Takashi Iwai 74d90875f3 ALSA: pcm: Fix race of buffer access at PCM OSS layer ... commit 93a81ca065 upstream. The PCM OSS layer tries to clear the buffer with the silence data at initialization (or reconfiguration) of a stream with the explicit call of snd_pcm_format_set_silence() with runtime->dma_area. But this may lead to a UAF because the accessed runtime->dma_area might be freed concurrently, as it's performed outside the PCM ops. For avoiding it, move the code into the PCM core and perform it inside the buffer access lock, so that it won't be changed during the operation. Reported-by: syzbot+32d4647f551007595173@syzkaller.appspotmail.com Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-06-04 14:42:19 +02:00
..
ac97	ALSA: ac97: make remove callback of ac97 driver void returned	2023-01-25 09:34:20 +01:00
sof	ASoC: SOF: Deprecate invalid enums in IPC3	2023-07-31 23:24:03 +01:00
ac97_codec.h	ALSA: ac97: Define dummy functions for snd_ac97_suspend() and resume()	2023-03-30 17:04:56 +02:00
aci.h
acp63_chip_offset_byte.h	ASoC: amd: update ps platform acp header file	2023-02-03 12:04:02 +00:00
ad1816a.h
ad1843.h
adau1373.h
ak4xxx-adda.h
ak4113.h
ak4114.h
ak4117.h
ak4531_codec.h
ak4641.h
alc5623.h
asequencer.h	ALSA: seq: Add UMP support	2023-05-23 12:11:21 +02:00
asound.h
asoundef.h
compress_driver.h	ALSA: compress: Don't embed device	2023-08-17 09:24:15 +02:00
control.h	ALSA: vmaster: Add snd_ctl_add_followers() helper	2023-07-21 09:37:47 +02:00
core.h	ALSA: core: Drop snd_device_initialize()	2023-08-17 09:24:33 +02:00
cs35l33.h
cs35l34.h
cs35l35.h
cs35l36.h
cs35l41.h	ASoC: cs35l41: Fix broken shared boost activation	2023-11-20 11:59:17 +01:00
cs35l56.h	ASoC: cs35l56: Load tunings for the correct speaker models	2024-10-17 15:24:07 +02:00
cs42l42.h	ASoC: cs42l42: Add SOFT_RESET_REBOOT register	2023-01-31 12:10:46 +00:00
cs42l43.h	ASoC: cs42l43: Add support for the cs42l43	2023-08-18 23:41:54 +01:00
cs42l52.h
cs42l56.h
cs42l73.h
cs4231-regs.h
cs4271.h
cs8403.h
cs8427.h
da7213.h
da7218.h
da7219-aad.h	ASoC: da7219: Add Jack insertion detection polarity	2023-05-23 18:49:36 +01:00
da7219.h
da9055.h
designware_i2s.h	ASoC: dwc: i2s: Add StarFive JH7110 SoC support	2023-08-23 13:56:40 +01:00
dmaengine_pcm.h	ALSA: dmaengine: Synchronize dma channel after drop()	2024-07-25 09:50:49 +02:00
emu10k1_synth.h
emu10k1.h	ALSA: emu10k1: move the whole GPIO event handling to the workqueue	2024-05-17 12:02:03 +02:00
emu8000_reg.h
emu8000.h	ALSA: sb: Allocate resources with device-managed APIs	2021-07-19 16:17:14 +02:00
emux_legacy.h
emux_synth.h	ALSA: emu10k1: fix synthesizer pitch for E-MU cards at 44.1 kHz	2023-06-13 07:42:08 +02:00
es1688.h	ALSA: es1688: Avoid devres management for es1688 object creation	2021-08-05 08:24:17 +02:00
graph_card.h	ASoC: audio-graph-card2: add Codec2Codec support	2021-10-15 16:10:41 +01:00
gus.h
hda_chmap.h
hda_codec.h	ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7	2025-06-04 14:42:03 +02:00
hda_component.h
hda_hwdep.h
hda_i915.h
hda_register.h	ALSA: hda: add HDaudio Extended link definitions	2023-04-06 16:45:34 +01:00
hda_regmap.h
hda_verbs.h	ALSA: cleanup double word in comment	2022-02-11 15:18:56 +01:00
hda-mlink.h	ASoC: SOF: Intel: hda-mlink: add helper to get sublink LSDIID register	2023-08-07 23:09:46 +01:00
hdaudio_ext.h	ALSA: hda: Allow for compress stream to hdac_ext_stream assignment	2022-12-05 14:05:18 +00:00
hdaudio.h	ALSA: hda: Add controller matching macros	2023-07-18 14:22:17 +02:00
hdmi-codec.h	ASoC: hdmi-codec: Allow playback and capture to be disabled	2022-12-02 14:07:12 +00:00
hwdep.h	ALSA: hwdep: Don't embed device	2023-08-17 09:24:01 +02:00
i2c.h
info.h	ALSA: info: Remove unused function declarations	2023-08-08 14:45:45 +02:00
initval.h
