linux-kernel - [PATCH 1/2] ASoC: dapm: Fix UAF for snd_soc_pcm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240823144342.4123814-2-spujar@nvidia.com>
Date: Fri, 23 Aug 2024 14:43:41 +0000
From: Sameer Pujar <spujar@...dia.com>
To: <broonie@...nel.org>, <linux-sound@...r.kernel.org>
CC: <lgirdwood@...il.com>, <perex@...ex.cz>, <tiwai@...e.com>,
	<thierry.reding@...il.com>, <jonathanh@...dia.com>, <mkumard@...dia.com>,
	<spujar@...dia.com>, <rituc@...dia.com>, <jbrunet@...libre.com>,
	<linux-kernel@...r.kernel.org>, <linux-tegra@...r.kernel.org>,
	<robelin@...dia.com>
Subject: [PATCH 1/2] ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object

From: robelin <robelin@...dia.com>

When using kernel with the following extra config,

  - CONFIG_KASAN=y
  - CONFIG_KASAN_GENERIC=y
  - CONFIG_KASAN_INLINE=y
  - CONFIG_KASAN_VMALLOC=y
  - CONFIG_FRAME_WARN=4096

kernel detects that snd_pcm_suspend_all() access a freed
'snd_soc_pcm_runtime' object when the system is suspended, which
leads to a use-after-free bug:

[   52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270
[   52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330
[   52.047771]
[   52.047776] CPU: 7 PID: 2330 Comm: systemd-sleep Tainted: G           O      5.15.148-tegra #9
[   52.047781] Hardware name: NVIDIA NVIDIA Jetson AGX Orin Developer Kit/Jetson, BIOS 36.4.0-gcid-36705213 07/01/2024
[   52.047785] Call trace:
[   52.047787]  dump_backtrace+0x0/0x3c0
[   52.047794]  show_stack+0x34/0x50
[   52.047797]  dump_stack_lvl+0x68/0x8c
[   52.047802]  print_address_description.constprop.0+0x74/0x2c0
[   52.047809]  kasan_report+0x210/0x230
[   52.047815]  __asan_report_load1_noabort+0x3c/0x50
[   52.047820]  snd_pcm_suspend_all+0x1a8/0x270
[   52.047824]  snd_soc_suspend+0x19c/0x4e0
[   52.047831]  dpm_prepare+0x1c0/0xb90
[   52.047838]  dpm_suspend_start+0x30/0xe0
[   52.047842]  suspend_devices_and_enter+0x220/0xfd0
[   52.047849]  pm_suspend+0x464/0x560
[   52.047853]  state_store+0xac/0x180
[   52.047856]  kobj_attr_store+0x3c/0x90
[   52.047861]  sysfs_kf_write+0x10c/0x180
[   52.047868]  kernfs_fop_write_iter+0x280/0x3e0
[   52.047873]  new_sync_write+0x2cc/0x4c0
[   52.047877]  vfs_write+0x514/0x760
[   52.047880]  ksys_write+0x100/0x1f0
[   52.047883]  __arm64_sys_write+0x78/0xc0
[   52.047887]  invoke_syscall+0x7c/0x280
[   52.047892]  el0_svc_common.constprop.0+0xcc/0x270
[   52.047897]  do_el0_svc+0xb0/0x100
[   52.047901]  el0_svc+0x3c/0x90
[   52.047905]  el0t_64_sync_handler+0xac/0x130
[   52.047908]  el0t_64_sync+0x1a4/0x1a8

The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before
making any access. So we need to always set 'substream->runtime' to NULL
everytime we kfree() it.

Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables")
Signed-off-by: robelin <robelin@...dia.com>
Signed-off-by: Sameer Pujar <spujar@...dia.com>
---
 sound/soc/soc-dapm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index d7d6dbb9d9ea..e5900cb65cf6 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -4056,6 +4056,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
 
 	case SND_SOC_DAPM_POST_PMD:
 		kfree(substream->runtime);
+		substream->runtime = NULL;
 		break;
 
 	default:
-- 
2.17.1