2023-09-13 01:12:10

by Ma Ke

[permalink] [raw]
Subject: [PATCH] ALSA: control: do not access controls without possession of r_w lock

we should not access any of its memory when we don't ensure possession of
a read/write lock. Otherwise we risk a use after free access, which allows
local users to cause a denial of service and obtain sensitive information
from kernel memory.

Signed-off-by: Ma Ke <[email protected]>
---
sound/core/control.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/core/control.c b/sound/core/control.c
index 59c8658966d4..98782cc68ee1 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -590,7 +590,8 @@ static int __snd_ctl_remove(struct snd_card *card,
remove_hash_entries(card, kcontrol);

card->controls_count -= kcontrol->count;
- for (idx = 0; idx < kcontrol->count; idx++)
+ count = kcontrol->count;
+ for (idx = 0; idx < count; idx++)
snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
snd_ctl_free_one(kcontrol);
return 0;
--
2.37.2


2023-10-05 17:10:57

by kernel test robot

[permalink] [raw]
Subject: Re: [PATCH] ALSA: control: do not access controls without possession of r_w lock

Hi Ma,

kernel test robot noticed the following build errors:

[auto build test ERROR on tiwai-sound/for-next]
[also build test ERROR on tiwai-sound/for-linus linus/master v6.6-rc3 next-20230921]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/ALSA-control-do-not-access-controls-without-possession-of-r_w-lock/20230912-164832
base: https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git for-next
patch link: https://lore.kernel.org/r/20230912084530.3307329-1-make_ruc2021%40163.com
patch subject: [PATCH] ALSA: control: do not access controls without possession of r_w lock
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20230925/[email protected]/config)
compiler: loongarch64-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20230925/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

All errors (new ones prefixed by >>):

sound/core/control.c: In function '__snd_ctl_remove':
>> sound/core/control.c:593:9: error: 'count' undeclared (first use in this function); did you mean 'd_count'?
593 | count = kcontrol->count;
| ^~~~~
| d_count
sound/core/control.c:593:9: note: each undeclared identifier is reported only once for each function it appears in


vim +593 sound/core/control.c

576
577 static int __snd_ctl_remove(struct snd_card *card,
578 struct snd_kcontrol *kcontrol,
579 bool remove_hash)
580 {
581 unsigned int idx;
582
583 lockdep_assert_held_write(&card->controls_rwsem);
584
585 if (snd_BUG_ON(!card || !kcontrol))
586 return -EINVAL;
587 list_del(&kcontrol->list);
588
589 if (remove_hash)
590 remove_hash_entries(card, kcontrol);
591
592 card->controls_count -= kcontrol->count;
> 593 count = kcontrol->count;
594 for (idx = 0; idx < count; idx++)
595 snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx);
596 snd_ctl_free_one(kcontrol);
597 return 0;
598 }
599

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki