linux-kernel - Re: Null pointer dereference when accessing /dev/dsp1 with USB speakers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <s5h622ryman.wl%tiwai@suse.de>
Date:	Mon, 21 Jan 2013 09:26:08 +0100
From:	Takashi Iwai <tiwai@...e.de>
To:	Pavel Machek <pavel@....cz>
Cc:	kernel list <linux-kernel@...r.kernel.org>, perex@...ex.cz,
	"Rafael J. Wysocki" <rjw@...k.pl>
Subject: Re: Null pointer dereference when accessing /dev/dsp1 with USB speakers

At Sat, 19 Jan 2013 18:19:36 +0100,
Pavel Machek wrote:
> 
> Hi!
> 
> > > I have USB speakers 
> > > 
> > > Bus 004 Device 002: ID 04fa:4201 Dallas Semiconductor DS4201 Audio DAC
> > > 
> > > ... which make problems again
> > > (https://lkml.org/lkml/2008/3/20/274). They refuse to produce sound,
> > > so I updated to 3.8.0-rc2 in hope that would help... and tried testing
> > > them by "cat /bin/bash > /dev/dsp1". Instant crash :-(.
> > > 
> > > I guess this will happen in more than one config...?
> > 
> > This Oops should have been fixed recently.  Please try 3.8-rc4.
> > 
> > commit 31be5425d795585251a3ee970319c37643e0cda2
> >     ALSA: usb-audio: Fix NULL dereference by access to non-existing
> >     substream
> 
> 
> It is fixed in 3.8-rc4. But... I still get this: (it happened at least
> once with 3.8-rc2 and once with 3.8-rc4).
> 
> > > Jan 18 21:23:00 amd kernel: Slab corruption (Tainted: G        W   ):
> > > size-128 start=edd71b40, len=128
> > > Jan 18 21:23:00 amd kernel: 070: 6b 6b 6b 6b 6b 6b 6b 6b 00 6b 6b 6b
> > > 6b 6b 6b a5  kkkkkkkk.kkkkkk.
> > > Jan 18 21:23:00 amd kernel: Prev obj: start=edd71ac0, len=128
> > > Jan 18 21:23:00 amd kernel: 000: 00 7f e9 e9 c8 2f 40 f0 00 00 00 00
> > > 00 00 00 00  ...../@.........
> > > Jan 18 21:23:00 amd kernel: 010: 00 00 00 00 00 00 00 00 00 6c 94 e9
> > > 00 00 00 00  .........l......
> > > Jan 18 21:23:00 amd kernel: Next obj: start=edd71bc0, len=128
> > > Jan 18 21:23:00 amd kernel: 000: 40 12 d7 ed 40 11 d7 ed 02 00 00 00
> > > 02 00 00 00  @...@...........
> > > Jan 18 21:23:00 amd kernel: 010: 00 00 00 00 00 00 00 00 20 53 77 69
> > > 74 63 68 00  ........ Switch.

Hm, the slab corruption is new to me.  Is this a regression since 3.8
kernel?


> > > Jan 18 21:23:00 amd kernel: 8:0: cannot get min/max values for control
> > > 5 (id 8)
> > > Jan 18 21:23:00 amd kernel: 8:0: cannot get min/max values for control
> > > 6 (id 8)
> > > Jan 18 21:23:00 amd kernel: 8:0: cannot get min/max values for control
> > > 1 (id 8)
> > > Jan 18 21:23:00 amd kernel: 8:0: cannot get min/max values for control
> > > 2 (id 8)

These are usually harmless unless you get them endlessly.

Some devices don't report back the proper value at the first query
during the device probing by some reason.  These error messages show
that.  The driver tries to ask again when necessary, so if the mixer
looks working, it is OK.


Takashi

> > > Jan 18 21:23:00 amd kernel: usb 4-1: adding 4-1:1.1 (config #1,
> > > interface 1)
> > > Jan 18 21:23:00 amd kernel: hub 4-0:1.0: state 7 ports 2 chg 0000 evt
> > > 0002
> 
> Any ideas? Any similar reports?
> 
> (Hmm, and maybe "SLAB corruption" messages should have higher
> severity? KERN_ALERT or something, so that it is broadcast to all
> consoles?)
> 
> Thanks,
> 									Pavel
> -- 
> (english) http://www.livejournal.com/~pavelmachek
> (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/