From: Greg KH <greg@kroah.com>
To: Ovidiu Panait <ovidiu.panait@windriver.com>
Cc: stable@vger.kernel.org, tiwai@suse.de, perex@perex.cz,
kirin.say@gmail.com
Subject: Re: [PATCH 5.4 0/5] ALSA: pcm: backports for CVE-2022-1048
Date: Tue, 10 May 2022 13:32:45 +0200 [thread overview]
Message-ID: <YnpNXSAjV4DVZj/m@kroah.com> (raw)
In-Reply-To: <20220506091013.1746159-1-ovidiu.panait@windriver.com>
On Fri, May 06, 2022 at 12:10:08PM +0300, Ovidiu Panait wrote:
> Contextual adjustments were made to apply to 5.4 stable tree.
>
> Testing
> -------
> Running the PoC from [1] on 5.4.191 kernel produces the following oops:
>
> qemu-system-x86_64 -nographic -serial mon:stdio -serial null -enable-kvm \
> -net user,hostname=qemu0,hostfwd=tcp::36074-:22 -net nic \
> -drive file=rootfs.ext4,format=raw -cpu host -m 4096 -kernel bzImage \
> -append "console=ttyS0,115200 root=/dev/sda rw ip=dhcp " -soundhw ac97 -smp 2
> root@intel-x86-64:~# ./poc
> ...
> [ 95.839647] BUG: Bad page state in process poc pfn:bb860
> [ 95.841277] page:ffffea0002ee1800 refcount:-1 mapcount:0 mapping:0000000000000000 index:0x0
> [ 95.843521] flags: 0x100000000000000()
> [ 95.844539] raw: 0100000000000000 dead000000000100 dead000000000122 0000000000000000
> [ 95.846306] raw: 0000000000000000 0000000000000000 ffffffffffffffff 0000000000000000
> [ 95.847164] page dumped because: nonzero _refcount
> [ 95.847705] Modules linked in:
> [ 95.848063] CPU: 0 PID: 357 Comm: poc Tainted: G W 5.4.191 #6
> [ 95.848839] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> [ 95.849847] Call Trace:
> [ 95.850145] dump_stack+0x76/0x9c
> [ 95.850549] bad_page.cold+0xff/0x124
> [ 95.850980] ? si_mem_available+0x2f0/0x2f0
> [ 95.851464] ? _raw_spin_trylock_bh+0x120/0x120
> [ 95.851988] ? __module_text_address+0xe/0x140
> [ 95.852494] get_page_from_freelist+0x16f9/0x35b0
> [ 95.853034] ? __isolate_free_page+0x460/0x460
> [ 95.853543] ? save_stack+0x4c/0x80
> [ 95.853938] ? save_stack+0x1b/0x80
> [ 95.854343] ? __kasan_kmalloc.constprop.0+0xc2/0xd0
> [ 95.854897] ? snd_pcm_lib_malloc_pages+0x2b8/0x680
> [ 95.855433] ? snd_intel8x0_hw_params+0x106/0x550
> [ 95.855964] ? snd_pcm_hw_params+0x2b5/0x1290
> [ 95.856438] ? snd_pcm_common_ioctl+0x332/0x1a20
> [ 95.856954] __alloc_pages_nodemask+0x274/0x610
> [ 95.857460] ? __alloc_pages_slowpath+0x1ff0/0x1ff0
> [ 95.857992] ? snd_pcm_hw_refine+0x8de/0xdd0
> [ 95.858467] ? kfree+0x8c/0x230
> [ 95.858823] __dma_direct_alloc_pages+0x18d/0x390
> [ 95.859339] dma_direct_alloc_pages+0x1b/0x170
> [ 95.859827] snd_dma_alloc_pages+0x1ae/0x380
> [ 95.860294] snd_pcm_lib_malloc_pages+0x371/0x680
> [ 95.860812] snd_intel8x0_hw_params+0x106/0x550
> [ 95.861311] snd_pcm_hw_params+0x2b5/0x1290
> [ 95.861780] ? _copy_from_user+0x70/0xa0
> [ 95.862214] snd_pcm_common_ioctl+0x332/0x1a20
> [ 95.862699] ? up_read+0x10/0x90
> [ 95.863070] ? n_tty_write+0x7ba/0xf70
> [ 95.863484] ? snd_pcm_status_user+0x120/0x120
> [ 95.863974] ? _raw_spin_lock_irqsave+0x7b/0xd0
> [ 95.864473] ? _raw_spin_trylock_bh+0x120/0x120
> [ 95.864975] snd_pcm_ioctl+0x62/0xa0
> [ 95.865382] do_vfs_ioctl+0x9af/0xf30
> [ 95.865790] ? selinux_file_ioctl+0x3ca/0x530
> [ 95.866271] ? ioctl_preallocate+0x1a0/0x1a0
> [ 95.866739] ? selinux_capable+0x20/0x20
> [ 95.867172] ? __fget_light+0xab/0x4c0
> [ 95.867588] ? syscall_trace_enter+0x50e/0xb40
> [ 95.868074] ? iterate_fd+0x180/0x180
> [ 95.868478] ksys_ioctl+0x59/0x90
> [ 95.868853] __x64_sys_ioctl+0x6a/0xb0
> [ 95.869278] do_syscall_64+0x89/0x2e0
> [ 95.869681] ? prepare_exit_to_usermode+0xec/0x190
> [ 95.870213] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ 95.870764] RIP: 0033:0x7f6f375c8717
> [ 95.871157] Code: 00 00 90 48 8b 05 69 57 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 8
> [ 95.873187] RSP: 002b:00007ffdbdb71b48 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
> [ 95.874009] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6f375c8717
> [ 95.874780] RDX: 0000564d6f23c2a0 RSI: 00000000c2604111 RDI: 0000000000000003
> [ 95.875555] RBP: 00007ffdbdb71c20 R08: 0000000000000000 R09: 0000000000000010
