->dma_area)) + return VM_FAULT_SIGBUS; page = virt_to_page(runtime->dma_area + offset); - else + } else page = snd_sgbuf_get_page(snd_pcm_get_dma_buf(substream), offset); if (!page) return VM_FAULT_SIGBUS; |