Takashi Iwai f3e14d706e ALSA: pcm: Fix race of buffer access at PCM OSS layer ... commit 93a81ca065 upstream. The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. Reported-by: syzbot+32d4647f551007595173@syzkaller.appspotmail.com Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-06-04 14:40:20 +02:00
..
ac97
sof	ASoC: SOF: dai: move AMD_HS to end of list to restore backwards-compatibility	2022-11-18 11:39:46 +00:00
ac97_codec.h
aci.h
acp63_chip_offset_byte.h	ASoC: amd: fix ACP version typo mistake	2023-05-11 23:02:59 +09:00
ad1816a.h
ad1843.h
adau1373.h
ak4xxx-adda.h
ak4113.h
ak4114.h
ak4117.h
ak4531_codec.h
ak4641.h
alc5623.h
asequencer.h
asound.h
asoundef.h
compress_driver.h
control.h	ALSA: control: add snd_ctl_rename()	2022-10-21 08:17:08 +02:00
core.h	ALSA: core: Add async signal helpers	2022-07-29 12:57:10 +02:00
cs35l33.h
cs35l34.h
cs35l35.h
cs35l36.h
cs35l41.h	ASoC: Updates for v5.20	2022-07-15 16:11:58 +02:00
cs42l42.h	ASoC: cs42l83: Extend CS42L42 support to new part	2022-09-19 18:05:35 +01:00
cs42l52.h
cs42l56.h
cs42l73.h
cs4231-regs.h
cs4271.h
cs8403.h
cs8427.h
da7213.h
da7218.h
da7219-aad.h
da7219.h
da9055.h
designware_i2s.h
dmaengine_pcm.h	ALSA: dmaengine: Synchronize dma channel after drop()	2024-07-25 09:49:14 +02:00
emu10k1_synth.h
emu10k1.h
emu8000_reg.h
emu8000.h
emux_legacy.h
emux_synth.h
es1688.h
graph_card.h	ASoC: audio-graph-card2: add Codec2Codec support	2021-10-15 16:10:41 +01:00
gus.h
hda_chmap.h
hda_codec.h	ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7	2025-06-04 14:40:09 +02:00
hda_component.h
hda_hwdep.h
hda_i915.h
hda_register.h	ALSA: hda: cleanup definitions for multi-link registers	2022-08-23 10:14:24 +02:00
hda_regmap.h
hda_verbs.h	ALSA: cleanup double word in comment	2022-02-11 15:18:56 +01:00
hdaudio_ext.h	ALSA: hda: Use hdac_ext prefix in snd_hdac_stream_free_all() for clarity	2022-09-20 08:08:14 +02:00
hdaudio.h	ALSA: hda: Update register polling macros	2022-10-09 12:34:32 +02:00
hdmi-codec.h	ASoC: hdmi-codec: Update to modern DAI terminology	2022-06-13 14:56:07 +01:00
hwdep.h
i2c.h
info.h
initval.h
intel-dsp-config.h	ASoC: Intel: avs: PCI driver implementation	2022-05-17 11:58:04 +01:00
intel-nhlt.h	ALSA: hda: intel-nhlt: add intel_nhlt_ssp_mclk_mask()	2022-09-20 12:25:03 +01:00
jack.h	ALSA: jack: Access input_dev under mutex	2022-04-12 12:19:05 +02:00
l3.h
madera-pdata.h	ASoC: madera: Replace kernel.h with the necessary inclusions	2022-07-05 13:00:49 +01:00
max9768.h
max98088.h
max98090.h
max98095.h
memalloc.h	ALSA: memalloc: Drop special handling of GFP for CONTINUOUS allocation	2022-08-24 08:00:26 +02:00
minors.h
mixer_oss.h
mpu401.h
omap-hdmi-audio.h
opl3.h
opl4.h
pcm_drm_eld.h
pcm_iec958.h
pcm_oss.h
pcm_params.h
pcm-indirect.h
pcm.h	ALSA: pcm: Fix race of buffer access at PCM OSS layer	2025-06-04 14:40:20 +02:00
pt2258.h
pxa2xx-lib.h	Input: touchscreen: use wrapper for pxa2xx ac97 registers	2022-05-07 22:55:48 +02:00
rawmidi.h	ALSA: rawmidi: Move lock to snd_rawmidi_substream	2022-06-20 09:36:02 +02:00
rt286.h
rt298.h
rt1015.h
rt5514.h
rt5659.h
rt5660.h
rt5663.h
rt5665.h
rt5668.h
rt5682.h
rt5682s.h	ASoC: rt5682s: add delay time to fix pop sound issue	2021-12-08 13:07:58 +00:00
s3c24xx_uda134x.h
sb.h
sb16_csp.h
seq_device.h
seq_kernel.h
seq_midi_emul.h
seq_midi_event.h
seq_oss_legacy.h
seq_oss.h
seq_virmidi.h
sh_dac_audio.h
sh_fsi.h
simple_card_utils.h	ASoC: simple-card: Fix up checks for HW param fixups	2022-10-19 13:39:34 +01:00
simple_card.h
snd_wavefront.h
soc-acpi-intel-match.h	ASoC: Intel: HSW and BDW updates	2022-08-16 17:33:11 +01:00
soc-acpi.h	ASoC: SOF: Pass PCI SSID to machine driver	2023-11-28 17:06:58 +00:00
soc-card.h	ASoC: soc-card: Add storage for PCI SSID	2023-11-28 17:06:58 +00:00
soc-component.h	ASoC: soc-component: Remove non_legacy_dai_naming flag	2022-06-27 13:17:43 +01:00
soc-dai.h	ASoC: soc-dai: Remove set_fmt_new callback	2022-06-06 12:34:21 +01:00
soc-dapm.h	ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared	2023-03-10 09:33:23 +01:00
soc-dpcm.h	ASoC: soc-pcm: test if a BE can be prepared	2023-06-21 16:00:53 +02:00
soc-jack.h
soc-link.h
soc-topology.h	ASoC: topology: Fix stub for snd_soc_tplg_component_remove()	2021-10-25 17:41:26 +01:00
soc.h	ASoC: ops: Consistently treat platform_max as control value	2025-03-28 21:58:57 +01:00
sof.h	ASoC: SOF: Pass PCI SSID to machine driver	2023-11-28 17:06:58 +00:00
soundfont.h
spear_dma.h
spear_spdif.h
sta32x.h
sta350.h
tas2552-plat.h
tas5086.h
tea6330t.h
timer.h
tlv.h
tlv320aic3x.h
tlv320aic32x4.h
tlv320dac33-plat.h
tpa6130a2-plat.h
uda134x.h
uda1380.h
util_mem.h
vx_core.h
wavefront.h
wm0010.h
wm1250-ev1.h
wm2000.h
wm2200.h
wm5100.h
wm8903.h
wm8904.h
wm8955.h
wm8960.h
wm8962.h
wm8993.h
wm8996.h
wm9081.h
wm9090.h
wss.h