lkml.org 
[lkml]   [2020]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 006/228] ALSA: seq: oss: Serialize ioctls
    Date
    From: Takashi Iwai <tiwai@suse.de>

    commit 80982c7e834e5d4e325b6ce33757012ecafdf0bb upstream.

    Some ioctls via OSS sequencer API may race and lead to UAF when the
    port create and delete are performed concurrently, as spotted by a
    couple of syzkaller cases. This patch is an attempt to address it by
    serializing the ioctls with the existing register_mutex.

    Basically OSS sequencer API is an obsoleted interface and was designed
    without much consideration of the concurrency. There are very few
    applications with it, and the concurrent performance isn't asked,
    hence this "big hammer" approach should be good enough.

    Reported-by: syzbot+1a54a94bd32716796edd@syzkaller.appspotmail.com
    Reported-by: syzbot+9d2abfef257f3e2d4713@syzkaller.appspotmail.com
    Suggested-by: Hillf Danton <hdanton@sina.com>
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20200804185815.2453-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/core/seq/oss/seq_oss.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    --- a/sound/core/seq/oss/seq_oss.c
    +++ b/sound/core/seq/oss/seq_oss.c
    @@ -181,10 +181,16 @@ static long
    odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
    {
    struct seq_oss_devinfo *dp;
    + long rc;
    +
    dp = file->private_data;
    if (snd_BUG_ON(!dp))
    return -ENXIO;
    - return snd_seq_oss_ioctl(dp, cmd, arg);
    +
    + mutex_lock(&register_mutex);
    + rc = snd_seq_oss_ioctl(dp, cmd, arg);
    + mutex_unlock(&register_mutex);
    + return rc;
    }

    #ifdef CONFIG_COMPAT

    \
     
     \ /
      Last update: 2020-08-20 13:26    [W:4.040 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site