Re: A new null-ptr-deref Write bug in snd_pcm_format_set_silence

[Takashi Iwai <tiwai@suse.de>]

On Sun, 04 Sep 2022 11:48:37 +0200,
butt3rflyh4ck wrote:
> 
> Hi, there is a new null-ptr-deref Write bug in
> snd_pcm_format_set_slience in sound/core/pcm_misc.c in the latest
> upstream kernel and can reproduce it.
> We call SNDCTL_DSP_SYNC and SNDCTL_DSP_SPEED in multiple threads to
> trigger the vulnerability.
> 
> See the Call Trace:
> ==================================================================
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
>  kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
>  check_region_inline mm/kasan/generic.c:183 [inline]
>  kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
>  memset+0x20/0x40 mm/kasan/shadow.c:44
>  snd_pcm_format_set_silence sound/core/pcm_misc.c:441 [inline]
>  snd_pcm_format_set_silence+0x215/0x350 sound/core/pcm_misc.c:424
>  snd_pcm_oss_sync+0x60e/0x800 sound/core/oss/pcm_oss.c:1690
>  snd_pcm_oss_ioctl+0x2087/0x3420 sound/core/oss/pcm_oss.c:2634
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:870 [inline]
>  __se_sys_ioctl fs/ioctl.c:856 [inline]
>  __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856
>  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>  do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> ==================================================================
> We can see the function snd_pcm_format_set_silence code below:
> ```
> int snd_pcm_format_set_silence(snd_pcm_format_t format, void *data,
> unsigned int samples)
> {
>         int width;
>         unsigned char *dst;
>         const unsigned char *pat;
> 
>         if (!valid_format(format))
>                 return -EINVAL;
>         if (samples == 0)
>                 return 0;
>         width = pcm_formats[(INT)format].phys; /* physical width */
>         pat = pcm_formats[(INT)format].silence;
>         if (!width || !pat)
>                 return -EINVAL;
>         /* signed or 1 byte data */
>         if (pcm_formats[(INT)format].signd == 1 || width <= 8) {
>                 unsigned int bytes = samples * width / 8;
>                 memset(data, *pat, bytes);    ///// [1] ---------> data is NULL
>                 return 0;
>         }
>        ......
> }
> ```
> [1], the data pointer is NULL, we can know snd_pcm_format_set_silence
> called in line 1690 in sound/core/oss/pcm_oss.c from call stack trace.
> let we see code below:
> ```
> static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
> {
>         int err = 0;
>         unsigned int saved_f_flags;
>         struct snd_pcm_substream *substream;
>         struct snd_pcm_runtime *runtime;
>         snd_pcm_format_t format;
>         unsigned long width;
>         size_t size;
> 
>         substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
>         if (substream != NULL) {
>                 runtime = substream->runtime;
>                 if (atomic_read(&substream->mmap_count))
>                         goto __direct;
>                 err = snd_pcm_oss_make_ready(substream);
>                 if (err < 0)
>                         return err;
>                 atomic_inc(&runtime->oss.rw_ref);
>                 if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
>                         atomic_dec(&runtime->oss.rw_ref);
>                         return -ERESTARTSYS;
>                 }
>                 format = snd_pcm_oss_format_from(runtime->oss.format);
>                 width = snd_pcm_format_physical_width(format);
>                 if (runtime->oss.buffer_used > 0) {
> #ifdef OSS_DEBUG
>                         pcm_dbg(substream->pcm, "sync: buffer_used\n");
> #endif
>                         size = (8 * (runtime->oss.period_bytes -
> runtime->oss.buffer_used) + 7) / width;
>                         snd_pcm_format_set_silence(format,
>                                                    runtime->oss.buffer
> + runtime->oss.buffer_used,   ///// [2]
>                                                    size);
>                         err = snd_pcm_oss_sync1(substream,
> runtime->oss.period_bytes);
>                         if (err < 0)
>                                 goto unlock;
>                 } else if (runtime->oss.period_ptr > 0) {
> 
> ```
> [2]  runtime->oss.buffer + runtime->oss.buffer_used is the data
> pointer, but runtime->oss.buffer is NULL here but it doesn't make
> sense.
> runtime->oss.buffter is allocated by kvzalloc, if runtime->oss_buffer
> is NULL, it would return an ENOMEM error.
> Maybe I think there is a race condition, the runtime->oss.buffer is
> freed and set to NULL but we can use runtime->oss.buffter via ioctl.

Yeah, likely it's in a small race window between two calls.

Could you try the patch below?


thanks,

Takashi

---
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1672,14 +1672,14 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
 		runtime = substream->runtime;
 		if (atomic_read(&substream->mmap_count))
 			goto __direct;
-		err = snd_pcm_oss_make_ready(substream);
-		if (err < 0)
-			return err;
 		atomic_inc(&runtime->oss.rw_ref);
 		if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
 			atomic_dec(&runtime->oss.rw_ref);
 			return -ERESTARTSYS;
 		}
+		err = snd_pcm_oss_make_ready_locked(substream);
+		if (err < 0)
+			goto unlock;
 		format = snd_pcm_oss_format_from(runtime->oss.format);
 		width = snd_pcm_format_physical_width(format);
 		if (runtime->oss.buffer_used > 0) {