| Message ID | ZRb2CKHuaCu0u38i@work |
|---|---|
| State | New |
| Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org>
Delivered-To: ouuuleilei@gmail.com
Received: by 2002:a59:cae8:0:b0:403:3b70:6f57 with SMTP id r8csp4158501vqu;
Fri, 29 Sep 2023 09:28:13 -0700 (PDT)
X-Google-Smtp-Source:
AGHT+IFUoL7c6bQ/kLkA0H3eJZN0C3lbtjE1vq+CxcBKol6kT8PReOFbeghepCT7NeeFwtdmKYlq
X-Received: by 2002:a05:6a21:3288:b0:15e:986:d92b with SMTP id
yt8-20020a056a21328800b0015e0986d92bmr5439275pzb.16.1696004892780;
Fri, 29 Sep 2023 09:28:12 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1696004892; cv=none;
d=google.com; s=arc-20160816;
b=BSgQ2Ws9/r319v7b0uhISlj6ZTz0Sm/wGdCja6qgo+2ITBW86LfHamUO3lVuzfK6e2
uhUOVZt9aJbc3sILxSy3e71h8WgA0swRO/PTmN3PrTpxw42Mp0N1obXKbKgRKI8LSIYZ
EEBliE1na338oEfo6sKraDnEQc+mBsPmOHCtlcHVNkNrqrJLsJQaYIf5Q9tl60WJWbwu
qcfA45EnQEXh+YQ2ZaLOrSqifWCyhXlhxG0i/QFWD+nlQV+/aC+Osi/YCUa4UYpTgKbM
+eHl9YP4plOhM4QHxwa7T0/6F2ejmyfxTTV0p1tPs1sy1hZwNle9JhDuTXU3zIslIVkS
28Vg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;
s=arc-20160816;
h=list-id:precedence:content-disposition:mime-version:message-id
:subject:cc:to:from:date:dkim-signature;
bh=1kdJIKmc7Ck1RWQ7dFtgDfFvcEG3MaZmQEDNFwVdF6A=;
fh=JM+07Ch9NtN8RPXCZq0qDGvXOetvejo3RDEW87XSfsM=;
b=jadDmFDh37J46ymK34Oc+AM8h+znc5W1+mQ0O7ZsdAOnGKKK1UCV2DKJklSsIyOj2c
7FD379E0fr6sOzhvOiIYHR/p0S60xUUTwqbfXFi7lQ8V9IFArK+8aTpysUM6URxlMlox
ojXrq6+IvszJCXo1NIsmpnnzjLqKbcup8zur+tY57BjfRtcgumX0stPFzoMWPRA6+B5Q
wF2H3+4MS21Mr6B97+5u43CZrbb+ySy2dr0WdIX7Z/28vGbg7uxD4yxplFDRTF8Y0m55
t01HJGYvvAicHwneACKXdg1D4E4KYIOJKuaWeKCR5yJaXkeWjVq8QoVpKCSHUjUyZakn
PcLQ==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@kernel.org header.s=k20201202 header.b="e30T/zR3";
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::3:3 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org
Received: from lipwig.vger.email (lipwig.vger.email. [2620:137:e000::3:3])
by mx.google.com with ESMTPS id
d11-20020a056a00198b00b0069353ac3d3csi4246163pfl.72.2023.09.29.09.28.12
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Fri, 29 Sep 2023 09:28:12 -0700 (PDT)
Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::3:3 as permitted sender)
client-ip=2620:137:e000::3:3;
Authentication-Results: mx.google.com;
dkim=pass header.i=@kernel.org header.s=k20201202 header.b="e30T/zR3";
spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org
designates 2620:137:e000::3:3 as permitted sender)
smtp.mailfrom=linux-kernel-owner@vger.kernel.org;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org
Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0])
by lipwig.vger.email (Postfix) with ESMTP id 2CCE580A13AB;
Fri, 29 Sep 2023 09:06:59 -0700 (PDT)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 0.103.10 at lipwig.vger.email
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S233726AbjI2QGo (ORCPT <rfc822;pwkd43@gmail.com> + 20 others);
Fri, 29 Sep 2023 12:06:44 -0400
Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36014 "EHLO
lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
with ESMTP id S233551AbjI2QGk (ORCPT
<rfc822;linux-kernel@vger.kernel.org>);
Fri, 29 Sep 2023 12:06:40 -0400
Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140])
by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A70DE139
for <linux-kernel@vger.kernel.org>;
Fri, 29 Sep 2023 09:06:38 -0700 (PDT)
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34E10C433C7;
Fri, 29 Sep 2023 16:06:35 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
s=k20201202; t=1696003598;
bh=JjvdY6vNRaU1rCbwGgkNSNDb81US03BKyTCcV+LEmPM=;
h=Date:From:To:Cc:Subject:From;
b=e30T/zR3Px8FY8bLmSHYEjXs067XxvqClj1EJBQHwpfJQBDSKfIUYiDAqJnrACHgL
ar2NOy1poMvsQsZFHuAP7WtSeEHsX1xrHfkABQgjApuw4IpBPZyaUOTdDN4b+W0tOa
FVR6oL2W9qAep9+fTN8nOD93r6n8TA6P64JmUr6q1OFetkZhEjMrY2EySQdES1wcv/
0ewYZ3u+FKNvtFxeFG6CFSmTpsFC4sqqDryE2lr2DgH15NNcOr33pnHti682imoHjc
c9KoRsJHI0PxhF6iVdprbM1byqep7GcCeCqlXiwx2nFjlZGKDlt04FTospMVv4hjG6
bdv/SgZsrBSGA==
Date: Fri, 29 Sep 2023 18:06:32 +0200
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
To: Jaroslav Kysela <perex@perex.cz>, Takashi Iwai <tiwai@suse.com>,
Torsten Schenk <torsten.schenk@zoho.com>
Cc: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org,
"Gustavo A. R. Silva" <gustavoars@kernel.org>,
linux-hardening@vger.kernel.org
Subject: [PATCH][next] ALSA: 6fire: Fix undefined behavior bug in struct
