From: Markus Osterhoff <linux-kernel@k-raum.org>
To: alsa-devel@alsa-project.org
Cc: Takashi Iwai <tiwai@suse.com>
Subject: PATCH: ALSA: hda: fix possible null dereference
Date: Sun, 23 Aug 2015 20:37:05 +0200 [thread overview]
Message-ID: <20150823183705.GT31650@mo-online.de> (raw)
Upgrading on Gentoo hardened from 4.0.8 to 4.1.6 (with intermediate 4.1.4), I
noticed a NULL pointer derefence during booting, and tackled it down to
static int add_std_chmaps(struct hda_codec *codec)
in file sound/pci/hda/hda_codec.c
With commits bbbc7e85 and 751e2216, a for-loop was restated using
list_for_each_entry(...); originally, a local pcm* was extracted from an array
and checked against NULL, if not-NULL then passed along to
snd_pcm_add_chmap_ctls(...).
Now, pcm->pcm is passed to snd_pcm_add_chmap_ctls, but the NULL pointer check
still uses the “upper level” pcm, not the “in-loop” pcm->pcm.
Please have a look at the attached (rather small) suggestion to fix this
problem.
For a history of the function in question, have a look at lines 2430ff for
git diff v4.0 v4.1 sound/pci/hda/hda_codec.c
The two commits that touched this function are
Commit bbbc7e8502c9 ("ALSA: hda - Allocate hda_pcm objects dynamically")
Commit 751e2216899c ("ALSA: hda: fix possible null dereference")
where the latter only fixes the order of two fixes, but not the pcm / pcm->pcm confusion.
Using v4.1-descendant sources, boot got OOPS like this (two bug-hunting printk's added up front):
> pcm: ffff88040cf83400
> pcm->pcm: (nil)
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
> IP: [<ffffffffa07feab9>] snd_pcm_add_chmap_ctls+0x119/0x1f0 [snd_pcm]
> PGD 0
> Oops: 0000 [#1] PREEMPT SMP
NULL checking pcm->pcm instead of pcm fixes this problem.
Greetings and thanks for your time, Markus
Signed-off-by: Markus Osterhoff <linux-kernel@k-raum.org>
---
--- sound/pci/hda/hda_codec.c 2015-08-23 20:02:57.281782648 +0200
+++ sound/pci/hda/hda_codec.c.orig 2015-08-23 20:02:49.723783063 +0200
@@ -3172,7 +3172,7 @@ static int add_std_chmaps(struct hda_cod
struct snd_pcm_chmap *chmap;
const struct snd_pcm_chmap_elem *elem;
- if (!pcm->pcm || pcm->own_chmap ||
+ if (!pcm || pcm->own_chmap ||
!hinfo->substreams)
continue;
elem = hinfo->chmap ? hinfo->chmap : snd_pcm_std_chmaps;
_______________________________________________
Alsa-devel mailing list
Alsa-devel@alsa-project.org
http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
next reply other threads:[~2015-08-23 18:37 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-23 18:37 Markus Osterhoff [this message]
2015-08-24 6:30 ` PATCH: ALSA: hda: fix possible null dereference Takashi Iwai
2015-08-24 10:17 ` Markus Osterhoff
2015-08-24 10:25 ` Takashi Iwai
2015-08-24 12:11 ` [PATCH RESEND V2] ALSA: hda: fix possible NULL dereference Markus Osterhoff
2015-08-24 13:04 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150823183705.GT31650@mo-online.de \
--to=linux-kernel@k-raum.org \
--cc=alsa-devel@alsa-project.org \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.