From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96355C433EF for ; Tue, 14 Jun 2022 10:49:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354047AbiFNKtt (ORCPT ); Tue, 14 Jun 2022 06:49:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41036 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240905AbiFNKtl (ORCPT ); Tue, 14 Jun 2022 06:49:41 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 88E3A48E60 for ; Tue, 14 Jun 2022 03:49:40 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 321F821A4A; Tue, 14 Jun 2022 10:49:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1655203779; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BRrQFXdCbyVpl82DrmdE8Gz3NAbhN9s8qRhd/Zc1x14=; b=wikKS2WhWNH+VhmBbMHeWIzW+yoxaLMy0arjW2uaxUr7m6mQ5oIJwSxO1oNnktJQKweC0p X5ylPzAwvO3l81eNIAoJ9TtjqIJBDSYObiFapp6k+DUBMW0kuvu0GJOPF0Q5zkRF2qFw+N xjxeEVGKG6g+k+zZO6sybp5/yslZPTs= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1655203779; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BRrQFXdCbyVpl82DrmdE8Gz3NAbhN9s8qRhd/Zc1x14=; b=9ohBsH8uzbnz/w94dMmwRbPZKJfCUXyTdAVHntYO+Ega88dqMIEIAW+sNqGz9l+/wIPN7M jmjtml0FK2oOMiDw== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 1782B1361C; Tue, 14 Jun 2022 10:49:39 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 18lkBcNnqGLuXwAAMHmgww (envelope-from ); Tue, 14 Jun 2022 10:49:39 +0000 Date: Tue, 14 Jun 2022 12:49:38 +0200 Message-ID: <87y1xzplj1.wl-tiwai@suse.de> From: Takashi Iwai To: "Fabio M. De Francesco" Cc: Eugeniu Rosca , Jaroslav Kysela , Takashi Iwai , Mark Brown , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, syzbot+205eb15961852c2c5974@syzkaller.appspotmail.com, naveenkumar.sunkari@in.bosch.com, Eugeniu Rosca Subject: Re: [PATCH] ALSA: pcm: Test for "silence" field in struct "pcm_format_data" In-Reply-To: <2245197.ElGaqSPkdT@opensuse> References: <20220409012655.9399-1-fmdefrancesco@gmail.com> <20220614095851.GA4199@lxhi-065> <2245197.ElGaqSPkdT@opensuse> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.2 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 14 Jun 2022 12:43:16 +0200, Fabio M. De Francesco wrote: > > On marted́ 14 giugno 2022 11:58:51 CEST Eugeniu Rosca wrote: > > Hello Fabio, hello All, > > > > On Sa, Apr 09, 2022 at 03:26:55 +0200, Fabio M. De Francesco wrote: > > > Syzbot reports "KASAN: null-ptr-deref Write in > > > snd_pcm_format_set_silence".[1] > > > > > > It is due to missing validation of the "silence" field of struct > > > "pcm_format_data" in "pcm_formats" array. > > > > > > Add a test for valid "pat" and, if it is not so, return -EINVAL. > > > > > > [1] https://lore.kernel.org/lkml/ > 000000000000d188ef05dc2c7279@google.com/ > > > > > > Reported-and-tested-by: > syzbot+205eb15961852c2c5974@syzkaller.appspotmail.com > > > Signed-off-by: Fabio M. De Francesco > > > --- > > > > > > I wasn't able to figure out the commit for the "Fixes:" tag. If this > patch > > > is good, can someone please help with providing this missing > information? > > > > > > sound/core/pcm_misc.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/sound/core/pcm_misc.c b/sound/core/pcm_misc.c > > > index 4866aed97aac..5588b6a1ee8b 100644 > > > --- a/sound/core/pcm_misc.c > > > +++ b/sound/core/pcm_misc.c > > > @@ -433,7 +433,7 @@ int snd_pcm_format_set_silence(snd_pcm_format_t > format, void *data, unsigned int > > > return 0; > > > width = pcm_formats[(INT)format].phys; /* physical width */ > > > pat = pcm_formats[(INT)format].silence; > > > - if (! width) > > > + if (!width || !pat) > > > return -EINVAL; > > > /* signed or 1 byte data */ > > > if (pcm_formats[(INT)format].signd == 1 || width <= 8) { > > > > JFYI, PVS-Studio 7.19 reports: > > > > sound/core/pcm_misc.c 409 warn V560 A part of > conditional expression is always false: !pat. > > Sorry, I assumed (wrongly!) that when we have > > static const struct pcm_format_data > pcm_formats[(INT)SNDRV_PCM_FORMAT_LAST+1] = { > [SNDRV_PCM_FORMAT_S8] = { > .width = 8, .phys = 8, .le = -1, .signd = 1, > .silence = {}, > }, > [snip] > /* FIXME: the following two formats are not defined properly yet > */ > [SNDRV_PCM_FORMAT_MPEG] = { > .le = -1, .signd = -1, > }, > [SNDRV_PCM_FORMAT_GSM] = { > .le = -1, .signd = -1, > }, > > pointer "silence", and then "pat", must be NULL. Oh right, those are missing ones. I haven't realized that those formats are allowed by PCM OSS layer. Practically seen, those formats have never been used in reality, and we may consider dropping them completely to plug such holes... Takashi