linux-kernel - Re: [PATCH AUTOSEL 5.13 03/12] ASoC: wm_adsp: Let soc_cleanup_component

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Aug 2021 13:15:44 +0000
From:   Charles Keepax <ckeepax@...nsource.cirrus.com>
To:     Sasha Levin <sashal@...nel.org>
CC:     <linux-kernel@...r.kernel.org>, <stable@...r.kernel.org>,
        Lucas Tanure <tanureal@...nsource.cirrus.com>,
        Mark Brown <broonie@...nel.org>,
        <patches@...nsource.cirrus.com>, <alsa-devel@...a-project.org>
Subject: Re: [PATCH AUTOSEL 5.13 03/12] ASoC: wm_adsp: Let
 soc_cleanup_component_debugfs remove debugfs

On Mon, Aug 16, 2021 at 08:35:27PM -0400, Sasha Levin wrote:
> From: Lucas Tanure <tanureal@...nsource.cirrus.com>
> 
> [ Upstream commit acbf58e530416e167c3b323111f4013d9f2b0a7d ]
> 
> soc_cleanup_component_debugfs will debugfs_remove_recursive
> the component->debugfs_root, so adsp doesn't need to also
> remove the same entry.
> By doing that adsp also creates a race with core component,
> which causes a NULL pointer dereference
> 
> Signed-off-by: Lucas Tanure <tanureal@...nsource.cirrus.com>
> Link: https://lore.kernel.org/r/20210728104416.636591-1-tanureal@opensource.cirrus.com
> Signed-off-by: Mark Brown <broonie@...nel.org>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---
>  sound/soc/codecs/wm_adsp.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
> index cef05d81c39b..6698b5343974 100644
> --- a/sound/soc/codecs/wm_adsp.c
> +++ b/sound/soc/codecs/wm_adsp.c
> @@ -746,7 +746,6 @@ static void wm_adsp2_init_debugfs(struct wm_adsp *dsp,
>  static void wm_adsp2_cleanup_debugfs(struct wm_adsp *dsp)
>  {
>  	wm_adsp_debugfs_clear(dsp);
> -	debugfs_remove_recursive(dsp->debugfs_root);
>  }

It might be better not to backport this patch to the stable
kernels. The issue has only been seen on one out of tree driver
and the patch looks a little off to me. This
debugfs_remove_recursive should run before the
soc_cleanup_component_debugfs one, and as such it's hard to see
what is actually going on. We are currently investigating internally
but we might end up reverting the change, and it only seems to be
causing issues on the one not upstreamed part.

Apologies for missing the review of this one when it went up
Mark, I was on holiday at the time.

Thanks,
Charles