From: Takashi Iwai Date: Wed, 20 Nov 2024 14:11:02 +0000 (+0100) Subject: ALSA: pcm: Add sanity NULL check for the default mmap fault handler X-Git-Tag: v6.13-rc1~27^2~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d2913a07d9037fe7aed4b7e680684163eaed6bc4;p=thirdparty%2Fkernel%2Flinux.git ALSA: pcm: Add sanity NULL check for the default mmap fault handler A driver might allow the mmap access before initializing its runtime->dma_area properly. Add a proper NULL check before passing to virt_to_page() for avoiding a panic. Reported-by: syzbot+4bf62a7b1d0f4fdb7ae2@syzkaller.appspotmail.com Cc: Link: https://patch.msgid.link/20241120141104.7060-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index 47027fa4eb282..381a476a1045d 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -3813,9 +3813,11 @@ static vm_fault_t snd_pcm_mmap_data_fault(struct vm_fault *vmf) return VM_FAULT_SIGBUS; if (substream->ops->page) page = substream->ops->page(substream, offset); - else if (!snd_pcm_get_dma_buf(substream)) + else if (!snd_pcm_get_dma_buf(substream)) { + if (WARN_ON_ONCE(!runtime->dma_area)) + return VM_FAULT_SIGBUS; page = virt_to_page(runtime->dma_area + offset); - else + } else page = snd_sgbuf_get_page(snd_pcm_get_dma_buf(substream), offset); if (!page) return VM_FAULT_SIGBUS;