[PATCH] ALSA: control: do not access controls without possession of r_w lock

[PATCH] ALSA: control: do not access controls without possession of r_w lock

[Ma Ke]

we should not access any of its memory when we don't ensure possession of
a read/write lock. Otherwise we risk a use after free access, which allows
local users to cause a denial of service and obtain sensitive information
from kernel memory.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
---
 sound/core/control.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/core/control.c b/sound/core/control.c
index 59c8658966d4..98782cc68ee1 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -590,7 +590,8 @@ static int __snd_ctl_remove(struct snd_card *card,
 		remove_hash_entries(card, kcontrol);
 
 	card->controls_count -= kcontrol->count;
-	for (idx = 0; idx < kcontrol->count; idx++)
+	count = kcontrol->count;
+	for (idx = 0; idx < count; idx++)
 		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
 	snd_ctl_free_one(kcontrol);
 	return 0;
-- 
2.37.2

Re: [PATCH] ALSA: control: do not access controls without possession of r_w lock

[Takashi Iwai]

On Tue, 12 Sep 2023 10:45:30 +0200,
Ma Ke wrote:
> 
> we should not access any of its memory when we don't ensure possession of
> a read/write lock. Otherwise we risk a use after free access, which allows
> local users to cause a denial of service and obtain sensitive information
> from kernel memory.

This function is called always under card->controls_rwsem.
So it should be OK as is.


thanks,

Takashi

> 
> Signed-off-by: Ma Ke <make_ruc2021@163.com>
> ---
>  sound/core/control.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/sound/core/control.c b/sound/core/control.c
> index 59c8658966d4..98782cc68ee1 100644
> --- a/sound/core/control.c
> +++ b/sound/core/control.c
> @@ -590,7 +590,8 @@ static int __snd_ctl_remove(struct snd_card *card,
>  		remove_hash_entries(card, kcontrol);
>  
>  	card->controls_count -= kcontrol->count;
> -	for (idx = 0; idx < kcontrol->count; idx++)
> +	count = kcontrol->count;
> +	for (idx = 0; idx < count; idx++)
>  		snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
>  	snd_ctl_free_one(kcontrol);
>  	return 0;
> -- 
> 2.37.2
> 

Re: [PATCH] ALSA: control: do not access controls without possession of r_w lock

[kernel test robot]

Hi Ma,

kernel test robot noticed the following build errors:

[auto build test ERROR on tiwai-sound/for-next]
[also build test ERROR on tiwai-sound/for-linus linus/master v6.6-rc1 next-20230912]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/ALSA-control-do-not-access-controls-without-possession-of-r_w-lock/20230912-164832
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git for-next
patch link:    https://lore.kernel.org/r/20230912084530.3307329-1-make_ruc2021%40163.com
patch subject: [PATCH] ALSA: control: do not access controls without possession of r_w lock
config: arm-randconfig-r032-20230913 (https://download.01.org/0day-ci/archive/20230913/202309130328.UdCL3yzt-lkp@intel.com/config)
compiler: clang version 17.0.0 (https://github.com/llvm/llvm-project.git 4a5ac14ee968ff0ad5d2cc1ffa0299048db4c88a)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20230913/202309130328.UdCL3yzt-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202309130328.UdCL3yzt-lkp@intel.com/

All errors (new ones prefixed by >>):

>> sound/core/control.c:593:2: error: use of undeclared identifier 'count'
     593 |         count = kcontrol->count;
         |         ^
   sound/core/control.c:594:22: error: use of undeclared identifier 'count'
     594 |         for (idx = 0; idx < count; idx++)
         |                             ^
   2 errors generated.


vim +/count +593 sound/core/control.c

   576	
   577	static int __snd_ctl_remove(struct snd_card *card,
   578				    struct snd_kcontrol *kcontrol,
   579				    bool remove_hash)
   580	{
   581		unsigned int idx;
   582	
   583		lockdep_assert_held_write(&card->controls_rwsem);
   584	
   585		if (snd_BUG_ON(!card || !kcontrol))
   586			return -EINVAL;
   587		list_del(&kcontrol->list);
   588	
   589		if (remove_hash)
   590			remove_hash_entries(card, kcontrol);
   591	
   592		card->controls_count -= kcontrol->count;
 > 593		count = kcontrol->count;
   594		for (idx = 0; idx < count; idx++)
   595			snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
   596		snd_ctl_free_one(kcontrol);
   597		return 0;
   598	}
   599	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] ALSA: control: do not access controls without possession of r_w lock

[kernel test robot]

Hi Ma,

kernel test robot noticed the following build errors:

[auto build test ERROR on tiwai-sound/for-next]
[also build test ERROR on tiwai-sound/for-linus linus/master v6.6-rc3 next-20230921]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/ALSA-control-do-not-access-controls-without-possession-of-r_w-lock/20230912-164832
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git for-next
patch link:    https://lore.kernel.org/r/20230912084530.3307329-1-make_ruc2021%40163.com
patch subject: [PATCH] ALSA: control: do not access controls without possession of r_w lock
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20230925/202309251036.Yjiuc0Lq-lkp@intel.com/config)
compiler: loongarch64-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20230925/202309251036.Yjiuc0Lq-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202309251036.Yjiuc0Lq-lkp@intel.com/

All errors (new ones prefixed by >>):

   sound/core/control.c: In function '__snd_ctl_remove':
>> sound/core/control.c:593:9: error: 'count' undeclared (first use in this function); did you mean 'd_count'?
     593 |         count = kcontrol->count;
         |         ^~~~~
         |         d_count
   sound/core/control.c:593:9: note: each undeclared identifier is reported only once for each function it appears in


vim +593 sound/core/control.c

   576	
   577	static int __snd_ctl_remove(struct snd_card *card,
   578				    struct snd_kcontrol *kcontrol,
   579				    bool remove_hash)
   580	{
   581		unsigned int idx;
   582	
   583		lockdep_assert_held_write(&card->controls_rwsem);
   584	
   585		if (snd_BUG_ON(!card || !kcontrol))
   586			return -EINVAL;
   587		list_del(&kcontrol->list);
   588	
   589		if (remove_hash)
   590			remove_hash_entries(card, kcontrol);
   591	
   592		card->controls_count -= kcontrol->count;
 > 593		count = kcontrol->count;
   594		for (idx = 0; idx < count; idx++)
   595			snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
   596		snd_ctl_free_one(kcontrol);
   597		return 0;
   598	}
   599	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki