linux-kernel - Re: [PATCH] Make snd_BUG_ON() always evaluate and return the conditional expression.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 05 Mar 2013 15:41:06 -0500
From:	Christine Spang <christine.spang@...cle.com>
To:	Takashi Iwai <tiwai@...e.de>
CC:	Jaroslav Kysela <perex@...ex.cz>, alsa-devel@...a-project.org,
	Jamie Iles <jamie.iles@...cle.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Make snd_BUG_ON() always evaluate and return the conditional
 expression.

On 03/05/2013 04:05 AM, Takashi Iwai wrote:
> At Mon,  4 Mar 2013 17:02:59 -0500,
> Christine Spang wrote:
>> Having snd_BUG_ON() only evaluate its conditional when CONFIG_SND_DEBUG
>> is set leads to frequent bugs, since other similar macros in the kernel
>> have different behavior. Let's make snd_BUG_ON() act like those macros
>> so it will stop being accidentally misused.
>>
>> Signed-off-by: Christine Spang <christine.spang@...cle.com>
> Sounds reasonable.  The dependency on CONFIG_SND_DEBUG was for
> allowing more optimization, but since we use this for more places than
> expected, this change would be safer indeed.
>
> If no one has objection, I'll apply it for 3.10 kernel.
>
>
> thanks,
>
> Takashi

This ought to be considered for 3.9 and stable@ as
well. It fixes NULL derefs all over the place, e.g.

sound/core/device.c:126

    if (snd_BUG_ON(!card || !device_data))
        return -ENXIO;
    list_for_each_entry(dev, &card->devices, list) {
       [...]

If card == NULL and CONFIG_SND_DEBUG is off, this code will NULL deref.

There are some 600 other instances of snd_BUG_ON() being used dubiously
in the current tree. Some of these instances even perform extra cleanup
before returning in error conditions. It's really broken with
CONFIG_SND_DEBUG off, and no major distro ships production kernels with
this setting enabled.

Christine

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/