From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 205C7C433F5 for ; Tue, 19 Apr 2022 09:02:48 +0000 (UTC) Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id 432B61725; Tue, 19 Apr 2022 11:01:56 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz 432B61725 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1650358966; bh=HyqKlH8bOwBwVO91Kr6l4qEPG3zTPcjI+nlMvdOflsk=; h=Date:From:To:Subject:In-Reply-To:References:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=Hka5Xw14r9HkGDkTicvT2fwPf8PI641CAyyNbRR6lhxE3BHHb8ExPWsh2ZcyCPuAI SiLuG9QnKpZL7pFZexSxahBrwmLWVNzdQSfDxT7O8Hh/ee3iBtvgIlNWwqo9v+VPx7 /do/UtCkSdHBsiW0IwudfjFMKcnLHe39CflP+PJs= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id C4244F80237; Tue, 19 Apr 2022 11:01:55 +0200 (CEST) Received: by alsa1.perex.cz (Postfix, from userid 50401) id 4B3C5F8025D; Tue, 19 Apr 2022 11:01:54 +0200 (CEST) Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id 3C527F80121 for ; Tue, 19 Apr 2022 11:01:47 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz 3C527F80121 Authentication-Results: alsa1.perex.cz; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.b="Hi3ztoMt"; dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de header.b="8guWCu+M" Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out1.suse.de (Postfix) with ESMTP id 742BC210F1; Tue, 19 Apr 2022 09:01:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1650358907; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=7tmu8xW2ZdVQ7G42JQsUqYarrqw3vZczKi0AAynAqgs=; b=Hi3ztoMt7VAfNp7D2N610rfR3Z9oRO4g0B4pGiE+a02MGcEtQNagvYOe4XxP5BRMEvgFEt lZrwyMotHsvAub3vGNoBJnHZvZjLs/eIsnehJWYvnCl6ggGHMvRqArbBJk6v+3QAVosZB7 3S7QBRE0XZuyCvUGeL61yLf2jvBf+L8= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1650358907; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=7tmu8xW2ZdVQ7G42JQsUqYarrqw3vZczKi0AAynAqgs=; b=8guWCu+Ml7aWrhiMjov3KuKxQRUN66aMC/mN7a1pAijAExCi0UGVQo6ofVhvZkFti//Gjo kIFWUeH7O0HMCeDA== Received: from alsa1.suse.de (alsa1.suse.de [10.160.4.42]) by relay2.suse.de (Postfix) with ESMTP id 50E982C146; Tue, 19 Apr 2022 09:01:47 +0000 (UTC) Date: Tue, 19 Apr 2022 11:01:47 +0200 Message-ID: From: Takashi Iwai To: syzbot Subject: Re: [syzbot] KASAN: use-after-free Read in __snd_rawmidi_transmit_peek In-Reply-To: <00000000000011555605dceaff03@google.com> References: <00000000000011555605dceaff03@google.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: alsa-devel@alsa-project.org, coding@diwic.se, tiwai@suse.com, syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org, colin.king@intel.com X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" On Mon, 18 Apr 2022 12:12:23 +0200, syzbot wrote: > > Hello, > > syzbot found the following issue on: > > HEAD commit: a19944809fe9 Merge tag 'hardening-v5.18-rc3' of git://git... > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=16a40ae0f00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=eb177500e563582f > dashboard link: https://syzkaller.appspot.com/bug?extid=70e777a39907d6d5fd0a > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1590dfa8f00000 > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com > > ================================================================== > BUG: KASAN: use-after-free in __snd_rawmidi_transmit_peek+0x261/0x360 sound/core/rawmidi.c:1286 Looks like a leftover work. The fix patch is below. Takashi -- 8< -- From: Takashi Iwai Subject: [PATCH] ALSA: usb-audio: Fix potential use-after-free at releasing MIDI streams As recently spotted by syzbot, the USB MIDI code may leave a work that handles the pending output queue even after a stream gets released (either internally via sequencer or via device files), which may lead to use-after-free. We have already a proper drop of pending URBs but this is executed only at the device disconnection. This patch moves the URB clean-up code into both the code path that is called at releasing, namely, snd_usb_midi_in_endpoint_delete() and snd_usb_midi_out_endpoint_clear() functions, so that the pending URBs and work are cleared properly before releasing the resources. Reported-by: syzbot+70e777a39907d6d5fd0a@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/00000000000011555605dceaff03@google.com Signed-off-by: Takashi Iwai --- sound/usb/midi.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index 2c01649c70f6..8e5281f7f1fc 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1247,6 +1247,10 @@ static void snd_usbmidi_in_endpoint_delete(struct snd_usb_midi_in_endpoint *ep) { unsigned int i; + for (i = 0; i < INPUT_URBS; ++i) + if (ep->urbs[i]) + usb_kill_urb(ep->urbs[i]); + for (i = 0; i < INPUT_URBS; ++i) if (ep->urbs[i]) free_urb_and_buffer(ep->umidi, ep->urbs[i], @@ -1327,6 +1331,18 @@ static void snd_usbmidi_out_endpoint_clear(struct snd_usb_midi_out_endpoint *ep) { unsigned int i; + cancel_work_sync(&ep->work); + for (i = 0; i < OUTPUT_URBS; ++i) + if (ep->urbs[i].urb) + usb_kill_urb(ep->urbs[i].urb); + if (ep->umidi->usb_protocol_ops->finish_out_endpoint) + ep->umidi->usb_protocol_ops->finish_out_endpoint(ep); + ep->active_urbs = 0; + if (ep->drain_urbs) { + ep->drain_urbs = 0; + wake_up(&ep->drain_wait); + } + for (i = 0; i < OUTPUT_URBS; ++i) if (ep->urbs[i].urb) { free_urb_and_buffer(ep->umidi, ep->urbs[i].urb, @@ -1469,7 +1485,7 @@ static void snd_usbmidi_free(struct snd_usb_midi *umidi) void snd_usbmidi_disconnect(struct list_head *p) { struct snd_usb_midi *umidi; - unsigned int i, j; + unsigned int i; umidi = list_entry(p, struct snd_usb_midi, list); /* @@ -1487,22 +1503,6 @@ void snd_usbmidi_disconnect(struct list_head *p) for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; - if (ep->out) - cancel_work_sync(&ep->out->work); - if (ep->out) { - for (j = 0; j < OUTPUT_URBS; ++j) - usb_kill_urb(ep->out->urbs[j].urb); - if (umidi->usb_protocol_ops->finish_out_endpoint) - umidi->usb_protocol_ops->finish_out_endpoint(ep->out); - ep->out->active_urbs = 0; - if (ep->out->drain_urbs) { - ep->out->drain_urbs = 0; - wake_up(&ep->out->drain_wait); - } - } - if (ep->in) - for (j = 0; j < INPUT_URBS; ++j) - usb_kill_urb(ep->in->urbs[j]); /* free endpoints here; later call can result in Oops */ if (ep->out) snd_usbmidi_out_endpoint_clear(ep->out); -- 2.31.1