Takashi Iwai 66efdc71d9 ALSA: seq: Fix missing error handling in snd_seq_timer_open() ... snd_seq_timer_open() didn't catch the whole error path but let through if the timer id is a slave. This may lead to Oops by accessing the uninitialized pointer. BUG: unable to handle kernel NULL pointer dereference at 00000000000002ae IP: [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130 PGD 785cd067 PUD 76964067 PMD 0 Oops: 0002 [#4] SMP CPU 0 Pid: 4288, comm: trinity-child7 Tainted: G D W 3.9.0-rc1+ #100 Bochs Bochs RIP: 0010:[<ffffffff819b3477>] [<ffffffff819b3477>] snd_seq_timer_open+0xe7/0x130 RSP: 0018:ffff88006ece7d38 EFLAGS: 00010246 RAX: 0000000000000286 RBX: ffff88007851b400 RCX: 0000000000000000 RDX: 000000000000ffff RSI: ffff88006ece7d58 RDI: ffff88006ece7d38 RBP: ffff88006ece7d98 R08: 000000000000000a R09: 000000000000fffe R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8800792c5400 R14: 0000000000e8f000 R15: 0000000000000007 FS: 00007f7aaa650700(0000) GS:ffff88007f800000(0000) GS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000002ae CR3: 000000006efec000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process trinity-child7 (pid: 4288, threadinfo ffff88006ece6000, task ffff880076a8a290) Stack: 0000000000000286 ffffffff828f2be0 ffff88006ece7d58 ffffffff810f354d 65636e6575716573 2065756575712072 ffff8800792c0030 0000000000000000 ffff88006ece7d98 ffff8800792c5400 ffff88007851b400 ffff8800792c5520 Call Trace: [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff819b17e9>] snd_seq_queue_timer_open+0x29/0x70 [<ffffffff819ae01a>] snd_seq_ioctl_set_queue_timer+0xda/0x120 [<ffffffff819acb9b>] snd_seq_do_ioctl+0x9b/0xd0 [<ffffffff819acbe0>] snd_seq_ioctl+0x10/0x20 [<ffffffff811b9542>] do_vfs_ioctl+0x522/0x570 [<ffffffff8130a4b3>] ? file_has_perm+0x83/0xa0 [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff811b95ed>] sys_ioctl+0x5d/0xa0 [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f [<ffffffff81faed69>] system_call_fastpath+0x16/0x1b Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>		2013-03-11 09:40:36 +01:00
..
oss	ALSA: seq: seq_oss_event: missing range checks	2013-03-04 16:39:50 +01:00
Kconfig	ALSA: clean up the logic for building sequencer modules	2009-05-29 11:49:42 +02:00
Makefile	ALSA: OSS sequencer should be initialized after snd_seq_system_client_init	2009-07-19 19:10:01 +02:00
seq_clientmgr.c	sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed	2011-10-31 19:31:22 -04:00
seq_clientmgr.h
seq_compat.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
seq_device.c	various: Fix spelling of "registered" in comments.	2012-11-19 14:29:46 +01:00
seq_dummy.c	Documentation: remove references to /etc/modprobe.conf	2012-03-30 16:03:15 -07:00
seq_fifo.c	ALSA: Kill snd_assert() in sound/core/*	2008-08-13 11:46:35 +02:00
seq_fifo.h
seq_info.c	sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed	2011-10-31 19:31:22 -04:00
seq_info.h
seq_lock.c	sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed	2011-10-31 19:31:22 -04:00
seq_lock.h
seq_memory.c	sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed	2011-10-31 19:31:22 -04:00
seq_memory.h	ALSA: core: sparse cleanups	2011-02-14 17:10:11 +01:00
seq_midi_emul.c	sound: Add module.h to the previously silent sound users	2011-10-31 19:31:21 -04:00
seq_midi_event.c	sound: Add module.h to the previously silent sound users	2011-10-31 19:31:21 -04:00
seq_midi.c	sound: fix drivers needing module.h not moduleparam.h	2011-10-31 19:31:19 -04:00
seq_ports.c	sound: Add module.h to the previously silent sound users	2011-10-31 19:31:21 -04:00
seq_ports.h
seq_prioq.c	ALSA: Add missing KERN_* prefix to printk in sound/core	2009-02-05 16:00:49 +01:00
seq_prioq.h
seq_queue.c	ALSA: core: remove unused variables.	2011-05-26 08:19:04 +02:00
seq_queue.h
seq_system.c	sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed	2011-10-31 19:31:22 -04:00
seq_system.h
seq_timer.c	ALSA: seq: Fix missing error handling in snd_seq_timer_open()	2013-03-11 09:40:36 +01:00
seq_timer.h
seq_virmidi.c	sound: Add module.h to the previously silent sound users	2011-10-31 19:31:21 -04:00
seq.c	device.h: cleanup users outside of linux/include (C files)	2012-03-11 14:27:37 -04:00