q3k
/
linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
linux/sound/core/seq
History
Takashi Iwai 66efdc71d9 ALSA: seq: Fix missing error handling in snd_seq_timer_open() 
snd_seq_timer_open() didn't catch the whole error path but let through
if the timer id is a slave.  This may lead to Oops by accessing the
uninitialized pointer.

 BUG: unable to handle kernel NULL pointer dereference at 00000000000002ae
 IP: [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
 PGD 785cd067 PUD 76964067 PMD 0
 Oops: 0002 [#4] SMP
 CPU 0
 Pid: 4288, comm: trinity-child7 Tainted: G      D W 3.9.0-rc1+ #100 Bochs Bochs
 RIP: 0010:[<ffffffff819b3477>]  [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
 RSP: 0018:ffff88006ece7d38  EFLAGS: 00010246
 RAX: 0000000000000286 RBX: ffff88007851b400 RCX: 0000000000000000
 RDX: 000000000000ffff RSI: ffff88006ece7d58 RDI: ffff88006ece7d38
 RBP: ffff88006ece7d98 R08: 000000000000000a R09: 000000000000fffe
 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
 R13: ffff8800792c5400 R14: 0000000000e8f000 R15: 0000000000000007
 FS:  00007f7aaa650700(0000) GS:ffff88007f800000(0000) GS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00000000000002ae CR3: 000000006efec000 CR4: 00000000000006f0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
 Process trinity-child7 (pid: 4288, threadinfo ffff88006ece6000, task ffff880076a8a290)
 Stack:
  0000000000000286 ffffffff828f2be0 ffff88006ece7d58 ffffffff810f354d
  65636e6575716573 2065756575712072 ffff8800792c0030 0000000000000000
  ffff88006ece7d98 ffff8800792c5400 ffff88007851b400 ffff8800792c5520
 Call Trace:
  [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
  [<ffffffff819b17e9>] snd_seq_queue_timer_open+0x29/0x70
  [<ffffffff819ae01a>] snd_seq_ioctl_set_queue_timer+0xda/0x120
  [<ffffffff819acb9b>] snd_seq_do_ioctl+0x9b/0xd0
  [<ffffffff819acbe0>] snd_seq_ioctl+0x10/0x20
  [<ffffffff811b9542>] do_vfs_ioctl+0x522/0x570
  [<ffffffff8130a4b3>] ? file_has_perm+0x83/0xa0
  [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
  [<ffffffff811b95ed>] sys_ioctl+0x5d/0xa0
  [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f
  [<ffffffff81faed69>] system_call_fastpath+0x16/0x1b

Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
 		2013-03-11 09:40:36 +01:00
..
oss ALSA: seq: seq_oss_event: missing range checks 2013-03-04 16:39:50 +01:00
Kconfig ALSA: clean up the logic for building sequencer modules 2009-05-29 11:49:42 +02:00
Makefile ALSA: OSS sequencer should be initialized after snd_seq_system_client_init 2009-07-19 19:10:01 +02:00
seq.c device.h: cleanup users outside of linux/include (C files) 2012-03-11 14:27:37 -04:00
seq_clientmgr.c sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed 2011-10-31 19:31:22 -04:00
seq_clientmgr.h [ALSA] sound/core/seq: move declarations of globally visible variables to proper headers 2008-01-31 17:29:35 +01:00
seq_compat.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
seq_device.c various: Fix spelling of "registered" in comments. 2012-11-19 14:29:46 +01:00
seq_dummy.c Documentation: remove references to /etc/modprobe.conf 2012-03-30 16:03:15 -07:00
seq_fifo.c ALSA: Kill snd_assert() in sound/core/* 2008-08-13 11:46:35 +02:00
seq_fifo.h
…
seq_info.c sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed 2011-10-31 19:31:22 -04:00
seq_info.h
…
seq_lock.c sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed 2011-10-31 19:31:22 -04:00
seq_lock.h
…
seq_memory.c sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed 2011-10-31 19:31:22 -04:00
seq_memory.h ALSA: core: sparse cleanups 2011-02-14 17:10:11 +01:00
seq_midi.c sound: fix drivers needing module.h not moduleparam.h 2011-10-31 19:31:19 -04:00
seq_midi_emul.c sound: Add module.h to the previously silent sound users 2011-10-31 19:31:21 -04:00
seq_midi_event.c sound: Add module.h to the previously silent sound users 2011-10-31 19:31:21 -04:00
seq_ports.c sound: Add module.h to the previously silent sound users 2011-10-31 19:31:21 -04:00
seq_ports.h
…
seq_prioq.c ALSA: Add missing KERN_* prefix to printk in sound/core 2009-02-05 16:00:49 +01:00
seq_prioq.h
…
seq_queue.c ALSA: core: remove unused variables. 2011-05-26 08:19:04 +02:00
seq_queue.h
…
seq_system.c sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed 2011-10-31 19:31:22 -04:00
seq_system.h
…
seq_timer.c ALSA: seq: Fix missing error handling in snd_seq_timer_open() 2013-03-11 09:40:36 +01:00
seq_timer.h [ALSA] sound/core/seq: move declarations of globally visible variables to proper headers 2008-01-31 17:29:35 +01:00
seq_virmidi.c sound: Add module.h to the previously silent sound users 2011-10-31 19:31:21 -04:00