84 lines
2.9 KiB
Diff
84 lines
2.9 KiB
Diff
|
From 425e11483546f928109e5871a2c8b0fba3ddb3b4 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Takashi Iwai <tiwai@suse.de>
|
||
|
|
Date: Wed, 21 Jun 2017 18:56:01 +0200
|
||
|
|
Subject: [PATCH 1/5] ALSA: timer: Fix race between read and ioctl
|
||
|
|
|
||
|
|
The read from ALSA timer device, the function snd_timer_user_tread(),
|
||
|
|
may access to an uninitialized struct snd_timer_user fields when the
|
||
|
|
read is concurrently performed while the ioctl like
|
||
|
|
snd_timer_user_tselect() is invoked. We have already fixed the races
|
||
|
|
among ioctls via a mutex, but we seem to have forgotten the race
|
||
|
|
between read vs ioctl.
|
||
|
|
|
||
|
|
This patch simply applies (more exactly extends the already applied
|
||
|
|
range of) tu->ioctl_lock in snd_timer_user_tread() for closing the
|
||
|
|
race window.
|
||
|
|
|
||
|
|
Reported-by: Alexander Potapenko <glider@google.com>
|
||
|
|
Tested-by: Alexander Potapenko <glider@google.com>
|
||
|
|
Cc: <stable@vger.kernel.org>
|
||
|
|
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||
|
|
|
||
|
|
CVE-2017-1000380
|
||
|
|
|
||
|
|
(cherry-picked from commit d11662f4f798b50d8c8743f433842c3e40fe3378)
|
||
|
|
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
|
||
|
|
Acked-by: Seth Forshee <seth.forshee@canonical.com>
|
||
|
|
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
|
||
|
|
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
|
||
|
|
|
||
|
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
||
|
|
---
|
||
|
|
sound/core/timer.c | 6 ++++--
|
||
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/sound/core/timer.c b/sound/core/timer.c
|
||
|
|
index ad153149b231..3c11a6983f54 100644
|
||
|
|
--- a/sound/core/timer.c
|
||
|
|
+++ b/sound/core/timer.c
|
||
|
|
@@ -1963,6 +1963,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
|
||
|
|
|
||
|
|
tu = file->private_data;
|
||
|
|
unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read);
|
||
|
|
+ mutex_lock(&tu->ioctl_lock);
|
||
|
|
spin_lock_irq(&tu->qlock);
|
||
|
|
while ((long)count - result >= unit) {
|
||
|
|
while (!tu->qused) {
|
||
|
|
@@ -1978,7 +1979,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
|
||
|
|
add_wait_queue(&tu->qchange_sleep, &wait);
|
||
|
|
|
||
|
|
spin_unlock_irq(&tu->qlock);
|
||
|
|
+ mutex_unlock(&tu->ioctl_lock);
|
||
|
|
schedule();
|
||
|
|
+ mutex_lock(&tu->ioctl_lock);
|
||
|
|
spin_lock_irq(&tu->qlock);
|
||
|
|
|
||
|
|
remove_wait_queue(&tu->qchange_sleep, &wait);
|
||
|
|
@@ -1998,7 +2001,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
|
||
|
|
tu->qused--;
|
||
|
|
spin_unlock_irq(&tu->qlock);
|
||
|
|
|
||
|
|
- mutex_lock(&tu->ioctl_lock);
|
||
|
|
if (tu->tread) {
|
||
|
|
if (copy_to_user(buffer, &tu->tqueue[qhead],
|
||
|
|
sizeof(struct snd_timer_tread)))
|
||
|
|
@@ -2008,7 +2010,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
|
||
|
|
sizeof(struct snd_timer_read)))
|
||
|
|
err = -EFAULT;
|
||
|
|
}
|
||
|
|
- mutex_unlock(&tu->ioctl_lock);
|
||
|
|
|
||
|
|
spin_lock_irq(&tu->qlock);
|
||
|
|
if (err < 0)
|
||
|
|
@@ -2018,6 +2019,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
|
||
|
|
}
|
||
|
|
_error:
|
||
|
|
spin_unlock_irq(&tu->qlock);
|
||
|
|
+ mutex_unlock(&tu->ioctl_lock);
|
||
|
|
return result > 0 ? result : err;
|
||
|
|
}
|
||
|
|
|
||
|
|
--
|
||
|
|
2.11.0
|
||
|
|
|