* [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe()
@ 2016-03-15 12:35 Nicolai Stange
2016-03-15 12:41 ` Takashi Iwai
2016-03-15 13:37 ` Shuah Khan
0 siblings, 2 replies; 9+ messages in thread
From: Nicolai Stange @ 2016-03-15 12:35 UTC (permalink / raw)
To: Jaroslav Kysela, Takashi Iwai
Cc: Shuah Khan, Mauro Carvalho Chehab, Nicolai Stange, alsa-devel,
linux-kernel
With commit
aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
media resources")
an access to quirk->media_device without checking for quirk != NULL has
been introduced in usb_audio_probe().
With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
this results in the following splat at boot time:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
Oops: 0000 [#1] SMP
[...]
CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
[...]
Call Trace:
[<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
[<ffffffff81509edc>] driver_probe_device+0x22c/0x440
[<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
[<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
[<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
[<ffffffff815095ce>] driver_attach+0x1e/0x20
[<ffffffff81509013>] bus_add_driver+0x1c3/0x280
[<ffffffff8150ab10>] driver_register+0x60/0xe0
[<ffffffff815a7711>] usb_register_driver+0x81/0x140
[<ffffffffa08c7000>] ? 0xffffffffa08c7000
[<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
[<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
[<ffffffff811fb091>] ? __vunmap+0x81/0xd0
[<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
[<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
[<ffffffff811b029f>] do_init_module+0x5f/0x1d8
[<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
[<ffffffff81129870>] ? __symbol_put+0x60/0x60
[<ffffffff81241690>] ? vfs_read+0x110/0x130
[<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
[<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
[<ffffffff81003d94>] do_syscall_64+0x64/0x110
[<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
After encountering this, the system-udevd process seems to be blocked
until it is killed when hitting its timeout of 3min.
In analogy to the other accesses to members of quirk in usb_audio_probe(),
check for quirk != NULL before accessing its ->media_device.
Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
media resources")
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
---
Applicable to linux-next-20160315.
sound/usb/card.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 63244bb..479621e 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
if (err < 0)
goto __error;
- if (quirk->media_device) {
+ if (quirk && quirk->media_device) {
/* don't want to fail when media_snd_device_create() fails */
media_snd_device_create(chip, intf);
}
--
2.7.2
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe()
2016-03-15 12:35 [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe() Nicolai Stange
@ 2016-03-15 12:41 ` Takashi Iwai
2016-03-15 13:37 ` Shuah Khan
1 sibling, 0 replies; 9+ messages in thread
From: Takashi Iwai @ 2016-03-15 12:41 UTC (permalink / raw)
To: Nicolai Stange
Cc: Jaroslav Kysela, alsa-devel, Mauro Carvalho Chehab, Shuah Khan,
linux-kernel
On Tue, 15 Mar 2016 13:35:06 +0100,
Nicolai Stange wrote:
>
> With commit
>
> aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> media resources")
>
> an access to quirk->media_device without checking for quirk != NULL has
> been introduced in usb_audio_probe().
>
> With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
> this results in the following splat at boot time:
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
> IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> Oops: 0000 [#1] SMP
> [...]
> CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
> Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
> task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
> RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
> usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> [...]
> Call Trace:
> [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
> [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
> [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
> [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
> [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
> [<ffffffff815095ce>] driver_attach+0x1e/0x20
> [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
> [<ffffffff8150ab10>] driver_register+0x60/0xe0
> [<ffffffff815a7711>] usb_register_driver+0x81/0x140
> [<ffffffffa08c7000>] ? 0xffffffffa08c7000
> [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
> [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
> [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
> [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
> [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
> [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
> [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
> [<ffffffff81129870>] ? __symbol_put+0x60/0x60
> [<ffffffff81241690>] ? vfs_read+0x110/0x130
> [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
> [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
> [<ffffffff81003d94>] do_syscall_64+0x64/0x110
> [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
>
> After encountering this, the system-udevd process seems to be blocked
> until it is killed when hitting its timeout of 3min.
>
> In analogy to the other accesses to members of quirk in usb_audio_probe(),
> check for quirk != NULL before accessing its ->media_device.
>
> Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> media resources")
> Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Mauro, please merge through your tree. I haven't merged MC changes
into my tree yet.
thanks
Takashi
> ---
> Applicable to linux-next-20160315.
