From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB875ECDFB8 for ; Wed, 18 Jul 2018 15:25:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7229E20850 for ; Wed, 18 Jul 2018 15:25:01 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7229E20850 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.de Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731297AbeGRQDX (ORCPT ); Wed, 18 Jul 2018 12:03:23 -0400 Received: from mx2.suse.de ([195.135.220.15]:60016 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1730902AbeGRQDX (ORCPT ); Wed, 18 Jul 2018 12:03:23 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id D8A34AE9F; Wed, 18 Jul 2018 15:24:57 +0000 (UTC) Date: Wed, 18 Jul 2018 17:24:56 +0200 Message-ID: From: Takashi Iwai To: "Srikanth K H" Cc: , , , , , , , Subject: Re: [PATCHv2 1/1] Preventive fix in sound module In-Reply-To: <1531926420-25488-1-git-send-email-srikanth.h@samsung.com> References: <1531908468-1352-1-git-send-email-srikanth.h@samsung.com> <1531926420-25488-1-git-send-email-srikanth.h@samsung.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/26 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 18 Jul 2018 17:07:00 +0200, Srikanth K H wrote: > > If the timer object is created without the card for entries > "SNDRV_TIMER_CLASS_CARD" and "SNDRV_TIMER_CLASS_PCM", then > while reading the sound info entry in function > "snd_timer_proc_read" the card information is directly > dereferenced without checking for NULL and hence kernel > panic occur. So as preventive measure while the creating > the sound timer object is created the card information > availability is checked for the mentioned entries and > returned error if its NULL. > > Signed-off-by: Srikanth K H > --- > sound/core/timer.c | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > > diff --git a/sound/core/timer.c b/sound/core/timer.c > index c7be4f1..06f734f 100644 > --- a/sound/core/timer.c > +++ b/sound/core/timer.c > @@ -883,6 +883,11 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid, > > if (snd_BUG_ON(!tid)) > return -EINVAL; > + if (tid->dev_class == SNDRV_TIMER_CLASS_CARD || > + tid->dev_class == SNDRV_TIMER_CLASS_PCM) { > + if (WARN_ON(!card)) > + return -EINVAL; > + } > if (rtimer) > *rtimer = NULL; > timer = kzalloc(sizeof(*timer), GFP_KERNEL); > @@ -1192,12 +1197,10 @@ static void snd_timer_proc_read(struct snd_info_entry *entry, > break; > case SNDRV_TIMER_CLASS_CARD: > snd_iprintf(buffer, "C%i-%i: ", > - timer->card ? timer->card->number : -1, > - timer->tmr_device); > + timer->card->number, timer->tmr_device); > break; > case SNDRV_TIMER_CLASS_PCM: > - snd_iprintf(buffer, "P%i-%i-%i: ", > - timer->card ? timer->card->number : -1, > + snd_iprintf(buffer, "P%i-%i-%i: ", timer->card->number, > timer->tmr_device, timer->tmr_subdevice); > break; The checks in proc are moot if we guarantee the non-NULL card at snd_timer_new() in the above. So it's not about fixing in sound module. It serves right. Your patch would add a sanity check to catch a buggy code in the caller side. thanks, Takashi