linux-kernel - Re: [INTERNAL][PATCH 4/7] ASoC: stm32: sai: fix stop management in isr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 2 Nov 2017 16:38:36 +0000
From:   Olivier MOYSAN <olivier.moysan@...com>
To:     Takashi Iwai <tiwai@...e.de>
CC:     "alsa-devel@...a-project.org" <alsa-devel@...a-project.org>,
        "mark.rutland@....com" <mark.rutland@....com>,
        "lgirdwood@...il.com" <lgirdwood@...il.com>,
        "mcoquelin.stm32@...il.com" <mcoquelin.stm32@...il.com>,
        "broonie@...nel.org" <broonie@...nel.org>,
        "robh@...nel.org" <robh@...nel.org>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "perex@...ex.cz" <perex@...ex.cz>,
        Alexandre TORGUE <alexandre.torgue@...com>,
        "kernel@...inux.com" <kernel@...inux.com>,
        "devicetree@...r.kernel.org" <devicetree@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Arnaud POULIQUEN <arnaud.pouliquen@...com>,
        Benjamin GAIGNARD <benjamin.gaignard@...com>
Subject: Re: [INTERNAL][PATCH 4/7] ASoC: stm32: sai: fix stop management in
 isr

Hello Takashi,

Sorry for late answer. I was OoO.
Ok, I will add a protection on sai->substream accesses.

Best regards
Olivier


On 10/26/2017 05:32 PM, Takashi Iwai wrote:
> On Thu, 19 Oct 2017 15:03:20 +0200,
> Olivier Moysan wrote:
>>
>> Add check on substream validity.
>>
>> Signed-off-by: Olivier Moysan <olivier.moysan@...com>
>> ---
>>   sound/soc/stm/stm32_sai_sub.c | 12 ++++++++----
>>   1 file changed, 8 insertions(+), 4 deletions(-)
>>
>> diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
>> index 2af397d..815ef10 100644
>> --- a/sound/soc/stm/stm32_sai_sub.c
>> +++ b/sound/soc/stm/stm32_sai_sub.c
>> @@ -184,7 +184,6 @@ static bool stm32_sai_sub_writeable_reg(struct device *dev, unsigned int reg)
>>   static irqreturn_t stm32_sai_isr(int irq, void *devid)
>>   {
>>   	struct stm32_sai_sub_data *sai = (struct stm32_sai_sub_data *)devid;
>> -	struct snd_pcm_substream *substream = sai->substream;
>>   	struct platform_device *pdev = sai->pdev;
>>   	unsigned int sr, imr, flags;
>>   	snd_pcm_state_t status = SNDRV_PCM_STATE_RUNNING;
>> @@ -199,6 +198,11 @@ static irqreturn_t stm32_sai_isr(int irq, void *devid)
>>   	regmap_update_bits(sai->regmap, STM_SAI_CLRFR_REGX, SAI_XCLRFR_MASK,
>>   			   SAI_XCLRFR_MASK);
>>   
>> +	if (!sai->substream) {
>> +		dev_err(&pdev->dev, "Device stopped. Spurious IRQ 0x%x\n", sr);
>> +		return IRQ_NONE;
>> +	}
>> +
>>   	if (flags & SAI_XIMR_OVRUDRIE) {
>>   		dev_err(&pdev->dev, "IRQ %s\n",
>>   			STM_SAI_IS_PLAYBACK(sai) ? "underrun" : "overrun");
>> @@ -227,9 +231,9 @@ static irqreturn_t stm32_sai_isr(int irq, void *devid)
>>   	}
>>   
>>   	if (status != SNDRV_PCM_STATE_RUNNING) {
>> -		snd_pcm_stream_lock(substream);
>> -		snd_pcm_stop(substream, SNDRV_PCM_STATE_XRUN);
>> -		snd_pcm_stream_unlock(substream);
>> +		snd_pcm_stream_lock(sai->substream);
>> +		snd_pcm_stop(sai->substream, SNDRV_PCM_STATE_XRUN);
>> +		snd_pcm_stream_unlock(sai->substream);
> 
> Actually changing to sai->substream opens a race, so this chunk is a
> bad move, at least.  We have no protection of sai->substream in this
> context, thus it can hit a NULL dereference...
> 
> 
> thanks,
> 
> Takashi
>