public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* Segmentation fault in i810_audio.c:__i810_update_lvi
@ 2004-05-10 16:36 Gary Wong
  2004-05-11  7:27 ` Andrew Morton
  0 siblings, 1 reply; 6+ messages in thread
From: Gary Wong @ 2004-05-10 16:36 UTC (permalink / raw)
  To: linux-kernel

Hi,

It seems that buggy programs can cause a segmentation fault in the
i810_audio module.  (I noticed the problem in DRIVER_VERSION 0.23, and
a quick peek at the 0.24 source looks as if it is still present
there.)

The problem is that if somebody opens the DSP as O_RDONLY, and then
generates a SNDCTL_DSP_SETTRIGGER with both PCM_ENABLE_INPUT and
PCM_ENABLE_OUTPUT, dmabuf->trigger will have both of those two bits
set.  This doesn't cause an immediate problem, but once i810_release()
is eventually called, it will notice the PCM_ENABLE_OUTPUT bit and
call drain_dac(), which in turn calls i810_update_lvi(), and
__i810_update_lvi(), which will cause a segmentation fault
dereferencing dmabuf->write_channel->port (where write_channel is
NULL; the channel was never established, since file->f_mode does
not include FMODE_WRITE).

I believe that one of two fixes should be applied: either the
SNDCTL_DSP_SETTRIGGER ioctl handling should not enable the
PCM_ENABLE_{IN,OUT}PUT bits unless file->f_mode is compatible,
or i810_release() should ignore the PCM_ENABLE_* bits without
the corresponding FMODE_*.

I am happy to provide a patch to i810_audio.c implementing whichever
solution you prefer, or I can send a test case and oops and backtrace
information if it will help, but I wanted to check first to see if
you already have a report about the problem and if it is still present
in the latest revision.

Cheers,
Gary.
-- 
     Gary Wong          gtw@cs.bu.edu          http://cs-people.bu.edu/gtw/

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2004-05-11 17:20 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-05-10 16:36 Segmentation fault in i810_audio.c:__i810_update_lvi Gary Wong
2004-05-11  7:27 ` Andrew Morton
2004-05-11  7:36   ` Jeff Garzik
2004-05-11  8:16     ` [BK PATCHES] i810_audio fixes from Herbert Xu Jeff Garzik
2004-05-11 17:06   ` [PATCH] Re: Segmentation fault in i810_audio.c:__i810_update_lvi Gary Wong
2004-05-11 17:20     ` Jeff Garzik

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox