From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23A7FC31E5B for ; Mon, 17 Jun 2019 21:31:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E2349204FD for ; Mon, 17 Jun 2019 21:31:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1560807089; bh=01JgqLU+q/jditVF0XnE6iIetBdTeaxf7YEBoD9AiAg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=bZprHOnM5+hZwYUBYUTUBgiusC8i+5udv1nX4pt7dTejPV91mD5eoZLXAZro9tceS ptI6nG6ZGFx+Z7qKy/n2On2zlbdmSYtNbDWiCO7P2pqJO1sazxJz5HAZ3EvZJTgFXK NVgZFeeIzIFm1swfaMEbaUIQttp5Nu0At8BmI2PY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730101AbfFQV2w (ORCPT ); Mon, 17 Jun 2019 17:28:52 -0400 Received: from mail.kernel.org ([198.145.29.99]:55950 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729031AbfFQV2t (ORCPT ); Mon, 17 Jun 2019 17:28:49 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 34097204FD; Mon, 17 Jun 2019 21:28:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1560806928; bh=01JgqLU+q/jditVF0XnE6iIetBdTeaxf7YEBoD9AiAg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YMxFLr+Gh/T3nvyFie3z1ngr0niiAbj8mK2n2/SfyOTDG+Zb1t3T3KpbfHFZRXjjE BvsE9jmyh7UUykoBmztOwBJhdSPS0GSGASJA+Vuj8OzuqF2XH5gT5U0FL7Ro9W/2pT Bta/TGe9RDMwXNPRXSFnbruSCOin4i8uuoFOrytg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com, Takashi Iwai , Sasha Levin Subject: [PATCH 4.14 23/53] ALSA: seq: Protect in-kernel ioctl calls with mutex Date: Mon, 17 Jun 2019 23:10:06 +0200 Message-Id: <20190617210749.935047820@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190617210745.104187490@linuxfoundation.org> References: <20190617210745.104187490@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org [ Upstream commit feb689025fbb6f0aa6297d3ddf97de945ea4ad32 ] ALSA OSS sequencer calls the ioctl function indirectly via snd_seq_kernel_client_ctl(). While we already applied the protection against races between the normal ioctls and writes via the client's ioctl_mutex, this code path was left untouched. And this seems to be the cause of still remaining some rare UAF as spontaneously triggered by syzkaller. For the sake of robustness, wrap the ioctl_mutex also for the call via snd_seq_kernel_client_ctl(), too. Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/core/seq/seq_clientmgr.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 3bcd7a2f0394..692631bd4a35 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -2348,14 +2348,19 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg) { const struct ioctl_handler *handler; struct snd_seq_client *client; + int err; client = clientptr(clientid); if (client == NULL) return -ENXIO; for (handler = ioctl_handlers; handler->cmd > 0; ++handler) { - if (handler->cmd == cmd) - return handler->func(client, arg); + if (handler->cmd == cmd) { + mutex_lock(&client->ioctl_mutex); + err = handler->func(client, arg); + mutex_unlock(&client->ioctl_mutex); + return err; + } } pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n", -- 2.20.1