From: "Zhang, Qiang" <Qiang.Zhang@windriver.com>
To: Takashi Iwai <tiwai@suse.de>
Cc: "perex@perex.cz" <perex@perex.cz>,
"tiwai@suse.com" <tiwai@suse.com>,
"alsa-devel@alsa-project.org" <alsa-devel@alsa-project.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: 回复: 回复: [PATCH] ALSA: seq: KASAN: use-after-free Read in delete_and_unsubscribe_port
Date: Mon, 3 Aug 2020 09:44:30 +0000 [thread overview]
Message-ID: <BYAPR11MB263286CE056BBFE368EEC20EFF4D0@BYAPR11MB2632.namprd11.prod.outlook.com> (raw)
In-Reply-To: <s5hd0486yq3.wl-tiwai@suse.de>
________________________________________
发件人: Takashi Iwai <tiwai@suse.de>
发送时间: 2020年8月3日 14:16
收件人: Zhang, Qiang
抄送: perex@perex.cz; tiwai@suse.com; alsa-devel@alsa-project.org; linux-kernel@vger.kernel.org
主题: Re: 回复: [PATCH] ALSA: seq: KASAN: use-after-free Read in delete_and_unsubscribe_port
On Mon, 03 Aug 2020 03:35:05 +0200,
Zhang, Qiang wrote:
>
> >Thanks for the patch. But I'm afraid that this change would break the
> >existing behavior and might have a bad side-effect.
>
> >It's likely the same issue as reported in another syzkaller report
> >("KASAN: invalid-free in snd_seq_port_disconnect"), and Hillf's patch
> >below should covert this as well. Could you check whether it works?
>
> yes It's should same issue, add mutex lock in odev_ioctl, ensure serialization.
> however, it should not be necessary to mutually exclusive with open and close.
>>>That's a big-hammer approach indeed, but it should be more reasonable
>>>in this case. It makes the patch shorter and simpler, while the OSS
>>>sequencer is an ancient interface that wasn't considered much for the
>>>concurrency, and this might also cover the case where the access to
>>>another sequencer object that is being to be closed.
>>>So, it'd be great if you can confirm that the patch actually works.
>>>Then we can brush up and merge it for 5.9-rc1.
Just like you said, this change is more reasonable. It makes the patch shorter and simpler.
>>>thanks,
>>>Takashi
>
>
>
> >thanks,
>
> >Takashi
>
> >---
> >--- a/sound/core/seq/oss/seq_oss.c
> >+++ b/sound/core/seq/oss/seq_oss.c
> >@@ -167,11 +167,17 @@ odev_write(struct file *file, const char
> >static long
> >odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
> >{
> >+ long rc;
> > struct seq_oss_devinfo *dp;
> >+
> >+ mutex_lock(®ister_mutex);
> > dp = file->private_data;
> > if (snd_BUG_ON(!dp))
> >- return -ENXIO;
> >- return snd_seq_oss_ioctl(dp, cmd, arg);
> >+ rc = -ENXIO;
> >+ else
> >+ rc = snd_seq_oss_ioctl(dp, cmd, arg);
> >+ mutex_unlock(®ister_mutex);
> >+ return rc;
> >}
>
> >#ifdef CONFIG_COMPAT
prev parent reply other threads:[~2020-08-03 9:44 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-01 6:24 [PATCH] ALSA: seq: KASAN: use-after-free Read in delete_and_unsubscribe_port qiang.zhang
2020-08-01 9:39 ` Takashi Iwai
2020-08-03 1:35 ` 回复: " Zhang, Qiang
2020-08-03 6:16 ` Takashi Iwai
2020-08-03 9:44 ` Zhang, Qiang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=BYAPR11MB263286CE056BBFE368EEC20EFF4D0@BYAPR11MB2632.namprd11.prod.outlook.com \
--to=qiang.zhang@windriver.com \
--cc=alsa-devel@alsa-project.org \
--cc=linux-kernel@vger.kernel.org \
--cc=perex@perex.cz \
--cc=tiwai@suse.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).