intel-dsp-config.h	ASoC: Intel: avs: PCI driver implementation	2022-05-17 11:58:04 +01:00
intel-nhlt.h	ALSA: hda: intel-nhlt: add intel_nhlt_ssp_mclk_mask()	2022-09-20 12:25:03 +01:00
jack.h	ALSA: jack: Access input_dev under mutex	2022-04-12 12:19:05 +02:00
madera-pdata.h	ASoC: madera: Replace kernel.h with the necessary inclusions	2022-07-05 13:00:49 +01:00
max9768.h
max98088.h
max98090.h
max98095.h
memalloc.h	ALSA: memalloc: Drop special handling of GFP for CONTINUOUS allocation	2022-08-24 08:00:26 +02:00
minors.h
mixer_oss.h
mpu401.h
omap-hdmi-audio.h
opl3.h
opl4.h
pcm_drm_eld.h
pcm_iec958.h	ALSA: iec958: Split status creation and fill	2021-06-08 17:05:41 +02:00
pcm_oss.h
pcm_params.h
pcm-indirect.h	ALSA: pcm: Improved XRUN handling for indirect PCM helpers	2023-03-24 14:52:58 +01:00
pcm.h	ALSA: pcm: Fix race of buffer access at PCM OSS layer	2025-06-04 14:42:19 +02:00
pt2258.h
pxa2xx-lib.h	Input: touchscreen: use wrapper for pxa2xx ac97 registers	2022-05-07 22:55:48 +02:00
rawmidi.h	ALSA: rawmidi: Don't embed device	2023-08-17 09:24:08 +02:00
rt286.h
rt298.h
rt1015.h
rt5514.h
rt5659.h
rt5660.h
rt5663.h
rt5665.h	ASoC: rt5665: Convert to use GPIO descriptors	2023-08-17 15:10:11 +01:00
rt5668.h	ASoC: rt5668: Convert to use GPIO descriptors	2023-08-17 15:10:12 +01:00
rt5682.h	ASoC: rt5682: Convert to use GPIO descriptors	2023-08-17 15:10:13 +01:00
rt5682s.h	ASoC: rt5682s: Convert to use GPIO descriptors	2023-08-17 15:10:13 +01:00
sb.h
sb16_csp.h
sdw.h	sound: sdw: Add hw_params to SoundWire config helper function	2022-11-28 13:04:24 +00:00
seq_device.h	ALSA: seq: Bind UMP device	2023-05-23 12:11:33 +02:00
seq_kernel.h	ALSA: seq: Add UMP support	2023-05-23 12:11:21 +02:00
seq_midi_emul.h
seq_midi_event.h
seq_oss_legacy.h
seq_oss.h
seq_virmidi.h
sh_dac_audio.h
sh_fsi.h
simple_card_utils.h	ASoC: simple-card-utils.c: enable multi Component support	2023-07-17 06:15:47 +01:00
simple_card.h
snd_wavefront.h
soc-acpi-intel-match.h	ASoC: Intel: common: add ACPI matching tables for Arrow Lake	2024-06-12 11:11:59 +02:00
soc-acpi.h	ASoC: SOF: Pass PCI SSID to machine driver	2023-11-28 17:19:42 +00:00
soc-card.h	ASoC: soc-card: Fix missing locking in snd_soc_card_get_kcontrol()	2024-03-06 14:48:38 +00:00
soc-component.h	ASoC: Name iov_iter argument as iterator instead of buffer	2023-09-01 15:38:49 +02:00
soc-dai.h	ASoC: soc-dai: add flag to mute and unmute stream during trigger	2023-11-28 17:20:04 +00:00
soc-dapm.h	ASoC: soc-dapm: Add helper for comparing widget name	2023-10-09 13:03:28 +01:00
soc-dpcm.h	ASoC: soc-pcm: test if a BE can be prepared	2023-05-19 02:31:14 +09:00
soc-jack.h
soc-link.h
soc-topology.h	ASoC: topology: Use unload() op directly	2023-01-30 16:56:41 +00:00
soc.h	ASoC: ops: Consistently treat platform_max as control value	2025-03-22 12:50:48 -07:00
sof.h	ASoC: SOF: Introduce generic names for IPC types	2024-05-17 12:01:59 +02:00
soundfont.h
spear_dma.h
spear_spdif.h
sta32x.h
sta350.h
tas2552-plat.h
tas2781-dsp.h	ASoc: tas2781: Enable RCA-based playback without DSP firmware download	2024-08-03 08:53:57 +02:00
tas2781-tlv.h	ASoC: tas2781: mark dvc_tlv with __maybe_unused	2024-10-17 15:24:11 +02:00
tas2781.h	ASoC: tas2781-i2c: Drop weird GPIO code	2024-10-04 16:29:05 +02:00
tas5086.h
tea6330t.h
timer.h
tlv.h
tlv320aic32x4.h
tlv320dac33-plat.h
tpa6130a2-plat.h
uda1380.h
ump_convert.h	ALSA: ump: Fix buffer overflow at UMP SysEx message conversion	2025-05-09 09:44:00 +02:00
ump_msg.h	ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info	2025-05-22 14:12:16 +02:00
ump.h	ALSA: usb-audio: Update UMP group attributes for GTB blocks, too	2024-12-14 20:00:23 +01:00
util_mem.h
vx_core.h
wavefront.h
wm0010.h
wm1250-ev1.h
wm2000.h
wm2200.h
wm5100.h
wm8903.h
wm8904.h
wm8955.h
wm8960.h
wm8962.h
wm8993.h
wm8996.h
wm9081.h
wm9090.h
wss.h