diff options
| author | Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> | 2021-11-19 17:08:49 -0600 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2021-11-24 12:57:17 +0000 |
| commit | 0e888a74e52db369e19aec908131cf171079b306 (patch) | |
| tree | cb975d7eefac7d03f4af12dcb44e9c7a6166d115 /sound/core | |
| parent | 65c16dd2942f4476a3f96a2625b1475c6137c09a (diff) | |
| download | linux-0e888a74e52db369e19aec908131cf171079b306.tar.gz | |
ALSA: pcm: unconditionally check if appl_ptr is in 0..boundary range
In some cases, the appl_ptr passed by userspace is not checked before being used. This patch adds an unconditional check and returns an error code should the appl_ptr exceed the ALSA 'boundary'. Suggested-by: Takashi Iwai <tiwai@suse.de> Reviewed-by: Takashi Iwai <tiwai@suse.de> Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com> Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com> Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Link: https://lore.kernel.org/r/20211119230852.206310-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/core')
| -rw-r--r-- | sound/core/pcm_lib.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c index 4f4b4739f987..fdd992772b20 100644 --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -2133,6 +2133,9 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream, if (old_appl_ptr == appl_ptr) return 0; + if (appl_ptr >= runtime->boundary) + return -EINVAL; + runtime->control->appl_ptr = appl_ptr; if (substream->ops->ack) { ret = substream->ops->ack(substream); |