>
> sound/usb/card.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/usb/card.c b/sound/usb/card.c
> index 63244bb..479621e 100644
> --- a/sound/usb/card.c
> +++ b/sound/usb/card.c
> @@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
> if (err < 0)
> goto __error;
>
> - if (quirk->media_device) {
> + if (quirk && quirk->media_device) {
> /* don't want to fail when media_snd_device_create() fails */
> media_snd_device_create(chip, intf);
> }
> --
> 2.7.2
>
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe()
@ 2016-03-15 12:41 ` Takashi Iwai
0 siblings, 0 replies; 9+ messages in thread
From: Takashi Iwai @ 2016-03-15 12:41 UTC (permalink / raw)
To: Nicolai Stange
Cc: Jaroslav Kysela, alsa-devel, Mauro Carvalho Chehab, Shuah Khan,
linux-kernel
On Tue, 15 Mar 2016 13:35:06 +0100,
Nicolai Stange wrote:
>
> With commit
>
> aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> media resources")
>
> an access to quirk->media_device without checking for quirk != NULL has
> been introduced in usb_audio_probe().
>
> With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
> this results in the following splat at boot time:
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
> IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> Oops: 0000 [#1] SMP
> [...]
> CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
> Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
> task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
> RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
> usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> [...]
> Call Trace:
> [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
> [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
> [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
> [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
> [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
> [<ffffffff815095ce>] driver_attach+0x1e/0x20
> [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
> [<ffffffff8150ab10>] driver_register+0x60/0xe0
> [<ffffffff815a7711>] usb_register_driver+0x81/0x140
> [<ffffffffa08c7000>] ? 0xffffffffa08c7000
> [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
> [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
> [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
> [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
> [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
> [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
> [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
> [<ffffffff81129870>] ? __symbol_put+0x60/0x60
> [<ffffffff81241690>] ? vfs_read+0x110/0x130
> [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
> [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
> [<ffffffff81003d94>] do_syscall_64+0x64/0x110
> [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
>
> After encountering this, the system-udevd process seems to be blocked
> until it is killed when hitting its timeout of 3min.
>
> In analogy to the other accesses to members of quirk in usb_audio_probe(),
> check for quirk != NULL before accessing its ->media_device.
>
> Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> media resources")
> Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Mauro, please merge through your tree. I haven't merged MC changes
into my tree yet.
thanks
Takashi
> ---
> Applicable to linux-next-20160315.
>
> sound/usb/card.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/usb/card.c b/sound/usb/card.c
> index 63244bb..479621e 100644
> --- a/sound/usb/card.c
> +++ b/sound/usb/card.c
> @@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
> if (err < 0)
> goto __error;
>
> - if (quirk->media_device) {
> + if (quirk && quirk->media_device) {
> /* don't want to fail when media_snd_device_create() fails */
> media_snd_device_create(chip, intf);
> }
> --
> 2.7.2
>
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe()
2016-03-15 12:35 [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe() Nicolai Stange
@ 2016-03-15 13:37 ` Shuah Khan
2016-03-15 13:37 ` Shuah Khan
1 sibling, 0 replies; 9+ messages in thread
From: Shuah Khan @ 2016-03-15 13:37 UTC (permalink / raw)
To: Nicolai Stange, Jaroslav Kysela, Takashi Iwai
Cc: Mauro Carvalho Chehab, alsa-devel, linux-kernel, Shuah Khan
On 03/15/2016 06:35 AM, Nicolai Stange wrote:
> With commit
>
> aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> media resources")
>
> an access to quirk->media_device without checking for quirk != NULL has
> been introduced in usb_audio_probe().
>
> With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
> this results in the following splat at boot time:
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
> IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> Oops: 0000 [#1] SMP
> [...]
> CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
> Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
> task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
> RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
> usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> [...]
> Call Trace:
> [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
> [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
> [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
> [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
> [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
> [<ffffffff815095ce>] driver_attach+0x1e/0x20
> [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
> [<ffffffff8150ab10>] driver_register+0x60/0xe0
> [<ffffffff815a7711>] usb_register_driver+0x81/0x140
> [<ffffffffa08c7000>] ? 0xffffffffa08c7000
> [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
> [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
> [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
> [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
> [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
> [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
> [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
> [<ffffffff81129870>] ? __symbol_put+0x60/0x60
> [<ffffffff81241690>] ? vfs_read+0x110/0x130
> [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
> [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
> [<ffffffff81003d94>] do_syscall_64+0x64/0x110
> [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
>
> After encountering this, the system-udevd process seems to be blocked
> until it is killed when hitting its timeout of 3min.
