Skip to main content

Browse the archive

Revision 7e1d90f60a0d501c8503e636942ca704a454d910 authored by Daniel Mentz on 14 August 2017, 21:46:01 UTC, committed by Takashi Iwai on 15 August 2017, 06:02:35 UTC 
ALSA: seq: 2nd attempt at fixing race creating a queue
 
commit 4842e98f26dd80be3623c4714a244ba52ea096a8 ("ALSA: seq: Fix race at
creating a queue") attempted to fix a race reported by syzkaller. That
fix has been described as follows:

"
When a sequencer queue is created in snd_seq_queue_alloc(),it adds the
new queue element to the public list before referencing it.  Thus the
queue might be deleted before the call of snd_seq_queue_use(), and it
results in the use-after-free error, as spotted by syzkaller.

The fix is to reference the queue object at the right time.
"

Even with that fix in place, syzkaller reported a use-after-free error.
It specifically pointed to the last instruction "return q->queue" in
snd_seq_queue_alloc(). The pointer q is being used after kfree() has
been called on it.

It turned out that there is still a small window where a race can
happen. The window opens at
snd_seq_ioctl_create_queue()->snd_seq_queue_alloc()->queue_list_add()
and closes at
snd_seq_ioctl_create_queue()->queueptr()->snd_use_lock_use(). Between
these two calls, a different thread could delete the queue and possibly
re-create a different queue in the same location in queue_list.

This change prevents this situation by calling snd_use_lock_use() from
snd_seq_queue_alloc() prior to calling queue_list_add(). It is then the
caller's responsibility to call snd_use_lock_free(&q->use_lock).

Fixes: 4842e98f26dd ("ALSA: seq: Fix race at creating a queue")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent 8df4b00
Raw File
test_static_key_base.c 
/*
 * Kernel module for testing static keys.
 *
 * Copyright 2015 Akamai Technologies Inc. All Rights Reserved
 *
 * Authors:
 *      Jason Baron       <jbaron@akamai.com>
 *
 * This software is licensed under the terms of the GNU General Public
 * License version 2, as published by the Free Software Foundation, and
 * may be copied, distributed, and modified under those terms.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 */

#include <linux/module.h>
#include <linux/jump_label.h>

/* old keys */
struct static_key base_old_true_key = STATIC_KEY_INIT_TRUE;
EXPORT_SYMBOL_GPL(base_old_true_key);
struct static_key base_inv_old_true_key = STATIC_KEY_INIT_TRUE;
EXPORT_SYMBOL_GPL(base_inv_old_true_key);
struct static_key base_old_false_key = STATIC_KEY_INIT_FALSE;
EXPORT_SYMBOL_GPL(base_old_false_key);
struct static_key base_inv_old_false_key = STATIC_KEY_INIT_FALSE;
EXPORT_SYMBOL_GPL(base_inv_old_false_key);

/* new keys */
DEFINE_STATIC_KEY_TRUE(base_true_key);
EXPORT_SYMBOL_GPL(base_true_key);
DEFINE_STATIC_KEY_TRUE(base_inv_true_key);
EXPORT_SYMBOL_GPL(base_inv_true_key);
DEFINE_STATIC_KEY_FALSE(base_false_key);
EXPORT_SYMBOL_GPL(base_false_key);
DEFINE_STATIC_KEY_FALSE(base_inv_false_key);
EXPORT_SYMBOL_GPL(base_inv_false_key);

static void invert_key(struct static_key *key)
{
	if (static_key_enabled(key))
		static_key_disable(key);
	else
		static_key_enable(key);
}

static int __init test_static_key_base_init(void)
{
	invert_key(&base_inv_old_true_key);
	invert_key(&base_inv_old_false_key);
	invert_key(&base_inv_true_key.key);
	invert_key(&base_inv_false_key.key);

	return 0;
}

static void __exit test_static_key_base_exit(void)
{
}

module_init(test_static_key_base_init);
module_exit(test_static_key_base_exit);

MODULE_AUTHOR("Jason Baron <jbaron@akamai.com>");
MODULE_LICENSE("GPL");
back to top