Subject: [PATCH v2] media: saa7134-alsa: avoid IRQ handling before capture is prepared

Subject: [PATCH v2] media: saa7134-alsa: avoid IRQ handling before capture is prepared

[潘煜杭]

[-- Attachment #1.1: Type: text/plain, Size: 3280 bytes --]

Hello Greg and maintainers,

I apologize for the mistake in my previous submission. I sent the updated
patch directly to Greg as an attachment, but I did not post it to the
linux-media mailing list. Therefore, there is no lore.kernel.org link for
that submission.

The patch fixes a potential NULL pointer dereference in the saa7134 ALSA
IRQ path. If the ALSA capture stream has not been successfully prepared,
dev->dmasound.substream may be NULL when a DMA sound interrupt is handled.
The handler can then call snd_pcm_stop_xrun() with a NULL substream and
crash the kernel in IRQ context.

The patch ignores DMA sound interrupts until the ALSA substream and the
required buffer parameters have been initialized.

The v2 patch was previously tested on a clean tree at commit
6779b50faa56 with:

  git am --3way 0001-media-saa7134-alsa-avoid-IRQ-handling-before-capture.patch
  ./scripts/checkpatch.pl --strict 0001-media-saa7134-alsa-avoid-IRQ-handling-before-capture.patch
  make M=drivers/media/pci/saa7134 modules

The patch applied successfully, checkpatch reported zero errors and zero
warnings, and the saa7134 module build succeeded.

Could you please review this patch and let me know whether an updated
version is required? I would also appreciate guidance on whether this issue
is confirmed as a security bug and whether a CVE should be requested.

Regards,

Yuhang Pan
242270054@hdu.edu.cn


======================================================================
Inline patch
======================================================================

From e8dc7af05c562822c687beae88582e78aef205f6 Mon Sep 17 00:00:00 2001
From: Pan Yuhang <242270054@hdu.edu.cn>
Date: Mon, 25 May 2026 13:45:39 +0800
Subject: [PATCH v2] media: saa7134-alsa: avoid IRQ handling before capture is
 prepared

The saa7134 ALSA IRQ handler can be reached while the ALSA PCM capture
stream has not been prepared. In that state, dmasound.substream can be
NULL and the dmasound buffer parameters can still be zero.

If a DMA sound interrupt is handled in that state,
saa7134_irq_alsa_done() can reach the overrun path and call
snd_pcm_stop_xrun() with a NULL substream pointer, causing a NULL pointer
dereference in IRQ context and a kernel panic.

The same handler also uses blocks and blksize for ring-buffer processing,
so those fields must be initialized before the IRQ path continues.

Ignore DMA sound interrupts unless the ALSA substream and buffer
parameters have been initialized.

Signed-off-by: Pan Yuhang <242270054@hdu.edu.cn>
---
 drivers/media/pci/saa7134/saa7134-alsa.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
index 147985bb0261..eab0843c4eba 100644
--- a/drivers/media/pci/saa7134/saa7134-alsa.c
+++ b/drivers/media/pci/saa7134/saa7134-alsa.c
@@ -126,6 +126,11 @@ static void saa7134_irq_alsa_done(struct saa7134_dev *dev,
     int next_blk, reg = 0;
 
     spin_lock(&dev->slock);
+    if (!dev->dmasound.substream || !dev->dmasound.blocks ||
+        !dev->dmasound.blksize) {
+        pr_debug("irq: recording not active\n");
+        goto done;
+    }
     if (UNSET == dev->dmasound.dma_blk) {
         pr_debug("irq: recording stopped\n");
         goto done;
-- 
2.34.1


[-- Attachment #1.2: Type: text/html, Size: 3865 bytes --]

[-- Attachment #2: 0001-media-saa7134-alsa-avoid-IRQ-handling-before-capture.patch --]
[-- Type: text/x-patch, Size: 1678 bytes --]

From e8dc7af05c562822c687beae88582e78aef205f6 Mon Sep 17 00:00:00 2001
From: Pan Yuhang <242270054@hdu.edu.cn>
Date: Mon, 25 May 2026 13:45:39 +0800
Subject: [PATCH v2] media: saa7134-alsa: avoid IRQ handling before capture is
 prepared

The saa7134 ALSA IRQ handler can be reached while the ALSA PCM capture
stream has not been prepared. In that state, dmasound.substream can be
NULL and the dmasound buffer parameters can still be zero.

If a DMA sound interrupt is handled in that state,
saa7134_irq_alsa_done() can reach the overrun path and call
snd_pcm_stop_xrun() with a NULL substream pointer, causing a NULL pointer
dereference in IRQ context and a kernel panic.

The same handler also uses blocks and blksize for ring-buffer processing,
so those fields must be initialized before the IRQ path continues.

Ignore DMA sound interrupts unless the ALSA substream and buffer
parameters have been initialized.

Signed-off-by: Pan Yuhang <242270054@hdu.edu.cn>
---
 drivers/media/pci/saa7134/saa7134-alsa.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
index 147985bb0261..eab0843c4eba 100644
--- a/drivers/media/pci/saa7134/saa7134-alsa.c
+++ b/drivers/media/pci/saa7134/saa7134-alsa.c
@@ -126,6 +126,11 @@ static void saa7134_irq_alsa_done(struct saa7134_dev *dev,
 	int next_blk, reg = 0;
 
 	spin_lock(&dev->slock);
+	if (!dev->dmasound.substream || !dev->dmasound.blocks ||
+	    !dev->dmasound.blksize) {
+		pr_debug("irq: recording not active\n");
+		goto done;
+	}
 	if (UNSET == dev->dmasound.dma_blk) {
 		pr_debug("irq: recording stopped\n");
 		goto done;
-- 
2.34.1

Re: Subject: [PATCH v2] media: saa7134-alsa: avoid IRQ handling before capture is prepared

[Greg KH]

On Tue, Aug 18, 2026 at 03:19:51PM +0800, 潘煜杭 wrote:
> Hello Greg and maintainers,
> 
> I apologize for the mistake in my previous submission. I sent the updated
> patch directly to Greg as an attachment, but I did not post it to the
> linux-media mailing list. Therefore, there is no lore.kernel.org link for
> that submission.
> 
> The patch fixes a potential NULL pointer dereference in the saa7134 ALSA
> IRQ path. If the ALSA capture stream has not been successfully prepared,
> dev->dmasound.substream may be NULL when a DMA sound interrupt is handled.

And how can that happen?  Is it something that a user can trigger or is
this only due to fault-injection testing?

> The handler can then call snd_pcm_stop_xrun() with a NULL substream and
> crash the kernel in IRQ context.
> 
> The patch ignores DMA sound interrupts until the ALSA substream and the
> required buffer parameters have been initialized.
> 
> The v2 patch was previously tested on a clean tree at commit
> 6779b50faa56 with:
> 
>   git am --3way 0001-media-saa7134-alsa-avoid-IRQ-handling-before-capture.patch
>   ./scripts/checkpatch.pl --strict 0001-media-saa7134-alsa-avoid-IRQ-handling-before-capture.patch
>   make M=drivers/media/pci/saa7134 modules
> 
> The patch applied successfully, checkpatch reported zero errors and zero
> warnings, and the saa7134 module build succeeded.
> 
> Could you please review this patch and let me know whether an updated
> version is required? I would also appreciate guidance on whether this issue
> is confirmed as a security bug and whether a CVE should be requested.

Again, can a user trigger this?

And please read the documentation for how CVEs are assigned (hint, this
isn't where that happens...)

thanks,

greg k-h