From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Nicolai Stange <nstange@suse.de>,
Takashi Iwai <tiwai@suse.de>
Subject: [PATCH 4.15 13/52] ALSA: seq: Fix possible UAF in snd_seq_check_queue()
Date: Mon, 19 Mar 2018 19:08:11 +0100 [thread overview]
Message-ID: <20180319180735.875062430@linuxfoundation.org> (raw)
In-Reply-To: <20180319180734.976730813@linuxfoundation.org>
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit d0f833065221cbfcbadf19fd4102bcfa9330006a upstream.
Although we've covered the races between concurrent write() and
ioctl() in the previous patch series, there is still a possible UAF in
the following scenario:
A: user client closed B: timer irq
-> snd_seq_release() -> snd_seq_timer_interrupt()
-> snd_seq_free_client() -> snd_seq_check_queue()
-> cell = snd_seq_prioq_cell_peek()
-> snd_seq_prioq_leave()
.... removing all cells
-> snd_seq_pool_done()
.... vfree()
-> snd_seq_compare_tick_time(cell)
... Oops
So the problem is that a cell is peeked and accessed without any
protection until it's retrieved from the queue again via
snd_seq_prioq_cell_out().
This patch tries to address it, also cleans up the code by a slight
refactoring. snd_seq_prioq_cell_out() now receives an extra pointer
argument. When it's non-NULL, the function checks the event timestamp
with the given pointer. The caller needs to pass the right reference
either to snd_seq_tick or snd_seq_realtime depending on the event
timestamp type.
A good news is that the above change allows us to remove the
snd_seq_prioq_cell_peek(), too, thus the patch actually reduces the
code size.
Reviewed-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/seq_prioq.c | 28 ++++++++++++++--------------
sound/core/seq/seq_prioq.h | 6 ++----
sound/core/seq/seq_queue.c | 28 +++++++++-------------------
3 files changed, 25 insertions(+), 37 deletions(-)
--- a/sound/core/seq/seq_prioq.c
+++ b/sound/core/seq/seq_prioq.c
@@ -87,7 +87,7 @@ void snd_seq_prioq_delete(struct snd_seq
if (f->cells > 0) {
/* drain prioQ */
while (f->cells > 0)
- snd_seq_cell_free(snd_seq_prioq_cell_out(f));
+ snd_seq_cell_free(snd_seq_prioq_cell_out(f, NULL));
}
kfree(f);
@@ -214,8 +214,18 @@ int snd_seq_prioq_cell_in(struct snd_seq
return 0;
}
+/* return 1 if the current time >= event timestamp */
+static int event_is_ready(struct snd_seq_event *ev, void *current_time)
+{
+ if ((ev->flags & SNDRV_SEQ_TIME_STAMP_MASK) == SNDRV_SEQ_TIME_STAMP_TICK)
+ return snd_seq_compare_tick_time(current_time, &ev->time.tick);
+ else
+ return snd_seq_compare_real_time(current_time, &ev->time.time);
+}
+
/* dequeue cell from prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f)
+struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f,
+ void *current_time)
{
struct snd_seq_event_cell *cell;
unsigned long flags;
@@ -227,6 +237,8 @@ struct snd_seq_event_cell *snd_seq_prioq
spin_lock_irqsave(&f->lock, flags);
cell = f->head;
+ if (cell && current_time && !event_is_ready(&cell->event, current_time))
+ cell = NULL;
if (cell) {
f->head = cell->next;
@@ -252,18 +264,6 @@ int snd_seq_prioq_avail(struct snd_seq_p
return f->cells;
}
-
-/* peek at cell at the head of the prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq * f)
-{
- if (f == NULL) {
- pr_debug("ALSA: seq: snd_seq_prioq_cell_in() called with NULL prioq\n");
- return NULL;
- }
- return f->head;
-}
-
-
static inline int prioq_match(struct snd_seq_event_cell *cell,
int client, int timestamp)
{
--- a/sound/core/seq/seq_prioq.h
+++ b/sound/core/seq/seq_prioq.h
@@ -44,14 +44,12 @@ void snd_seq_prioq_delete(struct snd_seq
int snd_seq_prioq_cell_in(struct snd_seq_prioq *f, struct snd_seq_event_cell *cell);
/* dequeue cell from prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f);
+struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f,
+ void *current_time);
/* return number of events available in prioq */
int snd_seq_prioq_avail(struct snd_seq_prioq *f);
-/* peek at cell at the head of the prioq */
-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq *f);
-
/* client left queue */
void snd_seq_prioq_leave(struct snd_seq_prioq *f, int client, int timestamp);
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -277,30 +277,20 @@ void snd_seq_check_queue(struct snd_seq_
__again:
/* Process tick queue... */
- while ((cell = snd_seq_prioq_cell_peek(q->tickq)) != NULL) {
- if (snd_seq_compare_tick_time(&q->timer->tick.cur_tick,
- &cell->event.time.tick)) {
- cell = snd_seq_prioq_cell_out(q->tickq);
- if (cell)
- snd_seq_dispatch_event(cell, atomic, hop);
- } else {
- /* event remains in the queue */
+ for (;;) {
+ cell = snd_seq_prioq_cell_out(q->tickq,
+ &q->timer->tick.cur_tick);
+ if (!cell)
break;
- }
+ snd_seq_dispatch_event(cell, atomic, hop);
}
-
/* Process time queue... */
- while ((cell = snd_seq_prioq_cell_peek(q->timeq)) != NULL) {
- if (snd_seq_compare_real_time(&q->timer->cur_time,
- &cell->event.time.time)) {
- cell = snd_seq_prioq_cell_out(q->timeq);
- if (cell)
- snd_seq_dispatch_event(cell, atomic, hop);
- } else {
- /* event remains in the queue */
+ for (;;) {
+ cell = snd_seq_prioq_cell_out(q->timeq, &q->timer->cur_time);
+ if (!cell)
break;
- }
+ snd_seq_dispatch_event(cell, atomic, hop);
}
/* free lock */
next prev parent reply other threads:[~2018-03-19 18:08 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-19 18:07 [PATCH 4.15 00/52] 4.15.12-stable review Greg Kroah-Hartman
2018-03-19 18:07 ` [PATCH 4.15 01/52] x86/cpufeatures: Add Intel Total Memory Encryption cpufeature Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 02/52] x86/cpufeatures: Add Intel PCONFIG cpufeature Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 03/52] selftests/x86/entry_from_vm86: Exit with 1 if we fail Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 04/52] selftests/x86/entry_from_vm86: Add test cases for POPF Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 05/52] x86/vm86/32: Fix POPF emulation Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 06/52] x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 07/52] x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 08/52] KVM: x86: Fix device passthrough when SME is active Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 09/52] x86/mm: Fix vmalloc_fault to use pXd_large Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 10/52] parisc: Handle case where flush_cache_range is called with no context Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 11/52] ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 12/52] ALSA: hda - Revert power_save option default value Greg Kroah-Hartman
2018-03-19 18:08 ` Greg Kroah-Hartman [this message]
2018-03-19 18:08 ` [PATCH 4.15 14/52] ALSA: seq: Clear client entry before deleting else at closing Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 15/52] drm/nouveau/bl: Fix oops on driver unbind Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 16/52] drm/nouveau/mmu: ALIGN_DOWN correct variable Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 17/52] drm/amdgpu: fix prime teardown order Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 18/52] drm/radeon: " Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 19/52] drm/amdgpu/dce: Dont turn off DP sink when disconnected Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 20/52] fs: Teach path_connected to handle nfs filesystems with multiple roots Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 21/52] KVM: arm/arm64: Reduce verbosity of KVM init log Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 22/52] KVM: arm/arm64: Reset mapped IRQs on VM reset Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 23/52] kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on v3 Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 24/52] KVM: arm/arm64: vgic: Dont populate multiple LRs with the same vintid Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 25/52] lock_parent() needs to recheck if dentry got __dentry_killed under it Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 26/52] fs/aio: Add explicit RCU grace period when freeing kioctx Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 27/52] fs/aio: Use RCU accessors for kioctx_table->table[] Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 28/52] RDMAVT: Fix synchronization around percpu_ref Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 29/52] irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 30/52] nvme: fix subsystem multiple controllers support check Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 31/52] xfs: preserve i_rdev when recycling a reclaimable inode Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 32/52] btrfs: Fix NULL pointer exception in find_bio_stripe Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 33/52] btrfs: add missing initialization in btrfs_check_shared Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 34/52] btrfs: alloc_chunk: fix DUP stripe size handling Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 35/52] btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 36/52] btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 37/52] btrfs: Fix memory barriers usage with device stats counters Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 38/52] scsi: qla2xxx: Fix smatch warning in qla25xx_delete_{rsp|req}_que Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 39/52] scsi: qla2xxx: Fix NULL pointer access for fcport structure Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 40/52] scsi: qla2xxx: Fix logo flag for qlt_free_session_done() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 41/52] scsi: qla2xxx: Fix crashes in qla2x00_probe_one on probe failure Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 42/52] usb: dwc2: fix STM32F7 USB OTG HS compatible Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 43/52] dt-bindings: usb: fix the STM32F7 DWC2 OTG HS core binding Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 44/52] USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 45/52] usb: dwc3: Fix GDBGFIFOSPACE_TYPE values Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 46/52] usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 47/52] usb: dwc3: of-simple: fix oops by unbalanced clk disable call Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 48/52] usb: gadget: udc: renesas_usb3: fix oops in renesas_usb3_remove() Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 49/52] phy: phy-brcm-usb: Fix two DT properties to match bindings doc Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 50/52] phy: phy-brcm-usb-init: Some Low Speed keyboards fail on 7271 Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 51/52] phy: phy-brcm-usb-init: DRD mode can cause crash on startup Greg Kroah-Hartman
2018-03-19 18:08 ` [PATCH 4.15 52/52] phy: phy-brcm-usb-init: Power down USB 3.0 PHY when XHCI disabled Greg Kroah-Hartman
2018-03-19 23:20 ` [PATCH 4.15 00/52] 4.15.12-stable review kernelci.org bot
2018-03-20 6:47 ` Naresh Kamboju
2018-03-20 7:44 ` Greg Kroah-Hartman
2018-03-20 12:24 ` Thadeu Lima de Souza Cascardo
2018-03-21 11:07 ` Greg Kroah-Hartman
2018-03-20 16:11 ` Guenter Roeck
2018-03-21 12:29 ` Greg Kroah-Hartman
2018-03-20 20:11 ` Shuah Khan
2018-03-21 9:42 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180319180735.875062430@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nstange@suse.de \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).