ALSA: seq: Fix racy pool initializations

"Linux Kernel Mailing List" <[email protected]> Fri, 16 Feb 2018 17:15:05 +0000 (UTC)
Newsgroups gmane.linux.kernel.commits.head
Message-ID <[email protected]>
Web:        https://git.kernel.org/torvalds/c/d15d662e89fc667b90cd294b0eb45694e33144da
Commit:     d15d662e89fc667b90cd294b0eb45694e33144da
Parent:     1dcb1859dd6752131b85c78fb3e440bd1d2cf361
Refname:    refs/heads/master
Author:     Takashi Iwai <[email protected]>
AuthorDate: Mon Feb 12 15:20:51 2018 +0100
Committer:  Takashi Iwai <[email protected]>
CommitDate: Wed Feb 14 10:39:08 2018 +0100

    ALSA: seq: Fix racy pool initializations
    
    ALSA sequencer core initializes the event pool on demand by invoking
    snd_seq_pool_init() when the first write happens and the pool is
    empty.  Meanwhile user can reset the pool size manually via ioctl
    concurrently, and this may lead to UAF or out-of-bound accesses since
    the function tries to vmalloc / vfree the buffer.
    
    A simple fix is to just wrap the snd_seq_pool_init() call with the
    recently introduced client->ioctl_mutex; as the calls for
    snd_seq_pool_init() from other side are always protected with this
    mutex, we can avoid the race.
    
    Reported-by: 范龙飞 <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>
---
 sound/core/seq/seq_clientmgr.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 60db32785f62..04d4db44fae5 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1003,7 +1003,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 {
 	struct snd_seq_client *client = file->private_data;
 	int written = 0, len;
-	int err = -EINVAL;
+	int err;
 	struct snd_seq_event event;
 
 	if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
@@ -1018,11 +1018,15 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 
 	/* allocate the pool now if the pool is not allocated yet */ 
 	if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
-		if (snd_seq_pool_init(client->pool) < 0)
+		mutex_lock(&client->ioctl_mutex);
+		err = snd_seq_pool_init(client->pool);
+		mutex_unlock(&client->ioctl_mutex);
+		if (err < 0)
 			return -ENOMEM;
 	}
 
 	/* only process whole events */
+	err = -EINVAL;
 	while (count >= sizeof(struct snd_seq_event)) {
 		/* Read in the event header from the user */
 		len = sizeof(event);
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html