OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ALSA: seq: Fix racy access for queue timer in proc read 

commit 60adcfde92 upstream.

snd_seq_info_timer_read() reads the information of the timer assigned
for each queue, but it's done in a racy way which may lead to UAF as
spotted by syzkaller.

This patch applies the missing q->timer_mutex lock while accessing the
timer object as well as a slight code change to adapt the standard
coding style.

Reported-by: syzbot+2b2ef983f973e5c40943@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200115203733.26530-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Takashi Iwai 2020-01-15 21:37:33 +01:00 committed by Greg Kroah-Hartman
parent 4aeac091e2
commit 1990603db1
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sound/core/seq/seq_timer.c
View File

@ -465,15 +465,19 @@ void snd_seq_info_timer_read(struct snd_info_entry *entry,
q = queueptr(idx); q = queueptr(idx);
if (q == NULL) if (q == NULL)
continue; continue;
if ((tmr = q->timer) == NULL || mutex_lock(&q->timer_mutex);
(ti = tmr->timeri) == NULL) { tmr = q->timer;
queuefree(q); if (!tmr)
continue; goto unlock;
} ti = tmr->timeri;
if (!ti)
goto unlock;
snd_iprintf(buffer, "Timer for queue %i : %s\n", q->queue, ti->timer->name); snd_iprintf(buffer, "Timer for queue %i : %s\n", q->queue, ti->timer->name);
resolution = snd_timer_resolution(ti) * tmr->ticks; resolution = snd_timer_resolution(ti) * tmr->ticks;
snd_iprintf(buffer, " Period time : %lu.%09lu\n", resolution / 1000000000, resolution % 1000000000); snd_iprintf(buffer, " Period time : %lu.%09lu\n", resolution / 1000000000, resolution % 1000000000);
snd_iprintf(buffer, " Skew : %u / %u\n", tmr->skew, tmr->skew_base); snd_iprintf(buffer, " Skew : %u / %u\n", tmr->skew, tmr->skew_base);
unlock:
mutex_unlock(&q->timer_mutex);
queuefree(q); queuefree(q);
} }
} }