Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1311532 > unrolled thread

sound: BUG in snd_ctl_find_numid

Back to article view | Back to linux.kernel

Contents

  sound: BUG in snd_ctl_find_numid Dmitry Vyukov <dvyukov@google.com> - 2016-01-18 14:10 +0100
    Re: sound: BUG in snd_ctl_find_numid Takashi Iwai <tiwai@suse.de> - 2016-01-18 14:20 +0100
      Re: sound: BUG in snd_ctl_find_numid Dmitry Vyukov <dvyukov@google.com> - 2016-01-18 14:20 +0100

#1311532 — sound: BUG in snd_ctl_find_numid

Hello,

The following program triggers a BUG in snd_ctl_find_numid:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sound/asound.h>

int main()
{
  struct snd_ctl_tlv tlv;
  int fd = open("/dev/snd/controlC0", O_RDWR);
  tlv.numid = 0;
  tlv.length = 8;
  ioctl(fd, SNDRV_CTL_IOCTL_TLV_WRITE, &tlv);
  return 0;
}

------------[ cut here ]------------
WARNING: CPU: 1 PID: 29204 at sound/core/control.c:668
snd_ctl_find_numid+0xff/0x130()
Modules linked in:
CPU: 1 PID: 29204 Comm: a.out Tainted: G        W       4.4.0+ #259
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 00000000ffffffff ffff88005e55fb30 ffffffff8298accd 0000000000000000
 ffff8800647caf80 ffffffff86d23d80 ffff88005e55fb70 ffffffff81352089
 ffffffff84f16b3f ffffffff86d23d80 000000000000029c ffff88002402cb60
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff8298accd>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
 [<ffffffff81352089>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
 [<ffffffff813522b9>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
 [<ffffffff84f16b3f>] snd_ctl_find_numid+0xff/0x130 sound/core/control.c:668
 [<ffffffff84f1caf9>] snd_ctl_tlv_ioctl+0x119/0x680 sound/core/control.c:1409
 [<ffffffff84f1f88b>] snd_ctl_ioctl+0x24b/0xdd0 sound/core/control.c:1501
 [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [<ffffffff817ebfac>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
 [<     inline     >] SYSC_ioctl fs/ioctl.c:689
 [<ffffffff817ece5f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
 [<ffffffff863259b6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
---[ end trace 010bca66b8d6c52a ]---

On commit 5807fcaa9bf7dd87241df739161c119cf78a6bc4.

[toc] | [next] | [standalone]

#1311536

On Mon, 18 Jan 2016 13:59:49 +0100,
Dmitry Vyukov wrote:
> 
> Hello,
> 
> The following program triggers a BUG in snd_ctl_find_numid:

Do I understand correctly that you meant a kernel WARNING with a stack
trace as a "BUG"?  If so, the patch below should cover it.


thanks,

Takashi

-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] ALSA: control: Avoid kernel warnings from tlv ioctl with
 numid 0

When a TLV ioctl with numid zero is handled, the driver may spew a
kernel warning with a stack trace at each call.  The check was
intended obviously only for a kernel driver, but not for a user
interaction.  Let's fix it.

This was spotted by syzkaller fuzzer.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/core/control.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/core/control.c b/sound/core/control.c
index 196a6fe100ca..a85d45595d02 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1405,6 +1405,8 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
 		return -EFAULT;
 	if (tlv.length < sizeof(unsigned int) * 2)
 		return -EINVAL;
+	if (!tlv.numid)
+		return -EINVAL;
 	down_read(&card->controls_rwsem);
 	kctl = snd_ctl_find_numid(card, tlv.numid);
 	if (kctl == NULL) {
-- 
2.7.0

[toc] | [prev] | [next] | [standalone]

#1311540

On Mon, Jan 18, 2016 at 2:17 PM, Takashi Iwai <tiwai@suse.de> wrote:
> On Mon, 18 Jan 2016 13:59:49 +0100,
> Dmitry Vyukov wrote:
>>
>> Hello,
>>
>> The following program triggers a BUG in snd_ctl_find_numid:
>
> Do I understand correctly that you meant a kernel WARNING with a stack
> trace as a "BUG"?  If so, the patch below should cover it.


Yes, I guess it's just a BUG warning message.

> thanks,
>
> Takashi
>
> -- 8< --
> From: Takashi Iwai <tiwai@suse.de>
> Subject: [PATCH] ALSA: control: Avoid kernel warnings from tlv ioctl with
>  numid 0
>
> When a TLV ioctl with numid zero is handled, the driver may spew a
> kernel warning with a stack trace at each call.  The check was
> intended obviously only for a kernel driver, but not for a user
> interaction.  Let's fix it.
>
> This was spotted by syzkaller fuzzer.
>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
> ---
>  sound/core/control.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/sound/core/control.c b/sound/core/control.c
> index 196a6fe100ca..a85d45595d02 100644
> --- a/sound/core/control.c
> +++ b/sound/core/control.c
> @@ -1405,6 +1405,8 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
>                 return -EFAULT;
>         if (tlv.length < sizeof(unsigned int) * 2)
>                 return -EINVAL;
> +       if (!tlv.numid)
> +               return -EINVAL;
>         down_read(&card->controls_rwsem);
>         kctl = snd_ctl_find_numid(card, tlv.numid);
>         if (kctl == NULL) {
> --
> 2.7.0
>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web