diff mbox series

[4.9,14/42] ALSA: pcm: oss: Limit the period size to 16MB

Message ID	20211213092927.043931503@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+bb348e9f9a954d42746f@syzkaller.appspotmail.com, Bixuan Cui <cuibixuan@linux.alibaba.com>, Takashi Iwai <tiwai@suse.de> Subject: [PATCH 4.9 14/42] ALSA: pcm: oss: Limit the period size to 16MB Date: Mon, 13 Dec 2021 10:29:56 +0100 Message-Id: <20211213092927.043931503@linuxfoundation.org> In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,02/42] HID: add hid_is_usb() function to make it simpler for USB detection [4.9,03/42] HID: add USB_HID dependancy to hid-prodikeys [4.9,06/42] HID: wacom: fix problems when device is not a valid USB device [4.9,08/42] can: sja1000: fix use after free in ems_pcmcia_add_card() [4.9,11/42] mm: bdi: initialize bdi_min_ratio when bdi is unregistered [4.9,12/42] ALSA: ctl: Fix copy of updated id with element read/write [4.9,13/42] ALSA: pcm: oss: Fix negative period/buffer sizes [4.9,14/42] ALSA: pcm: oss: Limit the period size to 16MB [4.9,16/42] tracefs: Have new files inherit the ownership of their parent [4.9,19/42] wait: add wake_up_pollfree() [4.9,20/42] binder: use wake_up_pollfree() [4.9,22/42] tracefs: Set all files to the same group ownership as the mount option [4.9,23/42] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) [4.9,25/42] net: altera: set a couple error code in probe() [4.9,28/42] net/qla3xxx: fix an error code in ql_adapter_up() [4.9,29/42] USB: gadget: detect too-big endpoint 0 requests [4.9,32/42] usb: core: config: using bit mask instead of individual bits [4.9,34/42] iio: mma8452: Fix trigger reference couting [4.9,35/42] iio: ltr501: Dont return error code in trigger handler [4.9,38/42] iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove [4.9,41/42] irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL [4.9,42/42] irqchip: nvic: Fix offset for Interrupt Priority Offsets

Commit Message

Greg Kroah-Hartman Dec. 13, 2021, 9:29 a.m. UTC

From: Takashi Iwai <tiwai@suse.de>

commit 8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2 upstream.

Set the practical limit to the period size (the fragment shift in OSS)
instead of a full 31bit; a too large value could lead to the exhaust
of memory as we allocate temporary buffers of the period size, too.

As of this patch, we set to 16MB limit, which should cover all use
cases.

Reported-by: syzbot+bb348e9f9a954d42746f@syzkaller.appspotmail.com
Reported-by: Bixuan Cui <cuibixuan@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1638270978-42412-1-git-send-email-cuibixuan@linux.alibaba.com
Link: https://lore.kernel.org/r/20211201073606.11660-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/oss/pcm_oss.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2019,7 +2019,7 @@  static int snd_pcm_oss_set_fragment1(str
 	if (runtime->oss.subdivision || runtime->oss.fragshift)
 		return -EINVAL;
 	fragshift = val & 0xffff;
-	if (fragshift >= 31)
+	if (fragshift >= 25) /* should be large enough */
 		return -EINVAL;
 	runtime->oss.fragshift = fragshift;
 	runtime->oss.maxfrags = (val >> 16) & 0xffff;