linux-kernel - Re: [PATCH] ALSA: rawmidi: Fix potential UAF from sequencer destruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <s5hzgrvl9j0.wl-tiwai@suse.de>
Date:   Wed, 29 Sep 2021 16:51:47 +0200
From:   Takashi Iwai <tiwai@...e.de>
To:     John Keeping <john@...anate.com>
Cc:     alsa-devel@...a-project.org, Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai <tiwai@...e.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ALSA: rawmidi: Fix potential UAF from sequencer destruction

On Wed, 29 Sep 2021 13:36:20 +0200,
John Keeping wrote:
> 
> If the sequencer device outlives the rawmidi device, then
> snd_rawmidi_dev_seq_free() will run after release_rawmidi_device() has
> freed the snd_rawmidi structure.
> 
> This can easily be reproduced with CONFIG_DEBUG_KOBJECT_RELEASE.
> 
> Keep a reference to the rawmidi device until the sequencer has been
> destroyed in order to avoid this.
> 
> Signed-off-by: John Keeping <john@...anate.com>

Thanks for the patch.  I wonder, though, how this could be triggered.
Is this the case where the connected sequencer device is being used
while the sound card gets released?  Or is it something else?


thanks,

Takashi

> ---
>  sound/core/rawmidi.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
> index 6f30231bdb88..b015f5f69175 100644
> --- a/sound/core/rawmidi.c
> +++ b/sound/core/rawmidi.c
> @@ -1860,6 +1860,7 @@ static void snd_rawmidi_dev_seq_free(struct snd_seq_device *device)
>  	struct snd_rawmidi *rmidi = device->private_data;
>  
>  	rmidi->seq_dev = NULL;
> +	put_device(&rmidi->dev);
>  }
>  #endif
>  
> @@ -1936,6 +1937,9 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
>  #if IS_ENABLED(CONFIG_SND_SEQUENCER)
>  	if (!rmidi->ops || !rmidi->ops->dev_register) { /* own registration mechanism */
>  		if (snd_seq_device_new(rmidi->card, rmidi->device, SNDRV_SEQ_DEV_ID_MIDISYNTH, 0, &rmidi->seq_dev) >= 0) {
> +			/* Ensure we outlive the sequencer (see snd_rawmidi_dev_seq_free). */
> +			get_device(&rmidi->dev);
> +
>  			rmidi->seq_dev->private_data = rmidi;
>  			rmidi->seq_dev->private_free = snd_rawmidi_dev_seq_free;
>  			sprintf(rmidi->seq_dev->name, "MIDI %d-%d", rmidi->card->number, rmidi->device);
> -- 
> 2.33.0
>