From: Takashi Iwai <tiwai@suse.de>
To: "Srikanth K H" <srikanth.h@samsung.com>
Cc: <alsa-devel@alsa-project.org>, <keescook@chromium.org>,
<ben.hutchings@codethink.co.uk>, <perex@perex.cz>,
<elfring@users.sourceforge.net>, <linux-kernel@vger.kernel.org>,
<viro@zeniv.linux.org.uk>, <cpgs@samsung.com>
Subject: Re: [PATCHv2 1/1] Preventive fix in sound module
Date: Wed, 18 Jul 2018 17:24:56 +0200 [thread overview]
Message-ID: <s5hd0vkbm7r.wl-tiwai@suse.de> (raw)
In-Reply-To: <1531926420-25488-1-git-send-email-srikanth.h@samsung.com>
On Wed, 18 Jul 2018 17:07:00 +0200,
Srikanth K H wrote:
>
> If the timer object is created without the card for entries
> "SNDRV_TIMER_CLASS_CARD" and "SNDRV_TIMER_CLASS_PCM", then
> while reading the sound info entry in function
> "snd_timer_proc_read" the card information is directly
> dereferenced without checking for NULL and hence kernel
> panic occur. So as preventive measure while the creating
> the sound timer object is created the card information
> availability is checked for the mentioned entries and
> returned error if its NULL.
>
> Signed-off-by: Srikanth K H <srikanth.h@samsung.com>
> ---
> sound/core/timer.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/sound/core/timer.c b/sound/core/timer.c
> index c7be4f1..06f734f 100644
> --- a/sound/core/timer.c
> +++ b/sound/core/timer.c
> @@ -883,6 +883,11 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
>
> if (snd_BUG_ON(!tid))
> return -EINVAL;
> + if (tid->dev_class == SNDRV_TIMER_CLASS_CARD ||
> + tid->dev_class == SNDRV_TIMER_CLASS_PCM) {
> + if (WARN_ON(!card))
> + return -EINVAL;
> + }
> if (rtimer)
> *rtimer = NULL;
> timer = kzalloc(sizeof(*timer), GFP_KERNEL);
> @@ -1192,12 +1197,10 @@ static void snd_timer_proc_read(struct snd_info_entry *entry,
> break;
> case SNDRV_TIMER_CLASS_CARD:
> snd_iprintf(buffer, "C%i-%i: ",
> - timer->card ? timer->card->number : -1,
> - timer->tmr_device);
> + timer->card->number, timer->tmr_device);
> break;
> case SNDRV_TIMER_CLASS_PCM:
> - snd_iprintf(buffer, "P%i-%i-%i: ",
> - timer->card ? timer->card->number : -1,
> + snd_iprintf(buffer, "P%i-%i-%i: ", timer->card->number,
> timer->tmr_device, timer->tmr_subdevice);
> break;
The checks in proc are moot if we guarantee the non-NULL card at
snd_timer_new() in the above.
So it's not about fixing in sound module. It serves right. Your
patch would add a sanity check to catch a buggy code in the caller
side.
thanks,
Takashi
next prev parent reply other threads:[~2018-07-18 15:25 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20180718100741epcas1p393bea852d102e903ab6a48ff952761db@epcas1p3.samsung.com>
2018-07-18 10:07 ` [PATCH 1/1] Preventive fix in sound module Srikanth K H
2018-07-18 10:16 ` Takashi Iwai
[not found] ` <CGME20180718100741epcas1p393bea852d102e903ab6a48ff952761db@epcms5p1>
2018-07-18 10:58 ` Srikanth Korangala Hari
2018-07-18 12:14 ` Takashi Iwai
[not found] ` <CGME20180718150653epcas2p3c2f0e36569529df72ce0b79a22867eac@epcas2p3.samsung.com>
2018-07-18 15:07 ` [PATCHv2 " Srikanth K H
2018-07-18 15:24 ` Takashi Iwai [this message]
[not found] ` <CGME20180718150653epcas2p3c2f0e36569529df72ce0b79a22867eac@epcms5p8>
2018-07-19 5:16 ` Srikanth Korangala Hari
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=s5hd0vkbm7r.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=alsa-devel@alsa-project.org \
--cc=ben.hutchings@codethink.co.uk \
--cc=cpgs@samsung.com \
--cc=elfring@users.sourceforge.net \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=perex@perex.cz \
--cc=srikanth.h@samsung.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).