[PATCH 3.18.y] ALSA: timer: Fix race between read and ioctl

[PATCH 3.18.y] ALSA: timer: Fix race between read and ioctl

[Takashi Iwai]

commit d11662f4f798b50d8c8743f433842c3e40fe3378 upstream.

The read from ALSA timer device, the function snd_timer_user_tread(),
may access to an uninitialized struct snd_timer_user fields when the
read is concurrently performed while the ioctl like
snd_timer_user_tselect() is invoked.  We have already fixed the races
among ioctls via a mutex, but we seem to have forgotten the race
between read vs ioctl.

This patch simply applies (more exactly extends the already applied
range of) tu->ioctl_lock in snd_timer_user_tread() for closing the
race window.

Reported-by: Alexander Potapenko <glider@google.com>
Tested-by: Alexander Potapenko <glider@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---

This is the patch adapted to 3.18.y base that failed to apply.

 sound/core/timer.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/core/timer.c b/sound/core/timer.c
index d448437df4b5..00a73ecfb4e9 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1948,6 +1948,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
 
 	tu = file->private_data;
 	unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read);
+	mutex_lock(&tu->ioctl_lock);
 	spin_lock_irq(&tu->qlock);
 	while ((long)count - result >= unit) {
 		while (!tu->qused) {
@@ -1963,7 +1964,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
 			add_wait_queue(&tu->qchange_sleep, &wait);
 
 			spin_unlock_irq(&tu->qlock);
+			mutex_unlock(&tu->ioctl_lock);
 			schedule();
+			mutex_lock(&tu->ioctl_lock);
 			spin_lock_irq(&tu->qlock);
 
 			remove_wait_queue(&tu->qchange_sleep, &wait);
@@ -2001,6 +2004,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
 	}
  _error:
 	spin_unlock_irq(&tu->qlock);
+	mutex_unlock(&tu->ioctl_lock);
 	return result > 0 ? result : err;
 }
 
-- 
2.13.1

Re: [PATCH 3.18.y] ALSA: timer: Fix race between read and ioctl

[Greg Kroah-Hartman]

On Mon, Jun 12, 2017 at 07:12:02PM +0200, Takashi Iwai wrote:
> commit d11662f4f798b50d8c8743f433842c3e40fe3378 upstream.
> 
> The read from ALSA timer device, the function snd_timer_user_tread(),
> may access to an uninitialized struct snd_timer_user fields when the
> read is concurrently performed while the ioctl like
> snd_timer_user_tselect() is invoked.  We have already fixed the races
> among ioctls via a mutex, but we seem to have forgotten the race
> between read vs ioctl.
> 
> This patch simply applies (more exactly extends the already applied
> range of) tu->ioctl_lock in snd_timer_user_tread() for closing the
> race window.
> 
> Reported-by: Alexander Potapenko <glider@google.com>
> Tested-by: Alexander Potapenko <glider@google.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
> ---
> 
> This is the patch adapted to 3.18.y base that failed to apply.

Wonderful, thanks for the patch, now queued up.

greg k-h