[alsa-devel] /proc/asound/card0/oss_mixer stack corruption

[Tommi Rantala]

Hello,

Trinity discovered that writing 128 bytes to
/proc/asound/card0/oss_mixer triggers a stack corruption.

Tommi


# printf %128s > /proc/asound/card0/oss_mixer

ALSA: mixer_oss: invalid OSS volume ''
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted
in: ffffffff81e193ba

CPU: 0 PID: 2778 Comm: bash Not tainted 3.17.0-rc1+ #13
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
 ffff880039fd4bf0 ffff880034c87bd8 ffffffff8229824a ffffffff828e2a40
 ffff880034c87c50 ffffffff8229051d ffff880000000010 ffff880034c87c60
 ffff880034c87c00 0000000000000020 ffffffff81e193ba 0000000000000080
Call Trace:
 [<ffffffff8229824a>] dump_stack+0x4d/0x66
 [<ffffffff8229051d>] panic+0xc8/0x201
 [<ffffffff81e193ba>] ? snd_mixer_oss_proc_write+0x24a/0x270
 [<ffffffff8113c716>] __stack_chk_fail+0x16/0x20
 [<ffffffff81e193ba>] snd_mixer_oss_proc_write+0x24a/0x270
 [<ffffffff810a8a27>] ? kvm_clock_read+0x27/0x40
 [<ffffffff81dfb54c>] snd_info_entry_release+0x6c/0x110
 [<ffffffff812e9af6>] close_pdeo+0x136/0x1a0
 [<ffffffff8118bec1>] ? __lock_acquire+0x951/0xb40
 [<ffffffff810a8a27>] ? kvm_clock_read+0x27/0x40
 [<ffffffff812e9b9e>] proc_reg_release+0x3e/0x60
 [<ffffffff8127fa41>] __fput+0x111/0x1e0
 [<ffffffff8127fb59>] ____fput+0x9/0x10
 [<ffffffff8115e3ee>] task_work_run+0x9e/0xd0
 [<ffffffff8106aaa5>] do_notify_resume+0x55/0x70
 [<ffffffff822b12e2>] int_signal+0x12/0x17
Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range:
0xffffffff80000000-0xffffffff9fffffff)