linux-kernel - Re: ALSA: intel8x0: div by zero in snd_intel8x0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 14 May 2021 20:16:45 +0900
From:   Sergey Senozhatsky <senozhatsky@...omium.org>
To:     Takashi Iwai <tiwai@...e.de>
Cc:     Sergey Senozhatsky <senozhatsky@...omium.org>,
        Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai <tiwai@...e.com>,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        Leon Romanovsky <leon@...nel.org>, alsa-devel@...a-project.org,
        linux-kernel@...r.kernel.org
Subject: Re: ALSA: intel8x0: div by zero in snd_intel8x0_update()

On (21/05/14 13:05), Takashi Iwai wrote:
> >  divide error: 0000 [#1] PREEMPT SMP NOPTI
> >  RIP: 0010:snd_intel8x0_interrupt+0x121/0x279
> >  Code: 42 8b 44 35 34 41 0f af c5 42 03 44 35 38 42 89 44 35 38 48 8b 0c 24 80 b9 60 03 00 00 00 78 0f 49 8d 0c 2e 48 83 c1 38 31 d2 <f7> 71 f4 89 11 42 8b 7c 35 48 44 01 ef 83 e7 1f 42 89 7c 35 48 48
> >  RSP: 0000:ffff9a0a80108eb0 EFLAGS: 00010046
> >  RAX: 0000000000000000 RBX: 0000000000000019 RCX: ffff90d8c5efc198
> >  RDX: 0000000000000000 RSI: ffff9a0a80549016 RDI: ffff9a0a80549024
> >  RBP: ffff90d8c5efc060 R08: 000000000000197a R09: 00000f604ed00191
> >  R10: 00000000000001e0 R11: ffffffff9468e1d8 R12: 0000000000000020
> >  R13: 0000000000000040 R14: 0000000000000100 R15: 0000000000000002
> >  FS:  00007a75c397aff8(0000) GS:ffff90d912d80000(0000) knlGS:0000000000000000                                                               
> >  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >  CR2: 00007a77945d1000 CR3: 000000015bf46002 CR4: 0000000000360ea0
> >  Call Trace:
> >   <IRQ>
> >   __handle_irq_event_percpu+0xa0/0x1c0
> >   handle_irq_event_percpu+0x2d/0x70
> >   handle_irq_event+0x2c/0x48
> >   handle_fasteoi_irq+0xa1/0x161
> >   do_IRQ+0x51/0xd6
> >   common_interrupt+0xf/0xf
> >   </IRQ>
> >  RIP: 0033:0x7a7856462c59
> >  Code: 89 ca 48 2b 57 20 48 83 c2 10 31 c0 48 3b 57 28 48 0f 46 c1 c3 cc cc cc cc cc cc cc cc cc cc cc cc 64 48 8b 0c 25 00 00 00 00 <b8> f8 02 00 00 48 03 41 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc
> >  RSP: 002b:00007a75c39794e8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde
> >  RAX: 02fa413b24209c6c RBX: 0000017f19e1cf9e RCX: 00007a75c397aff8
> >  RDX: 00007a7855792472 RSI: 00007a7855790aa0 RDI: 0000000000000005
> >  RBP: 0000000000000005 R08: 0000000000000012 R09: 000000000000000d
> >  R10: 00000000009f86d2 R11: 000000000000197a R12: 0000017f19e40e7d
> >  R13: 000005ee937ae557 R14: 00007a7855790aa0 R15: 00007a7855792472
> >  Modules linked in:
> >  ---[ end trace 2ef6d63d0e3d757c ]---
> >  RIP: 0010:snd_intel8x0_interrupt+0x121/0x279
> >  Code: 42 8b 44 35 34 41 0f af c5 42 03 44 35 38 42 89 44 35 38 48 8b 0c 24 80 b9 60 03 00 00 00 78 0f 49 8d 0c 2e 48 83 c1 38 31 d2 <f7> 71 f4 89 11 42 8b 7c 35 48 44 01 ef 83 e7 1f 42 89 7c 35 48 48
> >  RSP: 0000:ffff9a0a80108eb0 EFLAGS: 00010046
> >  RAX: 0000000000000000 RBX: 0000000000000019 RCX: ffff90d8c5efc198
> >  RDX: 0000000000000000 RSI: ffff9a0a80549016 RDI: ffff9a0a80549024
> >  RBP: ffff90d8c5efc060 R08: 000000000000197a R09: 00000f604ed00191
> >  R10: 00000000000001e0 R11: ffffffff9468e1d8 R12: 0000000000000020
> >  R13: 0000000000000040 R14: 0000000000000100 R15: 0000000000000002
> >  FS:  00007a75c397aff8(0000) GS:ffff90d912d80000(0000) knlGS:0000000000000000                                                               
> >  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >  CR2: 00007a77945d1000 CR3: 000000015bf46002 CR4: 0000000000360ea0
> > 
> > This corresponds to
> > 
> > 	ichdev->position %= ichdev->size;
> > 
> > in snd_intel8x0_update().
> > 
> > A print out of that ichdev looks as follows
> > 
> > snd_intel8x0 0000:00:18.0: lvi_frag = 0, frags = 0, size = 0, period_size = 0x0, period_size1 = 0x0
> 
> This sounds like some spurious IRQ that casually hits during the
> resume.  It's strange that, even if it's a spurious IRQ, it contains
> the proper update bits for the stream.

Yes, I found this to be strange as well. That's why I started dumping
ichdev fields and so on.

> Is that on a real hardware or
> on a VM?

VM.

> In anyway, the patch like below might cover enough.

I'll give it a try.

> --- a/sound/pci/intel8x0.c
> +++ b/sound/pci/intel8x0.c
> @@ -691,6 +691,9 @@ static inline void snd_intel8x0_update(struct intel8x0 *chip, struct ichdev *ich
>  	int status, civ, i, step;
>  	int ack = 0;
>  
> +	if (!ichdev->substream || ichdev->suspended)
> +		return;
> +
>  	spin_lock_irqsave(&chip->reg_lock, flags);
>  	status = igetbyte(chip, port + ichdev->roff_sr);
>  	civ = igetbyte(chip, port + ICH_REG_OFF_CIV);