From patchwork Thu Mar 8 19:47:50 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10268961 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4ADEC602BD for ; Thu, 8 Mar 2018 19:48:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3AD8E28768 for ; Thu, 8 Mar 2018 19:48:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2EC2829B1C; Thu, 8 Mar 2018 19:48:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_NONE,T_DKIM_INVALID autolearn=no version=3.3.1 Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A84C428768 for ; Thu, 8 Mar 2018 19:48:00 +0000 (UTC) Received: from alsa0.perex.cz (localhost [127.0.0.1]) by alsa0.perex.cz (Postfix) with ESMTP id 3050826743C; Thu, 8 Mar 2018 20:47:58 +0100 (CET) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 91BE2267442; Thu, 8 Mar 2018 20:47:55 +0100 (CET) Received: from mail-ua0-f196.google.com (mail-ua0-f196.google.com [209.85.217.196]) by alsa0.perex.cz (Postfix) with ESMTP id 20F822673F5 for ; Thu, 8 Mar 2018 20:47:52 +0100 (CET) Received: by mail-ua0-f196.google.com with SMTP id b13so640656uam.10 for ; Thu, 08 Mar 2018 11:47:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=HnMLKgHYmuXA/VyCwAZG7edEcKiLPLck5Fx04YWRGy0=; b=sfLCC9HX+D/YbU+bekiWzERsATQLui3PRNdOv6kT5mqMqBi4kM/saQlYF55ImLA/eP UHtJeAUn74DCqXLGqApFLL7Y2vmnnLZe9l8ozhDqEFLBFbKA6uW4ArMEFIGppFjKgXlp uYLXnXb8+64fqlW0qcf/3NMBwlyp1Vb6Q9THhxKtVy5sppA2GH1Sy3z+YYP9GDY9Bu6W mb9RX87EClzw18uwgLhzKkqwwA9dpxkvRC0CdC1oBeM1WsnHW1m10qgbciLlDduDxSG1 4zd9tGn+wuZyt4id9fhmSYXnfytB2jJPpqA/2bJxcfA11+CwCmyW8Rd0vhLGOPM02Ime a0/g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=HnMLKgHYmuXA/VyCwAZG7edEcKiLPLck5Fx04YWRGy0=; b=Nl5n0DPLMybCdsm0B3QpxqKWHJib930flKWsCPfalM6lCLrRSmLSWyV6qjb9GIyIrL mJkeSG/fTNpxmTiYJ/JhqQ0Qj+pFs5rz97L7RpokwtxSwHJ7MF9mlaCZB4Fo3SqE4lDP eJpaRH0XvhZMRv/zX53oXvyHM3mPcYJBDcBvo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=HnMLKgHYmuXA/VyCwAZG7edEcKiLPLck5Fx04YWRGy0=; b=KgXY+vsHcBxWECIJHQ7/QvhroSH0+UInqVeKs0iT4HDekuZ+HhbkH8xWD492u+OUfb m53aEsyoIZTQ3Ntn9u7AkDGbwkiT5nT5DdHg0u+y5zF1ktXkrHgwLoxo5niWr83YcS3V IgFFL/931hkZvmZkGPu0k5GO1WoIBgaqie2JXJ01SijH/ISRYgr3foASCf22Zs6RBh0R kd24htjn86M+m+kDD/JCdx/xpV8zyBLa7s1MQAsB/aHUgDLs5B84ZAiVgf1s9oPacN4a ndL4+oYLIMXAdUkYyC4Xgr9Lk8LiRLxFu+FayhtL8wKrb/0+jW7BAFOenrmB/qkh32Wb 7djA== X-Gm-Message-State: APf1xPCoVI69+R6gJ/QzTOR60OUk4EshSXTsaCd70zCP2F150FbMrL6F j2/1Ej/vim/iO24weq6n38UvtYgAEilqQQ2jTvS/Dg== X-Google-Smtp-Source: AG47ELuYLIsyGuehK67x5OBRB4CFXXvODyS1XzmSvB4OD86Iopv3+a2SPglm+vgZQc0wsM+++J6PtoxDgDfbG6jI+ew= X-Received: by 10.159.36.243 with SMTP id 106mr19684148uar.83.1520538470921; Thu, 08 Mar 2018 11:47:50 -0800 (PST) MIME-Version: 1.0 Received: by 10.31.242.140 with HTTP; Thu, 8 Mar 2018 11:47:50 -0800 (PST) In-Reply-To: <20180308151421.GA13160@amd> References: <20180308151421.GA13160@amd> From: Kees Cook Date: Thu, 8 Mar 2018 11:47:50 -0800 X-Google-Sender-Auth: FuBMPf4G7lXy9j0eo0kSLeeI508 Message-ID: To: Pavel Machek Cc: peter.ujfalusi@ti.com, moderated for non-subscribers , ivo.g.dimitrov.75@gmail.com, Kevin Hilman , Tony Lindgren , security@kernel.org, Aaro Koskinen , kernel list , sre@kernel.org, martijn@brixit.nl, =?UTF-8?Q?Filip_Matijevi=C4=87?= , Mark Brown , abcloriens@gmail.com, Sakari Ailus , pali.rohar@gmail.com, Clayton Craft , linux-omap@vger.kernel.org, patrikbachan@gmail.com, linux-arm-kernel , "Serge E. Hallyn" Subject: Re: [alsa-devel] linux-next on n900: oops in codec_reg_show() when grepping sysfs X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP On Thu, Mar 8, 2018 at 7:14 AM, Pavel Machek wrote: > Hi! > > pavel@n900:/sys$ uname -a > Linux n900 4.16.0-rc4-next-20180308 #71 Thu Mar 8 15:27:49 CET 2018 > armv7l GNU/Linux > pavel@n900:/sys$ grep -ri fasdfasdf . > > leads to an oops: > > [ 2278.331878] DSS: context saved > [ 2278.820343] Unable to handle kernel NULL pointer dereference at > virtual address 00000004 > [ 2278.828948] pgd = c36040a2 > [ 2278.831787] [00000004] *pgd=876c4831, *pte=00000000, *ppte=00000000 > [ 2278.838439] Internal error: Oops: 17 [#1] ARM > [ 2278.843017] Modules linked in: > [ 2278.846221] CPU: 0 PID: 16337 Comm: grep Tainted: G W > 4.16.0-rc4-next-20180308 #71 > [ 2278.855529] Hardware name: Nokia RX-51 board > [ 2278.860015] PC is at soc_codec_reg_show+0x8/0x19c > [ 2278.864959] LR is at codec_reg_show+0x28/0x30 Looks like a NULL codec (driver has offsetof of 0x4). static ssize_t soc_codec_reg_show(struct snd_soc_codec *codec, char *buf, size_t count, loff_t pos) { ... loff_t p = 0; wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2; regsize = codec->driver->reg_word_size * 2; ... This would paper over it. I have no idea that the lifetime expectation are for codec and driver... -Kees diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 96c44f6576c9..78ad165ad424 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -137,6 +137,9 @@ static ssize_t soc_codec_reg_show(struct snd_soc_codec *codec, char *buf, size_t total = 0; loff_t p = 0; + if (!codec || !codec->driver) + return 0; + wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2; regsize = codec->driver->reg_word_size * 2;