From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83D5BECAAD3 for ; Sun, 4 Sep 2022 10:27:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233548AbiIDK1u (ORCPT ); Sun, 4 Sep 2022 06:27:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50248 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230119AbiIDK1r (ORCPT ); Sun, 4 Sep 2022 06:27:47 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 56F4142AFB for ; Sun, 4 Sep 2022 03:27:46 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id CBCD91FCF3; Sun, 4 Sep 2022 10:27:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1662287264; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ru4cXrU8uZRVJvnYMDLwX+xQ2GsOxjkupeRmR5ICRJ8=; b=f/+s4b51ybzY4RD2sc7CJSG6Uw05/CsxEftj1hRVp/HnYwaWvsJYM5sAnQtK4OHcYasKF5 JblAo9Gb+zIkLUKbWMroaaPceneCdhlDA+ZHHQSGQuFmuWM36+o+tjBgxT7oENISnh9Jdb X+bWCCzB/Xny8Jsgct8bmvahO5hzDFI= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1662287264; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ru4cXrU8uZRVJvnYMDLwX+xQ2GsOxjkupeRmR5ICRJ8=; b=2XAbT0bajlkyYwNXv0rippJGG6jFV3x32CckWqSBG91wLPG252WqCuiS6I21DjAScYk9ht wvZbfjO77XLBqeCg== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 9DA5313A6B; Sun, 4 Sep 2022 10:27:44 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id WiwCJaB9FGNQEQAAMHmgww (envelope-from ); Sun, 04 Sep 2022 10:27:44 +0000 Date: Sun, 04 Sep 2022 12:27:43 +0200 Message-ID: <87edwrl9i8.wl-tiwai@suse.de> From: Takashi Iwai To: butt3rflyh4ck Cc: perex@perex.cz, tiwai@suse.com, cuibixuan@linux.alibaba.com, alsa-devel@alsa-project.org, LKML Subject: Re: A new null-ptr-deref Write bug in snd_pcm_format_set_silence In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.2 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, 04 Sep 2022 11:48:37 +0200, butt3rflyh4ck wrote: > > Hi, there is a new null-ptr-deref Write bug in > snd_pcm_format_set_slience in sound/core/pcm_misc.c in the latest > upstream kernel and can reproduce it. > We call SNDCTL_DSP_SYNC and SNDCTL_DSP_SPEED in multiple threads to > trigger the vulnerability. > > See the Call Trace: > ================================================================== > Call Trace: > > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 > kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 > check_region_inline mm/kasan/generic.c:183 [inline] > kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 > memset+0x20/0x40 mm/kasan/shadow.c:44 > snd_pcm_format_set_silence sound/core/pcm_misc.c:441 [inline] > snd_pcm_format_set_silence+0x215/0x350 sound/core/pcm_misc.c:424 > snd_pcm_oss_sync+0x60e/0x800 sound/core/oss/pcm_oss.c:1690 > snd_pcm_oss_ioctl+0x2087/0x3420 sound/core/oss/pcm_oss.c:2634 > vfs_ioctl fs/ioctl.c:51 [inline] > __do_sys_ioctl fs/ioctl.c:870 [inline] > __se_sys_ioctl fs/ioctl.c:856 [inline] > __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > ================================================================== > We can see the function snd_pcm_format_set_silence code below: > ``` > int snd_pcm_format_set_silence(snd_pcm_format_t format, void *data, > unsigned int samples) > { > int width; > unsigned char *dst; > const unsigned char *pat; > > if (!valid_format(format)) > return -EINVAL; > if (samples == 0) > return 0; > width = pcm_formats[(INT)format].phys; /* physical width */ > pat = pcm_formats[(INT)format].silence; > if (!width || !pat) > return -EINVAL; > /* signed or 1 byte data */ > if (pcm_formats[(INT)format].signd == 1 || width <= 8) { > unsigned int bytes = samples * width / 8; > memset(data, *pat, bytes); ///// [1] ---------> data is NULL > return 0; > } > ...... > } > ``` > [1], the data pointer is NULL, we can know snd_pcm_format_set_silence > called in line 1690 in sound/core/oss/pcm_oss.c from call stack trace. > let we see code below: > ``` > static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) > { > int err = 0; > unsigned int saved_f_flags; > struct snd_pcm_substream *substream; > struct snd_pcm_runtime *runtime; > snd_pcm_format_t format; > unsigned long width; > size_t size; > > substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; > if (substream != NULL) { > runtime = substream->runtime; > if (atomic_read(&substream->mmap_count)) > goto __direct; > err = snd_pcm_oss_make_ready(substream); > if (err < 0) > return err; > atomic_inc(&runtime->oss.rw_ref); > if (mutex_lock_interruptible(&runtime->oss.params_lock)) { > atomic_dec(&runtime->oss.rw_ref); > return -ERESTARTSYS; > } > format = snd_pcm_oss_format_from(runtime->oss.format); > width = snd_pcm_format_physical_width(format); > if (runtime->oss.buffer_used > 0) { > #ifdef OSS_DEBUG > pcm_dbg(substream->pcm, "sync: buffer_used\n"); > #endif > size = (8 * (runtime->oss.period_bytes - > runtime->oss.buffer_used) + 7) / width; > snd_pcm_format_set_silence(format, > runtime->oss.buffer > + runtime->oss.buffer_used, ///// [2] > size); > err = snd_pcm_oss_sync1(substream, > runtime->oss.period_bytes); > if (err < 0) > goto unlock; > } else if (runtime->oss.period_ptr > 0) { > > ``` > [2] runtime->oss.buffer + runtime->oss.buffer_used is the data > pointer, but runtime->oss.buffer is NULL here but it doesn't make > sense. > runtime->oss.buffter is allocated by kvzalloc, if runtime->oss_buffer > is NULL, it would return an ENOMEM error. > Maybe I think there is a race condition, the runtime->oss.buffer is > freed and set to NULL but we can use runtime->oss.buffter via ioctl. Yeah, likely it's in a small race window between two calls. Could you try the patch below? thanks, Takashi --- --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1672,14 +1672,14 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) runtime = substream->runtime; if (atomic_read(&substream->mmap_count)) goto __direct; - err = snd_pcm_oss_make_ready(substream); - if (err < 0) - return err; atomic_inc(&runtime->oss.rw_ref); if (mutex_lock_interruptible(&runtime->oss.params_lock)) { atomic_dec(&runtime->oss.rw_ref); return -ERESTARTSYS; } + err = snd_pcm_oss_make_ready_locked(substream); + if (err < 0) + goto unlock; format = snd_pcm_oss_format_from(runtime->oss.format); width = snd_pcm_format_physical_width(format); if (runtime->oss.buffer_used > 0) { From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 67C9BECAAD4 for ; Sun, 4 Sep 2022 10:28:42 +0000 (UTC) Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id C338715DC; Sun, 4 Sep 2022 12:27:49 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz C338715DC DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1662287319; bh=hNyZCrFa4i4iQjUHray3sg10+TCSV1/qeuARSRk+0Wk=; h=Date:From:To:Subject:In-Reply-To:References:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=gKPSQ54EpCwUtmYkqw+aq42P6JSXEUnNsnWujZw/BL9hydda7TaywSps796kgc0Px xpXcQ9vGaiItie3FpB5xXHKZKLqDWTqaysUOyG3WIgoOwXS4o9Wp204w3ahY2NRj5Y aCYstORAzCGfopnkEqIxgqcoT7O6Iw11xjRRxFsA= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id 5AC6FF80124; Sun, 4 Sep 2022 12:27:49 +0200 (CEST) Received: by alsa1.perex.cz (Postfix, from userid 50401) id 2A73BF8013D; Sun, 4 Sep 2022 12:27:48 +0200 (CEST) Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 93BEBF800A7 for ; Sun, 4 Sep 2022 12:27:45 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 93BEBF800A7 Authentication-Results: alsa1.perex.cz; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.b="f/+s4b51"; dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de header.b="2XAbT0ba" Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id CBCD91FCF3; Sun, 4 Sep 2022 10:27:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1662287264; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ru4cXrU8uZRVJvnYMDLwX+xQ2GsOxjkupeRmR5ICRJ8=; b=f/+s4b51ybzY4RD2sc7CJSG6Uw05/CsxEftj1hRVp/HnYwaWvsJYM5sAnQtK4OHcYasKF5 JblAo9Gb+zIkLUKbWMroaaPceneCdhlDA+ZHHQSGQuFmuWM36+o+tjBgxT7oENISnh9Jdb X+bWCCzB/Xny8Jsgct8bmvahO5hzDFI= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1662287264; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=ru4cXrU8uZRVJvnYMDLwX+xQ2GsOxjkupeRmR5ICRJ8=; b=2XAbT0bajlkyYwNXv0rippJGG6jFV3x32CckWqSBG91wLPG252WqCuiS6I21DjAScYk9ht wvZbfjO77XLBqeCg== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 9DA5313A6B; Sun, 4 Sep 2022 10:27:44 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id WiwCJaB9FGNQEQAAMHmgww (envelope-from ); Sun, 04 Sep 2022 10:27:44 +0000 Date: Sun, 04 Sep 2022 12:27:43 +0200 Message-ID: <87edwrl9i8.wl-tiwai@suse.de> From: Takashi Iwai To: butt3rflyh4ck Subject: Re: A new null-ptr-deref Write bug in snd_pcm_format_set_silence In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.2 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: cuibixuan@linux.alibaba.com, LKML , alsa-devel@alsa-project.org, tiwai@suse.com X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" On Sun, 04 Sep 2022 11:48:37 +0200, butt3rflyh4ck wrote: > > Hi, there