diff mbox series

[5.4,31/88] ALSA: pcm: oss: Limit the period size to 16MB

Message ID	20211213092934.298941420@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+bb348e9f9a954d42746f@syzkaller.appspotmail.com, Bixuan Cui <cuibixuan@linux.alibaba.com>, Takashi Iwai <tiwai@suse.de> Subject: [PATCH 5.4 31/88] ALSA: pcm: oss: Limit the period size to 16MB Date: Mon, 13 Dec 2021 10:30:01 +0100 Message-Id: <20211213092934.298941420@linuxfoundation.org> In-Reply-To: <20211213092933.250314515@linuxfoundation.org> References: <20211213092933.250314515@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,03/88] HID: quirks: Add quirk for the Microsoft Surface 3 type-cover [5.4,05/88] HID: add hid_is_usb() function to make it simpler for USB detection [5.4,09/88] HID: bigbenff: prevent null pointer dereference [5.4,10/88] HID: wacom: fix problems when device is not a valid USB device [5.4,14/88] can: sja1000: fix use after free in ems_pcmcia_add_card() [5.4,16/88] selftests: netfilter: add a vrf+conntrack testcase [5.4,20/88] bonding: make tx_rebalance_counter an atomic [5.4,22/88] seg6: fix the iif in the IPv6 socket control block [5.4,23/88] udp: using datalen to cap max gso segments [5.4,26/88] IB/hfi1: Correct guard on eager buffer deallocation [5.4,28/88] ALSA: ctl: Fix copy of updated id with element read/write [5.4,31/88] ALSA: pcm: oss: Limit the period size to 16MB [5.4,32/88] ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() [5.4,34/88] btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling [5.4,35/88] nfsd: Fix nsfd startup race (again) [5.4,37/88] clk: qcom: regmap-mux: fix parent clock lookup [5.4,38/88] drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. [5.4,41/88] x86/sme: Explicitly map new EFI memmap table as encrypted [5.4,42/88] libata: add horkage for ASMedia 1092 [5.4,44/88] binder: use wake_up_pollfree() [5.4,46/88] aio: keep poll requests on waitqueue until completed [5.4,47/88] aio: fix use-after-free due to missing POLLFREE handling [5.4,48/88] tracefs: Set all files to the same group ownership as the mount option [5.4,49/88] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) [5.4,50/88] qede: validate non LSO skb length [5.4,51/88] ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer [5.4,52/88] i40e: Fix failed opcode appearing if handling messages from VF [5.4,53/88] i40e: Fix pre-set max number of queues for VF [5.4,54/88] mtd: rawnand: fsmc: Take instruction delay into account [5.4,55/88] mtd: rawnand: fsmc: Fix timing computation [5.4,56/88] dt-bindings: net: Reintroduce PHY no lane swap binding [5.4,57/88] tools build: Remove needless libpython-version feature check that breaks test-all fas... [5.4,59/88] net: altera: set a couple error code in probe() [5.4,62/88] net/qla3xxx: fix an error code in ql_adapter_up() [5.4,63/88] selftests/fib_tests: Rework fib_rp_filter_test() [5.4,65/88] USB: gadget: zero allocate endpoint 0 buffers [5.4,66/88] usb: core: config: fix validation of wMaxPacketValue entries [5.4,67/88] xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending [5.4,68/88] usb: core: config: using bit mask instead of individual bits [5.4,70/88] iio: trigger: Fix reference counting [5.4,73/88] iio: mma8452: Fix trigger reference couting [5.4,75/88] iio: kxsd9: Dont return error code in trigger handler [5.4,76/88] iio: itg3200: Call iio_trigger_notify_done() on error [5.4,77/88] iio: dln2-adc: Fix lockdep complaint [5.4,78/88] iio: dln2: Check return value of devm_iio_trigger_register() [5.4,79/88] iio: at91-sama5d2: Fix incorrect sign extension [5.4,80/88] iio: adc: axp20x_adc: fix charging current reporting on AXP22x [5.4,83/88] irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() [5.4,86/88] irqchip: nvic: Fix offset for Interrupt Priority Offsets

Commit Message

Greg Kroah-Hartman Dec. 13, 2021, 9:30 a.m. UTC

From: Takashi Iwai <tiwai@suse.de>

commit 8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2 upstream.

Set the practical limit to the period size (the fragment shift in OSS)
instead of a full 31bit; a too large value could lead to the exhaust
of memory as we allocate temporary buffers of the period size, too.

As of this patch, we set to 16MB limit, which should cover all use
cases.

Reported-by: syzbot+bb348e9f9a954d42746f@syzkaller.appspotmail.com
Reported-by: Bixuan Cui <cuibixuan@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1638270978-42412-1-git-send-email-cuibixuan@linux.alibaba.com
Link: https://lore.kernel.org/r/20211201073606.11660-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/oss/pcm_oss.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1952,7 +1952,7 @@  static int snd_pcm_oss_set_fragment1(str
 	if (runtime->oss.subdivision || runtime->oss.fragshift)
 		return -EINVAL;
 	fragshift = val & 0xffff;
-	if (fragshift >= 31)
+	if (fragshift >= 25) /* should be large enough */
 		return -EINVAL;
 	runtime->oss.fragshift = fragshift;
 	runtime->oss.maxfrags = (val >> 16) & 0xffff;