linux-kernel - [PATCH] ALSA: fix kernel panic in initialization of mpu401 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0610042216240.12556@twin.jikos.cz>
Date:	Wed, 4 Oct 2006 22:22:19 +0200 (CEST)
From:	Jiri Kosina <jikos@...os.cz>
To:	Jaroslav Kysela <perex@...e.cz>,
	Castet Matthieu <castet.matthieu@...e.fr>,
	Takashi Iwai <tiwai@...e.de>
cc:	linux-kernel@...r.kernel.org, alsa-devel@...a-project.org,
	Andrew Morton <akpm@...l.org>
Subject: [PATCH] ALSA: fix kernel panic in initialization of mpu401 driver

I am getting kernel panic (NULL pointer dereference) on boot, with kernel 
compiled with CONFIG_SND_MPU401_UART=y, on machine which does not have 
this piece of hardware.

I have traced the problem down to 
sound/drivers/mpu401/mpu401.c:snd_mpu401_probe() returning EINVAL, when 
either port or IRQ parameters are not specified.

In such case, the drivers/base/bus.c:bus_attach_device() does not perform 
klist_add_tail() call, but rather sets dev->is_registered to 0. This flag 
is however not checked by the driver, so later on, when 
alsa_card_mpu401_init() is called and platform_device_register_simple() 
fails, the following callchain happens, causing NULL pointer dereference: 
alsa_card_mpu401_init() -> platform_device_unregister() -> 
platform_device_del() -> device_del() -> bus_remove_device() -> 
klist_del() -> BOOM (the entry was not added to klist in 
bus_attach_device()).

Proper solution is returning ENODEV from the ->probe() routine, which will 
be correctly handled then by the rest of the device-driver attaching 
subsystem (namely the retval check in bus_attach_device()). The following 
patch fixes the problem, please apply.

Patch against current Linus' git tree.

Signed-off-by: Jiri Kosina <jikos@...os.cz>

--- a/sound/drivers/mpu401/mpu401.c
+++ b/sound/drivers/mpu401/mpu401.c
@@ -104,11 +104,11 @@ static int __devinit snd_mpu401_probe(st

 	if (port[dev] == SNDRV_AUTO_PORT) {
 		snd_printk(KERN_ERR "specify port\n");
-		return -EINVAL;
+		return -ENODEV;
 	}
 	if (irq[dev] == SNDRV_AUTO_IRQ) {
 		snd_printk(KERN_ERR "specify or disable IRQ\n");
-		return -EINVAL;
+		return -ENODEV;
 	}
 	err = snd_mpu401_create(dev, &card);
 	if (err < 0)

-- 
Jiri Kosina
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/