From owner-freebsd-bugs@FreeBSD.ORG Sun Jul 5 20:40:01 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id F138410656AB for ; Sun, 5 Jul 2009 20:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id CD4948FC26 for ; Sun, 5 Jul 2009 20:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n65Ke174083073 for ; Sun, 5 Jul 2009 20:40:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n65Ke1PS083072; Sun, 5 Jul 2009 20:40:01 GMT (envelope-from gnats) Resent-Date: Sun, 5 Jul 2009 20:40:01 GMT Resent-Message-Id: <200907052040.n65Ke1PS083072@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Eygene Ryabinkin Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D4AFE106566C; Sun, 5 Jul 2009 20:33:41 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from 0.mx.codelabs.ru (0.mx.codelabs.ru [144.206.177.45]) by mx1.freebsd.org (Postfix) with ESMTP id 881D18FC15; Sun, 5 Jul 2009 20:33:41 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from amnesiac.at.no.dns (ppp85-141-65-195.pppoe.mtu-net.ru [85.141.65.195]) by 0.mx.codelabs.ru with esmtps (TLSv1:CAMELLIA256-SHA:256) id 1MNYP6-000Hwg-8F; Mon, 06 Jul 2009 00:33:40 +0400 Message-Id: <20090705200128.E2CE117076@amnesiac.at.no.dns> Date: Mon, 6 Jul 2009 00:01:28 +0400 (MSD) From: Eygene Ryabinkin To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: ariff@FreeBSD.org, thompsa@FreeBSD.org Subject: kern/136361: [patch] fix regression (kernel panic) in uaudio.c X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Eygene Ryabinkin List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2009 20:40:02 -0000 >Number: 136361 >Category: kern >Synopsis: [patch] fix regression (kernel panic) in uaudio.c >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Jul 05 20:40:01 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Eygene Ryabinkin >Release: FreeBSD 8.0-CURRENT amd64 >Organization: Code Labs >Environment: System: FreeBSD 8.0-CURRENT amd64 >Description: r194677 introduced a regression into uaudio.c: USB transfers for recording will result in a kernel panics due to the read of non-present memory page. This is perfectly reproducible with at least my Creative X-Fi USB card, but should trigger the panic almost with any USB sound card. The following path lines are responsible for the bug: ----- + pc = usbd_xfer_get_frame(xfer, n); + len = usbd_xfer_get_framelen(xfer, n); [...] - usbd_copy_out(xfer->frbuffers, offset1, ch->cur, m); + usbd_copy_out(pc, offset1, ch->cur, m); ----- One can easily see that before the patch, offset1 was counted from xfer->frbuffers on each iteration and after the patch it is counted from xfer->frbuffers[n] (this is what usbd_xfer_get_frame does). >How-To-Repeat: Plug the USB sound card and try to record something, for example, ----- dd if=/dev/dspX of=snd.dump bs=64k count=1 ----- >Fix: The following patch reverts the logics to the old one, but uses new xfer structure accessors. Variables were slightly renamed to better reflect the things that are done. --- fix-buffer-overflow-record-callback.diff begins here --- begin 644 fix-buffer-overflow-record-callback.diff M1G)O;2`T,6,U-#!C.&4U-F0R,#(T838Q9F(Y,S!F93@Q.#0S,6,Y,#6=E;F4@4GEA8FEN M:VEN(#QR96$M9F)S9$!C;V1E;&%B71E&9E&9E71E&9E M&9E&9E&9E5]O=70H<&,L(&]F9G-E=#$L(&-H M+3YC=7(L(&TI.PHK"0D)"75S8F1?8V]P>5]O=70H<&,L(&]F9G-E="P@8V@M M/F-UPH@"0D)"0EC:"T^8W5R(#T@8V@M M/G-T87)T.PH@"0D)"7T*(`D)"7T*+0HM"0D);V9F6=E;F4@4GEA8FEN M:VEN(#QR96$M9F)S9$!C;V1E;&%BF4@=&AE;0H*=&]T86PO8FQO8VMS:7IE(&-A;&-U;&%T:6]N M2!O<'1I;6EZ960@=&AE M(&%L:6=N(')O=71I;F4@=&\@=7-E('1H92!F86-T('1H870@=&AE(&-U3H@17EG96YE(%)Y86)I;FMI;B`\7,O9&5V+W-O=6YD+W5S8B]U875D:6\N8PII;F1E>"`R M-3`T,C)E+BXW8CDU-C(V(#$P,#8T-`HM+2T@82]S>7,O9&5V+W-O=6YD+W5S M8B]U875D:6\N8PHK*RL@8B]S>7,O9&5V+W-O=6YD+W5S8B]U875D:6\N8PI` M0"`M,3`Y+#8@*S$P.2PQ,"!`0"!365-#5$Q?24Y4*%]H=U]UF4I("8]('XH54%51$E/ M7TU)3D9204U%4R`M(#$I.PD)"0E<"BM]('=H:6QE("@P*0HK"B`C9&5F:6YE M"4U!2T5?5T]21"AH+&PI("@H*&@I(#P\(#@I('P@*&PI*0H@(V1E9FEN90E" M251?5$535"AB;2QB;F\I("@H*&)M*5LH8FYO*2`O(#A=(#X^("@W("T@*"AB M;F\I("4@."DI*2`F(#$I"B`C9&5F:6YE"55!541)3U]-05A?0TA!3BAX*2`H M>"D*0$`@+3$Q,3,L-B`K,3$Q-RPS-R!`0"!D;VYE.@H@"7T*('T*(`HK+RH* M*R`J(%-E=',@=7`@=&AE('1O=&%L('-I>F4@86YD(&)L;V-K(&-O=6YT(&9O M2!U%]F6YA;6EC('-I>FEN9R!O9B!P;&%Y+W)E8V]R9"!B=69F97(@*B\**PDJ=&]T M86P@/2!C:"T^:6YT"`J+PHK"6EF("@J8FQO8VMC;W5N="`^(&UA>%]F5]C86QL8F%C:RAS=')U8W0@=7-B7WAF97(@ M*GAF97(L('5S8E]E&9E&9E6YA;6EC('-I>FEN9R!O M9B!P;&%Y(&)U9F9E"`J+PHM"6EF("AB;&]C:V-O=6YT(#X@=7-B9%]X9F5R7VUA>%]F&9E&9E&9E6YA;6EC('-I>FEN9R!O9B!P;&%Y(&)U M9F9E"`J+PHM"6EF M("AB;&]C:V-O=6YT(#X@=7-B9%]X9F5R7VUA>%]F&9E&9ERelease-Note: >Audit-Trail: >Unformatted: