| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | sound tests: Remove trailing PROT_EXEC | Christos Margiolis | 2026-06-21 | 1 | -1/+1 |
| | | | | | | | | Fixes: 730eaf466493 ("sound tests: Add PROT_EXEC rejection test") Reported by: Oliver Pinter <oliver.pntr@gmail.com> Sponsored by: The FreeBSD Foundation MFC after: 6 days | ||||
| * | sound tests: Add PROT_EXEC rejection test | Christos Margiolis | 2026-06-20 | 1 | -0/+28 |
| | | | | | | | | Sponsored by: The FreeBSD Foundation MFC after: 1 week Reviewed by: markj, kib Pull-Request: https://ron-dev.freebsd.org/FreeBSD/src/pulls/30 | ||||
| * | sound: Fix software buffer lifetime issues | Mark Johnston | 2026-06-09 | 1 | -0/+60 |
| | | | | | | | | | | | | | | | | | | | | | The channel buffer mapped by dsp_mmap_single() may be freed when the device handle is closed, but the mapping persists beyond that, allowing userspace to read or write memory owned by a different consumer. Fix the problem by adding a reference counter to the sound buffer. Define pager ops for the VM object returned by dsp_mmap_single() and use them to manage the extra reference. Add a regression test. Approved by: so Security: FreeBSD-SA-26:27.sound Security: CVE-2026-49417 Reported by: Lexpl0it, 75Acol, Liyw979, Rob1n Reviewed by kib Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D57393 | ||||
| * | sound: Check for offset overflow in dsp_mmap_single() | Christos Margiolis | 2026-06-09 | 1 | -0/+51 |
| Approved by: so Security: FreeBSD-SA-26:27.sound Security: CVE-2026-45258 Reviewed by: markj Sponsored by: The FreeBSD Foundation | |||||
 |
index : src | |
| FreeBSD source tree |
| aboutsummaryrefslogtreecommitdiff |