ALSA: asihpi: quiesce PCM timer and IRQ before freeing dpcm on close (UAF)

[徐晗翔 <xuhx@hust.edu.cn>]

[-- Attachment #1: Type: text/plain, Size: 3582 bytes --]

`snd_card_asihpi_runtime_free()` frees the per-open `struct
snd_card_asihpi_pcm` while a polled timer callback or an IRQ/threaded handler
can still use it.  The polled stop path uses `timer_delete()` (not
`timer_delete_sync()`), and the IRQ stop path clears
`card->llmode_streampriv` without `synchronize_irq()`.  A normal PCM close can
therefore free `dpcm` and then `runtime` while the callback is still running.

The detailed description:

* Test environment / affected version

  Linux 7.3.0 source plus a QEMU/KASAN fake-PCM harness.  No ASI6205 hardware
  was available; the harness validates the ALSA core close ordering and the
  exact `timer_delete`/`llmode_streampriv` lifetime pattern.

* Mechanism

  `snd_card_asihpi_runtime_free()` (`asihpi.c:495-499`) does `kfree(dpcm)` and
  is installed as `runtime->private_free` at playback open
  (`asihpi.c:997-1000`) and capture open (`1166-1169`).

  Polled mode:

    snd_card_asihpi_pcm_timer_start()  asihpi.c:501-513
        mod_timer(&dpcm->timer, jiffies + expiry);
        dpcm->respawn_timer = 1;

    snd_card_asihpi_pcm_timer_stop()   asihpi.c:515-522
        dpcm->respawn_timer = 0;
        timer_delete(&dpcm->timer);     /* no sync */

  `snd_card_asihpi_timer_function()` (`asihpi.c:710-896`) uses `dpcm`
  throughout and can re-arm at 894-895 if it observes `respawn_timer`.

  IRQ mode:

    snd_card_asihpi_pcm_int_start()    asihpi.c:524-538
        card->llmode_streampriv = dpcm;
        ... set HPI IRQ rate ...

    snd_card_asihpi_pcm_int_stop()     asihpi.c:540-550
        ... set HPI IRQ rate 0 ...
        card->llmode_streampriv = NULL;  /* no synchronize_irq */

  `snd_card_asihpi_isr()` (`asihpi.c:898-907`) reads
  `asihpi->llmode_streampriv` twice (check, then dereference), so a threaded
  handler can hold the old `dpcm` pointer across the NULL store.

  Close path: `snd_pcm_release_substream()`
  (`sound/core/pcm_native.c:2785-2805`) -> `snd_pcm_drop()`
  (`pcm_native.c:2267-2289`) -> `snd_pcm_detach_substream()`
  (`sound/core/pcm.c:978-1005`) -> `runtime->private_free()` -> `kfree(dpcm)`
  and then `kfree(runtime)`.


* Trigger model

  Local user opens a capture or playback PCM, starts it, and closes it while
  the polled timer or HPI IRQ is active.  Polled mode is available on HPI6000
  and HPI6205; IRQ mode requires HPI6205 in interrupt mode.  SMP/preemption
  needed for the cross-CPU window.  Consequence: UAF of `dpcm`/`runtime` in
  timer softirq or threaded IRQ; crash or memory corruption.

* Dynamic evidence

  `sndpci_race.c` mode `pcm`, `verification/kmod/
  sndpci/pcmtest.c close 200`: `.trigger STOP` uses `timer_delete()` and
  `runtime->private_free` frees `dpcm`; timer pinned to CPU0, user close to
  CPU1.  Contain 35 KASAN UAF report fragments:

    BUG: KASAN: slab-use-after-free in race_pcm_timer
    ...
    Allocated by task: race_pcm_open
    Freed by task: kfree -> snd_pcm_detach_substream -> snd_pcm_release



* Suggested direction

  In `snd_card_asihpi_runtime_free()` (or immediately before it), for polled
  mode call `timer_shutdown_sync(&dpcm->timer)`.  For IRQ mode, first clear
  `card->llmode_streampriv` (with the appropriate ordering), then
  `synchronize_irq(card->hpi->irq)` before `kfree(dpcm)`.  Do not put the
  sleeping sync inside the PCM stream lock; do it in the detach/private_free
  process context.  Also consider quiescing before the HPI stream `.close`
  (the extra HPI stream handle window is discussed in the report).



