| From foo@baz Wed Aug 22 09:42:09 CEST 2018 |
| From: Takashi Iwai <tiwai@suse.de> |
| Date: Mon, 25 Jun 2018 11:13:59 +0200 |
| Subject: ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl |
| |
| From: Takashi Iwai <tiwai@suse.de> |
| |
| [ Upstream commit c9a4c63888dbb79ce4d068ca1dd8b05bc3f156b1 ] |
| |
| The kernel may spew a WARNING with UBSAN undefined behavior at |
| handling ALSA sequencer ioctl SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT: |
| |
| UBSAN: Undefined behaviour in sound/core/seq/seq_clientmgr.c:2007:14 |
| signed integer overflow: |
| 2147483647 + 1 cannot be represented in type 'int' |
| Call Trace: |
| __dump_stack lib/dump_stack.c:77 [inline] |
| dump_stack+0x122/0x1c8 lib/dump_stack.c:113 |
| ubsan_epilogue+0x12/0x86 lib/ubsan.c:159 |
| handle_overflow+0x1c2/0x21f lib/ubsan.c:190 |
| __ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198 |
| snd_seq_ioctl_query_next_client+0x1ac/0x1d0 sound/core/seq/seq_clientmgr.c:2007 |
| snd_seq_ioctl+0x264/0x3d0 sound/core/seq/seq_clientmgr.c:2144 |
| .... |
| |
| It happens only when INT_MAX is passed there, as we're incrementing it |
| unconditionally. So the fix is trivial, check the value with |
| INT_MAX. Although the bug itself is fairly harmless, it's better to |
| fix it so that fuzzers won't hit this again later. |
| |
| Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200211 |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| sound/core/seq/seq_clientmgr.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/sound/core/seq/seq_clientmgr.c |
| +++ b/sound/core/seq/seq_clientmgr.c |
| @@ -2002,7 +2002,8 @@ static int snd_seq_ioctl_query_next_clie |
| struct snd_seq_client *cptr = NULL; |
| |
| /* search for next client */ |
| - info->client++; |
| + if (info->client < INT_MAX) |
| + info->client++; |
| if (info->client < 0) |
| info->client = 0; |
| for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) { |