linux-kernel - Re: [BUG] Kernel crash on Allwinner H3 due to sound core changes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 07 Mar 2018 22:11:56 +0100
From:   Jernej Škrabec <jernej.skrabec@...l.net>
To:     Mark Brown <broonie@...nel.org>
Cc:     kuninori.morimoto.gx@...esas.com, maxime.ripard@...e-electrons.com,
        wens@...e.org, linux-arm-kernel@...ts.infradead.org,
        linux-kernel@...r.kernel.org, alsa-devel@...a-project.org
Subject: Re: [BUG] Kernel crash on Allwinner H3 due to sound core changes

Hi,

Dne ponedeljek, 05. marec 2018 ob 22:30:23 CET je Jernej Škrabec napisal(a):
> Hi,
> 
> Dne petek, 02. marec 2018 ob 13:40:50 CET je Mark Brown napisal(a):
> > On Thu, Mar 01, 2018 at 11:23:57PM +0100, Jernej Škrabec wrote:
> > > I removed parts of the code from the sun4i codec driver and
> > > interestingly
> > > it doesn't crash if I remove following lines:
> > > 
> > > ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
> > > if (ret) {
> > > 
> > > 	dev_err(&pdev->dev, "Failed to register against DMAEngine\n");
> > > 	goto err_assert_reset;
> > > 
> > > }
> > > 
> > > Is it possible that NULL pointer causes troubles somewhere down the
> > > line?
> > 
> > Shouldn't be, that's just the configuration which is optional and not
> > what we're crashing trying to register, we can mostly configure things
> > by querying the capabilities of the DMA controller via the dmaengine API
> > these days.  You're removing all the DMA support there so cutting out a
> > huge segment of the initialization of both this driver and the machine
> > driver.  Other sunxi devices seem to be starting happily in -next so
> > there's something system dependent here...
> 
> I enabled memory debugging and it seems that there is an issue caused by
> loading sun4i-codec driver and it is somehow connected to
> snd_dmaengine_pcm_unregister().
> 
> Here is relevant dmesg: https://pastebin.com/raw/80K9GPnB
> 

I found the issue. Commit be7ee5f32a9a ("ASoC: soc-generic-dmaengine-pcm: 
replace platform to component") changes struct dmaengine_pcm:

 struct dmaengine_pcm {
 	struct dma_chan *chan[SNDRV_PCM_STREAM_LAST + 1];
 	const struct snd_dmaengine_pcm_config *config;
-	struct snd_soc_platform platform;
+	struct snd_soc_component component;
 	unsigned int flags;
 };

In snd_dmaengine_pcm_register():
ret = snd_soc_add_component(dev, &pcm->component,
				    &dmaengine_pcm_component, NULL, 0);

And now, sun4i-codec first time returns -EPROBE_DEFER since driver for analog 
part is not yet loaded. Because of that, all components get destroyed.

snd_dmaengine_pcm_unregister() calls snd_soc_unregister_component() and that 
one calls __snd_soc_unregister_component() multiple times (until it fails).

Issue is that __snd_soc_unregister_component() uses kfree() on component 
pointer and that naturally can't succed since component was never kmalloc'ed 
since it is a part of a bigger structure - struct dmaengine_pcm.

What would be the best fix? Changing struct dmaengine_pcm to have pointer to a 
component, so it can be freed?

Best regards,
Jernej