From: Takashi Iwai <tiwai@suse.de>
To: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Cc: Hillf Danton <hdanton@sina.com>,
zonque@gmail.com, LKML <linux-kernel@vger.kernel.org>,
alsa-devel@alsa-project.org, linux-usb@vger.kernel.org
Subject: Re: BUG: KASAN: use-after-free in snd_complete_urb+0x109e/0x1740 [snd_usb_audio] (5.11-rc6)
Date: Sat, 06 Feb 2021 13:19:11 +0100 [thread overview]
Message-ID: <s5hczxd1j9c.wl-tiwai@suse.de> (raw)
In-Reply-To: <s5hlfc11tx8.wl-tiwai@suse.de>
On Sat, 06 Feb 2021 09:28:51 +0100,
Takashi Iwai wrote:
>
> On Sat, 06 Feb 2021 08:48:05 +0100,
> Takashi Iwai wrote:
> >
> > On Sat, 06 Feb 2021 06:45:32 +0100,
> > Hillf Danton wrote:
> > >
> > > Due to the reconnecting key word mentioned, no fix to
> > > d0f09d1e4a88 ("ALSA: usb-audio: Refactoring endpoint URB deactivation")
> > > will be added.
> > >
> > > What is added is to capture EP_FLAG_STOPPING and remove the one
> > > second wait limit if the reconnecting acts may make it easier to
> > > repro the uaf. The diff is only for idea show.
> >
> > If my understanding is right, this won't change. The problem is
> > rather the lack of this function call itself, i.e. the missing
> > synchronization for the stream stop.
> >
> > It worked casually in the past because the endpoint resource is
> > released at a later point that is after all streams are really closed.
> > Now it's released earlier and hitting the UAF.
>
> ... and reading the code in a closer look, my guess was also wrong.
> The sync should have happened in snd_usb_endpoint_release(), and this
> didn't change for quite some time. So my previous fix won't be
> effective, too, I'm afraid. (And Hilif's patch won't help, either; if
> it's effective, there must have been a timeout error in the original
> case.)
>
> That said, I don't think this is a newly introduced regression, and
> race the condition could be in a hairy detail.
>
> Mikhail, can you reproduce this bug reliably?
And if you can reproduce the problem, please try the
topic/pcm-sync-stop-fixes branch of my sound git tree
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
Takashi
next prev parent reply other threads:[~2021-02-06 12:20 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-05 21:02 BUG: KASAN: use-after-free in snd_complete_urb+0x109e/0x1740 [snd_usb_audio] (5.11-rc6) Mikhail Gavrilov
2021-02-05 22:25 ` Takashi Iwai
[not found] ` <20210206054533.120-1-hdanton@sina.com>
2021-02-06 7:48 ` Takashi Iwai
2021-02-06 8:28 ` Takashi Iwai
2021-02-06 12:19 ` Takashi Iwai [this message]
[not found] <20210206081333.7472-1-hdanton@sina.com>
2021-02-06 8:32 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=s5hczxd1j9c.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=alsa-devel@alsa-project.org \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mikhail.v.gavrilov@gmail.com \
--cc=zonque@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).