Please keep me in Cc; I am not subscribed to the lists.


Regards,
Hanxiang Xu
xuhx@hust.edu.cn

[-- Attachment #2: sndpci_race.c --]
[-- Type: text/plain, Size: 9729 bytes --]

// SPDX-License-Identifier: GPL-2.0
/*
 * sndpci_race.c - minimal ALSA/kernel lifetime-race reproducers for the
 * sound/pci manual-review cases V3/V4/V5.
 *
 * The module deliberately reproduces the *lifetime patterns* used by
 * ctxfi/asihpi, using only exported ALSA core and timer APIs.  It is not a
 * ctxfi/asihpi emulator: those drivers need hardware that this QEMU does not
 * provide.  The purpose is to test whether the core/API windows identified in
 * the report are real on an instrumented KASAN kernel.
 *
 * modes:
 *   v3  - timer_delete_sync_try() returns -1 while the callback runs on
 *         another CPU; free the object anyway (ctxfi system-timer pattern).
 *   pcm - create a fake ALSA card with two playback substreams.  The guest
 *         program pcmtest then exercises close (V4) or link+close (V5).
 */
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/timer.h>
#include <linux/jiffies.h>
#include <linux/delay.h>
#include <linux/kthread.h>
#include <linux/cpumask.h>
#include <linux/sched.h>
#include <linux/container_of.h>
#include <linux/string.h>
#include <linux/platform_device.h>
#include <sound/core.h>
#include <sound/pcm.h>
#include <sound/pcm_params.h>

#define DRV "sndpci_race"
#define COOKIE 0x5a5a1234deadbeefULL

static char *mode = "pcm";
module_param(mode, charp, 0444);
static bool safe;
module_param(safe, bool, 0444);
MODULE_PARM_DESC(mode, "v3 or pcm");

/* ------------------------------------------------------------------ */
/* V3: timer_delete_sync_try() ignored -1                              */
/* ------------------------------------------------------------------ */
struct v3_obj {
	struct timer_list timer;
	u64 cookie;
	struct task_struct *thread;
};

static void v3_callback(struct timer_list *t)
{
	struct v3_obj *v = container_of(t, struct v3_obj, timer);

	/* Keep the callback alive long enough for the freeing CPU to run. */
	mdelay(20);
	pr_info(DRV ": v3 callback cookie=%#llx\n", v->cookie);
	/* Second read after the delay: the object may already be freed. */
	if (v->cookie == COOKIE)
		pr_info(DRV ": v3 callback read-after-free survived\n");
}

static int v3_thread(void *arg)
{
	struct v3_obj *v;
	int i, ret;

	for (i = 0; i < 8; i++) {
		v = kzalloc(sizeof(*v), GFP_KERNEL);
		if (!v)
			return -ENOMEM;
		v->cookie = COOKIE;
		timer_setup(&v->timer, v3_callback, 0);
		/* Pin the callback to CPU0; this thread runs on CPU1. */
		add_timer_on(&v->timer, 0);
		usleep_range(2000, 3000);
		ret = timer_delete_sync_try(&v->timer);
		pr_info(DRV ": v3 iter=%d delete_sync_try=%d\n", i, ret);
		if (ret == -1) {
			/* BUG: callback is running on CPU0; free it anyway. */
			if (safe)
				timer_delete_sync(&v->timer);
			kfree(v);
		} else {
			timer_delete_sync(&v->timer);
			kfree(v);
		}
		usleep_range(60000, 70000);
	}
	pr_info(DRV ": v3 done\n");
	return 0;
}

/* ------------------------------------------------------------------ */
/* V4/V5: fake ALSA PCM with a driver-private dpcm and a timer        */
/* ------------------------------------------------------------------ */
struct race_pcm {
	struct timer_list timer;
	struct snd_pcm_substream *substream;
	u64 cookie;
	bool respawn;
	bool active;
};

static struct snd_card *race_card;
static struct platform_device *race_pdev;
static struct snd_pcm *race_pcm_dev;

static void race_pcm_timer(struct timer_list *t)
{
	struct race_pcm *dpcm = container_of(t, struct race_pcm, timer);
	struct snd_pcm_substream *s;
	struct snd_pcm_runtime *victim_rt = NULL;
	u64 cookie;

	if (!dpcm->active)
		return;
	pr_info(DRV ": timer start dpcm=%px\n", dpcm);

