ALSA: rawmidi - fix the uninitalized user_pversion

perexg · tiwai · commit 39a8fc4971a0 · 2021-12-22T20:18:27.000+01:00
The user_pversion was uninitialized for the user space file structure in the open function, because the file private structure use kmalloc for the allocation. The kernel ALSA sequencer code clears the file structure, so no additional fixes are required. Cc: stable@kernel.org Cc: broonie@kernel.org BugLink: alsa-project/alsa-lib#178 Fixes: 09d2317 ("ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION") Reported-by: syzbot+88412ee8811832b00dbe@syzkaller.appspotmail.com Signed-off-by: Jaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20211218123925.2583847-1-perex@perex.cz Signed-off-by: Takashi Iwai <tiwai@suse.de>
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
@@ -447,6 +447,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
 		err = -ENOMEM;
 		goto __error;
 	}
+	rawmidi_file->user_pversion = 0;
 	init_waitqueue_entry(&wait, current);
 	add_wait_queue(&rmidi->open_wait, &wait);
 	while (1) {

Original file line number	Diff line number	Diff line change
`@@ -447,6 +447,7 @@ static int snd_rawmidi_open(struct inode inode, struct file file)`
`447`	`447`	`err = -ENOMEM;`
`448`	`448`	`goto __error;`
`449`	`449`	`}`
	`450`	`+ rawmidi_file->user_pversion = 0;`
`450`	`451`	`init_waitqueue_entry(&wait, current);`
`451`	`452`	`add_wait_queue(&rmidi->open_wait, &wait);`
`452`	`453`	`while (1) {`