linux-kernel - Re: snd_bt87x crash with kernel 2.6.24.2 on amd64

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 20 Feb 2008 09:19:20 +0100
From:	Clemens Ladisch <clemens@...isch.de>
To:	Andreas Matthus <matthus@...go.de>
CC:	linux-kernel@...r.kernel.org
Subject: Re: snd_bt87x crash with kernel 2.6.24.2 on amd64

Andreas Matthus wrote:
> Feb 19 19:17:01 mahome1 kernel: RIP: 0010:[<ffffffff88486a52>]  [<ffffffff88486a52>] :snd_bt87x:snd_bt87x_interrupt+0x13/0x1b8
> ...
> Feb 19 19:17:01 mahome1 kernel:  [<ffffffff80262739>] free_irq+0xf6/0x141
> Feb 19 19:17:01 mahome1 kernel:  [<ffffffff884861f2>] :snd_bt87x:snd_bt87x_free+0x34/0x52

This is caused a bug in the driver (it calls iounmap() before
free_irq()).

The patch below fixes this (I just applied it to the ALSA tree);
or you could disable CONFIG_DEBUG_SHIRQ.


Regards,
Clemens

-- 
bt87X: fix freeing of shared interrupt

Call free_irq() after iounmap() because other devices could trigger our
shared interrupt handler.

Signed-off-by: Clemens Ladisch <clemens@...isch.de>

--- linux.orig/sound/pci/bt87x.c	Tue Feb 19 15:03:57 2008 +0100
+++ linux/sound/pci/bt87x.c	Wed Feb 20 08:55:18 2008 +0100
@@ -681,15 +681,12 @@ static struct snd_kcontrol_new snd_bt87x

 static int snd_bt87x_free(struct snd_bt87x *chip)
 {
-	if (chip->mmio) {
+	if (chip->mmio)
 		snd_bt87x_stop(chip);
-		if (chip->irq >= 0)
-			synchronize_irq(chip->irq);
-
-		iounmap(chip->mmio);
-	}
 	if (chip->irq >= 0)
 		free_irq(chip->irq, chip);
+	if (chip->mmio)
+		iounmap(chip->mmio);
 	pci_release_regions(chip->pci);
 	pci_disable_device(chip->pci);
 	kfree(chip);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/