Some rawmidi compat ioctls lack of the input substream checks (although they do check only for rfile->output). This many eventually lead to an Oops as NULL substream is passed to the rawmidi core functions. Fix it by adding the proper checks before each function call. The bug was spotted by syzkaller.
Unified · Split
| @@ -36,8 +36,6 @@ static int snd_rawmidi_ioctl_params_compat(struct snd_rawmidi_file *rfile, · 35 unmodified lines | ||
| 36 | 36 | struct snd_rawmidi_params params; |
| 37 | 37 | unsigned int val; |
| 38 | 38 | |
| 39 | − if (rfile->output == NULL) | |
| 40 | − return -EINVAL; | |
| 41 | 39 | if (get_user(params.stream, &src->stream) || |
| 42 | 40 | get_user(params.buffer_size, &src->buffer_size) || |
| 43 | 41 | get_user(params.avail_min, &src->avail_min) || |
| @@ -46,8 +44,12 @@ static int snd_rawmidi_ioctl_params_compat(struct snd_rawmidi_file *rfile, · 2 unmodified lines | ||
| 46 | 44 | params.no_active_sensing = val; |
| 47 | 45 | switch (params.stream) { |
| 48 | 46 | case SNDRV_RAWMIDI_STREAM_OUTPUT: |
| 47 | + if (!rfile->output) | |
| 48 | + return -EINVAL; | |
| 49 | 49 | return snd_rawmidi_output_params(rfile->output, ¶ms); |
| 50 | 50 | case SNDRV_RAWMIDI_STREAM_INPUT: |
| 51 | + if (!rfile->input) | |
| 52 | + return -EINVAL; | |
| 51 | 53 | return snd_rawmidi_input_params(rfile->input, ¶ms); |
| 52 | 54 | } |
| 53 | 55 | return -EINVAL; |
| @@ -67,16 +69,18 @@ static int snd_rawmidi_ioctl_status_compat(struct snd_rawmidi_file *rfile, · 13 unmodified lines | ||
| 67 | 69 | int err; |
| 68 | 70 | struct snd_rawmidi_status status; |
| 69 | 71 | |
| 70 | − if (rfile->output == NULL) | |
| 71 | − return -EINVAL; | |
| 72 | 72 | if (get_user(status.stream, &src->stream)) |
| 73 | 73 | return -EFAULT; |
| 74 | 74 | |
| 75 | 75 | switch (status.stream) { |
| 76 | 76 | case SNDRV_RAWMIDI_STREAM_OUTPUT: |
| 77 | + if (!rfile->output) | |
| 78 | + return -EINVAL; | |
| 77 | 79 | err = snd_rawmidi_output_status(rfile->output, &status); |
| 78 | 80 | break; |
| 79 | 81 | case SNDRV_RAWMIDI_STREAM_INPUT: |
| 82 | + if (!rfile->input) | |
| 83 | + return -EINVAL; | |
| 80 | 84 | err = snd_rawmidi_input_status(rfile->input, &status); |
| 81 | 85 | break; |
| 82 | 86 | default: |
| @@ -112,16 +116,18 @@ static int snd_rawmidi_ioctl_status_x32(struct snd_rawmidi_file *rfile, · 29 unmodified lines | ||
| 112 | 116 | int err; |
| 113 | 117 | struct snd_rawmidi_status status; |
| 114 | 118 | |
| 115 | − if (rfile->output == NULL) | |
| 116 | − return -EINVAL; | |
| 117 | 119 | if (get_user(status.stream, &src->stream)) |
| 118 | 120 | return -EFAULT; |
| 119 | 121 | |
| 120 | 122 | switch (status.stream) { |
| 121 | 123 | case SNDRV_RAWMIDI_STREAM_OUTPUT: |
| 124 | + if (!rfile->output) | |
| 125 | + return -EINVAL; | |
| 122 | 126 | err = snd_rawmidi_output_status(rfile->output, &status); |
| 123 | 127 | break; |
| 124 | 128 | case SNDRV_RAWMIDI_STREAM_INPUT: |
| 129 | + if (!rfile->input) | |
| 130 | + return -EINVAL; | |
| 125 | 131 | err = snd_rawmidi_input_status(rfile->input, &status); |
| 126 | 132 | break; |
| 127 | 133 | default: |