linux-kernel - Re: [PATCH 1/1] sound/hda/hdac_stream: Avoid NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <s5htvg7ul5q.wl-tiwai@suse.de>
Date:   Wed, 13 Mar 2019 11:24:33 +0100
From:   Takashi Iwai <tiwai@...e.de>
To:     "Mariusz Ceier" <mceier+kernel@...il.com>
Cc:     <alsa-devel@...a-project.org>,
        "Pierre-Louis Bossart" <pierre-louis.bossart@...ux.intel.com>,
        "Keyon Jie" <yang.jie@...ux.intel.com>,
        "Mohan Kumar D" <mkumard@...dia.com>,
        "Ravindra Lokhande" <rlokhande@...dia.com>,
        "Sameer Pujar" <spujar@...dia.com>,
        "Jaroslav Kysela" <perex@...ex.cz>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/1] sound/hda/hdac_stream: Avoid NULL pointer dereference

On Mon, 11 Mar 2019 21:53:57 +0100,
Mariusz Ceier wrote:
> 
> For ca0132 codec, azx_dev->stream is NULL during firmware loading.
> Calling snd_hdac_get_stream_stripe_ctl unconditionally causes NULL
> pointer dereference in that function.
> 
> Signed-off-by: Mariusz Ceier <mceier+kernel@...il.com>

Applied now (with a proper Fixes tag).


thanks,

Takashi


> ---
>  sound/hda/hdac_stream.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/sound/hda/hdac_stream.c b/sound/hda/hdac_stream.c
> index f5dd288d1a7a..76e9b41fcea2 100644
> --- a/sound/hda/hdac_stream.c
> +++ b/sound/hda/hdac_stream.c
> @@ -95,7 +95,10 @@ void snd_hdac_stream_start(struct hdac_stream *azx_dev, bool fresh_start)
>  			      1 << azx_dev->index,
>  			      1 << azx_dev->index);
>  	/* set stripe control */
> -	stripe_ctl = snd_hdac_get_stream_stripe_ctl(bus, azx_dev->substream);
> +	if (azx_dev->substream)
> +		stripe_ctl = snd_hdac_get_stream_stripe_ctl(bus, azx_dev->substream);
> +	else
> +		stripe_ctl = 0;
>  	snd_hdac_stream_updateb(azx_dev, SD_CTL_3B, SD_CTL_STRIPE_MASK,
>  				stripe_ctl);
>  	/* set DMA start and interrupt mask */
> -- 
> 2.21.0
> 
>