diff options
| author | Takashi Iwai <tiwai@suse.de> | 2018-04-09 17:12:16 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2018-04-09 17:39:31 +0200 |
| commit | e1a3a981e320a6916b30ff53571ba144274def0e (patch) | |
| tree | 75652f896153b41f9825d14b8725c752070421fd /sound | |
| parent | e15dc99dbb9cf99f6432e8e3c0b3a8f7a3403a86 (diff) | |
| download | linux-0-day-e1a3a981e320a6916b30ff53571ba144274def0e.tar.gz linux-0-day-e1a3a981e320a6916b30ff53571ba144274def0e.tar.xz | |
ALSA: pcm: Remove WARN_ON() at snd_pcm_hw_params() error
snd_pcm_hw_params() (more exactly snd_pcm_hw_params_choose()) contains
a check of the return error from snd_pcm_hw_param_first() and _last()
with snd_BUG_ON() -- i.e. it may trigger WARN_ON() depending on the
kconfig.
This was a valid check in the past, as these functions shouldn't
return any error if the parameters have been already refined via
snd_pcm_hw_refine() beforehand. However, the recent rewrite
introduced a kmalloc() in snd_pcm_hw_refine() for removing VLA, and
this brought a possibility to trigger an error. As a result, syzbot
caught lots of superfluous kernel WARN_ON() and paniced via fault
injection.
As the WARN_ON() is no longer valid with the introduction of
kmalloc(), let's drop snd_BUG_ON() check, in order to make the world
peaceful place again.
Reported-by: syzbot+803e0047ac3a3096bb4f@syzkaller.appspotmail.com
Fixes: 5730f9f744cf ("ALSA: pcm: Remove VLA usage")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/core/pcm_native.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index b84554893fab2..35ffccea94c3e 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -617,7 +617,7 @@ static int snd_pcm_hw_params_choose(struct snd_pcm_substream *pcm, changed = snd_pcm_hw_param_first(pcm, params, *v, NULL); else changed = snd_pcm_hw_param_last(pcm, params, *v, NULL); - if (snd_BUG_ON(changed < 0)) + if (changed < 0) return changed; if (changed == 0) continue; |