• Takashi Iwai's avatar
    ALSA: seq: Fix possible UAF in snd_seq_check_queue() · d0f83306
    Takashi Iwai authored
    Although we've covered the races between concurrent write() and
    ioctl() in the previous patch series, there is still a possible UAF in
    the following scenario:
    
    A: user client closed		B: timer irq
      -> snd_seq_release()		  -> snd_seq_timer_interrupt()
        -> snd_seq_free_client()	    -> snd_seq_check_queue()
    				      -> cell = snd_seq_prioq_cell_peek()
          -> snd_seq_prioq_leave()
             .... removing all cells
          -> snd_seq_pool_done()
             .... vfree()
    				      -> snd_seq_compare_tick_time(cell)
    				         ... Oops
    
    So the problem is that a cell is peeked and accessed without any
    protection until it's retrieved from the queue again via
    snd_seq_prioq_cell_out().
    
    This patch tries to address it, also cleans up the code by a slight
    refactoring.  snd_seq_prioq_cell_out() now receives an extra pointer
    argument.  When it's non-NULL, the function checks the event timestamp
    with the given pointer.  The caller needs to pass the right reference
    either to snd_seq_tick or snd_seq_realtime depending on the event
    timestamp type.
    
    A good news is that the above change allows us to remove the
    snd_seq_prioq_cell_peek(), too, thus the patch actually reduces the
    code size.
    Reviewed-by: default avatarNicolai Stange <nstange@suse.de>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    d0f83306
seq_prioq.c 10.9 KB