linux-kernel - ALSA: intel8x0: div by zero in snd_intel8x0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <YJ4yBmIV6RJCo42U@google.com>
Date:   Fri, 14 May 2021 17:17:10 +0900
From:   Sergey Senozhatsky <senozhatsky@...omium.org>
To:     Jaroslav Kysela <perex@...ex.cz>, Takashi Iwai <tiwai@...e.com>
Cc:     "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        Leon Romanovsky <leon@...nel.org>, alsa-devel@...a-project.org,
        linux-kernel@...r.kernel.org
Subject: ALSA: intel8x0: div by zero in snd_intel8x0_update()

Hi,

I'm running (sometimes) into the following problem during resume

 divide error: 0000 [#1] PREEMPT SMP NOPTI
 RIP: 0010:snd_intel8x0_interrupt+0x121/0x279
 Code: 42 8b 44 35 34 41 0f af c5 42 03 44 35 38 42 89 44 35 38 48 8b 0c 24 80 b9 60 03 00 00 00 78 0f 49 8d 0c 2e 48 83 c1 38 31 d2 <f7> 71 f4 89 11 42 8b 7c 35 48 44 01 ef 83 e7 1f 42 89 7c 35 48 48
 RSP: 0000:ffff9a0a80108eb0 EFLAGS: 00010046
 RAX: 0000000000000000 RBX: 0000000000000019 RCX: ffff90d8c5efc198
 RDX: 0000000000000000 RSI: ffff9a0a80549016 RDI: ffff9a0a80549024
 RBP: ffff90d8c5efc060 R08: 000000000000197a R09: 00000f604ed00191
 R10: 00000000000001e0 R11: ffffffff9468e1d8 R12: 0000000000000020
 R13: 0000000000000040 R14: 0000000000000100 R15: 0000000000000002
 FS:  00007a75c397aff8(0000) GS:ffff90d912d80000(0000) knlGS:0000000000000000                                                               
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007a77945d1000 CR3: 000000015bf46002 CR4: 0000000000360ea0
 Call Trace:
  <IRQ>
  __handle_irq_event_percpu+0xa0/0x1c0
  handle_irq_event_percpu+0x2d/0x70
  handle_irq_event+0x2c/0x48
  handle_fasteoi_irq+0xa1/0x161
  do_IRQ+0x51/0xd6
  common_interrupt+0xf/0xf
  </IRQ>
 RIP: 0033:0x7a7856462c59
 Code: 89 ca 48 2b 57 20 48 83 c2 10 31 c0 48 3b 57 28 48 0f 46 c1 c3 cc cc cc cc cc cc cc cc cc cc cc cc 64 48 8b 0c 25 00 00 00 00 <b8> f8 02 00 00 48 03 41 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc
 RSP: 002b:00007a75c39794e8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde
 RAX: 02fa413b24209c6c RBX: 0000017f19e1cf9e RCX: 00007a75c397aff8
 RDX: 00007a7855792472 RSI: 00007a7855790aa0 RDI: 0000000000000005
 RBP: 0000000000000005 R08: 0000000000000012 R09: 000000000000000d
 R10: 00000000009f86d2 R11: 000000000000197a R12: 0000017f19e40e7d
 R13: 000005ee937ae557 R14: 00007a7855790aa0 R15: 00007a7855792472
 Modules linked in:
 ---[ end trace 2ef6d63d0e3d757c ]---
 RIP: 0010:snd_intel8x0_interrupt+0x121/0x279
 Code: 42 8b 44 35 34 41 0f af c5 42 03 44 35 38 42 89 44 35 38 48 8b 0c 24 80 b9 60 03 00 00 00 78 0f 49 8d 0c 2e 48 83 c1 38 31 d2 <f7> 71 f4 89 11 42 8b 7c 35 48 44 01 ef 83 e7 1f 42 89 7c 35 48 48
 RSP: 0000:ffff9a0a80108eb0 EFLAGS: 00010046
 RAX: 0000000000000000 RBX: 0000000000000019 RCX: ffff90d8c5efc198
 RDX: 0000000000000000 RSI: ffff9a0a80549016 RDI: ffff9a0a80549024
 RBP: ffff90d8c5efc060 R08: 000000000000197a R09: 00000f604ed00191
 R10: 00000000000001e0 R11: ffffffff9468e1d8 R12: 0000000000000020
 R13: 0000000000000040 R14: 0000000000000100 R15: 0000000000000002
 FS:  00007a75c397aff8(0000) GS:ffff90d912d80000(0000) knlGS:0000000000000000                                                               
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007a77945d1000 CR3: 000000015bf46002 CR4: 0000000000360ea0

This corresponds to

	ichdev->position %= ichdev->size;

in snd_intel8x0_update().

A print out of that ichdev looks as follows

snd_intel8x0 0000:00:18.0: lvi_frag = 0, frags = 0, size = 0, period_size = 0x0, period_size1 = 0x0