summaryrefslogtreecommitdiff
path: root/sound/core
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2024-11-20 15:11:02 +0100
committerTakashi Iwai <tiwai@suse.de>2024-11-21 12:34:43 +0100
commitd2913a07d9037fe7aed4b7e680684163eaed6bc4 (patch)
treef304daa5d3e2bd9b1a5137f54c47bdb874b8c9a8 /sound/core
parent56386292a0b44b550432aaff92f28e0d0d0f0209 (diff)
ALSA: pcm: Add sanity NULL check for the default mmap fault handler
A driver might allow the mmap access before initializing its runtime->dma_area properly. Add a proper NULL check before passing to virt_to_page() for avoiding a panic. Reported-by: syzbot+4bf62a7b1d0f4fdb7ae2@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://patch.msgid.link/20241120141104.7060-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core')
-rw-r--r--sound/core/pcm_native.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 47027fa4eb28..381a476a1045 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3813,9 +3813,11 @@ static vm_fault_t snd_pcm_mmap_data_fault(struct vm_fault *vmf)
return VM_FAULT_SIGBUS;
if (substream->ops->page)
page = substream->ops->page(substream, offset);
- else if (!snd_pcm_get_dma_buf(substream))
+ else if (!snd_pcm_get_dma_buf(substream)) {
+ if (WARN_ON_ONCE(!runtime->dma_area))
+ return VM_FAULT_SIGBUS;
page = virt_to_page(runtime->dma_area + offset);
- else
+ } else
page = snd_sgbuf_get_page(snd_pcm_get_dma_buf(substream), offset);
if (!page)
return VM_FAULT_SIGBUS;