From: Takashi Iwai <tiwai@suse.de> To: syzbot <syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com> Cc: alsa-devel@alsa-project.org, coding@diwic.se, colin.king@intel.com, linux-kernel@vger.kernel.org, perex@perex.cz, syzkaller-bugs@googlegroups.com, tiwai@suse.com Subject: Re: [syzbot] KASAN: use-after-free Read in __snd_rawmidi_transmit_peek Date: Tue, 19 Apr 2022 12:00:19 +0200 [thread overview] Message-ID: <s5hee1t1jgs.wl-tiwai@suse.de> (raw) In-Reply-To: <s5hk0bl1m6c.wl-tiwai@suse.de> On Tue, 19 Apr 2022 11:01:47 +0200, Takashi Iwai wrote: > > On Mon, 18 Apr 2022 12:12:23 +0200, > syzbot wrote: > > > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: a19944809fe9 Merge tag 'hardening-v5.18-rc3' of git://git... > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=16a40ae0f00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=eb177500e563582f > > dashboard link: https://syzkaller.appspot.com/bug?extid=70e777a39907d6d5fd0a > > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1590dfa8f00000 > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by: syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com > > > > ================================================================== > > BUG: KASAN: use-after-free in __snd_rawmidi_transmit_peek+0x261/0x360 sound/core/rawmidi.c:1286 > > Looks like a leftover work. The fix patch is below. On the second thought, this would be rather in a different code path, and the fix should be smaller like below. Let's see. Takashi -- 8< -- From: Takashi Iwai <tiwai@suse.de> Subject: [PATCH] ALSA: usb-audio: Clear MIDI port active flag after draining When a rawmidi output stream is closed, it calls the drain at first, then does trigger-off only when the drain returns -ERESTARTSYS as a fallback. It implies that each driver should turn off the stream properly after the drain. Meanwhile, USB-audio MIDI interface didn't change the port->active flag after the drain. This may leave the output work picking up the port that is closed right now, which eventually leads to a use-after-free for the already released rawmidi object. This patch fixes the bug by properly clearing the port->active flag after the output drain. Reported-by: syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/00000000000011555605dceaff03@google.com Signed-off-by: Takashi Iwai <tiwai@suse.de> --- sound/usb/midi.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index 2c01649c70f6..7c6ca2b433a5 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1194,6 +1194,7 @@ static void snd_usbmidi_output_drain(struct snd_rawmidi_substream *substream) } while (drain_urbs && timeout); finish_wait(&ep->drain_wait, &wait); } + port->active = 0; spin_unlock_irq(&ep->buffer_lock); } -- 2.34.1
WARNING: multiple messages have this Message-ID (diff)
From: Takashi Iwai <tiwai@suse.de> To: syzbot <syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com> Cc: alsa-devel@alsa-project.org, coding@diwic.se, tiwai@suse.com, syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org, colin.king@intel.com Subject: Re: [syzbot] KASAN: use-after-free Read in __snd_rawmidi_transmit_peek Date: Tue, 19 Apr 2022 12:00:19 +0200 [thread overview] Message-ID: <s5hee1t1jgs.wl-tiwai@suse.de> (raw) In-Reply-To: <s5hk0bl1m6c.wl-tiwai@suse.de> On Tue, 19 Apr 2022 11:01:47 +0200, Takashi Iwai wrote: > > On Mon, 18 Apr 2022 12:12:23 +0200, > syzbot wrote: > > > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: a19944809fe9 Merge tag 'hardening-v5.18-rc3' of git://git... > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=16a40ae0f00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=eb177500e563582f > > dashboard link: https://syzkaller.appspot.com/bug?extid=70e777a39907d6d5fd0a > > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1590dfa8f00000 > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by: syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com > > > > ================================================================== > > BUG: KASAN: use-after-free in __snd_rawmidi_transmit_peek+0x261/0x360 sound/core/rawmidi.c:1286 > > Looks like a leftover work. The fix patch is below. On the second thought, this would be rather in a different code path, and the fix should be smaller like below. Let's see. Takashi -- 8< -- From: Takashi Iwai <tiwai@suse.de> Subject: [PATCH] ALSA: usb-audio: Clear MIDI port active flag after draining When a rawmidi output stream is closed, it calls the drain at first, then does trigger-off only when the drain returns -ERESTARTSYS as a fallback. It implies that each driver should turn off the stream properly after the drain. Meanwhile, USB-audio MIDI interface didn't change the port->active flag after the drain. This may leave the output work picking up the port that is closed right now, which eventually leads to a use-after-free for the already released rawmidi object. This patch fixes the bug by properly clearing the port->active flag after the output drain. Reported-by: syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/00000000000011555605dceaff03@google.com Signed-off-by: Takashi Iwai <tiwai@suse.de> --- sound/usb/midi.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index 2c01649c70f6..7c6ca2b433a5 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1194,6 +1194,7 @@ static void snd_usbmidi_output_drain(struct snd_rawmidi_substream *substream) } while (drain_urbs && timeout); finish_wait(&ep->drain_wait, &wait); } + port->active = 0; spin_unlock_irq(&ep->buffer_lock); } -- 2.34.1
next prev parent reply other threads:[~2022-04-19 10:00 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-04-18 10:12 [syzbot] KASAN: use-after-free Read in __snd_rawmidi_transmit_peek syzbot 2022-04-19 9:01 ` Takashi Iwai 2022-04-19 9:01 ` Takashi Iwai 2022-04-19 10:00 ` Takashi Iwai [this message] 2022-04-19 10:00 ` Takashi Iwai [not found] <20220418140008.1853-1-hdanton@sina.com> 2022-04-18 14:30 ` syzbot [not found] <20220419021532.1932-1-hdanton@sina.com> 2022-04-19 2:25 ` syzbot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=s5hee1t1jgs.wl-tiwai@suse.de \ --to=tiwai@suse.de \ --cc=alsa-devel@alsa-project.org \ --cc=coding@diwic.se \ --cc=colin.king@intel.com \ --cc=linux-kernel@vger.kernel.org \ --cc=perex@perex.cz \ --cc=syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com \ --cc=syzkaller-bugs@googlegroups.com \ --cc=tiwai@suse.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.