From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66BD3C433EF for ; Tue, 2 Nov 2021 14:11:59 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 143AB61076 for ; Tue, 2 Nov 2021 14:11:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 143AB61076 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=suse.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=alsa-project.org Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id CB0A61669; Tue, 2 Nov 2021 15:11:05 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz CB0A61669 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1635862315; bh=czhq85D+Ik1Cgo/24pR7uTV1F/hiSwtIQh0zw78iOO4=; h=Date:From:To:Subject:In-Reply-To:References:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=CnbyIwno80ntJ8cXIqsBNvBLVX81vHsCfDTJfca3ukMUdl5vXMGlioZUkkffWEt81 9EwJDT4YJDRuzZDBbUTz4KnCHNExBmPBedrnKZtitqQqj7t+4pJVAIL/Do49QxPpZU k4MavJbb9OLxMdwobRvH7u3NyPVCcJxBG54SBy7Q= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id 49974F80229; Tue, 2 Nov 2021 15:11:05 +0100 (CET) Received: by alsa1.perex.cz (Postfix, from userid 50401) id 0DFF9F8025D; Tue, 2 Nov 2021 15:10:58 +0100 (CET) Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 1CF34F800BF for ; Tue, 2 Nov 2021 15:10:49 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 1CF34F800BF Authentication-Results: alsa1.perex.cz; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.b="ewYngEG3"; dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de header.b="dzF1lpO4" Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out2.suse.de (Postfix) with ESMTP id C16361FD4C; Tue, 2 Nov 2021 14:10:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1635862248; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=1DRWTC1TFIfMR6RNlvGI/qW1glO7XAqTrvN5XJswVzw=; b=ewYngEG3ImcmH8UfbJOem+z+BO4lsqJ4FnYkvyQqknNqbVgtUjzVWE3eQGr2U72pBiTs5u rn1Q5mAk57KtTLyC7Uc5vYVZ0uQ1huw6OCv9rBwcQ5BuAWuruJzWFU/ueDVwGAO8Z1SCIY 3EoXJDGvKoJmcMIzXKAs8qbRnHl4CQQ= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1635862248; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=1DRWTC1TFIfMR6RNlvGI/qW1glO7XAqTrvN5XJswVzw=; b=dzF1lpO49/xA1F+tOalq+n4/LIVwzpx3dEgxuHiMS/2mB7M3yfc7vxTvS1cWg1v2Z7IVid VQv7QJlOpsIxCMCA== Received: from alsa1.suse.de (alsa1.suse.de [10.160.4.42]) by relay2.suse.de (Postfix) with ESMTP id 99CB6A3B81; Tue, 2 Nov 2021 14:10:48 +0000 (UTC) Date: Tue, 02 Nov 2021 15:10:48 +0100 Message-ID: From: Takashi Iwai To: Wang Wensheng Subject: Re: [PATCH -next] ALSA: timer: Fix use-after-free problem In-Reply-To: <20211102134107.35126-1-wangwensheng4@huawei.com> References: <20211102134107.35126-1-wangwensheng4@huawei.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, tiwai@suse.com, rui.xiang@huawei.com, broonie@kernel.org, joe@perches.com X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" On Tue, 02 Nov 2021 14:41:07 +0100, Wang Wensheng wrote: > > When the timer instance was add into ack_list but was not currently in > process, the user could stop it via snd_timer_stop1() without delete it > from the ack_list. Then the user could free the timer instance and when > it was actually processed UAF occurred. > > This issue could be reproduced via testcase snd_timer01 in ltp - running > several instances of that testcase at the same time. > > What I actually met was that the ack_list of the timer broken and the > kernel went into deadloop with irqoff. That could be detected by > hardlockup detector on board or when we run it on qemu, we could use gdb > to dump the ack_list when the console has no response. > > To fix this issue, we introduce a new flag SNDRV_TIMER_IFLG_ACKING to > indicate the state where the timer instance is in ack_list but not > currently processed and check against the new flag in snd_timer_stop1() > and delete it from ack_list if the flag is set. > > Signed-off-by: Wang Wensheng Thanks for the patch. Just through a quick glance, I wonder whether it'd be easier to do list_del_init(&timeri->ack_list) unconditionally before the check of timeri->flags in snd_timer1_stop(). Ditto for active_list. So something like: --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -624,13 +624,13 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) if (!timer) return -EINVAL; spin_lock_irqsave(&timer->lock, flags); + list_del_init(&timeri->ack_list); + list_del_init(&timeri->active_list); if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START))) { result = -EBUSY; goto unlock; } - list_del_init(&timeri->ack_list); - list_del_init(&timeri->active_list); if (timer->card && timer->card->shutdown) goto unlock; if (stop) { Takashi > --- > include/sound/timer.h | 1 + > sound/core/timer.c | 12 +++++++++--- > 2 files changed, 10 insertions(+), 3 deletions(-) > > diff --git a/include/sound/timer.h b/include/sound/timer.h > index 760e132cc0cd..549288e94a39 100644 > --- a/include/sound/timer.h > +++ b/include/sound/timer.h > @@ -31,6 +31,7 @@ > #define SNDRV_TIMER_IFLG_CALLBACK 0x00000020 /* timer callback is active */ > #define SNDRV_TIMER_IFLG_EXCLUSIVE 0x00000040 /* exclusive owner - no more instances */ > #define SNDRV_TIMER_IFLG_EARLY_EVENT 0x00000080 /* write early event to the poll queue */ > +#define SNDRV_TIMER_IFLG_ACKING 0x00000100 /* the timeri was added to ack_list */ > > #define SNDRV_TIMER_FLG_CHANGE 0x00000001 > #define SNDRV_TIMER_FLG_RESCHED 0x00000002 /* need reschedule */ > diff --git a/sound/core/timer.c b/sound/core/timer.c > index 92b7008fcdb8..1d1e4274919c 100644 > --- a/sound/core/timer.c > +++ b/sound/core/timer.c > @@ -625,10 +625,12 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) > return -EINVAL; > spin_lock_irqsave(&timer->lock, flags); > if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | > - SNDRV_TIMER_IFLG_START))) { > + SNDRV_TIMER_IFLG_START | > + SNDRV_TIMER_IFLG_ACKING))) { > result = -EBUSY; > goto unlock; > } > + > list_del_init(&timeri->ack_list); > list_del_init(&timeri->active_list); > if (timer->card && timer->card->shutdown) > @@ -649,7 +651,8 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) > } > } > } > - timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START); > + timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START | > + SNDRV_TIMER_IFLG_ACKING); > if (stop) > timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED; > else > @@ -786,6 +789,7 @@ static void snd_timer_process_callbacks(struct snd_timer *timer, > > /* remove from ack_list and make empty */ > list_del_init(&ti->ack_list); > + ti->flags &= ~SNDRV_TIMER_IFLG_ACKING; > > if (!(ti->flags & SNDRV_TIMER_IFLG_DEAD)) { > ticks = ti->pticks; > @@ -890,8 +894,10 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left) > ack_list_head = &timer->ack_list_head; > else > ack_list_head = &timer->sack_list_head; > - if (list_empty(&ti->ack_list)) > + if (list_empty(&ti->ack_list)) { > list_add_tail(&ti->ack_list, ack_list_head); > + ti->flags |= SNDRV_TIMER_IFLG_ACKING; > + } > list_for_each_entry(ts, &ti->slave_active_head, active_list) { > ts->pticks = ti->pticks; > ts->resolution = resolution; > -- > 2.17.1 >