is a new null-ptr-deref Write bug in > snd_pcm_format_set_slience in sound/core/pcm_misc.c in the latest > upstream kernel and can reproduce it. > We call SNDCTL_DSP_SYNC and SNDCTL_DSP_SPEED in multiple threads to > trigger the vulnerability. > > See the Call Trace: > ================================================================== > Call Trace: > > __dump_stack lib/dump_stack.c:88 [inline] > dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 > kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 > check_region_inline mm/kasan/generic.c:183 [inline] > kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 > memset+0x20/0x40 mm/kasan/shadow.c:44 > snd_pcm_format_set_silence sound/core/pcm_misc.c:441 [inline] > snd_pcm_format_set_silence+0x215/0x350 sound/core/pcm_misc.c:424 > snd_pcm_oss_sync+0x60e/0x800 sound/core/oss/pcm_oss.c:1690 > snd_pcm_oss_ioctl+0x2087/0x3420 sound/core/oss/pcm_oss.c:2634 > vfs_ioctl fs/ioctl.c:51 [inline] > __do_sys_ioctl fs/ioctl.c:870 [inline] > __se_sys_ioctl fs/ioctl.c:856 [inline] > __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > ================================================================== > We can see the function snd_pcm_format_set_silence code below: > ``` > int snd_pcm_format_set_silence(snd_pcm_format_t format, void *data, > unsigned int samples) > { > int width; > unsigned char *dst; > const unsigned char *pat; > > if (!valid_format(format)) > return -EINVAL; > if (samples == 0) > return 0; > width = pcm_formats[(INT)format].phys; /* physical width */ > pat = pcm_formats[(INT)format].silence; > if (!width || !pat) > return -EINVAL; > /* signed or 1 byte data */ > if (pcm_formats[(INT)format].signd == 1 || width <= 8) { > unsigned int bytes = samples * width / 8; > memset(data, *pat, bytes); ///// [1] ---------> data is NULL > return 0; > } > ...... > } > ``` > [1], the data pointer is NULL, we can know snd_pcm_format_set_silence > called in line 1690 in sound/core/oss/pcm_oss.c from call stack trace. > let we see code below: > ``` > static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) > { > int err = 0; > unsigned int saved_f_flags; > struct snd_pcm_substream *substream; > struct snd_pcm_runtime *runtime; > snd_pcm_format_t format; > unsigned long width; > size_t size; > > substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; > if (substream != NULL) { > runtime = substream->runtime; > if (atomic_read(&substream->mmap_count)) > goto __direct; > err = snd_pcm_oss_make_ready(substream); > if (err < 0) > return err; > atomic_inc(&runtime->oss.rw_ref); > if (mutex_lock_interruptible(&runtime->oss.params_lock)) { > atomic_dec(&runtime->oss.rw_ref); > return -ERESTARTSYS; > } > format = snd_pcm_oss_format_from(runtime->oss.format); > width = snd_pcm_format_physical_width(format); > if (runtime->oss.buffer_used > 0) { > #ifdef OSS_DEBUG > pcm_dbg(substream->pcm, "sync: buffer_used\n"); > #endif > size = (8 * (runtime->oss.period_bytes - > runtime->oss.buffer_used) + 7) / width; > snd_pcm_format_set_silence(format, > runtime->oss.buffer > + runtime->oss.buffer_used, ///// [2] > size); > err = snd_pcm_oss_sync1(substream, > runtime->oss.period_bytes); > if (err < 0) > goto unlock; > } else if (runtime->oss.period_ptr > 0) { > > ``` > [2] runtime->oss.buffer + runtime->oss.buffer_used is the data > pointer, but runtime->oss.buffer is NULL here but it doesn't make > sense. > runtime->oss.buffter is allocated by kvzalloc, if runtime->oss_buffer > is NULL, it would return an ENOMEM error. > Maybe I think there is a race condition, the runtime->oss.buffer is > freed and set to NULL but we can use runtime->oss.buffter via ioctl. Yeah, likely it's in a small race window between two calls. Could you try the patch below? thanks, Takashi --- --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1672,14 +1672,14 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) runtime = substream->runtime; if (atomic_read(&substream->mmap_count)) goto __direct; - err = snd_pcm_oss_make_ready(substream); - if (err < 0) - return err; atomic_inc(&runtime->oss.rw_ref); if (mutex_lock_interruptible(&runtime->oss.params_lock)) { atomic_dec(&runtime->oss.rw_ref); return -ERESTARTSYS; } + err = snd_pcm_oss_make_ready_locked(substream); + if (err < 0) + goto unlock; format = snd_pcm_oss_format_from(runtime->oss.format); width = snd_pcm_format_physical_width(format); if (runtime->oss.buffer_used > 0) {