From: Sameer Pujar <spujar@nvidia.com>
To: <broonie@kernel.org>, <linux-sound@vger.kernel.org>
Cc: <lgirdwood@gmail.com>, <perex@perex.cz>, <tiwai@suse.com>,
<thierry.reding@gmail.com>, <jonathanh@nvidia.com>,
<mkumard@nvidia.com>, <spujar@nvidia.com>, <rituc@nvidia.com>,
<jbrunet@baylibre.com>, <linux-kernel@vger.kernel.org>,
<linux-tegra@vger.kernel.org>, <robelin@nvidia.com>
Subject: [PATCH 1/2] ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
Date: Fri, 23 Aug 2024 14:43:41 +0000 [thread overview]
Message-ID: <20240823144342.4123814-2-spujar@nvidia.com> (raw)
In-Reply-To: <20240823144342.4123814-1-spujar@nvidia.com>
From: robelin <robelin@nvidia.com>
When using kernel with the following extra config,
- CONFIG_KASAN=y
- CONFIG_KASAN_GENERIC=y
- CONFIG_KASAN_INLINE=y
- CONFIG_KASAN_VMALLOC=y
- CONFIG_FRAME_WARN=4096
kernel detects that snd_pcm_suspend_all() access a freed
'snd_soc_pcm_runtime' object when the system is suspended, which
leads to a use-after-free bug:
[ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270
[ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330
[ 52.047771]
[ 52.047776] CPU: 7 PID: 2330 Comm: systemd-sleep Tainted: G O 5.15.148-tegra #9
[ 52.047781] Hardware name: NVIDIA NVIDIA Jetson AGX Orin Developer Kit/Jetson, BIOS 36.4.0-gcid-36705213 07/01/2024
[ 52.047785] Call trace:
[ 52.047787] dump_backtrace+0x0/0x3c0
[ 52.047794] show_stack+0x34/0x50
[ 52.047797] dump_stack_lvl+0x68/0x8c
[ 52.047802] print_address_description.constprop.0+0x74/0x2c0
[ 52.047809] kasan_report+0x210/0x230
[ 52.047815] __asan_report_load1_noabort+0x3c/0x50
[ 52.047820] snd_pcm_suspend_all+0x1a8/0x270
[ 52.047824] snd_soc_suspend+0x19c/0x4e0
[ 52.047831] dpm_prepare+0x1c0/0xb90
[ 52.047838] dpm_suspend_start+0x30/0xe0
[ 52.047842] suspend_devices_and_enter+0x220/0xfd0
[ 52.047849] pm_suspend+0x464/0x560
[ 52.047853] state_store+0xac/0x180
[ 52.047856] kobj_attr_store+0x3c/0x90
[ 52.047861] sysfs_kf_write+0x10c/0x180
[ 52.047868] kernfs_fop_write_iter+0x280/0x3e0
[ 52.047873] new_sync_write+0x2cc/0x4c0
[ 52.047877] vfs_write+0x514/0x760
[ 52.047880] ksys_write+0x100/0x1f0
[ 52.047883] __arm64_sys_write+0x78/0xc0
[ 52.047887] invoke_syscall+0x7c/0x280
[ 52.047892] el0_svc_common.constprop.0+0xcc/0x270
[ 52.047897] do_el0_svc+0xb0/0x100
[ 52.047901] el0_svc+0x3c/0x90
[ 52.047905] el0t_64_sync_handler+0xac/0x130
[ 52.047908] el0t_64_sync+0x1a4/0x1a8
The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before
making any access. So we need to always set 'substream->runtime' to NULL
everytime we kfree() it.
Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables")
Signed-off-by: robelin <robelin@nvidia.com>
Signed-off-by: Sameer Pujar <spujar@nvidia.com>
---
sound/soc/soc-dapm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index d7d6dbb9d9ea..e5900cb65cf6 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -4056,6 +4056,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
case SND_SOC_DAPM_POST_PMD:
kfree(substream->runtime);
+ substream->runtime = NULL;
break;
default:
--
2.17.1
next prev parent reply other threads:[~2024-08-23 14:44 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-23 14:43 [PATCH 0/2] Fixes for Tegra audio Sameer Pujar
2024-08-23 14:43 ` Sameer Pujar [this message]
2024-08-23 22:03 ` [PATCH 1/2] ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object Mark Brown
2024-08-23 14:43 ` [PATCH 2/2] ASoC: tegra: Fix CBB error during probe() Sameer Pujar
2024-08-24 10:13 ` [PATCH 0/2] Fixes for Tegra audio Mark Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240823144342.4123814-2-spujar@nvidia.com \
--to=spujar@nvidia.com \
--cc=broonie@kernel.org \
--cc=jbrunet@baylibre.com \
--cc=jonathanh@nvidia.com \
--cc=lgirdwood@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=linux-tegra@vger.kernel.org \
--cc=mkumard@nvidia.com \
--cc=perex@perex.cz \
--cc=rituc@nvidia.com \
--cc=robelin@nvidia.com \
--cc=thierry.reding@gmail.com \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox