linux-kernel - Re: next-0519 on thinkpad x60: sound related? window manager crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <s5h8sgtede5.wl-tiwai@suse.de>
Date:   Thu, 11 Jun 2020 19:11:14 +0200
From:   Takashi Iwai <tiwai@...e.de>
To:     "Alex Xu (Hello71)" <alex_y_xu@...oo.ca>
Cc:     alsa-devel@...a-project.org, bp@...en8.de, hch@...radead.org,
        Christoph Hellwig <hch@....de>, hpa@...or.com,
        linux-kernel@...r.kernel.org, mingo@...hat.com,
        Pavel Machek <pavel@....cz>, perex@...ex.cz,
        rientjes@...gle.com, tglx@...utronix.de, tiwai@...e.com,
        x86@...nel.org
Subject: Re: next-0519 on thinkpad x60: sound related? window manager crash

On Thu, 11 Jun 2020 16:51:55 +0200,
Alex Xu (Hello71) wrote:
> 
> Excerpts from Takashi Iwai's message of June 9, 2020 11:12 am:
> > On Tue, 09 Jun 2020 13:47:33 +0200,
> > Christoph Hellwig wrote:
> >> 
> >> Alex, can you try this patch?
> > 
> > Also could you check whether just papering over the memset() call
> > alone avoids the crash like below?  For PulseAudio and dmix/dsnoop,
> > it's the only code path that accesses the vmapped buffer, I believe.
> > 
> > If this works more or less, I'll cook a more comprehensive fix.
> > 
> > 
> > thanks,
> > 
> > Takashi
> > 
> > --- a/sound/core/pcm_native.c
> > +++ b/sound/core/pcm_native.c
> > @@ -754,9 +754,11 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream,
> >  	while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size)
> >  		runtime->boundary *= 2;
> >  
> > +#if 0
> >  	/* clear the buffer for avoiding possible kernel info leaks */
> >  	if (runtime->dma_area && !substream->ops->copy_user)
> >  		memset(runtime->dma_area, 0, runtime->dma_bytes);
> > +#endif
> >  
> >  	snd_pcm_timer_resolution_change(substream);
> >  	snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP);
> > 
> 
> Sorry, this patch doesn't work for me with SME off using abfbb29297c2. 
> David's newest submitted patch works for me, which I already replied to 
> separately.

Thanks, so something still missing in the mmap handling, I guess.

I've worked on two different branches for potential fixes of your
problems.  Could you test topic/dma-fix and topic/dma-fix2 branches?
  git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
Just pull one of them onto Linus' git HEAD.

I guess we'll go with David's new patch, but still it's interesting
whether my changes do anything good actually.


Takashi