Skip to content

ASoC: rt1011: fix KASAN out-of-bounds bug in find_next_bit() - #2179

Merged
kv2019i merged 1 commit into
thesofproject:topic/sof-devfrom
fredoh9:fix/cml_kasan_find_next_bit
Jun 15, 2020
Merged

ASoC: rt1011: fix KASAN out-of-bounds bug in find_next_bit()#2179
kv2019i merged 1 commit into
thesofproject:topic/sof-devfrom
fredoh9:fix/cml_kasan_find_next_bit

Conversation

@fredoh9

@fredoh9fredoh9 commented Jun 9, 2020

Copy link
Copy Markdown
Collaborator

find_next_bit() try to access out-of-bounds of unsigned int variables,
rx_mask and tx_mask. Replace with unsigned long variable to avoid
pointer casting. This is verified with KASAN.

Return value of find_next_bit() is unsigned long, this is irrelevant
with the KASAN bug. But when down casting happens, at least better match
with 'unsigned'.

KASAN bug fixed,
[ 170.777592] ==================================================================
[ 170.777603] BUG: KASAN: stack-out-of-bounds in _find_next_bit.constprop.0+0x3e/0xf0
[ 170.777608] Read of size 8 at addr ffff888202d6f530 by task aplay/1757
[ 170.777615] CPU: 0 PID: 1757 Comm: aplay Not tainted 5.7.0-rc7-test+ #3
[ 170.777617] Hardware name: Google Helios/Helios, BIOS 01/21/2020
[ 170.777618] Call Trace:
[ 170.777624] dump_stack+0x76/0xa0
[ 170.777629] print_address_description.constprop.0.cold+0xd3/0x43e
[ 170.777634] ? _raw_spin_lock_irqsave+0x7b/0xd0
[ 170.777637] ? _raw_spin_trylock_bh+0xf0/0xf0
[ 170.777640] ? _find_next_bit.constprop.0+0x3e/0xf0
[ 170.777643] __kasan_report.cold+0x37/0x86
[ 170.777647] ? regmap_readable+0xb0/0xc0
[ 170.777650] ? _find_next_bit.constprop.0+0x3e/0xf0
[ 170.777652] kasan_report+0x38/0x50
[ 170.777656] _find_next_bit.constprop.0+0x3e/0xf0
[ 170.777663] rt1011_set_tdm_slot+0x125/0x5d0 [snd_soc_rt1011]
[ 170.777669] ? rt1011_hw_params+0x2f0/0x2f0 [snd_soc_rt1011]
[ 170.777672] ? mutex_unlock+0x18/0x40
[ 170.777691] snd_soc_dai_set_tdm_slot+0x152/0x210 [snd_soc_core]
[ 170.777710] ? snd_soc_dai_set_fmt+0x80/0x80 [snd_soc_core]
[ 170.777717] cml_rt1011_hw_params+0x20c/0x320 [snd_soc_cml_rt1011_rt5682]
[ 170.777735] snd_soc_link_hw_params+0x59/0x90 [snd_soc_core]
[ 170.777752] soc_pcm_hw_params+0x42c/0xb10 [snd_soc_core]
[ 170.777771] ? soc_pcm_open+0xbd0/0xbd0 [snd_soc_core]

Signed-off-by: Fred Oh fred.oh@linux.intel.com

fixes: #2176

@fredoh9
fredoh9 requested a review from lyakhJune 9, 2020 20:42
plbossart
plbossart requested changes Jun 9, 2020
View reviewed changes

@plbossartplbossart left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit-picks below, but sounds good @fredoh9

Comment threadsound/soc/codecs/rt1011.c Outdated
Comment threadsound/soc/codecs/rt1011.c Outdated
Comment threadsound/soc/codecs/rt1011.c
@fredoh9
fredoh9force-pushed the fix/cml_kasan_find_next_bit branch from 3fda7ee to 6e8604fCompareJune 9, 2020 21:27
ranj063
ranj063 reviewed Jun 9, 2020
View reviewed changes
Comment threadsound/soc/codecs/rt1011.c Outdated
@fredoh9
fredoh9force-pushed the fix/cml_kasan_find_next_bit branch from 6e8604f to 1b09e4bCompareJune 9, 2020 21:44
ranj063
ranj063 previously approved these changes Jun 9, 2020
View reviewed changes
@fredoh9

fredoh9 commented Jun 10, 2020•
edited
Loading

Copy link
Copy Markdown
CollaboratorAuthor

For failure in device test in multiple-pipeline-capture.sh with CML_MANTIS_HDA, while multiple-pipeline-playback is passed. The test case was 3x arecord + 1x aplay, one of instance is not able to run, but there is no log to dig more. I don't think the failure is related with with this PR.

