linux-kernel - Re: [PATCH] Fix NULL dereference when suspending snd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20090316213225.5d59aca1.krzysztof.h1@wp.pl>
Date:	Mon, 16 Mar 2009 21:32:25 +0100
From:	Krzysztof Helt <krzysztof.h1@...pl>
To:	Lubomir Rintel <lkundrak@...sk>
Cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	linux-sound@...r.kernel.org, stable@...nel.org,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] Fix NULL dereference when suspending snd_opl3sa2

On Mon, 16 Mar 2009 15:16:08 +0100
Lubomir Rintel <lkundrak@...sk> wrote:

> On Mon, 2009-03-16 at 11:01 +0100, Lubomir Rintel wrote:
> > This should fix the following OOPS:
> > http://www.kerneloops.org/raw.php?rawid=80591&msgid=
> 

> This is the same issue, with 2.6.28:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519939
> 
> 

One should no force loading of the snd-opl3sa2 driver
in the above cases. It was forced as the opl3sa2 is a PnP chip
and the drivers were loaded as plain ISA devices.

However, this is not a cause of the OOPS. The cause is that
despite the driver returns -ENODEV, the higher layer
hides it and the driver is bound to the bus. I suppose,
the suspend and resume functions are called on it.

Look at the ISA probe function:

static int __devinit snd_opl3sa2_isa_probe(struct device *pdev,
                       unsigned int dev)
{
    struct snd_card *card;
    int err;

    card = snd_opl3sa2_card_new(dev);
    if (! card)
        return -ENOMEM;
    snd_card_set_dev(card, pdev);
    if ((err = snd_opl3sa2_probe(card, dev)) < 0) {
        snd_card_free(card);
        return err;
    }
    dev_set_drvdata(pdev, card);
    return 0;
}

If the probe function fails, the drvdata is
never set to the snd_card structure pointer.

The patch below should fix suspend and resume
functions.

Regards,
Krzysztof
PS. It is the same situation for PnP and
BIOS PnP probing in this driver.
---

Fix the OOPS during a opl3sa2 card suspend
and resume if the driver is loaded but the card
is not found.

Signed-off-by: Krzysztof Helt <krzysztof.h1@...pl>

--- a/sound/isa/opl3sa2.c~	2008-10-13 18:03:52.000000000 +0200
+++ b/sound/isa/opl3sa2.c	2009-03-16 21:20:30.841348261 +0100
@@ -550,21 +550,27 @@ static int __devinit snd_opl3sa2_mixer(s
 #ifdef CONFIG_PM
 static int snd_opl3sa2_suspend(struct snd_card *card, pm_message_t state)
 {
-	struct snd_opl3sa2 *chip = card->private_data;
+	if (card) {
+		struct snd_opl3sa2 *chip = card->private_data;
 
-	snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
-	chip->wss->suspend(chip->wss);
-	/* power down */
-	snd_opl3sa2_write(chip, OPL3SA2_PM_CTRL, OPL3SA2_PM_D3);
+		snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+		chip->wss->suspend(chip->wss);
+		/* power down */
+		snd_opl3sa2_write(chip, OPL3SA2_PM_CTRL, OPL3SA2_PM_D3);
+	}
 
 	return 0;
 }
 
 static int snd_opl3sa2_resume(struct snd_card *card)
 {
-	struct snd_opl3sa2 *chip = card->private_data;
+	struct snd_opl3sa2 *chip;
 	int i;
 
+	if (!card)
+		return 0;
+
+	chip = card->private_data;
 	/* power up */
 	snd_opl3sa2_write(chip, OPL3SA2_PM_CTRL, OPL3SA2_PM_D0);
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/