Skip to contentSkip to conversation

sound/usb: fix NULL dereference in usb_audio_probe()

PATCH In review Nicolai Stange 4 participants 5 messages Mar 15, 2016 Sound

lore
Share & tools
lore

Nicolai Stange

author
#0 lore raw

PATCH 1/1 sound/usb: fix NULL dereference in usb_audio_probe()

With commit

aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
media resources")

an access to quirk->media_device without checking for quirk != NULL has been introduced in usb_audio_probe().

With a Plantronics USB headset (device ID 0x047f:0xc010) attached, this results in the following splat at boot time:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
  IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  Oops: 0000 [#1] SMP
  [...]
  CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
  Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
  task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
  RIP: 0010:[<ffffffffa089aa6c>]  [<ffffffffa089aa6c>]
                                usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  [...]
  Call Trace:
   [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
   [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
   [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
   [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
   [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
   [<ffffffff815095ce>] driver_attach+0x1e/0x20
   [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
   [<ffffffff8150ab10>] driver_register+0x60/0xe0
   [<ffffffff815a7711>] usb_register_driver+0x81/0x140
   [<ffffffffa08c7000>] ? 0xffffffffa08c7000
   [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
   [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
   [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
   [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
   [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
   [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
   [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
   [<ffffffff81129870>] ? __symbol_put+0x60/0x60
   [<ffffffff81241690>] ? vfs_read+0x110/0x130
   [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
   [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
   [<ffffffff81003d94>] do_syscall_64+0x64/0x110
   [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25

After encountering this, the system-udevd process seems to be blocked until it is killed when hitting its timeout of 3min.

In analogy to the other accesses to members of quirk in usb_audio_probe(), check for quirk != NULL before accessing its ->media_device.

Fixes aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share

media resources")

Signed-off-by Nicolai Stange <[email protected]>

---
Applicable to linux-next-20160315.

 sound/usb/card.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/card.c +1 -1
index 63244bb..479621e 100644
@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
 	if (err < 0)
 		goto __error;
 
-	if (quirk->media_device) {
+	if (quirk && quirk->media_device) {
 		/* don't want to fail when media_snd_device_create() fails */
 		media_snd_device_create(chip, intf);
 	}
Signature · 1 line
2.7.2
Reviewed-by on v1 1/1
#1 lore raw
Quoted 50 lines · Nicolai Stange

With commit

aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
media resources")

an access to quirk->media_device without checking for quirk != NULL has been introduced in usb_audio_probe().

With a Plantronics USB headset (device ID 0x047f:0xc010) attached, this results in the following splat at boot time:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
  IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  Oops: 0000 [#1] SMP
  [...]
  CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
  Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
  task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
  RIP: 0010:[<ffffffffa089aa6c>]  [<ffffffffa089aa6c>]
                                usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  [...]
  Call Trace:
   [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
   [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
   [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
   [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
   [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
   [<ffffffff815095ce>] driver_attach+0x1e/0x20
   [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
   [<ffffffff8150ab10>] driver_register+0x60/0xe0
   [<ffffffff815a7711>] usb_register_driver+0x81/0x140
   [<ffffffffa08c7000>] ? 0xffffffffa08c7000
   [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
   [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
   [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
   [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
   [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
   [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
   [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
   [<ffffffff81129870>] ? __symbol_put+0x60/0x60
   [<ffffffff81241690>] ? vfs_read+0x110/0x130
   [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
   [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
   [<ffffffff81003d94>] do_syscall_64+0x64/0x110
   [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25

After encountering this, the system-udevd process seems to be blocked until it is killed when hitting its timeout of 3min.

Quoted 6 lines

In analogy to the other accesses to members of quirk in usb_audio_probe(), check for quirk != NULL before accessing its ->media_device.

