linux-kernel - Re: [PATCH v2] ALSA: seq: resize buffer for overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 9 Oct 2017 07:51:40 -0700
From:   Mark Salyzyn <salyzyn@...roid.com>
To:     Takashi Iwai <tiwai@...e.de>
Cc:     linux-kernel@...r.kernel.org, alsa-devel@...a-project.org,
        bunk@...nel.org, Jaroslav Kysela <perex@...ex.cz>, bunk@...sta.de
Subject: Re: [PATCH v2] ALSA: seq: resize buffer for overflow

On 10/07/2017 02:39 AM, Takashi Iwai wrote:
> I doubt it came from snd_midi_event_encode_byte().
> Judging from the call trace below, the event originated from the OSS
> sequencer write, i.e. it received an OSS event packet, and it was
> delivered again to another OSS sequencer port back via dummy client.
>
> If so, it should have received some EV_SYSEX packet, and it was
> processed via snd_seq_oss_synth_sysex(), and the encoded event was
> delivered.
>
> Now the question is how it triggers this Oops.  I couldn't find any
> obvious cause, but one thing I noticed is a possible race when writing
> to OSS sequencer concurrently.  Something wrong might happen.

Concurrent writing, thanks, I will switch gears and see if that 
represents the replication path!
> BTW, about your patch is buggy regarding the call kmalloc() with
> GFP_KERNEL inside spinlock.

<urrrrk> yup, withdraw this patch, and please erase it from my permanent 
record ;->

Thanks for the review, it was immensely helpful!

-- Mark