>
> In analogy to the other accesses to members of quirk in usb_audio_probe(),
> check for quirk != NULL before accessing its ->media_device.
>
> Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> media resources")
> Signed-off-by: Nicolai Stange <nicstange@gmail.com>
> ---
> Applicable to linux-next-20160315.
>
> sound/usb/card.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/usb/card.c b/sound/usb/card.c
> index 63244bb..479621e 100644
> --- a/sound/usb/card.c
> +++ b/sound/usb/card.c
> @@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
> if (err < 0)
> goto __error;
>
> - if (quirk->media_device) {
> + if (quirk && quirk->media_device) {
> /* don't want to fail when media_snd_device_create() fails */
> media_snd_device_create(chip, intf);
> }
>
Thanks for finding the problem and fixing it.
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe()
@ 2016-03-15 13:37 ` Shuah Khan
0 siblings, 0 replies; 9+ messages in thread
From: Shuah Khan @ 2016-03-15 13:37 UTC (permalink / raw)
To: Nicolai Stange, Jaroslav Kysela, Takashi Iwai
Cc: Shuah Khan, alsa-devel, linux-kernel, Mauro Carvalho Chehab
On 03/15/2016 06:35 AM, Nicolai Stange wrote:
> With commit
>
> aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> media resources")
>
> an access to quirk->media_device without checking for quirk != NULL has
> been introduced in usb_audio_probe().
>
> With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
> this results in the following splat at boot time:
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
> IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> Oops: 0000 [#1] SMP
> [...]
> CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
> Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
> task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
> RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
> usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> [...]
> Call Trace:
> [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
> [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
> [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
> [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
> [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
> [<ffffffff815095ce>] driver_attach+0x1e/0x20
> [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
> [<ffffffff8150ab10>] driver_register+0x60/0xe0
> [<ffffffff815a7711>] usb_register_driver+0x81/0x140
> [<ffffffffa08c7000>] ? 0xffffffffa08c7000
> [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
> [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
> [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
> [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
> [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
> [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
> [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
> [<ffffffff81129870>] ? __symbol_put+0x60/0x60
> [<ffffffff81241690>] ? vfs_read+0x110/0x130
> [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
> [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
> [<ffffffff81003d94>] do_syscall_64+0x64/0x110
> [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
>
> After encountering this, the system-udevd process seems to be blocked
> until it is killed when hitting its timeout of 3min.
>
> In analogy to the other accesses to members of quirk in usb_audio_probe(),
> check for quirk != NULL before accessing its ->media_device.
>
> Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> media resources")
> Signed-off-by: Nicolai Stange <nicstange@gmail.com>
> ---
> Applicable to linux-next-20160315.
>
> sound/usb/card.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/usb/card.c b/sound/usb/card.c
> index 63244bb..479621e 100644
> --- a/sound/usb/card.c
> +++ b/sound/usb/card.c
> @@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
> if (err < 0)
> goto __error;
>
> - if (quirk->media_device) {
> + if (quirk && quirk->media_device) {
> /* don't want to fail when media_snd_device_create() fails */
> media_snd_device_create(chip, intf);
> }
>
Thanks for finding the problem and fixing it.
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe()
2016-03-15 12:41 ` Takashi Iwai
@ 2016-03-15 14:53 ` Mauro Carvalho Chehab
-1 siblings, 0 replies; 9+ messages in thread
From: Mauro Carvalho Chehab @ 2016-03-15 14:53 UTC (permalink / raw)
To: Takashi Iwai
Cc: Nicolai Stange, Jaroslav Kysela, alsa-devel, Shuah Khan, linux-kernel
Em Tue, 15 Mar 2016 13:41:28 +0100
Takashi Iwai <tiwai@suse.de> escreveu:
> On Tue, 15 Mar 2016 13:35:06 +0100,
> Nicolai Stange wrote:
> >
> > With commit
> >
> > aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> > media resources")
> >
> > an access to quirk->media_device without checking for quirk != NULL has
> > been introduced in usb_audio_probe().
