linux-kernel - Re: [PATCH v2] ASoC: soc-pcm: Add NULL check in BE reparenting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 23 Nov 2022 10:16:40 +0100
From:   Cezary Rojewski <cezary.rojewski@...el.com>
To:     Srinivasa Rao Mandadapu <quic_srivasam@...cinc.com>
CC:     <agross@...nel.org>, <andersson@...nel.org>, <lgirdwood@...il.com>,
        <broonie@...nel.org>, <robh+dt@...nel.org>,
        <quic_plai@...cinc.com>, <bgoswami@...cinc.com>, <perex@...ex.cz>,
        <tiwai@...e.com>, <srinivas.kandagatla@...aro.org>,
        <quic_rohkumar@...cinc.com>, <linux-arm-msm@...r.kernel.org>,
        <alsa-devel@...a-project.org>, <linux-kernel@...r.kernel.org>,
        <swboyd@...omium.org>, <judyhsiao@...omium.org>,
        <devicetree@...r.kernel.org>
Subject: Re: [PATCH v2] ASoC: soc-pcm: Add NULL check in BE reparenting

On 2022-11-22 7:31 AM, Srinivasa Rao Mandadapu wrote:
> Add NULL check in dpcm_be_reparent API, to handle
> kernel NULL pointer dereference error.
> The issue occurred in fuzzing test.
> 
> Signed-off-by: Srinivasa Rao Mandadapu <quic_srivasam@...cinc.com>
> ---
> Changes Since V1:
>      -- Update commit title.
> 
>   sound/soc/soc-pcm.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
> index 493f003..a7810c7 100644
> --- a/sound/soc/soc-pcm.c
> +++ b/sound/soc/soc-pcm.c
> @@ -1247,6 +1247,8 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe,
>   		return;
>   
>   	be_substream = snd_soc_dpcm_get_substream(be, stream);
> +	if (!be_substream)
> +		return;
>   
>   	for_each_dpcm_fe(be, stream, dpcm) {
>   		if (dpcm->fe == fe)

The explanation provided is hardly satisfactory. The reason I asked, is 
that be_substream should never be null by the time we get to 
dpcm_be_reparent(). There is a number of invocations of 
snd_soc_dpcm_get_substream() within sound/soc/*.c and yet most of them 
are not checked - as they do not need to be.

I believe that the problem may lie elsewhere and this patch just covered 
things up.


Regards,
Czarek