From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756566AbcAYKsY (ORCPT ); Mon, 25 Jan 2016 05:48:24 -0500 Received: from mx2.suse.de ([195.135.220.15]:57376 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756057AbcAYKsT (ORCPT ); Mon, 25 Jan 2016 05:48:19 -0500 Date: Mon, 25 Jan 2016 11:48:18 +0100 Message-ID: From: Takashi Iwai To: "Dmitry Vyukov" Cc: , "Jie Yang" , "Mark Brown" , "Jaroslav Kysela" , "LKML" , "Alexander Potapenko" , "Kostya Serebryany" , "syzkaller" , "Sasha Levin" Subject: Re: sound: WARNING in snd_seq_oss_synth_cleanup In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/24.5 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, 24 Jan 2016 11:26:47 +0100, Dmitry Vyukov wrote: > > Hello, > > The following program triggers WARNING in snd_seq_oss_synth_cleanup: > > ------------[ cut here ]------------ > WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311 > snd_seq_oss_synth_cleanup+0x35f/0x420() > Modules linked in: > CPU: 1 PID: 7573 Comm: a.out Tainted: G W 4.4.0+ #276 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > 00000000ffffffff ffff880036bcfbb0 ffffffff82999e2d 0000000000000000 > ffff8800339797c0 ffffffff86d46580 ffff880036bcfbf0 ffffffff81352089 > ffffffff84fd380f ffffffff86d46580 0000000000000137 ffff880033e592e8 > Call Trace: > [< inline >] __dump_stack lib/dump_stack.c:15 > [] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 > [] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 > [] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 > [] snd_seq_oss_synth_cleanup+0x35f/0x420 > sound/core/seq/oss/seq_oss_synth.c:311 > [] snd_seq_oss_release+0x79/0x130 > sound/core/seq/oss/seq_oss_init.c:427 > [] odev_release+0x5a/0x80 sound/core/seq/oss/seq_oss.c:155 > [] __fput+0x236/0x780 fs/file_table.c:208 > [] ____fput+0x15/0x20 fs/file_table.c:244 > [] task_work_run+0x170/0x210 kernel/task_work.c:115 > [< inline >] exit_task_work include/linux/task_work.h:21 > [] do_exit+0x8b5/0x2c60 kernel/exit.c:750 > [] do_group_exit+0x108/0x330 kernel/exit.c:880 > [< inline >] SYSC_exit_group kernel/exit.c:891 > [] SyS_exit_group+0x1d/0x20 kernel/exit.c:889 > [] entry_SYSCALL_64_fastpath+0x16/0x7a > arch/x86/entry/entry_64.S:185 > ---[ end trace e71270304b7f911a ]--- > > > // autogenerated by syzkaller (http://github.com/google/syzkaller) > #include > #include > #include > > int main() > { > open("/dev/char/14:8", O_RDWR); > } > > On commit 30f05309bde49295e02e45c7e615f73aa4e0ccc2. This must be an off-by-one error. The fix patch is below. thanks, Takashi -- 8< -- From: Takashi Iwai Subject: [PATCH] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() ALSA sequencer OSS emulation code has a sanity check for currently opened devices, but there is a thinko there, eventually it spews warnings and skips the operation wrongly. Fix this off-by-one error. Reported-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai --- sound/core/seq/oss/seq_oss_synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c index 0f3b38184fe5..b16dbef04174 100644 --- a/sound/core/seq/oss/seq_oss_synth.c +++ b/sound/core/seq/oss/seq_oss_synth.c @@ -308,7 +308,7 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp) struct seq_oss_synth *rec; struct seq_oss_synthinfo *info; - if (snd_BUG_ON(dp->max_synthdev >= SNDRV_SEQ_OSS_MAX_SYNTH_DEVS)) + if (snd_BUG_ON(dp->max_synthdev > SNDRV_SEQ_OSS_MAX_SYNTH_DEVS)) return; for (i = 0; i < dp->max_synthdev; i++) { info = &dp->synths[i]; -- 2.7.0 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Takashi Iwai Subject: Re: sound: WARNING in snd_seq_oss_synth_cleanup Date: Mon, 25 Jan 2016 11:48:18 +0100 Message-ID: References: Mime-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Dmitry Vyukov Cc: alsa-devel@alsa-project.org, Jie Yang , Mark Brown , Jaroslav Kysela , LKML , Alexander Potapenko , Kostya Serebryany , syzkaller , Sasha Levin List-Id: alsa-devel@alsa-project.org On Sun, 24 Jan 2016 11:26:47 +0100, Dmitry Vyukov wrote: > > Hello, > > The following program triggers WARNING in snd_seq_oss_synth_cleanup: > > ------------[ cut here ]------------ > WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311 > snd_seq_oss_synth_cleanup+0x35f/0x420() > Modules linked in: > CPU: 1 PID: 7573 Comm: a.out Tainted: G W 4.4.0+ #276 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > 00000000ffffffff ffff880036bcfbb0 ffffffff82999e2d 0000000000000000 > ffff8800339797c0 ffffffff86d46580 ffff880036bcfbf0 ffffffff81352089 > ffffffff84fd380f ffffffff86d46580 0000000000000137 ffff880033e592e8 > Call Trace: > [< inline >] __dump_stack lib/dump_stack.c:15 > [] dump_stack+0x6f/0xa2 lib/dump_stack.c:50 > [] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482 > [] warn_slowpath_null+0x29/0x30 kernel/panic.c:515 > [] snd_seq_oss_synth_cleanup+0x35f/0x420 > sound/core/seq/oss/seq_oss_synth.c:311 > [] snd_seq_oss_release+0x79/0x130 > sound/core/seq/oss/seq_oss_init.c:427 > [] odev_release+0x5a/0x80 sound/core/seq/oss/seq_oss.c:155 > [] __fput+0x236/0x780 fs/file_table.c:208 > [] ____fput+0x15/0x20 fs/file_table.c:244 > [] task_work_run+0x170/0x210 kernel/task_work.c:115 > [< inline >] exit_task_work include/linux/task_work.h:21 > [] do_exit+0x8b5/0x2c60 kernel/exit.c:750 > [] do_group_exit+0x108/0x330 kernel/exit.c:880 > [< inline >] SYSC_exit_group kernel/exit.c:891 > [] SyS_exit_group+0x1d/0x20 kernel/exit.c:889 > [] entry_SYSCALL_64_fastpath+0x16/0x7a > arch/x86/entry/entry_64.S:185 > ---[ end trace e71270304b7f911a ]--- > > > // autogenerated by syzkaller (http://github.com/google/syzkaller) > #include > #include > #include > > int main() > { > open("/dev/char/14:8", O_RDWR); > } > > On commit 30f05309bde49295e02e45c7e615f73aa4e0ccc2. This must be an off-by-one error. The fix patch is below. thanks, Takashi -- 8< -- From: Takashi Iwai Subject: [PATCH] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() ALSA sequencer OSS emulation code has a sanity check for currently opened devices, but there is a thinko there, eventually it spews warnings and skips the operation wrongly. Fix this off-by-one error. Reported-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai --- sound/core/seq/oss/seq_oss_synth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c index 0f3b38184fe5..b16dbef04174 100644 --- a/sound/core/seq/oss/seq_oss_synth.c +++ b/sound/core/seq/oss/seq_oss_synth.c @@ -308,7 +308,7 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp) struct seq_oss_synth *rec; struct seq_oss_synthinfo *info; - if (snd_BUG_ON(dp->max_synthdev >= SNDRV_SEQ_OSS_MAX_SYNTH_DEVS)) + if (snd_BUG_ON(dp->max_synthdev > SNDRV_SEQ_OSS_MAX_SYNTH_DEVS)) return; for (i = 0; i < dp->max_synthdev; i++) { info = &dp->synths[i]; -- 2.7.0