> >
> > With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
> > this results in the following splat at boot time:
> >
> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
> > IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> > Oops: 0000 [#1] SMP
> > [...]
> > CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
> > Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
> > task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
> > RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
> > usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> > [...]
> > Call Trace:
> > [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
> > [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
> > [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
> > [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
> > [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
> > [<ffffffff815095ce>] driver_attach+0x1e/0x20
> > [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
> > [<ffffffff8150ab10>] driver_register+0x60/0xe0
> > [<ffffffff815a7711>] usb_register_driver+0x81/0x140
> > [<ffffffffa08c7000>] ? 0xffffffffa08c7000
> > [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
> > [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
> > [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
> > [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
> > [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
> > [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
> > [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
> > [<ffffffff81129870>] ? __symbol_put+0x60/0x60
> > [<ffffffff81241690>] ? vfs_read+0x110/0x130
> > [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
> > [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
> > [<ffffffff81003d94>] do_syscall_64+0x64/0x110
> > [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
> >
> > After encountering this, the system-udevd process seems to be blocked
> > until it is killed when hitting its timeout of 3min.
> >
> > In analogy to the other accesses to members of quirk in usb_audio_probe(),
> > check for quirk != NULL before accessing its ->media_device.
> >
> > Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> > media resources")
> > Signed-off-by: Nicolai Stange <nicstange@gmail.com>
>
> Reviewed-by: Takashi Iwai <tiwai@suse.de>
>
> Mauro, please merge through your tree. I haven't merged MC changes
> into my tree yet.
OK, I'll send this fix together with some other patches in a couple
of days (it needs to go first to linux-next ;) ).
>
>
> thanks
>
> Takashi
>
>
> > ---
> > Applicable to linux-next-20160315.
> >
> > sound/usb/card.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/sound/usb/card.c b/sound/usb/card.c
> > index 63244bb..479621e 100644
> > --- a/sound/usb/card.c
> > +++ b/sound/usb/card.c
> > @@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
> > if (err < 0)
> > goto __error;
> >
> > - if (quirk->media_device) {
> > + if (quirk && quirk->media_device) {
> > /* don't want to fail when media_snd_device_create() fails */
> > media_snd_device_create(chip, intf);
> > }
> > --
> > 2.7.2
> >
> >
--
Thanks,
Mauro
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe()
@ 2016-03-15 14:53 ` Mauro Carvalho Chehab
0 siblings, 0 replies; 9+ messages in thread
From: Mauro Carvalho Chehab @ 2016-03-15 14:53 UTC (permalink / raw)
To: Takashi Iwai; +Cc: Shuah Khan, Nicolai Stange, alsa-devel, linux-kernel
Em Tue, 15 Mar 2016 13:41:28 +0100
Takashi Iwai <tiwai@suse.de> escreveu:
> On Tue, 15 Mar 2016 13:35:06 +0100,
> Nicolai Stange wrote:
> >
> > With commit
> >
> > aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> > media resources")
> >
> > an access to quirk->media_device without checking for quirk != NULL has
> > been introduced in usb_audio_probe().
> >
> > With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
> > this results in the following splat at boot time:
> >
> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
> > IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> > Oops: 0000 [#1] SMP
> > [...]
> > CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
> > Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
> > task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
> > RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
> > usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
> > [...]
> > Call Trace:
> > [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
> > [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
> > [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
> > [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
> > [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
> > [<ffffffff815095ce>] driver_attach+0x1e/0x20
> > [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
> > [<ffffffff8150ab10>] driver_register+0x60/0xe0
> > [<ffffffff815a7711>] usb_register_driver+0x81/0x140
> > [<ffffffffa08c7000>] ? 0xffffffffa08c7000
> > [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
> > [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
> > [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
> > [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
> > [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
> > [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
> > [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
> > [<ffffffff81129870>] ? __symbol_put+0x60/0x60
> > [<ffffffff81241690>] ? vfs_read+0x110/0x130
> > [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
> > [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
> > [<ffffffff81003d94>] do_syscall_64+0x64/0x110
> > [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
> >
> > After encountering this, the system-udevd process seems to be blocked
> > until it is killed when hitting its timeout of 3min.
> >
> > In analogy to the other accesses to members of quirk in usb_audio_probe(),
> > check for quirk != NULL before accessing its ->media_device.
