瀏覽代碼

sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer

When allocating the PCM buffer, use vmalloc_user() instead of vmalloc().
Otherwise, it would be possible for applications to play the previous
contents of the kernel memory to the speakers, or to read it directly if
the buffer is exported to userspace.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: <stable@kernel.org>

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Clemens Ladisch 15 年之前
父節點
當前提交
3e85fd614c
共有 3 個文件被更改,包括 3 次插入3 次删除
  1. 1 1
      sound/mips/sgio2audio.c
  2. 1 1
      sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
  3. 1 1
      sound/usb/usbaudio.c

+ 1 - 1
sound/mips/sgio2audio.c

@@ -609,7 +609,7 @@ static int snd_sgio2audio_pcm_hw_params(struct snd_pcm_substream *substream,
 	/* alloc virtual 'dma' area */
 	/* alloc virtual 'dma' area */
 	if (runtime->dma_area)
 	if (runtime->dma_area)
 		vfree(runtime->dma_area);
 		vfree(runtime->dma_area);
-	runtime->dma_area = vmalloc(size);
+	runtime->dma_area = vmalloc_user(size);
 	if (runtime->dma_area == NULL)
 	if (runtime->dma_area == NULL)
 		return -ENOMEM;
 		return -ENOMEM;
 	runtime->dma_bytes = size;
 	runtime->dma_bytes = size;

+ 1 - 1
sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c

@@ -51,7 +51,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s
 			return 0; /* already enough large */
 			return 0; /* already enough large */
 		vfree(runtime->dma_area);
 		vfree(runtime->dma_area);
 	}
 	}
-	runtime->dma_area = vmalloc_32(size);
+	runtime->dma_area = vmalloc_32_user(size);
 	if (! runtime->dma_area)
 	if (! runtime->dma_area)
 		return -ENOMEM;
 		return -ENOMEM;
 	runtime->dma_bytes = size;
 	runtime->dma_bytes = size;

+ 1 - 1
sound/usb/usbaudio.c

@@ -752,7 +752,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s
 			return 0; /* already large enough */
 			return 0; /* already large enough */
 		vfree(runtime->dma_area);
 		vfree(runtime->dma_area);
 	}
 	}
-	runtime->dma_area = vmalloc(size);
+	runtime->dma_area = vmalloc_user(size);
 	if (!runtime->dma_area)
 	if (!runtime->dma_area)
 		return -ENOMEM;
 		return -ENOMEM;
 	runtime->dma_bytes = size;
 	runtime->dma_bytes = size;