From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x225VI0f6kqw1mSy3+7EnBhM6CSkZymESVZkNyRjSeTZscpnl9YzEfJolM/uJyPfsBHM37svO ARC-Seal: i=1; a=rsa-sha256; t=1516611050; cv=none; d=google.com; s=arc-20160816; b=kwiJgZYGSAl66pU9n9fCSv8Zi4DWeMjTV0VzEDzL42M7kSR5nu/CXzzl0/13I+pQZh puf/yo+gsGzWL96c4YbwIBlXAKunkvlSZTJfePmMfF+gZniYst8HGPs/E95zzMkbMHuL W2qPX2o4Frprad2MaNEpy53bPnhPhH3nf0gZ3CS+wSkmj7471nPwmSVZwuNJf3IUdy3c +1dAgDSCmpbT6fA8Uik+PzM2dwERdxBW/fqBtZppRUWGfqpTVm//LzQWakiBdXx45Nj8 W4aBiZ3LbUcP2lDp5hZrlYEjBGu3bHc2lFlC0dUQfjNCY5iSo/ycsnUFnzGYuyaGSONL /VrA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=jU7sgTRdgJLHUILCbS7tswvzX3dnClwf/3o8Qu3vHVg=; b=0XQ+Nm3aemcKw1FQglrAhDZrY8QDcIYpZOH8EcNqnfFJVFtgtikM6t5k4m+AKdu9Pf RGpmkcNb7iAXIq8AVK/k+kBoVRwhs+rKXdwvjcEerZ1r+eWAX7L4aly0HXYvwr6jg0pB 5H6vrmPzw8Z7feQSSNOi1cvGGy4zEkX+wYfRMkuzWQxAvAvqUM6rzawi3SxapGBnQ060 Qlketn0IXsN7ia5etDdBCeNprpB829XNOEJvoUuIeSHZLHK5QhwEL5Lt9/h1hq5Wk/S6 /NSv6nzQg5AFT4zuptpvD8VDJCF2rAhrGkJZ1pbHKrvm/eKw9E0TojUu7FgRe6Hq1tEW X9TA== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Luo Quan , Kees Cook , Takashi Iwai Subject: [PATCH 4.14 18/89] ALSA: seq: Make ioctls race-free Date: Mon, 22 Jan 2018 09:44:58 +0100 Message-Id: <20180122083956.527692250@linuxfoundation.org> X-Mailer: git-send-email 2.16.0 In-Reply-To: <20180122083954.683903493@linuxfoundation.org> References: <20180122083954.683903493@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590281790627813025?= X-GMAIL-MSGID: =?utf-8?q?1590281949377565650?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Takashi Iwai commit b3defb791b26ea0683a93a4f49c77ec45ec96f10 upstream. The ALSA sequencer ioctls have no protection against racy calls while the concurrent operations may lead to interfere with each other. As reported recently, for example, the concurrent calls of setting client pool with a combination of write calls may lead to either the unkillable dead-lock or UAF. As a slightly big hammer solution, this patch introduces the mutex to make each ioctl exclusive. Although this may reduce performance via parallel ioctl calls, usually it's not demanded for sequencer usages, hence it should be negligible. Reported-by: Luo Quan Reviewed-by: Kees Cook Reviewed-by: Greg Kroah-Hartman Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/seq/seq_clientmgr.c | 3 +++ sound/core/seq/seq_clientmgr.h | 1 + 2 files changed, 4 insertions(+) --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -221,6 +221,7 @@ static struct snd_seq_client *seq_create rwlock_init(&client->ports_lock); mutex_init(&client->ports_mutex); INIT_LIST_HEAD(&client->ports_list_head); + mutex_init(&client->ioctl_mutex); /* find free slot in the client table */ spin_lock_irqsave(&clients_lock, flags); @@ -2126,7 +2127,9 @@ static long snd_seq_ioctl(struct file *f return -EFAULT; } + mutex_lock(&client->ioctl_mutex); err = handler->func(client, &buf); + mutex_unlock(&client->ioctl_mutex); if (err >= 0) { /* Some commands includes a bug in 'dir' field. */ if (handler->cmd == SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT || --- a/sound/core/seq/seq_clientmgr.h +++ b/sound/core/seq/seq_clientmgr.h @@ -61,6 +61,7 @@ struct snd_seq_client { struct list_head ports_list_head; rwlock_t ports_lock; struct mutex ports_mutex; + struct mutex ioctl_mutex; int convert32; /* convert 32->64bit */ /* output pool */