linux-kernel - Re: WARNING in initialize

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:   Thu, 30 Nov 2017 10:15:02 +0100
From:   Takashi Iwai <tiwai@...e.de>
To:     syzbot 
        <bot+f33bd65ef82b2dac666f0d0b79813c222cddb2e9@...kaller.appspotmail.com>
Cc:     <alsa-devel@...a-project.org>, <syzkaller-bugs@...glegroups.com>,
        <perex@...ex.cz>, <linux-kernel@...r.kernel.org>
Subject: Re: WARNING in initialize_timer

On Thu, 30 Nov 2017 06:59:01 +0100,
syzbot wrote:
> 
> Hello,
> 
> syzkaller hit the following crash on
> 43570f0383d6d5879ae585e6c3cf027ba321546f
> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/master
> compiler: gcc (GCC) 7.1.1 20170620
> .config is attached
> Raw console output is attached.
> 
> Unfortunately, I don't have any reproducer for this bug yet.
> 
> 
> binder: 4519:4521 ioctl 40046205 2 returned -22
> binder: 4519:4521 ioctl c0106403 20008ff0 returned -22
> WARNING: CPU: 0 PID: 4528 at sound/core/seq/seq_timer.c:358
> initialize_timer+0x22d/0x290 sound/core/seq/seq_timer.c:358

This must be a spurious WARN_ON() when a slave timer is used while the
master is freed.

I'm going to queue the patch below.

#syz fix: ALSA: seq: Remove spurious WARN_ON() at timer check


thanks,

Takashi

-- 8< --
From: Takashi Iwai <tiwai@...e.de>
Subject: [PATCH] ALSA: seq: Remove spurious WARN_ON() at timer check

The use of snd_BUG_ON() in ALSA sequencer timer may lead to a spurious
WARN_ON() when a slave timer is deployed as its backend and a
corresponding master timer stops meanwhile.  The symptom was triggered
by syzkaller spontaneously.

Since the NULL timer is valid there, rip off snd_BUG_ON().

Reported-by: syzbot <syzkaller@...glegroups.com>
Cc: <stable@...r.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@...e.de>
---
 sound/core/seq/seq_timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
index 37d9cfbc29f9..b80985fbc334 100644
--- a/sound/core/seq/seq_timer.c
+++ b/sound/core/seq/seq_timer.c
@@ -355,7 +355,7 @@ static int initialize_timer(struct snd_seq_timer *tmr)
 	unsigned long freq;
 
 	t = tmr->timeri->timer;
-	if (snd_BUG_ON(!t))
+	if (!t)
 		return -EINVAL;
 
 	freq = tmr->preferred_resolution;
-- 
2.15.0