2020-06-09 22:05:36 UTC [REMOTE_ERROR] Target pipeline count: 4, current process count: 3

lyakh
lyakh requested changes Jun 10, 2020
View reviewed changes
Comment threadsound/soc/codecs/rt1011.c Outdated
Comment threadsound/soc/codecs/rt1011.c Outdated
Comment threadsound/soc/codecs/rt1011.c Outdated
@fredoh9
fredoh9force-pushed the fix/cml_kasan_find_next_bit branch from 1b09e4b to e076705CompareJune 10, 2020 17:10
@fredoh9

fredoh9 commented Jun 10, 2020

Copy link
Copy Markdown
CollaboratorAuthor

@plbossart@ranj063
From @lyakh suggestion, replaced with __ffs()/__fls(). Much simpler.

@fredoh9
fredoh9force-pushed the fix/cml_kasan_find_next_bit branch 2 times, most recently from 1970c6d to bb90e6fCompareJune 11, 2020 00:58
@fredoh9

fredoh9 commented Jun 11, 2020

Copy link
Copy Markdown
CollaboratorAuthor

I worked on this in this morning. Just found I didn't push my last change. Sorry just pushed now.

ranj063
ranj063 reviewed Jun 11, 2020
View reviewed changes
Comment threadsound/soc/codecs/rt1011.c
@fredoh9
fredoh9force-pushed the fix/cml_kasan_find_next_bit branch from bb90e6f to 971d7acCompareJune 11, 2020 16:04
ranj063
ranj063 previously approved these changes Jun 11, 2020
View reviewed changes
plbossart
plbossart previously approved these changes Jun 11, 2020
View reviewed changes

@plbossartplbossart left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @fredoh9

lyakh
lyakh requested changes Jun 12, 2020
View reviewed changes
Comment threadsound/soc/codecs/rt1011.c Outdated
Comment threadsound/soc/codecs/rt1011.c Outdated
@fredoh9
ASoC: rt1011: fix KASAN out-of-bounds bug in find_next_bit()
c9f7a3b
KASAN throws the following warning in rt1011.c:
[ 170.777603] BUG: KASAN: stack-out-of-bounds in _find_next_bit.constprop.0+0x3e/0xf0
find_next_bit() relies on unsigned long pointer arguments, but this driver
uses a type cast that generates the KASAN warning. Replace find_next_bit()
and find_last_bit() with __ffs() and __fls() to pass the value and avoid
casting pointers to make the warning go away.
Signed-off-by: Fred Oh <fred.oh@linux.intel.com>
@fredoh9
fredoh9 dismissed stale reviews from plbossart and ranj063 via c9f7a3bJune 12, 2020 16:30
@fredoh9
fredoh9force-pushed the fix/cml_kasan_find_next_bit branch from 971d7ac to c9f7a3bCompareJune 12, 2020 16:30
@fredoh9
fredoh9 requested a review from lyakhJune 12, 2020 16:36
@kv2019i

kv2019i commented Jun 15, 2020

Copy link
Copy Markdown
Collaborator

Thanks @fredoh9 !

@kv2019i
kv2019i merged commit d27e0ba into thesofproject:topic/sof-devJun 15, 2020
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@plbossartplbossartplbossart approved these changes
@lyakhlyakhlyakh approved these changes
@ranj063ranj063ranj063 left review comments
@dbalutadbalutaAwaiting requested review from dbaluta
@kv2019ikv2019iAwaiting requested review from kv2019i
@lgirdwoodlgirdwoodAwaiting requested review from lgirdwood

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[BUG][CML][RT1011_RT5682] KASAN bug found to play with speaker

5 participants

@fredoh9@kv2019i@plbossart@lyakh@ranj063