> [ 95.876322] R10: 00007ffdbdb71a27 R11: 0000000000000206 R12: 0000564d6f15e120
> [ 95.877093] R13: 00007ffdbdb71d00 R14: 0000000000000000 R15: 0000000000000000
> [ 95.877864] Disabling lock debugging due to kernel taint
> [ 95.881630] ==================================================================
> [ 95.883522] BUG: KASAN: double-free or invalid-free in snd_pcm_lib_free_pages+0xe1/0x230
> [ 95.885570]
> [ 95.885976] CPU: 1 PID: 371 Comm: poc Tainted: G B W 5.4.191 #6
> [ 95.887787] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> [ 95.890095] Call Trace:
> [ 95.890505] dump_stack+0x76/0x9c
> [ 95.890859] print_address_description.constprop.0+0x16/0x200
> [ 95.891454] ? snd_pcm_lib_free_pages+0xe1/0x230
> [ 95.891940] kasan_report_invalid_free+0x61/0xa0
> [ 95.892429] ? snd_pcm_lib_free_pages+0xe1/0x230
> [ 95.892921] __kasan_slab_free+0x15e/0x170
> [ 95.893350] ? snd_pcm_lib_free_pages+0xe1/0x230
> [ 95.893843] kfree+0x8c/0x230
> [ 95.894163] snd_pcm_lib_free_pages+0xe1/0x230
> [ 95.894633] snd_pcm_common_ioctl+0x599/0x1a20
> [ 95.895089] ? snd_pcm_status_user+0x120/0x120
> [ 95.895543] snd_pcm_ioctl+0x62/0xa0
> [ 95.895912] do_vfs_ioctl+0x9af/0xf30
> [ 95.896292] ? selinux_file_ioctl+0x3ca/0x530
> [ 95.896752] ? ioctl_preallocate+0x1a0/0x1a0
> [ 95.897184] ? selinux_capable+0x20/0x20
> [ 95.897589] ? __fget_light+0x2ab/0x4c0
> [ 95.898002] ? iterate_fd+0x180/0x180
> [ 95.898385] ksys_ioctl+0x59/0x90
> [ 95.898739] __x64_sys_ioctl+0x6a/0xb0
> [ 95.899139] do_syscall_64+0x89/0x2e0
> [ 95.899521] ? syscall_return_slowpath+0x17a/0x1e0
> [ 95.900013] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ 95.900532] RIP: 0033:0x7f6f375c8717
> [ 95.900905] Code: 00 00 90 48 8b 05 69 57 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 8
> [ 95.902809] RSP: 002b:00007f6f30b72ee8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> [ 95.903572] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6f375c8717
> [ 95.904294] RDX: 0000000000000000 RSI: 0000000000004112 RDI: 0000000000000003
> [ 95.905009] RBP: 00007f6f30b72f00 R08: 00007f6f30b73700 R09: 00007f6f30b73700
> [ 95.905723] R10: 00007f6f30b739d0 R11: 0000000000000246 R12: 00007ffdbdb71ace
> [ 95.906442] R13: 00007ffdbdb71acf R14: 00007f6f30b72fc0 R15: 00007f6f30b73700
>
>
> The testcase runs successfully after applying this patchset.
>
> [1] https://www.openwall.com/lists/oss-security/2022/03/28/4
>
>
> Takashi Iwai (5):
> ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
> ALSA: pcm: Fix races among concurrent read/write and buffer changes
> ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free
> calls
> ALSA: pcm: Fix races among concurrent prealloc proc writes
> ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
>
> include/sound/pcm.h | 2 +
> sound/core/pcm.c | 3 ++
> sound/core/pcm_lib.c | 5 ++
> sound/core/pcm_memory.c | 11 ++--
> sound/core/pcm_native.c | 110 ++++++++++++++++++++++++++++------------
> 5 files changed, 95 insertions(+), 36 deletions(-)
>
> --
> 2.36.0
>
All now queued up, thanks.
greg k-h
prev parent reply other threads:[~2022-05-10 11:32 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-06 9:10 [PATCH 5.4 0/5] ALSA: pcm: backports for CVE-2022-1048 Ovidiu Panait
2022-05-06 9:10 ` [PATCH 5.4 1/5] ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Ovidiu Panait
2022-05-06 9:10 ` [PATCH 5.4 2/5] ALSA: pcm: Fix races among concurrent read/write and buffer changes Ovidiu Panait
2022-05-06 9:10 ` [PATCH 5.4 3/5] ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls Ovidiu Panait
2022-05-06 9:10 ` [PATCH 5.4 4/5] ALSA: pcm: Fix races among concurrent prealloc proc writes Ovidiu Panait
2022-05-06 9:10 ` [PATCH 5.4 5/5] ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock Ovidiu Panait
2022-05-10 11:32 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YnpNXSAjV4DVZj/m@kroah.com \
--to=greg@kroah.com \
--cc=kirin.say@gmail.com \
--cc=ovidiu.panait@windriver.com \
--cc=perex@perex.cz \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.