sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer

commit 3e85fd614c7b6bb7f33bb04a0dcb5a3bfca4c0fe upstream.

When allocating the PCM buffer, use vmalloc_user() instead of vmalloc().
Otherwise, it would be possible for applications to play the previous
contents of the kernel memory to the speakers, or to read it directly if
the buffer is exported to userspace.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/sound/mips/sgio2audio.c b/sound/mips/sgio2audio.c
index e497525bc11bcf50612c071bdfc3c5ba186bacf1..db7ff29ee9a1c768e94d9e0edf39c5a3a919dc29 100644 (file)
--- a/sound/mips/sgio2audio.c
+++ b/sound/mips/sgio2audio.c
@@ -609,7 +609,7 @@ static int snd_sgio2audio_pcm_hw_params(struct snd_pcm_substream *substream,
        /* alloc virtual 'dma' area */
        if (runtime->dma_area)
                vfree(runtime->dma_area);
-       runtime->dma_area = vmalloc(size);
+       runtime->dma_area = vmalloc_user(size);
        if (runtime->dma_area == NULL)
                return -ENOMEM;
        runtime->dma_bytes = size;

diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
index d057e648964389a53c7905a68311ecf35aff552a..5cfa608823f78d65e3f80d9e6b9ff08e377acb31 100644 (file)
--- a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
+++ b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
@@ -51,7 +51,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s
                        return 0; /* already enough large */
                vfree(runtime->dma_area);
        }
-       runtime->dma_area = vmalloc_32(size);
+       runtime->dma_area = vmalloc_32_user(size);
        if (! runtime->dma_area)
                return -ENOMEM;
        runtime->dma_bytes = size;

diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index 44b9cdc8a83bae15856ca18fb7915acc7197757d..b70527a92b01587aefb7ee59ac9e648b6203d7b4 100644 (file)
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -752,7 +752,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s
                        return 0; /* already large enough */
                vfree(runtime->dma_area);
        }
-       runtime->dma_area = vmalloc(size);
+       runtime->dma_area = vmalloc_user(size);
        if (!runtime->dma_area)
                return -ENOMEM;
        runtime->dma_bytes = size;