* [PATCH] ALSA: control: do not access controls without possession of r_w lock
@ 2023-09-12 8:45 Ma Ke
2023-09-12 8:50 ` Takashi Iwai
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Ma Ke @ 2023-09-12 8:45 UTC (permalink / raw)
To: perex, tiwai, cujomalainey, maciej.szmigiero, clecigne,
make_ruc2021
Cc: alsa-devel, linux-kernel
we should not access any of its memory when we don't ensure possession of
a read/write lock. Otherwise we risk a use after free access, which allows
local users to cause a denial of service and obtain sensitive information
from kernel memory.
Signed-off-by: Ma Ke <make_ruc2021@163.com>
---
sound/core/control.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/core/control.c b/sound/core/control.c
index 59c8658966d4..98782cc68ee1 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -590,7 +590,8 @@ static int __snd_ctl_remove(struct snd_card *card,
remove_hash_entries(card, kcontrol);
card->controls_count -= kcontrol->count;
- for (idx = 0; idx < kcontrol->count; idx++)
+ count = kcontrol->count;
+ for (idx = 0; idx < count; idx++)
snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
snd_ctl_free_one(kcontrol);
return 0;
--
2.37.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] ALSA: control: do not access controls without possession of r_w lock
2023-09-12 8:45 [PATCH] ALSA: control: do not access controls without possession of r_w lock Ma Ke
@ 2023-09-12 8:50 ` Takashi Iwai
2023-09-12 19:53 ` kernel test robot
2023-09-25 2:25 ` kernel test robot
2 siblings, 0 replies; 4+ messages in thread
From: Takashi Iwai @ 2023-09-12 8:50 UTC (permalink / raw)
To: Ma Ke
Cc: perex, tiwai, cujomalainey, maciej.szmigiero, clecigne,
alsa-devel, linux-kernel
On Tue, 12 Sep 2023 10:45:30 +0200,
Ma Ke wrote:
>
> we should not access any of its memory when we don't ensure possession of
> a read/write lock. Otherwise we risk a use after free access, which allows
> local users to cause a denial of service and obtain sensitive information
> from kernel memory.
This function is called always under card->controls_rwsem.
So it should be OK as is.
thanks,
Takashi
>
> Signed-off-by: Ma Ke <make_ruc2021@163.com>
> ---
> sound/core/control.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/sound/core/control.c b/sound/core/control.c
> index 59c8658966d4..98782cc68ee1 100644
> --- a/sound/core/control.c
> +++ b/sound/core/control.c
> @@ -590,7 +590,8 @@ static int __snd_ctl_remove(struct snd_card *card,
> remove_hash_entries(card, kcontrol);
>
> card->controls_count -= kcontrol->count;
> - for (idx = 0; idx < kcontrol->count; idx++)
> + count = kcontrol->count;
> + for (idx = 0; idx < count; idx++)
> snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
> snd_ctl_free_one(kcontrol);
> return 0;
> --
> 2.37.2
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] ALSA: control: do not access controls without possession of r_w lock
2023-09-12 8:45 [PATCH] ALSA: control: do not access controls without possession of r_w lock Ma Ke
2023-09-12 8:50 ` Takashi Iwai
@ 2023-09-12 19:53 ` kernel test robot
2023-09-25 2:25 ` kernel test robot
2 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2023-09-12 19:53 UTC (permalink / raw)
To: Ma Ke, perex, tiwai, cujomalainey, maciej.szmigiero, clecigne
Cc: llvm, oe-kbuild-all, alsa-devel, linux-kernel
Hi Ma,
kernel test robot noticed the following build errors:
[auto build test ERROR on tiwai-sound/for-next]
[also build test ERROR on tiwai-sound/for-linus linus/master v6.6-rc1 next-20230912]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/ALSA-control-do-not-access-controls-without-possession-of-r_w-lock/20230912-164832
base: https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git for-next
patch link: https://lore.kernel.org/r/20230912084530.3307329-1-make_ruc2021%40163.com
patch subject: [PATCH] ALSA: control: do not access controls without possession of r_w lock
config: arm-randconfig-r032-20230913 (https://download.01.org/0day-ci/archive/20230913/202309130328.UdCL3yzt-lkp@intel.com/config)
compiler: clang version 17.0.0 (https://github.com/llvm/llvm-project.git 4a5ac14ee968ff0ad5d2cc1ffa0299048db4c88a)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20230913/202309130328.UdCL3yzt-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202309130328.UdCL3yzt-lkp@intel.com/
All errors (new ones prefixed by >>):
>> sound/core/control.c:593:2: error: use of undeclared identifier 'count'
593 | count = kcontrol->count;
| ^
sound/core/control.c:594:22: error: use of undeclared identifier 'count'
594 | for (idx = 0; idx < count; idx++)
| ^
2 errors generated.
