linux-kernel - [PATCH] ASoC: rockchip: Allocate enough memory so we don't overflow routes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 29 Sep 2017 15:03:24 -0700
From:   Douglas Anderson <dianders@...omium.org>
To:     broonie@...nel.org, jeffy.chen@...k-chips.com, mka@...omium.org
Cc:     briannorris@...omium.org, Douglas Anderson <dianders@...omium.org>,
        Jaroslav Kysela <perex@...ex.cz>, alsa-devel@...a-project.org,
        Heiko Stuebner <heiko@...ech.de>,
        linux-rockchip@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Takashi Iwai <tiwai@...e.com>,
        Liam Girdwood <lgirdwood@...il.com>,
        linux-arm-kernel@...ts.infradead.org
Subject: [PATCH] ASoC: rockchip: Allocate enough memory so we don't overflow routes

In the recent commit d9f9c167edae ("ASoC: rockchip: Init dapm routes
dynamically") we improperly allocated memory for the card->dapm_routes
causing us to overflow the allocation on every boot.  Oops.

Let's allocate the correct amount of memory.  We'll also add a check
to make sure that we don't overrun memory even if we encounter some
sort of weird device tree.

Fixes: d9f9c167edae ("ASoC: rockchip: Init dapm routes dynamically")
Signed-off-by: Douglas Anderson <dianders@...omium.org>
---

 sound/soc/rockchip/rk3399_gru_sound.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/sound/soc/rockchip/rk3399_gru_sound.c b/sound/soc/rockchip/rk3399_gru_sound.c
index 30eed83e8a13..d64fbbd50544 100644
--- a/sound/soc/rockchip/rk3399_gru_sound.c
+++ b/sound/soc/rockchip/rk3399_gru_sound.c
@@ -494,13 +494,17 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
 	struct snd_soc_dai_link *dai;
 	struct snd_soc_dapm_route *routes;
 	int i, index;
+	int num_routes;
 
 	card->dai_link = devm_kzalloc(dev, sizeof(rockchip_dais),
 				      GFP_KERNEL);
 	if (!card->dai_link)
 		return -ENOMEM;
 
-	routes = devm_kzalloc(dev, sizeof(rockchip_routes),
+	num_routes = 0;
+	for (i = 0; i < ARRAY_SIZE(rockchip_routes); i++)
+		num_routes += rockchip_routes[i].num_routes;
+	routes = devm_kzalloc(dev, num_routes * sizeof(*routes),
 			      GFP_KERNEL);
 	if (!routes)
 		return -ENOMEM;
@@ -538,6 +542,12 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
 		dai->platform_of_node = np_cpu;
 		dai->cpu_of_node = np_cpu;
 
+		if (card->num_dapm_routes + rockchip_routes[index].num_routes >
+		    num_routes) {
+			dev_err(dev, "Too many routes\n");
+			return -EINVAL;
+		}
+
 		memcpy(routes + card->num_dapm_routes,
 		       rockchip_routes[index].routes,
 		       rockchip_routes[index].num_routes * sizeof(*routes));
-- 
2.14.2.822.g60be5d43e6-goog