linux-kernel - Re: [PATCH for-4.11] ASoC: don't dereference NULL pcm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 13 Mar 2017 03:46:00 +0000
From:   Kuninori Morimoto <kuninori.morimoto.gx@...esas.com>
To:     Brian Norris <briannorris@...omium.org>
CC:     Liam Girdwood <lgirdwood@...il.com>,
        Mark Brown <broonie@...nel.org>,
        <linux-kernel@...r.kernel.org>, Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai <tiwai@...e.com>, <alsa-devel@...a-project.org>
Subject: Re: [PATCH for-4.11] ASoC: don't dereference NULL pcm_{new,free}


Hi Brian

Thank you for your feedback

> There are 4 drivers calling that:
> 
>   snd_soc_dummy_probe
>   rt5514_spi_probe
>   2 instances of snd_dmaengine_pcm_register, via rockchip_i2s_probe
> 
> Only the latter two seem to run the assignment here:
> 
> 	if (platform_drv->pcm_new)
> 		platform->component.pcm_new = snd_soc_platform_drv_pcm_new;
> 
> Both snd_soc_dummy_probe and rt5514_spi_probe find ->pcm_new NULL here.

Hmm...

The crasher was snd_dmaengine_pcm_register's platform ?
This means, in your current kernel, dmaengine platform dosn't call
its .pcm_new (= dmaengine_pcm_new) somehow ?

I'm wondering why ->pcm_new became NULL which exists on probe timing ?
Can you check component and driver by this patch ?
This is very rough but enough for debug

---------------------
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 5933851..43da1ec 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3322,6 +3322,10 @@ static int snd_soc_platform_drv_pcm_new(struct snd_soc_pcm_runtime *rtd)
 {
 	struct snd_soc_platform *platform = rtd->platform;
 
+	printk("-------use name: %s, %p\n",
+	       platform->component.name,
+	       platform->driver);
+
 	return platform->driver->pcm_new(rtd);
 }
 
@@ -3356,8 +3360,12 @@ int snd_soc_add_platform(struct device *dev, struct snd_soc_platform *platform,
 		platform->component.probe = snd_soc_platform_drv_probe;
 	if (platform_drv->remove)
 		platform->component.remove = snd_soc_platform_drv_remove;
-	if (platform_drv->pcm_new)
+	if (platform_drv->pcm_new) {
+		printk("-------add name: %s, %p\n",
+		       platform->component.name,
+		       platform->driver);
 		platform->component.pcm_new = snd_soc_platform_drv_pcm_new;
+	}
 	if (platform_drv->pcm_free)
 		platform->component.pcm_free = snd_soc_platform_drv_pcm_free;
 
---------------------