> >
> > Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
> > media resources")
> > Signed-off-by: Nicolai Stange <nicstange@gmail.com>
>
> Reviewed-by: Takashi Iwai <tiwai@suse.de>
>
> Mauro, please merge through your tree. I haven't merged MC changes
> into my tree yet.
OK, I'll send this fix together with some other patches in a couple
of days (it needs to go first to linux-next ;) ).
>
>
> thanks
>
> Takashi
>
>
> > ---
> > Applicable to linux-next-20160315.
> >
> > sound/usb/card.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/sound/usb/card.c b/sound/usb/card.c
> > index 63244bb..479621e 100644
> > --- a/sound/usb/card.c
> > +++ b/sound/usb/card.c
> > @@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
> > if (err < 0)
> > goto __error;
> >
> > - if (quirk->media_device) {
> > + if (quirk && quirk->media_device) {
> > /* don't want to fail when media_snd_device_create() fails */
> > media_snd_device_create(chip, intf);
> > }
> > --
> > 2.7.2
> >
> >
--
Thanks,
Mauro
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe()
2016-03-15 14:53 ` Mauro Carvalho Chehab
@ 2016-03-15 15:00 ` Nicolai Stange
-1 siblings, 0 replies; 9+ messages in thread
From: Nicolai Stange @ 2016-03-15 15:00 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: Takashi Iwai, Nicolai Stange, Jaroslav Kysela, alsa-devel,
Shuah Khan, linux-kernel
Mauro Carvalho Chehab <mchehab@osg.samsung.com> writes:
> Em Tue, 15 Mar 2016 13:41:28 +0100
> Takashi Iwai <tiwai@suse.de> escreveu:
>
>> On Tue, 15 Mar 2016 13:35:06 +0100,
>> Nicolai Stange wrote:
>> >
>> > With commit
>> >
>> > aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
>> > media resources")
>> >
>> > an access to quirk->media_device without checking for quirk != NULL has
>> > been introduced in usb_audio_probe().
>> >
>> > With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
>> > this results in the following splat at boot time:
>> >
>> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
>> > IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
>> > Oops: 0000 [#1] SMP
>> > [...]
>> > CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
>> > Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
>> > task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
>> > RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
>> > usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
>> > [...]
>> > Call Trace:
>> > [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
>> > [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
>> > [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
>> > [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
>> > [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
>> > [<ffffffff815095ce>] driver_attach+0x1e/0x20
>> > [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
>> > [<ffffffff8150ab10>] driver_register+0x60/0xe0
>> > [<ffffffff815a7711>] usb_register_driver+0x81/0x140
>> > [<ffffffffa08c7000>] ? 0xffffffffa08c7000
>> > [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
>> > [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
>> > [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
>> > [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
>> > [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
>> > [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
>> > [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
>> > [<ffffffff81129870>] ? __symbol_put+0x60/0x60
>> > [<ffffffff81241690>] ? vfs_read+0x110/0x130
>> > [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
>> > [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
>> > [<ffffffff81003d94>] do_syscall_64+0x64/0x110
>> > [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
>> >
>> > After encountering this, the system-udevd process seems to be blocked
>> > until it is killed when hitting its timeout of 3min.
>> >
>> > In analogy to the other accesses to members of quirk in usb_audio_probe(),
>> > check for quirk != NULL before accessing its ->media_device.
>> >
>> > Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
>> > media resources")
>> > Signed-off-by: Nicolai Stange <nicstange@gmail.com>
>>
>> Reviewed-by: Takashi Iwai <tiwai@suse.de>
>>
>> Mauro, please merge through your tree. I haven't merged MC changes
>> into my tree yet.
>
> OK, I'll send this fix together with some other patches in a couple
> of days (it needs to go first to linux-next ;) ).
>
Thank you all!
Nicolai
>>
>>
>> > ---
>> > Applicable to linux-next-20160315.