	/*
	 * V5 pattern: walk the link group without the group lock and read
	 * each member's runtime/private_data.  V4 uses the same callback for
	 * the current stream; the delay widens the close/free window.
	 */
	cookie = dpcm->cookie;
	if (cookie == COOKIE && dpcm->substream && dpcm->substream->runtime) {
		snd_pcm_group_for_each_entry(s, dpcm->substream) {
			struct snd_pcm_runtime *rt = READ_ONCE(s->runtime);
			struct race_pcm *d = NULL;

			if (rt)
				d = READ_ONCE(rt->private_data);
			if (d && d->cookie == COOKIE) {
				/* Force the compiler to keep the load. */
				barrier();
			}
			if (rt) {
				(void)READ_ONCE(rt->dma_area);
				if (s != dpcm->substream && !victim_rt)
					victim_rt = rt;
			}
			/* A real driver also reports elapsed periods. */
			if (rt)
				snd_pcm_period_elapsed(s);
		}
	}

	/* Widen the window between the callback's load and the free. */
	mdelay(20);
	if (victim_rt) {
		struct race_pcm *d = READ_ONCE(victim_rt->private_data);

		pr_info(DRV ": victim use rt=%px d=%px\n", victim_rt, d);
		(void)READ_ONCE(victim_rt->dma_area);
	}
	pr_info(DRV ": timer end dpcm=%px\n", dpcm);
	if (dpcm->respawn) {
		if (!timer_pending(&dpcm->timer))
			add_timer_on(&dpcm->timer, 0);
		else
			mod_timer(&dpcm->timer, jiffies + 1);
	}
}

static void race_pcm_free(struct snd_pcm_runtime *runtime)
{
	struct race_pcm *dpcm = runtime->private_data;

	pr_info(DRV ": pcm private_free dpcm=%px\n", dpcm);
	if (safe)
		timer_shutdown_sync(&dpcm->timer);
	kfree(dpcm);
}

static int race_pcm_open(struct snd_pcm_substream *substream)
{
	struct snd_pcm_runtime *runtime = substream->runtime;
	struct race_pcm *dpcm;

	dpcm = kzalloc(sizeof(*dpcm), GFP_KERNEL);
	if (!dpcm)
		return -ENOMEM;
	dpcm->substream = substream;
	dpcm->cookie = COOKIE;
	timer_setup(&dpcm->timer, race_pcm_timer, 0);
	runtime->private_data = dpcm;
	runtime->private_free = race_pcm_free;
	runtime->hw.info = SNDRV_PCM_INFO_MMAP |
			   SNDRV_PCM_INFO_INTERLEAVED |
			   SNDRV_PCM_INFO_MMAP_VALID;
	runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
	runtime->hw.rates = SNDRV_PCM_RATE_44100;
	runtime->hw.rate_min = 44100;
	runtime->hw.rate_max = 44100;
	runtime->hw.channels_min = 2;
	runtime->hw.channels_max = 2;
	runtime->hw.buffer_bytes_max = 64 * 1024;
	runtime->hw.period_bytes_min = 1024;
	runtime->hw.period_bytes_max = 4096;
	runtime->hw.periods_min = 2;
	runtime->hw.periods_max = 8;
	pr_info(DRV ": pcm open sub=%px dpcm=%px\n", substream, dpcm);
	return 0;
}

static int race_pcm_close(struct snd_pcm_substream *substream)
{
	pr_info(DRV ": pcm .close sub=%px\n", substream);
	return 0;
}

static int race_pcm_ioctl(struct snd_pcm_substream *substream,
			  unsigned int cmd, void *arg)
{
	pr_info(DRV ": pcm ioctl cmd=%u\n", cmd);
	return snd_pcm_lib_ioctl(substream, cmd, arg);
}

static int race_pcm_hw_params(struct snd_pcm_substream *substream,
			      struct snd_pcm_hw_params *params)
{
	pr_info(DRV ": hw_params rate=%u ch=%u fmt=%u period_bytes=%u buffer_bytes=%u\n",
		params_rate(params), params_channels(params), params_format(params),
		params_period_bytes(params), params_buffer_bytes(params));
	return 0;
}

