LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, DaeRyong Jeong <threeearcat@gmail.com>,
	Takashi Iwai <tiwai@suse.de>
Subject: [PATCH 4.9 11/32] ALSA: aloop: Add missing cable lock to ctl API callbacks
Date: Tue,  8 May 2018 10:10:51 +0200	[thread overview]
Message-ID: <20180508074010.629946569@linuxfoundation.org> (raw)
In-Reply-To: <20180508074008.800421598@linuxfoundation.org>

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 76b3421b39bd610546931fc923edcf90c18fa395 upstream.

Some control API callbacks in aloop driver are too lazy to take the
loopback->cable_lock and it results in possible races of cable access
while it's being freed.  It eventually lead to a UAF, as reported by
fuzzer recently.

This patch covers such control API callbacks and add the proper mutex
locks.

Reported-by: DaeRyong Jeong <threeearcat@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/drivers/aloop.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -832,9 +832,11 @@ static int loopback_rate_shift_get(struc
 {
 	struct loopback *loopback = snd_kcontrol_chip(kcontrol);
 	
+	mutex_lock(&loopback->cable_lock);
 	ucontrol->value.integer.value[0] =
 		loopback->setup[kcontrol->id.subdevice]
 			       [kcontrol->id.device].rate_shift;
+	mutex_unlock(&loopback->cable_lock);
 	return 0;
 }
 
@@ -866,9 +868,11 @@ static int loopback_notify_get(struct sn
 {
 	struct loopback *loopback = snd_kcontrol_chip(kcontrol);
 	
+	mutex_lock(&loopback->cable_lock);
 	ucontrol->value.integer.value[0] =
 		loopback->setup[kcontrol->id.subdevice]
 			       [kcontrol->id.device].notify;
+	mutex_unlock(&loopback->cable_lock);
 	return 0;
 }
 
@@ -880,12 +884,14 @@ static int loopback_notify_put(struct sn
 	int change = 0;
 
 	val = ucontrol->value.integer.value[0] ? 1 : 0;
+	mutex_lock(&loopback->cable_lock);
 	if (val != loopback->setup[kcontrol->id.subdevice]
 				[kcontrol->id.device].notify) {
 		loopback->setup[kcontrol->id.subdevice]
 			[kcontrol->id.device].notify = val;
 		change = 1;
 	}
+	mutex_unlock(&loopback->cable_lock);
 	return change;
 }
 
@@ -893,15 +899,18 @@ static int loopback_active_get(struct sn
 			       struct snd_ctl_elem_value *ucontrol)
 {
 	struct loopback *loopback = snd_kcontrol_chip(kcontrol);
-	struct loopback_cable *cable = loopback->cables
-			[kcontrol->id.subdevice][kcontrol->id.device ^ 1];
+	struct loopback_cable *cable;
+
 	unsigned int val = 0;
 
+	mutex_lock(&loopback->cable_lock);
+	cable = loopback->cables[kcontrol->id.subdevice][kcontrol->id.device ^ 1];
 	if (cable != NULL) {
 		unsigned int running = cable->running ^ cable->pause;
 
 		val = (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) ? 1 : 0;
 	}
+	mutex_unlock(&loopback->cable_lock);
 	ucontrol->value.integer.value[0] = val;
 	return 0;
 }
@@ -944,9 +953,11 @@ static int loopback_rate_get(struct snd_
 {
 	struct loopback *loopback = snd_kcontrol_chip(kcontrol);
 	
+	mutex_lock(&loopback->cable_lock);
 	ucontrol->value.integer.value[0] =
 		loopback->setup[kcontrol->id.subdevice]
 			       [kcontrol->id.device].rate;
+	mutex_unlock(&loopback->cable_lock);
 	return 0;
 }
 
@@ -966,9 +977,11 @@ static int loopback_channels_get(struct
 {
 	struct loopback *loopback = snd_kcontrol_chip(kcontrol);
 	
+	mutex_lock(&loopback->cable_lock);
 	ucontrol->value.integer.value[0] =
 		loopback->setup[kcontrol->id.subdevice]
 			       [kcontrol->id.device].channels;
+	mutex_unlock(&loopback->cable_lock);
 	return 0;
 }
 

  parent reply	other threads:[~2018-05-08  8:10 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-08  8:10 [PATCH 4.9 00/32] 4.9.99-stable review Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 01/32] perf/core: Fix the perf_cpu_time_max_percent check Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 02/32] percpu: include linux/sched.h for cond_resched() Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 03/32] bpf: map_get_next_key to return first key on NULL Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 04/32] arm/arm64: KVM: Add PSCI version selection API Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 05/32] crypto: talitos - fix IPsec cipher in length Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 06/32] serial: imx: ensure UCR3 and UFCR are setup correctly Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 07/32] USB: serial: option: Add support for Quectel EP06 Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 08/32] ALSA: pcm: Check PCM state at xfern compat ioctl Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 09/32] ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger() Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 10/32] ALSA: aloop: Mark paused device as inactive Greg Kroah-Hartman
2018-05-08  8:10 ` Greg Kroah-Hartman [this message]
2018-05-08  8:10 ` [PATCH 4.9 12/32] tracepoint: Do not warn on ENOMEM Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 13/32] Input: leds - fix out of bound access Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 14/32] Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 15/32] xfs: prevent creating negative-sized file via INSERT_RANGE Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 16/32] RDMA/cxgb4: release hw resources on device removal Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 17/32] RDMA/ucma: Allow resolving address w/o specifying source address Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 18/32] RDMA/mlx5: Protect from shift operand overflow Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 19/32] NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 20/32] IB/mlx5: Use unlimited rate when static rate is not supported Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 21/32] IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 22/32] drm/vmwgfx: Fix a buffer object leak Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 23/32] drm/bridge: vga-dac: Fix edid memory leak Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 24/32] test_firmware: fix setting old custom fw path back on exit, second try Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 25/32] USB: serial: visor: handle potential invalid device configuration Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 26/32] USB: Accept bulk endpoints with 1024-byte maxpacket Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 27/32] USB: serial: option: reimplement interface masking Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 28/32] USB: serial: option: adding support for ublox R410M Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 29/32] usb: musb: host: fix potential NULL pointer dereference Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 30/32] usb: musb: trace: fix NULL pointer dereference in musb_g_tx() Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 31/32] platform/x86: asus-wireless: Fix NULL pointer dereference Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 32/32] s390/facilites: use stfle_fac_list array size for MAX_FACILITY_BIT Greg Kroah-Hartman
2018-05-08 14:25 ` [PATCH 4.9 00/32] 4.9.99-stable review kernelci.org bot
2018-05-08 16:21 ` Guenter Roeck
2018-05-08 18:13 ` Naresh Kamboju
2018-05-08 23:56 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180508074010.629946569@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=threeearcat@gmail.com \
    --cc=tiwai@suse.de \
    --subject='Re: [PATCH 4.9 11/32] ALSA: aloop: Add missing cable lock to ctl API callbacks' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).