Received: by 2002:a05:7412:31a9:b0:e2:908c:2ebd with SMTP id et41csp2944177rdb; Tue, 12 Sep 2023 18:12:10 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGM8Y2sDgZWi5uScKumlHmxzhMxUOfwXSv0wCDEZoELoayLhsvYLVMi+90Nxu+XR0lkTltM X-Received: by 2002:a05:6a20:7f84:b0:13d:7aa3:aa6c with SMTP id d4-20020a056a207f8400b0013d7aa3aa6cmr942363pzj.0.1694567530259; Tue, 12 Sep 2023 18:12:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1694567530; cv=none; d=google.com; s=arc-20160816; b=BYsIrWMjuCkDVDpnD+9uHPR7iS0mUwVIuAL5WK+dRBoN5D0WAqGTkH6BjmsLf/YmbT h8w9VYQAIpvOTODjrJqfKTxo2gGbNX3e77mLBuRMmHowxr/gBv0WYnCKJBVII3nFVj5P S6+WDyHOuCW/OyuarUtXA9x84KrG1lTqz3goREce5CNnfBaMgGEr3azPy6O9HDNi//Z0 Ql9h9//pmImjaTBN8THMac3Vb8DJbyRj7uB3/R/OMH1yRD2g6f8/zHjQ62BA9qV3c0ue ewLcCbdSTD5MkQ8d1bCdfdGkSHXmdTB1fEAUrMOJbLN1vVzvjJadJBC3AuiFz8HOU2Q/ rKsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=UUNaZGGbls46jLI+B/C/K14g49rwHi1RLoMHof9iMLo=; fh=sRyELSH/2x+VlE35N8IEWrgMjXvp9Z1iz8zAxgmlQYI=; b=IWugtuqDNhTObdXAYIhyEVFmIbVwOvRkljW51FWOv5j8b9fKIPlqXImMrzO5YtTF3V SZ3FCRsrTqaTSeiqD89Jbx8dKXUgAT0XZAUG30RAfWp8TEcoQi2bnzH80RrgfoKF+YCD 36szXCm+ci9C2ALWn84FtCH8UmAkdIeIBYLAV3Mdh6yEjLGGx8NnENl9KRtP4aSYTEDe Qf1DhGA4CexIcpFQI3yAhsmtyf5IKWZMz1B0HFTh0Sk6VUqdk2HZE1rvYNk+rGGRBBKp TWw9Ff8kgdCWcXA6QODiopROQLwZMbcKV2AsPT+903Vw1/HDYnol5nUc1hStV3xsVVsS u9CQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=VJ0PMyRI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Return-Path: Received: from howler.vger.email (howler.vger.email. [23.128.96.34]) by mx.google.com with ESMTPS id lx6-20020a17090b4b0600b002567ce1c798si524818pjb.137.2023.09.12.18.12.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 Sep 2023 18:12:10 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) client-ip=23.128.96.34; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=VJ0PMyRI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by howler.vger.email (Postfix) with ESMTP id D8918802D407; Tue, 12 Sep 2023 01:47:48 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at howler.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233045AbjILIrm (ORCPT + 99 others); Tue, 12 Sep 2023 04:47:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52382 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233001AbjILIrh (ORCPT ); Tue, 12 Sep 2023 04:47:37 -0400 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.196]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 12F0DAA for ; Tue, 12 Sep 2023 01:47:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=UUNaZ GGbls46jLI+B/C/K14g49rwHi1RLoMHof9iMLo=; b=VJ0PMyRI8vrBIOjmk9aUO pKAA9Z+gBp3CWM7Kjkj6q4JS7kH2slEfkSQmtz7LihoWMSTPB8HPw9LYydxKbq0h KFEhhZ0hBrTZQFrJ7z2ic6vgF93nUIVkqiAIxD4aJAhlc1m76QvG49pn7zzXChHE Mi9QYhOxJNg4f9WOsCxUbs= Received: from icess-ProLiant-DL380-Gen10.. (unknown [183.174.60.14]) by zwqz-smtp-mta-g2-0 (Coremail) with SMTP id _____wAnfEExJQBl10RRBw--.47327S4; Tue, 12 Sep 2023 16:45:46 +0800 (CST) From: Ma Ke To: perex@perex.cz, tiwai@suse.com, cujomalainey@chromium.org, maciej.szmigiero@oracle.com, clecigne@google.com, make_ruc2021@163.com Cc: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org Subject: [PATCH] ALSA: control: do not access controls without possession of r_w lock Date: Tue, 12 Sep 2023 16:45:30 +0800 Message-Id: <20230912084530.3307329-1-make_ruc2021@163.com> X-Mailer: git-send-email 2.37.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID: _____wAnfEExJQBl10RRBw--.47327S4 X-Coremail-Antispam: 1Uf129KBjvdXoWrKF1ruFWrWw18tw48XF43Wrg_yoWftrbEgF 48XF40kr4UuFyI9FnYy3WrJFWFkF1xAF1kK3Wftr13CFy3tr9IgF1UXFZ5ZryDuFs5ur18 Jw18Kr4ava43tjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7xRKSoXUUUUUU== X-Originating-IP: [183.174.60.14] X-CM-SenderInfo: 5pdnvshuxfjiisr6il2tof0z/1tbiVwnoC1etsTPt4gAAsK Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (howler.vger.email [0.0.0.0]); Tue, 12 Sep 2023 01:47:49 -0700 (PDT) we should not access any of its memory when we don't ensure possession of a read/write lock. Otherwise we risk a use after free access, which allows local users to cause a denial of service and obtain sensitive information from kernel memory. Signed-off-by: Ma Ke --- sound/core/control.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/core/control.c b/sound/core/control.c index 59c8658966d4..98782cc68ee1 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -590,7 +590,8 @@ static int __snd_ctl_remove(struct snd_card *card, remove_hash_entries(card, kcontrol); card->controls_count -= kcontrol->count; - for (idx = 0; idx < kcontrol->count; idx++) + count = kcontrol->count; + for (idx = 0; idx < count; idx++) snd_ctl_notify_one(card, SNDRV_CTL_EVENT_MASK_REMOVE, kcontrol, idx); snd_ctl_free_one(kcontrol); return 0; -- 2.37.2