From patchwork Thu May 19 20:21:44 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herton Ronaldo Krzesinski X-Patchwork-Id: 96453 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id A5B1DB718A for ; Fri, 20 May 2011 06:22:06 +1000 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1QN9jC-0006PI-6M; Thu, 19 May 2011 20:21:50 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1QN9jA-0006PD-89 for kernel-team@lists.ubuntu.com; Thu, 19 May 2011 20:21:48 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1QN9jA-0003EP-50 for ; Thu, 19 May 2011 20:21:48 +0000 Received: from 201.22.38.106.dynamic.adsl.gvt.net.br ([201.22.38.106] helo=canonical.com) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1QN9j9-0001i1-LW for kernel-team@lists.ubuntu.com; Thu, 19 May 2011 20:21:48 +0000 From: Herton Ronaldo Krzesinski To: kernel-team@lists.ubuntu.com Subject: [CVE-2011-1169][Maverick][PATCH] ALSA: sound/pci/asihpi: check adapter index in hpi_ioctl, CVE-2011-1169 Date: Thu, 19 May 2011 17:21:44 -0300 Message-Id: <1305836504-6864-1-git-send-email-herton.krzesinski@canonical.com> X-Mailer: git-send-email 1.7.4.1 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Dan Rosenberg CVE-2011-1169 BugLink: http://bugs.launchpad.net/bugs/785331 Released until now with stable versions 2.6.37.5, 2.6.38.1 The user-supplied index into the adapters array needs to be checked, or an out-of-bounds kernel pointer could be accessed and used, leading to potentially exploitable memory corruption. Signed-off-by: Dan Rosenberg Cc: Signed-off-by: Takashi Iwai (backported from commit 4a122c10fbfe9020df469f0f669da129c5757671 upstream) Signed-off-by: Herton Krzesinski Acked-by: John Johansen Acked-by: Leann Ogasawara --- sound/pci/asihpi/hpioctl.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c index 7396ac5..7b600f7 100644 --- a/sound/pci/asihpi/hpioctl.c +++ b/sound/pci/asihpi/hpioctl.c @@ -146,6 +146,11 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) goto out; } + if (hm->h.adapter_index >= HPI_MAX_ADAPTERS) { + err = -EINVAL; + goto out; + } + pa = &adapters[hm->h.adapter_index]; hr->h.size = 0; if (hm->h.object == HPI_OBJ_SUBSYSTEM) {