* sound: WARNING in snd_seq_oss_synth_cleanup
@ 2016-01-24 10:26 Dmitry Vyukov
2016-01-25 10:48 ` Takashi Iwai
0 siblings, 1 reply; 3+ messages in thread
From: Dmitry Vyukov @ 2016-01-24 10:26 UTC (permalink / raw)
To: Jaroslav Kysela, Takashi Iwai, Jie Yang, Mark Brown, alsa-devel, LKML
Cc: Alexander Potapenko, Kostya Serebryany, Sasha Levin, syzkaller
Hello,
The following program triggers WARNING in snd_seq_oss_synth_cleanup:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311
snd_seq_oss_synth_cleanup+0x35f/0x420()
Modules linked in:
CPU: 1 PID: 7573 Comm: a.out Tainted: G W 4.4.0+ #276
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
00000000ffffffff ffff880036bcfbb0 ffffffff82999e2d 0000000000000000
ffff8800339797c0 ffffffff86d46580 ffff880036bcfbf0 ffffffff81352089
ffffffff84fd380f ffffffff86d46580 0000000000000137 ffff880033e592e8
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff82999e2d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
[<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
[<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
[<ffffffff84fd380f>] snd_seq_oss_synth_cleanup+0x35f/0x420
sound/core/seq/oss/seq_oss_synth.c:311
[<ffffffff84fca919>] snd_seq_oss_release+0x79/0x130
sound/core/seq/oss/seq_oss_init.c:427
[<ffffffff84fc8faa>] odev_release+0x5a/0x80 sound/core/seq/oss/seq_oss.c:155
[<ffffffff817b73c6>] __fput+0x236/0x780 fs/file_table.c:208
[<ffffffff817b7995>] ____fput+0x15/0x20 fs/file_table.c:244
[<ffffffff813afdc0>] task_work_run+0x170/0x210 kernel/task_work.c:115
[< inline >] exit_task_work include/linux/task_work.h:21
[<ffffffff8135b275>] do_exit+0x8b5/0x2c60 kernel/exit.c:750
[<ffffffff8135d798>] do_group_exit+0x108/0x330 kernel/exit.c:880
[< inline >] SYSC_exit_group kernel/exit.c:891
[<ffffffff8135d9dd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:889
[<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
---[ end trace e71270304b7f911a ]---
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
int main()
{
open("/dev/char/14:8", O_RDWR);
}
On commit 30f05309bde49295e02e45c7e615f73aa4e0ccc2.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: sound: WARNING in snd_seq_oss_synth_cleanup
2016-01-24 10:26 sound: WARNING in snd_seq_oss_synth_cleanup Dmitry Vyukov
@ 2016-01-25 10:48 ` Takashi Iwai
0 siblings, 0 replies; 3+ messages in thread
From: Takashi Iwai @ 2016-01-25 10:48 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: alsa-devel, Jie Yang, Mark Brown, Jaroslav Kysela, LKML,
Alexander Potapenko, Kostya Serebryany, syzkaller, Sasha Levin
On Sun, 24 Jan 2016 11:26:47 +0100,
Dmitry Vyukov wrote:
>
> Hello,
>
> The following program triggers WARNING in snd_seq_oss_synth_cleanup:
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311
> snd_seq_oss_synth_cleanup+0x35f/0x420()
> Modules linked in:
> CPU: 1 PID: 7573 Comm: a.out Tainted: G W 4.4.0+ #276
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> 00000000ffffffff ffff880036bcfbb0 ffffffff82999e2d 0000000000000000
> ffff8800339797c0 ffffffff86d46580 ffff880036bcfbf0 ffffffff81352089
> ffffffff84fd380f ffffffff86d46580 0000000000000137 ffff880033e592e8
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff82999e2d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
> [<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
> [<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
> [<ffffffff84fd380f>] snd_seq_oss_synth_cleanup+0x35f/0x420
> sound/core/seq/oss/seq_oss_synth.c:311
> [<ffffffff84fca919>] snd_seq_oss_release+0x79/0x130
> sound/core/seq/oss/seq_oss_init.c:427
> [<ffffffff84fc8faa>] odev_release+0x5a/0x80 sound/core/seq/oss/seq_oss.c:155
> [<ffffffff817b73c6>] __fput+0x236/0x780 fs/file_table.c:208
> [<ffffffff817b7995>] ____fput+0x15/0x20 fs/file_table.c:244
> [<ffffffff813afdc0>] task_work_run+0x170/0x210 kernel/task_work.c:115
> [< inline >] exit_task_work include/linux/task_work.h:21
> [<ffffffff8135b275>] do_exit+0x8b5/0x2c60 kernel/exit.c:750
> [<ffffffff8135d798>] do_group_exit+0x108/0x330 kernel/exit.c:880
> [< inline >] SYSC_exit_group kernel/exit.c:891
> [<ffffffff8135d9dd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:889
> [<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
> ---[ end trace e71270304b7f911a ]---
>
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <fcntl.h>
>
> int main()
> {
> open("/dev/char/14:8", O_RDWR);
> }
>
> On commit 30f05309bde49295e02e45c7e615f73aa4e0ccc2.
