lkml.org 
[lkml]   [2018]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 024/410] ALSA: seq: Fix racy pool initializations
    3.16.57-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Takashi Iwai <tiwai@suse.de>

    commit d15d662e89fc667b90cd294b0eb45694e33144da upstream.

    ALSA sequencer core initializes the event pool on demand by invoking
    snd_seq_pool_init() when the first write happens and the pool is
    empty. Meanwhile user can reset the pool size manually via ioctl
    concurrently, and this may lead to UAF or out-of-bound accesses since
    the function tries to vmalloc / vfree the buffer.

    A simple fix is to just wrap the snd_seq_pool_init() call with the
    recently introduced client->ioctl_mutex; as the calls for
    snd_seq_pool_init() from other side are always protected with this
    mutex, we can avoid the race.

    Reported-by: 范龙飞 <long7573@126.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    sound/core/seq/seq_clientmgr.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)

    --- a/sound/core/seq/seq_clientmgr.c
    +++ b/sound/core/seq/seq_clientmgr.c
    @@ -1012,7 +1012,7 @@ static ssize_t snd_seq_write(struct file
    {
    struct snd_seq_client *client = file->private_data;
    int written = 0, len;
    - int err = -EINVAL;
    + int err;
    struct snd_seq_event event;

    if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
    @@ -1027,11 +1027,15 @@ static ssize_t snd_seq_write(struct file

    /* allocate the pool now if the pool is not allocated yet */
    if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
    - if (snd_seq_pool_init(client->pool) < 0)
    + mutex_lock(&client->ioctl_mutex);
    + err = snd_seq_pool_init(client->pool);
    + mutex_unlock(&client->ioctl_mutex);
    + if (err < 0)
    return -ENOMEM;
    }

    /* only process whole events */
    + err = -EINVAL;
    while (count >= sizeof(struct snd_seq_event)) {
    /* Read in the event header from the user */
    len = sizeof(event);
    \
     
     \ /
      Last update: 2018-06-07 18:11    [W:4.185 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site