Fixes aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share

media resources")

Signed-off-by Nicolai Stange <[email protected]>
Reviewed-by Takashi Iwai <[email protected]>

Mauro, please merge through your tree. I haven't merged MC changes into my tree yet.

thanks

Takashi

Quoted 23 lines

---
Applicable to linux-next-20160315.

 sound/usb/card.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/card.c +1 -1
index 63244bb..479621e 100644
@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
 	if (err < 0)
 		goto __error;
 
-	if (quirk->media_device) {
+	if (quirk && quirk->media_device) {
 		/* don't want to fail when media_snd_device_create() fails */
 		media_snd_device_create(chip, intf);
 	}
Signature · 1 line
2.7.2
#2 lore raw

Em Tue, 15 Mar 2016 13:41:28 +0100
Takashi Iwai <[email protected]> escreveu:

Quoted 55 lines
Quoted 53 lines · Nicolai Stange

With commit

aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
media resources")

an access to quirk->media_device without checking for quirk != NULL has been introduced in usb_audio_probe().

With a Plantronics USB headset (device ID 0x047f:0xc010) attached, this results in the following splat at boot time:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
  IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  Oops: 0000 [#1] SMP
  [...]
  CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
  Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
  task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
  RIP: 0010:[<ffffffffa089aa6c>]  [<ffffffffa089aa6c>]
                                usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  [...]
  Call Trace:
   [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
   [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
   [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
   [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
   [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
   [<ffffffff815095ce>] driver_attach+0x1e/0x20
   [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
   [<ffffffff8150ab10>] driver_register+0x60/0xe0
   [<ffffffff815a7711>] usb_register_driver+0x81/0x140
   [<ffffffffa08c7000>] ? 0xffffffffa08c7000
   [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
   [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
   [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
   [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
   [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
   [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
   [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
   [<ffffffff81129870>] ? __symbol_put+0x60/0x60
   [<ffffffff81241690>] ? vfs_read+0x110/0x130
   [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
   [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
   [<ffffffff81003d94>] do_syscall_64+0x64/0x110
   [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25

After encountering this, the system-udevd process seems to be blocked until it is killed when hitting its timeout of 3min.

In analogy to the other accesses to members of quirk in usb_audio_probe(), check for quirk != NULL before accessing its ->media_device.

Quoted 8 lines
Quoted 3 lines
Fixes aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share

media resources")

Signed-off-by Nicolai Stange <[email protected]>
Reviewed-by Takashi Iwai <[email protected]>

Mauro, please merge through your tree. I haven't merged MC changes into my tree yet.

OK, I'll send this fix together with some other patches in a couple of days (it needs to go first to linux-next ;) ).

Quoted 30 lines

thanks

Takashi

Quoted 23 lines

---
Applicable to linux-next-20160315.

 sound/usb/card.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/card.c +1 -1
index 63244bb..479621e 100644
@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
 	if (err < 0)
 		goto __error;
 
-	if (quirk->media_device) {
+	if (quirk && quirk->media_device) {
 		/* don't want to fail when media_snd_device_create() fails */
 		media_snd_device_create(chip, intf);
 	}
Signature · 1 line
2.7.2
Signature · 2 lines
Thanks,
Mauro
author
#3 lore raw
Quoted 62 lines · Mauro Carvalho Chehab

Em Tue, 15 Mar 2016 13:41:28 +0100
Takashi Iwai <[email protected]> escreveu:

Quoted 59 lines
Quoted 56 lines · Nicolai Stange

With commit

aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
media resources")

an access to quirk->media_device without checking for quirk != NULL has been introduced in usb_audio_probe().

With a Plantronics USB headset (device ID 0x047f:0xc010) attached, this results in the following splat at boot time:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
  IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  Oops: 0000 [#1] SMP
  [...]
  CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
  Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
  task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
  RIP: 0010:[<ffffffffa089aa6c>]  [<ffffffffa089aa6c>]
                                usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  [...]
  Call Trace:
   [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
   [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
   [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
   [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
   [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
   [<ffffffff815095ce>] driver_attach+0x1e/0x20
   [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
   [<ffffffff8150ab10>] driver_register+0x60/0xe0
   [<ffffffff815a7711>] usb_register_driver+0x81/0x140
   [<ffffffffa08c7000>] ? 0xffffffffa08c7000
   [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
   [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
   [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
   [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
   [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
   [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
   [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
   [<ffffffff81129870>] ? __symbol_put+0x60/0x60
   [<ffffffff81241690>] ? vfs_read+0x110/0x130
   [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
   [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
   [<ffffffff81003d94>] do_syscall_64+0x64/0x110
   [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25

After encountering this, the system-udevd process seems to be blocked until it is killed when hitting its timeout of 3min.

In analogy to the other accesses to members of quirk in usb_audio_probe(), check for quirk != NULL before accessing its ->media_device.

Fixes aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share

media resources")

Signed-off-by Nicolai Stange <[email protected]>
Quoted 8 lines
Quoted 4 lines
Reviewed-by Takashi Iwai <[email protected]>

Mauro, please merge through your tree. I haven't merged MC changes into my tree yet.

OK, I'll send this fix together with some other patches in a couple of days (it needs to go first to linux-next ;) ).

Thank you all!

Nicolai

Quoted 25 lines
Quoted 25 lines
Quoted 25 lines

---
Applicable to linux-next-20160315.

 sound/usb/card.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/card.c +1 -1
index 63244bb..479621e 100644
@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
 	if (err < 0)
 		goto __error;
 
-	if (quirk->media_device) {
+	if (quirk && quirk->media_device) {
 		/* don't want to fail when media_snd_device_create() fails */
 		media_snd_device_create(chip, intf);
 	}
Signature · 1 line
2.7.2
Reviewed-by on v1 1/1
#4 lore raw
In reply to Nicolai Stange
Quoted 67 lines · Nicolai Stange

With commit

aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
media resources")

an access to quirk->media_device without checking for quirk != NULL has been introduced in usb_audio_probe().

With a Plantronics USB headset (device ID 0x047f:0xc010) attached, this results in the following splat at boot time:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
  IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  Oops: 0000 [#1] SMP
  [...]
  CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
  Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
  task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
  RIP: 0010:[<ffffffffa089aa6c>]  [<ffffffffa089aa6c>]
                                usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
  [...]
  Call Trace:
   [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
   [<ffffffff81509edc>] driver_probe_device+0x22c/0x440
   [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
   [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
   [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
   [<ffffffff815095ce>] driver_attach+0x1e/0x20
   [<ffffffff81509013>] bus_add_driver+0x1c3/0x280
   [<ffffffff8150ab10>] driver_register+0x60/0xe0
   [<ffffffff815a7711>] usb_register_driver+0x81/0x140
   [<ffffffffa08c7000>] ? 0xffffffffa08c7000
   [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
   [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
   [<ffffffff811fb091>] ? __vunmap+0x81/0xd0
   [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
   [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
   [<ffffffff811b029f>] do_init_module+0x5f/0x1d8
   [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
   [<ffffffff81129870>] ? __symbol_put+0x60/0x60
   [<ffffffff81241690>] ? vfs_read+0x110/0x130
   [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
   [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
   [<ffffffff81003d94>] do_syscall_64+0x64/0x110
   [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25

After encountering this, the system-udevd process seems to be blocked until it is killed when hitting its timeout of 3min.

In analogy to the other accesses to members of quirk in usb_audio_probe(), check for quirk != NULL before accessing its ->media_device.

Fixes aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share

media resources")

Signed-off-by Nicolai Stange <[email protected]>

---
Applicable to linux-next-20160315.

 sound/usb/card.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/card.c +0 -0
index 63244bb..479621e 100644

sound/usb/card.c static int usb_audio_probe(struct usb_interface *intf, · line 618

Quoted 8 lines
sound/usb/card.c +1 -1
@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
 	if (err < 0)
 		goto __error;
 
-	if (quirk->media_device) {
+	if (quirk && quirk->media_device) {
 		/* don't want to fail when media_snd_device_create() fails */
 		media_snd_device_create(chip, intf);
 	}

Thanks for finding the problem and fixing it.

Reviewed-by Shuah Khan <[email protected]>

-- Shuah

Signature · 5 lines
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
[email protected] | (970) 217-8978