linux-kernel - Re: [PATCH] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0fe07c68-9a8b-a7fd-31e1-6026589b7101@gnuweeb.org>
Date:   Fri, 25 Feb 2022 00:55:20 +0700
From:   Ammar Faizi <ammarfaizi2@...weeb.org>
To:     Péter Ujfalusi <peter.ujfalusi@...ux.intel.com>,
        Mark Brown <broonie@...nel.org>
Cc:     Daniel Baluta <daniel.baluta@....com>,
        Jaroslav Kysela <perex@...ex.cz>,
        Kai Vehmanen <kai.vehmanen@...ux.intel.com>,
        Keyon Jie <yang.jie@...ux.intel.com>,
        Liam Girdwood <lgirdwood@...il.com>,
        Pierre-Louis Bossart <pierre-louis.bossart@...ux.intel.com>,
        Rander Wang <rander.wang@...el.com>,
        Ranjani Sridharan <ranjani.sridharan@...ux.intel.com>,
        Takashi Iwai <tiwai@...e.com>, stable@...r.kernel.org,
        sound-open-firmware@...a-project.org, alsa-devel@...a-project.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM

On 2/24/22 11:53 PM, Péter Ujfalusi wrote:
> On 24/02/2022 16:51, Ammar Faizi wrote:
>> From: Ammar Faizi <ammarfaizi2@...weeb.org>
>>
>> Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns
>> -ENOMEM because it leads to a NULL pointer dereference bug.
> 
> Reviewed-by: Peter Ujfalusi <peter.ujfalusi@...ux.intel.com>

Thanks for the review, I will append this tag in the v2.

>> The dmesg says:
>>
>>    <6>[109482.497835][T138537] usb 1-2: Manufacturer: SIGMACHIP
>>    <6>[109482.502506][T138537] input: SIGMACHIP USB Keyboard as /devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/0003:1C4F:0002.000D/input/input34
>>    <6>[109482.558976][T138537] hid-generic 0003:1C4F:0002.000D: input,hidraw1: USB HID v1.10 Keyboard [SIGMACHIP USB Keyboard] on usb-0000:00:14.0-2/input0
>>    <6>[109482.561653][T138537] input: SIGMACHIP USB Keyboard Consumer Control as /devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1/0003:1C4F:0002.000E/input/input35
>>    <6>[109482.615490][T138537] input: SIGMACHIP USB Keyboard System Control as /devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.1/0003:1C4F:0002.000E/input/input36
>>    <6>[109482.615643][T138537] hid-generic 0003:1C4F:0002.000E: input,hidraw2: USB HID v1.10 Device [SIGMACHIP USB Keyboard] on usb-0000:00:14.0-2/input1
>>    <4>[110102.335460][T140985] rtw_8822ce 0000:01:00.0: timed out to flush queue 1
>>    <3>[118575.730928][ T1387] sof-audio-pci-intel-tgl 0000:00:1f.3: error: memory alloc failed: -12
> 
> Wow, I wonder what is going on that allocation fails...

Can't really tell the reason behind the -ENOMEM.

It's hard to reproduce, randomly happens. I have hit this bug
at least 4 times on my laptop with 16 GB of RAM. All happened
randomly.

I tried to torture the memory with mmap() + mlock() + memset()
+ sleep(), then playing some audio while almost running out of
memory, but still can't reproduce the same -ENOMEM.

-- 
Ammar Faizi

Download attachment "OpenPGP_0x364FBA34FF170A4B.asc" of type "application/pgp-keys" (1766 bytes)

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (496 bytes)