lkml.org 
[lkml]   [2021]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH -next v2] ALSA: timer: Fix use-after-free problem
On Wed, 03 Nov 2021 04:35:17 +0100,
Wang Wensheng wrote:
>
> When the timer instance was add into ack_list but was not currently in
> process, the user could stop it via snd_timer_stop1() without delete it
> from the ack_list. Then the user could free the timer instance and when
> it was actually processed UAF occurred.
>
> This issue could be reproduced via testcase snd_timer01 in ltp - running
> several instances of that testcase at the same time.
>
> What I actually met was that the ack_list of the timer broken and the
> kernel went into deadloop with irqoff. That could be detected by
> hardlockup detector on board or when we run it on qemu, we could use gdb
> to dump the ack_list when the console has no response.
>
> To fix this issue, we delete the timer instance from ack_list and
> active_list unconditionally in snd_timer_stop1().
>
> Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
> Suggested-by: Takashi Iwai <tiwai@suse.de>

Thanks, applied now.


Takashi

\
 
 \ /
  Last update: 2021-11-03 16:53    [W:0.087 / U:0.236 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site