From: Duoming Zhou <duoming@zju.edu.cn>
To: linux-sound@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, tiwai@suse.com, perex@perex.cz,
Duoming Zhou <duoming@zju.edu.cn>
Subject: [PATCH] ALSA: sh: aica: reorder cleanup operations to avoid UAF bug
Date: Mon, 25 Mar 2024 11:39:46 +0800 [thread overview]
Message-ID: <20240325033946.47052-1-duoming@zju.edu.cn> (raw)
The dreamcastcard->timer could schedule the spu_dma_work and the
spu_dma_work could also arm the dreamcastcard->timer.
When the Yamaha AICA card is closing, the dreamcastcard->channel
will be deallocated. But it could still be dereferenced in the
worker thread. The reason is that del_timer() will return directly
regardless of whether the timer handler is running or not and the
worker could be rescheduled in the timer handler. As a result, the
UAF bug will happen. The racy situation is shown below:
(Thread 1) | (Thread 2)
snd_aicapcm_pcm_close() |
... | run_spu_dma() //worker
| mod_timer()
flush_work() |
del_timer() | aica_period_elapsed() //timer
kfree(dreamcastcard->channel) | schedule_work()
| run_spu_dma() //worker
... | dreamcastcard->channel-> //USE
In order to mitigate this bug, use timer_shutdown_sync() to shutdown
the timer and then use flush_work() to cancel the worker.
Fixes: 198de43d758c ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
---
sound/sh/aica.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/sh/aica.c b/sound/sh/aica.c
index 320ac792c7f..bc68a3903f2 100644
--- a/sound/sh/aica.c
+++ b/sound/sh/aica.c
@@ -354,8 +354,8 @@ static int snd_aicapcm_pcm_close(struct snd_pcm_substream
*substream)
{
struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
+ timer_shutdown_sync(&dreamcastcard->timer);
flush_work(&(dreamcastcard->spu_dma_work));
- del_timer(&dreamcastcard->timer);
dreamcastcard->substream = NULL;
kfree(dreamcastcard->channel);
spu_disable();
--
2.17.1
next reply other threads:[~2024-03-25 3:40 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-25 3:39 Duoming Zhou [this message]
2024-03-25 8:16 ` [PATCH] ALSA: sh: aica: reorder cleanup operations to avoid UAF bug Takashi Iwai
2024-03-25 14:26 ` duoming
2024-03-25 14:44 ` Takashi Iwai
2024-03-26 6:24 ` duoming
2024-03-26 7:08 ` Takashi Iwai
2024-03-26 8:06 ` duoming
2024-03-26 8:25 ` Takashi Iwai
2024-03-26 9:50 ` duoming
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240325033946.47052-1-duoming@zju.edu.cn \
--to=duoming@zju.edu.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=perex@perex.cz \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.