linux-kernel - Re: [PATCHv2 1/1] Preventive fix in sound module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Jul 2018 17:24:56 +0200
From:   Takashi Iwai <tiwai@...e.de>
To:     "Srikanth K H" <srikanth.h@...sung.com>
Cc:     <alsa-devel@...a-project.org>, <keescook@...omium.org>,
        <ben.hutchings@...ethink.co.uk>, <perex@...ex.cz>,
        <elfring@...rs.sourceforge.net>, <linux-kernel@...r.kernel.org>,
        <viro@...iv.linux.org.uk>, <cpgs@...sung.com>
Subject: Re: [PATCHv2 1/1] Preventive fix in sound module

On Wed, 18 Jul 2018 17:07:00 +0200,
Srikanth K H wrote:
> 
> If the timer object is created without the card for entries
> "SNDRV_TIMER_CLASS_CARD" and "SNDRV_TIMER_CLASS_PCM", then
> while reading the sound info entry in function
> "snd_timer_proc_read" the card information is directly
> dereferenced without checking for NULL and hence kernel
> panic occur. So as preventive measure while the creating
> the sound timer object is created the card information
> availability is checked for the mentioned entries and
> returned error if its NULL.
> 
> Signed-off-by: Srikanth K H <srikanth.h@...sung.com>
> ---
>  sound/core/timer.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/sound/core/timer.c b/sound/core/timer.c
> index c7be4f1..06f734f 100644
> --- a/sound/core/timer.c
> +++ b/sound/core/timer.c
> @@ -883,6 +883,11 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
>  
>  	if (snd_BUG_ON(!tid))
>  		return -EINVAL;
> +	if (tid->dev_class == SNDRV_TIMER_CLASS_CARD ||
> +			tid->dev_class == SNDRV_TIMER_CLASS_PCM) {
> +		if (WARN_ON(!card))
> +			return -EINVAL;
> +	}
>  	if (rtimer)
>  		*rtimer = NULL;
>  	timer = kzalloc(sizeof(*timer), GFP_KERNEL);
> @@ -1192,12 +1197,10 @@ static void snd_timer_proc_read(struct snd_info_entry *entry,
>  			break;
>  		case SNDRV_TIMER_CLASS_CARD:
>  			snd_iprintf(buffer, "C%i-%i: ",
> -					timer->card ? timer->card->number : -1,
> -					timer->tmr_device);
> +				    timer->card->number, timer->tmr_device);
>  			break;
>  		case SNDRV_TIMER_CLASS_PCM:
> -			snd_iprintf(buffer, "P%i-%i-%i: ",
> -					timer->card ? timer->card->number : -1,
> +			snd_iprintf(buffer, "P%i-%i-%i: ", timer->card->number,
>  				    timer->tmr_device, timer->tmr_subdevice);
>  			break;

The checks in proc are moot if we guarantee the non-NULL card at
snd_timer_new() in the above.

So it's not about fixing in sound module.  It serves right.  Your
patch would add a sanity check to catch a buggy code in the caller
side.


thanks,

Takashi