lkml.org 
[lkml]   [2020]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 53/97] ALSA: seq: Fix racy access for queue timer in proc read
    Date
    From: Takashi Iwai <tiwai@suse.de>

    commit 60adcfde92fa40fcb2dbf7cc52f9b096e0cd109a upstream.

    snd_seq_info_timer_read() reads the information of the timer assigned
    for each queue, but it's done in a racy way which may lead to UAF as
    spotted by syzkaller.

    This patch applies the missing q->timer_mutex lock while accessing the
    timer object as well as a slight code change to adapt the standard
    coding style.

    Reported-by: syzbot+2b2ef983f973e5c40943@syzkaller.appspotmail.com
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20200115203733.26530-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/core/seq/seq_timer.c | 14 +++++++++-----
    1 file changed, 9 insertions(+), 5 deletions(-)

    --- a/sound/core/seq/seq_timer.c
    +++ b/sound/core/seq/seq_timer.c
    @@ -479,15 +479,19 @@ void snd_seq_info_timer_read(struct snd_
    q = queueptr(idx);
    if (q == NULL)
    continue;
    - if ((tmr = q->timer) == NULL ||
    - (ti = tmr->timeri) == NULL) {
    - queuefree(q);
    - continue;
    - }
    + mutex_lock(&q->timer_mutex);
    + tmr = q->timer;
    + if (!tmr)
    + goto unlock;
    + ti = tmr->timeri;
    + if (!ti)
    + goto unlock;
    snd_iprintf(buffer, "Timer for queue %i : %s\n", q->queue, ti->timer->name);
    resolution = snd_timer_resolution(ti) * tmr->ticks;
    snd_iprintf(buffer, " Period time : %lu.%09lu\n", resolution / 1000000000, resolution % 1000000000);
    snd_iprintf(buffer, " Skew : %u / %u\n", tmr->skew, tmr->skew_base);
    +unlock:
    + mutex_unlock(&q->timer_mutex);
    queuefree(q);
    }
    }

    \
     
     \ /
      Last update: 2020-01-22 10:37    [W:3.296 / U:0.196 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site