Re: [PATCH RFC 0/6] ALSA: Fix UAF with delayed kobj release

[Takashi Iwai <tiwai@suse.de>]

On Wed, 16 Aug 2023 07:35:52 +0200,
Takashi Iwai wrote:
> 
> On Tue, 15 Aug 2023 23:32:31 +0200,
> Curtis Malainey wrote:
> > 
> > I still don't understand why you need the kref. The devices are
> > already reference counting, why not use them? If we split them up into
> > their own structs we could then just device_put everything on removal
> > and let it roll up the tree with releases automatically, blocking
> > where userspace is still holding references. I will share a patches
> > sometime this week of what I mean. They will probably be a bit bigger
> > blast radius but I think its what is needed here.
> 
> We want to trigger the top-level release free procedure once when all
> files are closed.  This top-level release does put_device() of all
> belonging devices.
> 
> The card_dev device refcount was used for this purpose.  OTOH, if we
> want to construct the topology of the devices until the actual
> deletion (i.e. keep card_dev until pcm and others are really
> released/deleted), the card_dev refcount will be used for managing
> the topology, too.  So, it'll get a side-effect side-effect that the
> card_dev refcount won't be zero even after all files are closed (it's
> referred from the children).
> 
> So, it's a kind of preparation for the future.

That said, the first two patches are basically independent from the
rest.  We can apply the rest changes at first for addressing the
existing UAF issues, then think of the further restructuring, too.


Takashi