On Thu, 28 Dec 2017 07:43:36 +0100, b_lkasam@xxxxxxxxxxxxxx wrote: > > hi ALSA team, > Recently when running KASAN on our devices, > we found below KASAN failure wrt uninitialized mem access(or null-ptr > deref) in file sound/core/timer.c. > > And our codebase already have this fix > https://www.spinics.net/lists/alsa-devel/msg63410.html > Seems issue is still present, please help check and comment. > > Let me know if you need any other inputs. Could you check whether 4.15-rc kernel still shows the issue? Judging from the line number in sound/core/timer.c, the code you're testing isn't the latest one, and some fixes might be missing. Takashi > > Observed Result:- > ================================================================== > sde_rotator ae00000.qcom,mdss_rotator: <SDEROT_WARN> invalid ioctl > type c040563d > sde_rotator ae00000.qcom,mdss_rotator: <SDEROT_WARN> invalid ioctl > type 4c81 > BUG: KASAN: null-ptr-deref in copy_to_user > arch/arm64/include/asm/uaccess.h:398 [inline] > BUG: KASAN: null-ptr-deref in snd_timer_user_read+0x33c/0x458 > sound/core/timer.c:2010 > Read of size 32 at addr (null) by task syz-executor/2171 > sde_rotator ae00000.qcom,mdss_rotator: <SDEROT_WARN> invalid output > format 0x00000000 7x2305 > CPU: 6 PID: 2171 Comm: syz-executor Tainted: G B W O 4.9.65+ #1 > Hardware name: Qualcomm Technologies, Inc. SDM670 PM660 + PM660L MTP > (DT) > Call trace: > [<ffffff9ed988d390>] dump_backtrace+0x0/0x428 > arch/arm64/kernel/traps.c:76 > [<ffffff9ed988d7e0>] show_stack+0x28/0x38 arch/arm64/kernel/traps.c:226 > [<ffffff9ed9e2d9b8>] __dump_stack lib/dump_stack.c:15 [inline] > [<ffffff9ed9e2d9b8>] dump_stack+0xd4/0x124 lib/dump_stack.c:51 > [<ffffff9ed9b1d77c>] kasan_report_error mm/kasan/report.c:345 [inline] > [<ffffff9ed9b1d77c>] kasan_report.part.2+0xdc/0x2f0 > mm/kasan/report.c:371 > [<ffffff9ed9b1df44>] kasan_report+0x5c/0x70 mm/kasan/report.c:372 > [<ffffff9ed9b1c434>] check_memory_region_inline mm/kasan/kasan.c:301 > [inline] > [<ffffff9ed9b1c434>] check_memory_region+0x12c/0x1c0 > mm/kasan/kasan.c:315 > [<ffffff9ed9b1c4e0>] kasan_check_read+0x18/0x20 mm/kasan/kasan.c:320 > [<ffffff9edad44144>] copy_to_user arch/arm64/include/asm/uaccess.h:398 > [inline] > [<ffffff9edad44144>] snd_timer_user_read+0x33c/0x458 > sound/core/timer.c:2010 > [<ffffff9ed9b425e0>] __vfs_read+0xe0/0x2a0 fs/read_write.c:452 > [<ffffff9ed9b43e68>] vfs_read+0xb8/0x1c0 fs/read_write.c:475 > [<ffffff9ed9b461d4>] SYSC_read fs/read_write.c:591 [inline] > [<ffffff9ed9b461d4>] SyS_read+0xcc/0x170 fs/read_write.c:584 > [<ffffff9ed9883f70>] el0_svc_naked+0x24/0x28 > ================================================================== > > Thank You, > Laxminath Kasam > _______________________________________________ > Alsa-devel mailing list > Alsa-devel@xxxxxxxxxxxxxxxx > http://mailman.alsa-project.org/mailman/listinfo/alsa-devel > _______________________________________________ Alsa-devel mailing list Alsa-devel@xxxxxxxxxxxxxxxx http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
