• Takashi Iwai's avatar
    ALSA: seq: Fix missing error handling in snd_seq_timer_open() · 66efdc71
    Takashi Iwai authored
    snd_seq_timer_open() didn't catch the whole error path but let through
    if the timer id is a slave.  This may lead to Oops by accessing the
    uninitialized pointer.
    
     BUG: unable to handle kernel NULL pointer dereference at 00000000000002ae
     IP: [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
     PGD 785cd067 PUD 76964067 PMD 0
     Oops: 0002 [#4] SMP
     CPU 0
     Pid: 4288, comm: trinity-child7 Tainted: G      D W 3.9.0-rc1+ #100 Bochs Bochs
     RIP: 0010:[<ffffffff819b3477>]  [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130
     RSP: 0018:ffff88006ece7d38  EFLAGS: 00010246
     RAX: 0000000000000286 RBX: ffff88007851b400 RCX: 0000000000000000
     RDX: 000000000000ffff RSI: ffff88006ece7d58 RDI: ffff88006ece7d38
     RBP: ffff88006ece7d98 R08: 000000000000000a R09: 000000000000fffe
     R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
     R13: ffff8800792c5400 R14: 0000000000e8f000 R15: 0000000000000007
     FS:  00007f7aaa650700(0000) GS:ffff88007f800000(0000) GS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 00000000000002ae CR3: 000000006efec000 CR4: 00000000000006f0
     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
     Process trinity-child7 (pid: 4288, threadinfo ffff88006ece6000, task ffff880076a8a290)
     Stack:
      0000000000000286 ffffffff828f2be0 ffff88006ece7d58 ffffffff810f354d
      65636e6575716573 2065756575712072 ffff8800792c0030 0000000000000000
      ffff88006ece7d98 ffff8800792c5400 ffff88007851b400 ffff8800792c5520
     Call Trace:
      [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
      [<ffffffff819b17e9>] snd_seq_queue_timer_open+0x29/0x70
      [<ffffffff819ae01a>] snd_seq_ioctl_set_queue_timer+0xda/0x120
      [<ffffffff819acb9b>] snd_seq_do_ioctl+0x9b/0xd0
      [<ffffffff819acbe0>] snd_seq_ioctl+0x10/0x20
      [<ffffffff811b9542>] do_vfs_ioctl+0x522/0x570
      [<ffffffff8130a4b3>] ? file_has_perm+0x83/0xa0
      [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10
      [<ffffffff811b95ed>] sys_ioctl+0x5d/0xa0
      [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f
      [<ffffffff81faed69>] system_call_fastpath+0x16/0x1b
    Reported-and-tested-by: default avatarTommi Rantala <tt.rantala@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    66efdc71
seq_timer.c 11 KB