static int race_pcm_prepare(struct snd_pcm_substream *substream)
{
	return 0;
}

static int race_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
{
	struct race_pcm *dpcm = substream->runtime->private_data;

	switch (cmd) {
	case SNDRV_PCM_TRIGGER_START:
	case SNDRV_PCM_TRIGGER_RESUME:
		if (substream != race_pcm_dev->streams[SNDRV_PCM_STREAM_CAPTURE].substream)
			break;
		dpcm->active = true;
		dpcm->respawn = true;
		if (!timer_pending(&dpcm->timer))
			add_timer_on(&dpcm->timer, 0);
		else
			mod_timer(&dpcm->timer, jiffies + 1);
		break;
	case SNDRV_PCM_TRIGGER_STOP:
	case SNDRV_PCM_TRIGGER_SUSPEND:
		dpcm->active = false;
		dpcm->respawn = false;
		/* Deliberately not timer_delete_sync(): mirrors asihpi. */
		timer_delete(&dpcm->timer);
		break;
	}
	return 0;
}

static snd_pcm_uframes_t race_pcm_pointer(struct snd_pcm_substream *substream)
{
	return 0;
}

static const struct snd_pcm_ops race_pcm_ops = {
	.open = race_pcm_open,
	.close = race_pcm_close,
	.ioctl = race_pcm_ioctl,
	.hw_params = race_pcm_hw_params,
	.prepare = race_pcm_prepare,
	.trigger = race_pcm_trigger,
	.pointer = race_pcm_pointer,
};

static int __init sndpci_init(void)
{
	struct task_struct *t;
	int ret;

	pr_info(DRV ": init mode=%s\n", mode);

	if (!strcmp(mode, "v3")) {
		t = kthread_create(v3_thread, NULL, "sndpci_v3");
		if (IS_ERR(t))
			return PTR_ERR(t);
		kthread_bind(t, 1);
		wake_up_process(t);
		return 0;
	}

	race_pdev = platform_device_register_simple("sndpci_race", -1, NULL, 0);
	if (IS_ERR(race_pdev))
		return PTR_ERR(race_pdev);
	ret = snd_card_new(&race_pdev->dev, 0, "SndPciRace", THIS_MODULE, 0, &race_card);
	if (ret < 0) {
		pr_err(DRV ": snd_card_new failed: %d\n", ret);
		return ret;
	}
	ret = snd_pcm_new(race_card, "SndPciRace", 0, 0, 2, &race_pcm_dev);
	if (ret < 0) {
		pr_err(DRV ": snd_pcm_new failed: %d\n", ret);
		snd_card_free(race_card);
		return ret;
	}
	snd_pcm_set_ops(race_pcm_dev, SNDRV_PCM_STREAM_CAPTURE,
			&race_pcm_ops);
	snd_pcm_lib_preallocate_pages_for_all(race_pcm_dev, SNDRV_DMA_TYPE_CONTINUOUS,
						      NULL, 64 * 1024, 64 * 1024);
	ret = 0;
	pr_info(DRV ": managed_buffer ret=%d dma_type=%d area=%px bytes=%zu\n", ret,
		race_pcm_dev->streams[SNDRV_PCM_STREAM_CAPTURE].substream->dma_buffer.dev.type,
		race_pcm_dev->streams[SNDRV_PCM_STREAM_CAPTURE].substream->dma_buffer.area,
		race_pcm_dev->streams[SNDRV_PCM_STREAM_CAPTURE].substream->dma_buffer.bytes);
	ret = snd_card_register(race_card);
	if (ret < 0) {
		pr_err(DRV ": snd_card_register failed: %d\n", ret);
		snd_card_free(race_card);
		return ret;
	}
	pr_info(DRV ": card registered\n");
	return 0;
}

static void __exit sndpci_exit(void)
{
	pr_info(DRV ": exit\n");
	if (race_card)
		snd_card_free(race_card);
	if (race_pdev)
		platform_device_unregister(race_pdev);
}

module_init(sndpci_init);
module_exit(sndpci_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("sound/pci lifetime-race reproducer (V3/V4/V5)");