>> >
>> > sound/usb/card.c | 2 +-
>> > 1 file changed, 1 insertion(+), 1 deletion(-)
>> >
>> > diff --git a/sound/usb/card.c b/sound/usb/card.c
>> > index 63244bb..479621e 100644
>> > --- a/sound/usb/card.c
>> > +++ b/sound/usb/card.c
>> > @@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
>> > if (err < 0)
>> > goto __error;
>> >
>> > - if (quirk->media_device) {
>> > + if (quirk && quirk->media_device) {
>> > /* don't want to fail when media_snd_device_create() fails */
>> > media_snd_device_create(chip, intf);
>> > }
>> > --
>> > 2.7.2
>> >
>> >
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe()
@ 2016-03-15 15:00 ` Nicolai Stange
0 siblings, 0 replies; 9+ messages in thread
From: Nicolai Stange @ 2016-03-15 15:00 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: alsa-devel, Takashi Iwai, Shuah Khan, linux-kernel, Nicolai Stange
Mauro Carvalho Chehab <mchehab@osg.samsung.com> writes:
> Em Tue, 15 Mar 2016 13:41:28 +0100
> Takashi Iwai <tiwai@suse.de> escreveu:
>
>> On Tue, 15 Mar 2016 13:35:06 +0100,
>> Nicolai Stange wrote:
>> >
>> > With commit
>> >
>> > aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
>> > media resources")
>> >
>> > an access to quirk->media_device without checking for quirk != NULL has
>> > been introduced in usb_audio_probe().
>> >
>> > With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
>> > this results in the following splat at boot time:
>> >
>> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
>> > IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
>> > Oops: 0000 [#1] SMP
>> > [...]
>> > CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
>> > Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
>> > task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
>> > RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
>> > usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
>> > [...]
>> > Call Trace:
>> > [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
>> > [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
>> > [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
>> > [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
>> > [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
>> > [<ffffffff815095ce>] driver_attach+0x1e/0x20
>> > [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
>> > [<ffffffff8150ab10>] driver_register+0x60/0xe0
>> > [<ffffffff815a7711>] usb_register_driver+0x81/0x140
>> > [<ffffffffa08c7000>] ? 0xffffffffa08c7000
>> > [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
>> > [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
>> > [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
>> > [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
>> > [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
>> > [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
>> > [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
>> > [<ffffffff81129870>] ? __symbol_put+0x60/0x60
>> > [<ffffffff81241690>] ? vfs_read+0x110/0x130
>> > [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
>> > [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
>> > [<ffffffff81003d94>] do_syscall_64+0x64/0x110
>> > [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
>> >
>> > After encountering this, the system-udevd process seems to be blocked
>> > until it is killed when hitting its timeout of 3min.
>> >
>> > In analogy to the other accesses to members of quirk in usb_audio_probe(),
>> > check for quirk != NULL before accessing its ->media_device.
>> >
>> > Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
>> > media resources")
>> > Signed-off-by: Nicolai Stange <nicstange@gmail.com>
>>
>> Reviewed-by: Takashi Iwai <tiwai@suse.de>
>>
>> Mauro, please merge through your tree. I haven't merged MC changes
>> into my tree yet.
>
> OK, I'll send this fix together with some other patches in a couple
> of days (it needs to go first to linux-next ;) ).
>
Thank you all!
Nicolai
>>
>>
>> > ---
>> > Applicable to linux-next-20160315.
>> >
>> > sound/usb/card.c | 2 +-
>> > 1 file changed, 1 insertion(+), 1 deletion(-)
>> >
>> > diff --git a/sound/usb/card.c b/sound/usb/card.c
>> > index 63244bb..479621e 100644
>> > --- a/sound/usb/card.c
>> > +++ b/sound/usb/card.c
>> > @@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
>> > if (err < 0)
>> > goto __error;
>> >
>> > - if (quirk->media_device) {
>> > + if (quirk && quirk->media_device) {
>> > /* don't want to fail when media_snd_device_create() fails */
>> > media_snd_device_create(chip, intf);
>> > }
>> > --
>> > 2.7.2
>> >
>> >
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2016-03-15 15:00 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-03-15 12:35 [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe() Nicolai Stange
2016-03-15 12:41 ` Takashi Iwai
2016-03-15 12:41 ` Takashi Iwai
2016-03-15 14:53 ` Mauro Carvalho Chehab
2016-03-15 14:53 ` Mauro Carvalho Chehab
2016-03-15 15:00 ` Nicolai Stange
2016-03-15 15:00 ` Nicolai Stange
2016-03-15 13:37 ` Shuah Khan
2016-03-15 13:37 ` Shuah Khan
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.