midi_runtime
Message-ID: <ZRb2CKHuaCu0u38i@work>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Spam-Status: No, score=-1.2 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI,
SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no
version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test,
not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]);
Fri, 29 Sep 2023 09:06:59 -0700 (PDT)
X-getmail-retrieved-from-mailbox: INBOX
X-GMAIL-THRID: 1778390026462729949
X-GMAIL-MSGID: 1778390026462729949
|
| Series |
[next] ALSA: 6fire: Fix undefined behavior bug in struct midi_runtime
|
|
Commit Message
Gustavo A. R. Silva
Sept. 29, 2023, 4:06 p.m. UTC
`struct urb` is a flexible structure, which means that it contains a
flexible-array member at the bottom. This could potentially lead to an
overwrite of the objects following `out_urb` in `struct midi_runtime`,
among them a function pointer.
Fix this by placing the declaration of object `out_urb` at the end of
`struct midi_runtime`.
Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
sound/usb/6fire/midi.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
On Fri, Sep 29, 2023 at 06:06:32PM +0200, Gustavo A. R. Silva wrote: > `struct urb` is a flexible structure, which means that it contains a > flexible-array member at the bottom. This could potentially lead to an > overwrite of the objects following `out_urb` in `struct midi_runtime`, > among them a function pointer. > > Fix this by placing the declaration of object `out_urb` at the end of > `struct midi_runtime`. > > Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") > Cc: stable@vger.kernel.org > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Another good find. :) Reviewed-by: Kees Cook <keescook@chromium.org>
On 9/29/23 19:27, Kees Cook wrote: > On Fri, Sep 29, 2023 at 06:06:32PM +0200, Gustavo A. R. Silva wrote: >> `struct urb` is a flexible structure, which means that it contains a >> flexible-array member at the bottom. This could potentially lead to an >> overwrite of the objects following `out_urb` in `struct midi_runtime`, >> among them a function pointer. >> >> Fix this by placing the declaration of object `out_urb` at the end of >> `struct midi_runtime`. >> >> Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") >> Cc: stable@vger.kernel.org >> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> > > Another good find. :) There are more coming. :) > > Reviewed-by: Kees Cook <keescook@chromium.org> > Thanks! -- Gustavo
On Fri, 29 Sep 2023 18:06:32 +0200, Gustavo A. R. Silva wrote: > > `struct urb` is a flexible structure, which means that it contains a > flexible-array member at the bottom. This could potentially lead to an > overwrite of the objects following `out_urb` in `struct midi_runtime`, > among them a function pointer. > > Fix this by placing the declaration of object `out_urb` at the end of > `struct midi_runtime`. > > Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") > Cc: stable@vger.kernel.org > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> The same question as your another 6fire patch is applied here: does it "fix" anything real? thanks, Takashi > --- > sound/usb/6fire/midi.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/sound/usb/6fire/midi.h b/sound/usb/6fire/midi.h > index 47640c845903..df3f41913274 100644 > --- a/sound/usb/6fire/midi.h > +++ b/sound/usb/6fire/midi.h > @@ -22,12 +22,12 @@ struct midi_runtime { > spinlock_t in_lock; > spinlock_t out_lock; > struct snd_rawmidi_substream *out; > - struct urb out_urb; > u8 out_serial; /* serial number of out packet */ > u8 *out_buffer; > int buffer_offset; > > void (*in_received)(struct midi_runtime *rt, u8 *data, int length); > + struct urb out_urb; > }; > > int usb6fire_midi_init(struct sfire_chip *chip); > -- > 2.34.1 >
diff --git a/sound/usb/6fire/midi.h b/sound/usb/6fire/midi.h index 47640c845903..df3f41913274 100644 --- a/sound/usb/6fire/midi.h +++ b/sound/usb/6fire/midi.h @@ -22,12 +22,12 @@ struct midi_runtime { spinlock_t in_lock; spinlock_t out_lock; struct snd_rawmidi_substream *out; - struct urb out_urb; u8 out_serial; /* serial number of out packet */ u8 *out_buffer; int buffer_offset; void (*in_received)(struct midi_runtime *rt, u8 *data, int length); + struct urb out_urb; }; int usb6fire_midi_init(struct sfire_chip *chip);