Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934786AbcCOMfa (ORCPT ); Tue, 15 Mar 2016 08:35:30 -0400 Received: from mail-wm0-f43.google.com ([74.125.82.43]:36734 "EHLO mail-wm0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752925AbcCOMfU (ORCPT ); Tue, 15 Mar 2016 08:35:20 -0400 From: Nicolai Stange To: Jaroslav Kysela , Takashi Iwai Cc: Shuah Khan , Mauro Carvalho Chehab , Nicolai Stange , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org Subject: [PATCH] [media] sound/usb: fix NULL dereference in usb_audio_probe() Date: Tue, 15 Mar 2016 13:35:06 +0100 Message-Id: <1458045306-4170-1-git-send-email-nicstange@gmail.com> X-Mailer: git-send-email 2.7.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3068 Lines: 76 With commit aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share media resources") an access to quirk->media_device without checking for quirk != NULL has been introduced in usb_audio_probe(). With a Plantronics USB headset (device ID 0x047f:0xc010) attached, this results in the following splat at boot time: BUG: unable to handle kernel NULL pointer dereference at 0000000000000014 IP: [] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio] Oops: 0000 [#1] SMP [...] CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13 Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014 task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000 RIP: 0010:[] [] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio] [...] Call Trace: [] usb_probe_interface+0x136/0x2d0 [] driver_probe_device+0x22c/0x440 [] __driver_attach+0xd1/0xf0 [] ? driver_probe_device+0x440/0x440 [] bus_for_each_dev+0x6c/0xc0 [] driver_attach+0x1e/0x20 [] bus_add_driver+0x1c3/0x280 [] driver_register+0x60/0xe0 [] usb_register_driver+0x81/0x140 [] ? 0xffffffffa08c7000 [] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio] [] do_one_initcall+0xb3/0x1f0 [] ? __vunmap+0x81/0xd0 [] ? kmem_cache_alloc_trace+0x182/0x1d0 [] ? do_init_module+0x27/0x1d8 [] do_init_module+0x5f/0x1d8 [] load_module+0x1fe5/0x27a0 [] ? __symbol_put+0x60/0x60 [] ? vfs_read+0x110/0x130 [] SYSC_finit_module+0xe6/0x120 [] SyS_finit_module+0xe/0x10 [] do_syscall_64+0x64/0x110 [] entry_SYSCALL64_slow_path+0x25/0x25 After encountering this, the system-udevd process seems to be blocked until it is killed when hitting its timeout of 3min. In analogy to the other accesses to members of quirk in usb_audio_probe(), check for quirk != NULL before accessing its ->media_device. Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share media resources") Signed-off-by: Nicolai Stange --- Applicable to linux-next-20160315. sound/usb/card.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/card.c b/sound/usb/card.c index 63244bb..479621e 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf, if (err < 0) goto __error; - if (quirk->media_device) { + if (quirk && quirk->media_device) { /* don't want to fail when media_snd_device_create() fails */ media_snd_device_create(chip, intf); } -- 2.7.2