From patchwork Thu Oct 13 17:52:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 2148 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp405336wrs; Thu, 13 Oct 2022 10:57:29 -0700 (PDT) X-Google-Smtp-Source: AMsMyM482EvDfd0xO1EbDAXoL5rMdtr0ABr2VOY2PmNUSo81PAN0qjGCUm7XFoM/+tWOA9risupy X-Received: by 2002:aa7:d458:0:b0:45b:ddbf:39fa with SMTP id q24-20020aa7d458000000b0045bddbf39famr824476edr.335.1665683849220; Thu, 13 Oct 2022 10:57:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665683849; cv=none; d=google.com; s=arc-20160816; b=cVJJ/tJPqta2CQV0TSWLopGzyKclvHST3OEA/70mRhbQuEojDY93X/U8OeBIHrmM+7 Ihm4DAnOp8w7Q0jjheAF9c04g92JSrTDivR0scwOQnu71/NxMMmW5pbr+ohwxw0wb3EA fwyrEUDU02PxTcuVSFJV/FNioL1i9VUzlzkSus5SPX/KatNu6+JRJhfL2ujQqT6Q8jbP JY43Yo5GFLfObxiO0TvobSuAoLFyaFM4Vey97PLL572VV9bh9jSDLqk/G/pJjww3tJoe B5UxQq5qlhoohoB2n71C3QxHDvQ20hCZI3AZ0zq8BLPqjWdWIwq0Dsk+Y0NYsZ4W4pid yfrg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=RoEvDvmGBf/vgYCddHiHMAbFXrFRpvGnckrLMuQ0qvk=; b=AawHmMhne/hewKTptxJNAt5FIIhSMQJm+PQa5dFCrT6qJif6W2U6nbg4VCnrJ7dDYk wI2BI+H0inog/egnXSar63ZrHD9gzfLC4dbw0JdZ2qWEc88NFLSsqc9zy9eWZzEKAZAw e4XtlnmB8rByO32GEiYy67HRpuJrLrFS67TTBat0XxoHkHTkOn9wh5kJjcRcf4JLw0So tbOpL2rEuF+3HIWdK7Hn9IQGRaYb1zuznpZChIaoSpcM/xVjEuE5tQYEEhiqMmuE5/Wv 71GLlmx1IHr24JHwAe+c0KqiztxCLjvfCLoWNyTFdnTIHJgFoHfo/dTrXE/CBXZFqF0p vzrA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=l5SLGcb3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id ga29-20020a1709070c1d00b0078d43ae07e1si307311ejc.649.2022.10.13.10.57.04; Thu, 13 Oct 2022 10:57:29 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=l5SLGcb3; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230176AbiJMR4q (ORCPT + 99 others); Thu, 13 Oct 2022 13:56:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229861AbiJMR4P (ORCPT ); Thu, 13 Oct 2022 13:56:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 234F3B493; Thu, 13 Oct 2022 10:54:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A70A8618CF; Thu, 13 Oct 2022 17:54:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ACD97C433C1; Thu, 13 Oct 2022 17:54:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665683673; bh=Wt2UcEB8TYyXdSrmrOgauGXpFfbuoOTAcU40VArRkGw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l5SLGcb3w8AyGmSHFHcrjhp9JhkM3hfcV7FQ7gIZ0OWdC5IClilidEeEwBZehUdCp 0vizO/Cyo8GgICPS1o49lQRXVBCn7vpWNqVNuw+aqbOtvvXaEqqpDqokIaN+lzj0KE bnLsCAhZrqoPGZmkGwhVZr/lusi3SA6BX1tZNUcI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jaroslav Kysela , Takashi Iwai , Zubin Mithra , butt3rflyh4ck Subject: [PATCH 5.10 10/54] ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC Date: Thu, 13 Oct 2022 19:52:04 +0200 Message-Id: <20221013175147.614037797@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175147.337501757@linuxfoundation.org> References: <20221013175147.337501757@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746596107835907833?= X-GMAIL-MSGID: =?utf-8?q?1746596107835907833?= From: Takashi Iwai commit 8423f0b6d513b259fdab9c9bf4aaa6188d054c2d upstream. There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant. Reported-and-tested-by: butt3rflyh4ck Reviewed-by: Jaroslav Kysela Cc: Link: https://lore.kernel.org/r/CAFcO6XN7JDM4xSXGhtusQfS2mSBcx50VJKwQpCq=WeLt57aaZA@mail.gmail.com Link: https://lore.kernel.org/r/20220905060714.22549-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Zubin Mithra Signed-off-by: Greg Kroah-Hartman --- sound/core/oss/pcm_oss.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -1662,13 +1662,14 @@ static int snd_pcm_oss_sync(struct snd_p runtime = substream->runtime; if (atomic_read(&substream->mmap_count)) goto __direct; - if ((err = snd_pcm_oss_make_ready(substream)) < 0) - return err; atomic_inc(&runtime->oss.rw_ref); if (mutex_lock_interruptible(&runtime->oss.params_lock)) { atomic_dec(&runtime->oss.rw_ref); return -ERESTARTSYS; } + err = snd_pcm_oss_make_ready_locked(substream); + if (err < 0) + goto unlock; format = snd_pcm_oss_format_from(runtime->oss.format); width = snd_pcm_format_physical_width(format); if (runtime->oss.buffer_used > 0) {