sound: sgio2audio/pdaudiocf/usb-audio: initialize PCM buffer

When allocating the PCM buffer, use vmalloc_user() instead of vmalloc().
Otherwise, it would be possible for applications to play the previous
contents of the kernel memory to the speakers, or to read it directly if
the buffer is exported to userspace.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/mips/sgio2audio.c b/sound/mips/sgio2audio.c
index 8691f4cf6191fc8500d4995c42e227bd8680a6c6..f1d9d16b54864258ce47868556f4b2f5888909f7 100644 (file)
--- a/sound/mips/sgio2audio.c
+++ b/sound/mips/sgio2audio.c
@@ -609,7 +609,7 @@ static int snd_sgio2audio_pcm_hw_params(struct snd_pcm_substream *substream,
        /* alloc virtual 'dma' area */
        if (runtime->dma_area)
                vfree(runtime->dma_area);
-       runtime->dma_area = vmalloc(size);
+       runtime->dma_area = vmalloc_user(size);
        if (runtime->dma_area == NULL)
                return -ENOMEM;
        runtime->dma_bytes = size;

diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
index d057e648964389a53c7905a68311ecf35aff552a..5cfa608823f78d65e3f80d9e6b9ff08e377acb31 100644 (file)
--- a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
+++ b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
@@ -51,7 +51,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s
                        return 0; /* already enough large */
                vfree(runtime->dma_area);
        }
-       runtime->dma_area = vmalloc_32(size);
+       runtime->dma_area = vmalloc_32_user(size);
        if (! runtime->dma_area)
                return -ENOMEM;
        runtime->dma_bytes = size;

diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index b074a594c595444994824c9384350ae3d019859d..4963defee18a210632ea8a8fd7c2b1e2d54f5476 100644 (file)
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -752,7 +752,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s
                        return 0; /* already large enough */
                vfree(runtime->dma_area);
        }
-       runtime->dma_area = vmalloc(size);
+       runtime->dma_area = vmalloc_user(size);
        if (!runtime->dma_area)
                return -ENOMEM;
        runtime->dma_bytes = size;