vim +/count +593 sound/core/control.c
576
577 static int __snd_ctl_remove(struct snd_card *card,
578 struct snd_kcontrol *kcontrol,
579 bool remove_hash)
580 {
581 unsigned int idx;
582
583 lockdep_assert_held_write(&card->controls_rwsem);
584
585 if (snd_BUG_ON(!card || !kcontrol))
586 return -EINVAL;
587 list_del(&kcontrol->list);
588
589 if (remove_hash)
590 remove_hash_entries(card, kcontrol);
591
592 card->controls_count -= kcontrol->count;
> 593 count = kcontrol->count;
594 for (idx = 0; idx < count; idx++)
595 snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
596 snd_ctl_free_one(kcontrol);
597 return 0;
598 }
599
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] ALSA: control: do not access controls without possession of r_w lock
2023-09-12 8:45 [PATCH] ALSA: control: do not access controls without possession of r_w lock Ma Ke
2023-09-12 8:50 ` Takashi Iwai
2023-09-12 19:53 ` kernel test robot
@ 2023-09-25 2:25 ` kernel test robot
2 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2023-09-25 2:25 UTC (permalink / raw)
To: Ma Ke, perex, tiwai, cujomalainey, maciej.szmigiero, clecigne
Cc: oe-kbuild-all, alsa-devel, linux-kernel
Hi Ma,
kernel test robot noticed the following build errors:
[auto build test ERROR on tiwai-sound/for-next]
[also build test ERROR on tiwai-sound/for-linus linus/master v6.6-rc3 next-20230921]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/ALSA-control-do-not-access-controls-without-possession-of-r_w-lock/20230912-164832
base: https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git for-next
patch link: https://lore.kernel.org/r/20230912084530.3307329-1-make_ruc2021%40163.com
patch subject: [PATCH] ALSA: control: do not access controls without possession of r_w lock
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20230925/202309251036.Yjiuc0Lq-lkp@intel.com/config)
compiler: loongarch64-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20230925/202309251036.Yjiuc0Lq-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202309251036.Yjiuc0Lq-lkp@intel.com/
All errors (new ones prefixed by >>):
sound/core/control.c: In function '__snd_ctl_remove':
>> sound/core/control.c:593:9: error: 'count' undeclared (first use in this function); did you mean 'd_count'?
593 | count = kcontrol->count;
| ^~~~~
| d_count
sound/core/control.c:593:9: note: each undeclared identifier is reported only once for each function it appears in
vim +593 sound/core/control.c
576
577 static int __snd_ctl_remove(struct snd_card *card,
578 struct snd_kcontrol *kcontrol,
579 bool remove_hash)
580 {
581 unsigned int idx;
582
583 lockdep_assert_held_write(&card->controls_rwsem);
584
585 if (snd_BUG_ON(!card || !kcontrol))
586 return -EINVAL;
587 list_del(&kcontrol->list);
588
589 if (remove_hash)
590 remove_hash_entries(card, kcontrol);
591
592 card->controls_count -= kcontrol->count;
> 593 count = kcontrol->count;
594 for (idx = 0; idx < count; idx++)
595 snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
596 snd_ctl_free_one(kcontrol);
597 return 0;
598 }
599
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-09-25 2:26 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-09-12 8:45 [PATCH] ALSA: control: do not access controls without possession of r_w lock Ma Ke
2023-09-12 8:50 ` Takashi Iwai
2023-09-12 19:53 ` kernel test robot
2023-09-25 2:25 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox