OSDN Git Service
(root)
/
uclinux-h8
/
linux.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
69a4cfd
)
ALSA: seq: Fix missing error handling in snd_seq_timer_open()
author
Takashi Iwai
<tiwai@suse.de>
Fri, 8 Mar 2013 17:11:17 +0000
(18:11 +0100)
committer
Takashi Iwai
<tiwai@suse.de>
Mon, 11 Mar 2013 08:40:36 +0000
(09:40 +0100)
snd_seq_timer_open() didn't catch the whole error path but let through
if the timer id is a slave. This may lead to Oops by accessing the
uninitialized pointer.
BUG: unable to handle kernel NULL pointer dereference at
00000000000002ae
IP: [<
ffffffff819b3477
>] snd_seq_timer_open+0xe7/0x130
PGD
785cd067
PUD
76964067
PMD 0
Oops: 0002 [#4] SMP
CPU 0
Pid: 4288, comm: trinity-child7 Tainted: G D W 3.9.0-rc1+ #100 Bochs Bochs
RIP: 0010:[<
ffffffff819b3477
>] [<
ffffffff819b3477
>] snd_seq_timer_open+0xe7/0x130
RSP: 0018:
ffff88006ece7d38
EFLAGS:
00010246
RAX:
0000000000000286
RBX:
ffff88007851b400
RCX:
0000000000000000
RDX:
000000000000ffff
RSI:
ffff88006ece7d58
RDI:
ffff88006ece7d38
RBP:
ffff88006ece7d98
R08:
000000000000000a
R09:
000000000000fffe
R10:
0000000000000000
R11:
0000000000000000
R12:
0000000000000000
R13:
ffff8800792c5400
R14:
0000000000e8f000
R15:
0000000000000007
FS:
00007f7aaa650700
(0000) GS:
ffff88007f800000
(0000) GS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
00000000000002ae
CR3:
000000006efec000
CR4:
00000000000006f0
DR0:
0000000000000000
DR1:
0000000000000000
DR2:
0000000000000000
DR3:
0000000000000000
DR6:
00000000ffff0ff0
DR7:
0000000000000400
Process trinity-child7 (pid: 4288, threadinfo
ffff88006ece6000
, task
ffff880076a8a290
)
Stack:
0000000000000286
ffffffff828f2be0
ffff88006ece7d58
ffffffff810f354d
65636e6575716573
2065756575712072
ffff8800792c0030
0000000000000000
ffff88006ece7d98
ffff8800792c5400
ffff88007851b400
ffff8800792c5520
Call Trace:
[<
ffffffff810f354d
>] ? trace_hardirqs_on+0xd/0x10
[<
ffffffff819b17e9
>] snd_seq_queue_timer_open+0x29/0x70
[<
ffffffff819ae01a
>] snd_seq_ioctl_set_queue_timer+0xda/0x120
[<
ffffffff819acb9b
>] snd_seq_do_ioctl+0x9b/0xd0
[<
ffffffff819acbe0
>] snd_seq_ioctl+0x10/0x20
[<
ffffffff811b9542
>] do_vfs_ioctl+0x522/0x570
[<
ffffffff8130a4b3
>] ? file_has_perm+0x83/0xa0
[<
ffffffff810f354d
>] ? trace_hardirqs_on+0xd/0x10
[<
ffffffff811b95ed
>] sys_ioctl+0x5d/0xa0
[<
ffffffff813663fe
>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[<
ffffffff81faed69
>] system_call_fastpath+0x16/0x1b
Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/seq/seq_timer.c
patch
|
blob
|
history
diff --git
a/sound/core/seq/seq_timer.c
b/sound/core/seq/seq_timer.c
index
160b1bd
..
24d44b2
100644
(file)
--- a/
sound/core/seq/seq_timer.c
+++ b/
sound/core/seq/seq_timer.c
@@
-290,10
+290,10
@@
int snd_seq_timer_open(struct snd_seq_queue *q)
tid.device = SNDRV_TIMER_GLOBAL_SYSTEM;
err = snd_timer_open(&t, str, &tid, q->queue);
}
- if (err < 0) {
- snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
-
return err
;
- }
+ }
+ if (err < 0) {
+
snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err)
;
+ return err;
}
t->callback = snd_seq_timer_interrupt;
t->callback_data = q;