From: Takashi Iwai <tiwai@suse.de>
To: alsa-devel@alsa-project.org
Subject: [PATCH 4/5] ALSA: seq: Protect in-kernel ioctl calls with mutex
Date: Tue, 9 Apr 2019 19:00:19 +0200 [thread overview]
Message-ID: <20190409170020.20685-5-tiwai@suse.de> (raw)
In-Reply-To: <20190409170020.20685-1-tiwai@suse.de>
ALSA OSS sequencer calls the ioctl function indirectly via
snd_seq_kernel_client_ctl(). While we already applied the protection
against races between the normal ioctls and writes via the client's
ioctl_mutex, this code path was left untouched. And this seems to be
the cause of still remaining some rare UAF as spontaneously triggered
by syzkaller.
For the sake of robustness, wrap the ioctl_mutex also for the call via
snd_seq_kernel_client_ctl(), too.
Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
sound/core/seq/seq_clientmgr.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 933bde3843d9..976404691261 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -2340,14 +2340,19 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
{
const struct ioctl_handler *handler;
struct snd_seq_client *client;
+ int err;
client = clientptr(clientid);
if (client == NULL)
return -ENXIO;
for (handler = ioctl_handlers; handler->cmd > 0; ++handler) {
- if (handler->cmd == cmd)
- return handler->func(client, arg);
+ if (handler->cmd == cmd) {
+ mutex_lock(&client->ioctl_mutex);
+ err = handler->func(client, arg);
+ mutex_unlock(&client->ioctl_mutex);
+ return err;
+ }
}
pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n",
--
2.16.4
next prev parent reply other threads:[~2019-04-09 17:00 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-09 17:00 [PATCH 0/5] ALSA: seq: More cleanups and fixes Takashi Iwai
2019-04-09 17:00 ` [PATCH 1/5] ALSA: seq: Use kvmalloc() for cell pools Takashi Iwai
2019-04-09 17:00 ` [PATCH 2/5] ALSA: seq: Align temporary re-locking with irqsave version Takashi Iwai
2019-04-09 17:00 ` [PATCH 3/5] ALSA: seq: Remove superfluous irqsave flags Takashi Iwai
2019-04-09 17:00 ` Takashi Iwai [this message]
2019-04-09 17:00 ` [PATCH 5/5] ALSA: seq: Fix race of get-subscription call vs port-delete ioctls Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190409170020.20685-5-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=alsa-devel@alsa-project.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.