linux-kernel - Re: [PATCH v3] ASoC: SOF: Intel: hda: Fix UAF when reloading module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <71d1f2a1-e2ab-4327-bc6a-ff0aa7dbc19c@linux.intel.com>
Date: Thu, 8 May 2025 08:49:59 +0300
From: Péter Ujfalusi <peter.ujfalusi@...ux.intel.com>
To: Tavian Barnes <tavianator@...ianator.com>
Cc: linux-sound@...r.kernel.org, Liam Girdwood <lgirdwood@...il.com>,
 Bard Liao <yung-chuan.liao@...ux.intel.com>,
 Ranjani Sridharan <ranjani.sridharan@...ux.intel.com>,
 Daniel Baluta <daniel.baluta@....com>,
 Kai Vehmanen <kai.vehmanen@...ux.intel.com>,
 Pierre-Louis Bossart <pierre-louis.bossart@...ux.dev>,
 Mark Brown <broonie@...nel.org>, Jaroslav Kysela <perex@...ex.cz>,
 Takashi Iwai <tiwai@...e.com>, Peter Zijlstra <peterz@...radead.org>,
 sound-open-firmware@...a-project.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] ASoC: SOF: Intel: hda: Fix UAF when reloading module



On 07/05/2025 20:06, Tavian Barnes wrote:
>>> -                     hda_mach = snd_soc_acpi_intel_hda_machines;
>>> +                     /* make a copy so we can modify it below */
>>> +                     hda_mach = devm_kmemdup(sdev->dev,
>>> +                                             snd_soc_acpi_intel_hda_machines,
>>> +                                             sizeof(*hda_mach),
>>> +                                             GFP_KERNEL);
>>
>> We need to copy 2x the size as the snd_soc_acpi_intel_hda_machines[] has
>> two entries, the second is the sentinel (all 0).
> 
> Do we?  I recognize that snd_soc_acpi_intel_hda_machines is an array,
> but I don't see anywhere that hda_mach or *mach are used as an array,
> at least in hda.c.
> 
> I'm no expert though, if we need the sentinel I can send a v4.  Thanks
> for the review!

Yes, we need to preserve the sentinel. When dealing with the
snd_soc_acpi_mach all code looks for the sentinel at the end to break
the loops. The size of the arrays are unknown outside where they are
defined.

-- 
Péter