From e8372839de14e55fccef988d1723e55c7f92dad5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 23 Dec 2019 19:27:34 -0500 Subject: [PATCH] 4.4-stable patches added patches: alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch --- ...e-info-leaks-from-pcm-stream-buffers.patch | 43 +++++++++++++++++++ queue-4.4/series | 1 + 2 files changed, 44 insertions(+) create mode 100644 queue-4.4/alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch diff --git a/queue-4.4/alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch b/queue-4.4/alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch new file mode 100644 index 00000000000..7a5f081ae3a --- /dev/null +++ b/queue-4.4/alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch @@ -0,0 +1,43 @@ +From add9d56d7b3781532208afbff5509d7382fb6efe Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 11 Dec 2019 16:57:42 +0100 +Subject: ALSA: pcm: Avoid possible info leaks from PCM stream buffers + +From: Takashi Iwai + +commit add9d56d7b3781532208afbff5509d7382fb6efe upstream. + +The current PCM code doesn't initialize explicitly the buffers +allocated for PCM streams, hence it might leak some uninitialized +kernel data or previous stream contents by mmapping or reading the +buffer before actually starting the stream. + +Since this is a common problem, this patch simply adds the clearance +of the buffer data at hw_params callback. Although this does only +zero-clear no matter which format is used, which doesn't mean the +silence for some formats, but it should be OK because the intention is +just to clear the previous data on the buffer. + +Reported-by: Lionel Koenig +Cc: +Link: https://lore.kernel.org/r/20191211155742.3213-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_native.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -587,6 +587,10 @@ static int snd_pcm_hw_params(struct snd_ + while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size) + runtime->boundary *= 2; + ++ /* clear the buffer for avoiding possible kernel info leaks */ ++ if (runtime->dma_area) ++ memset(runtime->dma_area, 0, runtime->dma_bytes); ++ + snd_pcm_timer_resolution_change(substream); + snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP); + diff --git a/queue-4.4/series b/queue-4.4/series index 6447f58f7ce..732304dee49 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -71,3 +71,4 @@ btrfs-do-not-call-synchronize_srcu-in-inode_tree_del.patch btrfs-return-error-pointer-from-alloc_test_extent_bu.patch btrfs-abort-transaction-after-failed-inode-updates-i.patch btrfs-fix-removal-logic-of-the-tree-mod-log-that-lea.patch +alsa-pcm-avoid-possible-info-leaks-from-pcm-stream-buffers.patch -- 2.47.3