patches for 3.18

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-3.18/alsa-isa-wavefront-prevent-some-out-of-bound-writes.patch b/queue-3.18/alsa-isa-wavefront-prevent-some-out-of-bound-writes.patch
new file mode 100644 (file)
index 0000000..2200b42
--- /dev/null
+++ b/queue-3.18/alsa-isa-wavefront-prevent-some-out-of-bound-writes.patch
@@ -0,0 +1,54 @@
+From 06c9e4d509d049e4b4bff7c82d5bb0191a2f7b60 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 May 2016 09:27:37 +0300
+Subject: ALSA: isa/wavefront: prevent some out of bound writes
+
+[ Upstream commit 84d7a4470dbac0dd9389050100b54a1625d04264 ]
+
+"header->number" can be up to USHRT_MAX and it comes from the ioctl so
+it needs to be capped.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/isa/wavefront/wavefront_synth.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
+index e5db001363ee..b5fde9fd1ae9 100644
+--- a/sound/isa/wavefront/wavefront_synth.c
++++ b/sound/isa/wavefront/wavefront_synth.c
+@@ -785,6 +785,9 @@ wavefront_send_patch (snd_wavefront_t *dev, wavefront_patch_info *header)
+       DPRINT (WF_DEBUG_LOAD_PATCH, "downloading patch %d\n",
+                                     header->number);
+ 
++      if (header->number >= ARRAY_SIZE(dev->patch_status))
++              return -EINVAL;
++
+       dev->patch_status[header->number] |= WF_SLOT_FILLED;
+ 
+       bptr = buf;
+@@ -809,6 +812,9 @@ wavefront_send_program (snd_wavefront_t *dev, wavefront_patch_info *header)
+       DPRINT (WF_DEBUG_LOAD_PATCH, "downloading program %d\n",
+               header->number);
+ 
++      if (header->number >= ARRAY_SIZE(dev->prog_status))
++              return -EINVAL;
++
+       dev->prog_status[header->number] = WF_SLOT_USED;
+ 
+       /* XXX need to zero existing SLOT_USED bit for program_status[i]
+@@ -898,6 +904,9 @@ wavefront_send_sample (snd_wavefront_t *dev,
+               header->number = x;
+       }
+ 
++      if (header->number >= WF_MAX_SAMPLE)
++              return -EINVAL;
++
+       if (header->size) {
+ 
+               /* XXX it's a debatable point whether or not RDONLY semantics
+-- 
+2.19.1
+

diff --git a/queue-3.18/series b/queue-3.18/series
index 522981d85dc8e3e34292519d911472d623a6185f..c21f52de429a156658a54dbc4b057e85418d6c98 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -23,3 +23,4 @@ libata-whitelist-all-samsung-mz7km-solid-state-disks.patch
 arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch
 cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch
 i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch
+alsa-isa-wavefront-prevent-some-out-of-bound-writes.patch