This must be an off-by-one error. The fix patch is below.
thanks,
Takashi
-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] ALSA: seq: Fix incorrect sanity check at
snd_seq_oss_synth_cleanup()
ALSA sequencer OSS emulation code has a sanity check for currently
opened devices, but there is a thinko there, eventually it spews
warnings and skips the operation wrongly.
Fix this off-by-one error.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/core/seq/oss/seq_oss_synth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
index 0f3b38184fe5..b16dbef04174 100644
--- a/sound/core/seq/oss/seq_oss_synth.c
+++ b/sound/core/seq/oss/seq_oss_synth.c
@@ -308,7 +308,7 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp)
struct seq_oss_synth *rec;
struct seq_oss_synthinfo *info;
- if (snd_BUG_ON(dp->max_synthdev >= SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
+ if (snd_BUG_ON(dp->max_synthdev > SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
return;
for (i = 0; i < dp->max_synthdev; i++) {
info = &dp->synths[i];
--
2.7.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: sound: WARNING in snd_seq_oss_synth_cleanup
@ 2016-01-25 10:48 ` Takashi Iwai
0 siblings, 0 replies; 3+ messages in thread
From: Takashi Iwai @ 2016-01-25 10:48 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: alsa-devel, Jie Yang, Mark Brown, Jaroslav Kysela, LKML,
Alexander Potapenko, Kostya Serebryany, syzkaller, Sasha Levin
On Sun, 24 Jan 2016 11:26:47 +0100,
Dmitry Vyukov wrote:
>
> Hello,
>
> The following program triggers WARNING in snd_seq_oss_synth_cleanup:
>
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311
> snd_seq_oss_synth_cleanup+0x35f/0x420()
> Modules linked in:
> CPU: 1 PID: 7573 Comm: a.out Tainted: G W 4.4.0+ #276
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> 00000000ffffffff ffff880036bcfbb0 ffffffff82999e2d 0000000000000000
> ffff8800339797c0 ffffffff86d46580 ffff880036bcfbf0 ffffffff81352089
> ffffffff84fd380f ffffffff86d46580 0000000000000137 ffff880033e592e8
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff82999e2d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
> [<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
> [<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
> [<ffffffff84fd380f>] snd_seq_oss_synth_cleanup+0x35f/0x420
> sound/core/seq/oss/seq_oss_synth.c:311
> [<ffffffff84fca919>] snd_seq_oss_release+0x79/0x130
> sound/core/seq/oss/seq_oss_init.c:427
> [<ffffffff84fc8faa>] odev_release+0x5a/0x80 sound/core/seq/oss/seq_oss.c:155
> [<ffffffff817b73c6>] __fput+0x236/0x780 fs/file_table.c:208
> [<ffffffff817b7995>] ____fput+0x15/0x20 fs/file_table.c:244
> [<ffffffff813afdc0>] task_work_run+0x170/0x210 kernel/task_work.c:115
> [< inline >] exit_task_work include/linux/task_work.h:21
> [<ffffffff8135b275>] do_exit+0x8b5/0x2c60 kernel/exit.c:750
> [<ffffffff8135d798>] do_group_exit+0x108/0x330 kernel/exit.c:880
> [< inline >] SYSC_exit_group kernel/exit.c:891
> [<ffffffff8135d9dd>] SyS_exit_group+0x1d/0x20 kernel/exit.c:889
> [<ffffffff86336c36>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
> ---[ end trace e71270304b7f911a ]---
>
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <fcntl.h>
>
> int main()
> {
> open("/dev/char/14:8", O_RDWR);
> }
>
> On commit 30f05309bde49295e02e45c7e615f73aa4e0ccc2.
This must be an off-by-one error. The fix patch is below.
thanks,
Takashi
-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] ALSA: seq: Fix incorrect sanity check at
snd_seq_oss_synth_cleanup()
ALSA sequencer OSS emulation code has a sanity check for currently
opened devices, but there is a thinko there, eventually it spews
warnings and skips the operation wrongly.
Fix this off-by-one error.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/core/seq/oss/seq_oss_synth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
index 0f3b38184fe5..b16dbef04174 100644
--- a/sound/core/seq/oss/seq_oss_synth.c
+++ b/sound/core/seq/oss/seq_oss_synth.c
@@ -308,7 +308,7 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp)
struct seq_oss_synth *rec;
struct seq_oss_synthinfo *info;
- if (snd_BUG_ON(dp->max_synthdev >= SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
+ if (snd_BUG_ON(dp->max_synthdev > SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
return;
for (i = 0; i < dp->max_synthdev; i++) {
info = &dp->synths[i];
--
2.7.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-01-25 10:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-01-24 10:26 sound: WARNING in snd_seq_oss_synth_cleanup Dmitry Vyukov
2016-01-25 10:48 ` Takashi Iwai
2016-01-25 10:48 ` Takashi Iwai
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.