提交 5a7b44a8 编写于 作者: T Takashi Iwai

ALSA: rawmidi: Initialize allocated buffers

syzbot reported the uninitialized value exposure in certain situations
using virmidi loop.  It's likely a very small race at writing and
reading, and the influence is almost negligible.  But it's safer to
paper over this just by replacing the existing kvmalloc() with
kvzalloc().

Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
上级 16037643
...@@ -129,7 +129,7 @@ static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream) ...@@ -129,7 +129,7 @@ static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream)
runtime->avail = 0; runtime->avail = 0;
else else
runtime->avail = runtime->buffer_size; runtime->avail = runtime->buffer_size;
runtime->buffer = kvmalloc(runtime->buffer_size, GFP_KERNEL); runtime->buffer = kvzalloc(runtime->buffer_size, GFP_KERNEL);
if (!runtime->buffer) { if (!runtime->buffer) {
kfree(runtime); kfree(runtime);
return -ENOMEM; return -ENOMEM;
...@@ -655,7 +655,7 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime, ...@@ -655,7 +655,7 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime,
if (params->avail_min < 1 || params->avail_min > params->buffer_size) if (params->avail_min < 1 || params->avail_min > params->buffer_size)
return -EINVAL; return -EINVAL;
if (params->buffer_size != runtime->buffer_size) { if (params->buffer_size != runtime->buffer_size) {
newbuf = kvmalloc(params->buffer_size, GFP_KERNEL); newbuf = kvzalloc(params->buffer_size, GFP_KERNEL);
if (!newbuf) if (!newbuf)
return -ENOMEM; return -ENOMEM;
spin_lock_irq(&runtime->lock); spin_lock_irq(&runtime->lock);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册