From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2ECEC433FE for ; Wed, 29 Sep 2021 15:29:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9785C6147F for ; Wed, 29 Sep 2021 15:29:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345274AbhI2Pam (ORCPT ); Wed, 29 Sep 2021 11:30:42 -0400 Received: from smtp-out2.suse.de ([195.135.220.29]:41570 "EHLO smtp-out2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345246AbhI2Paj (ORCPT ); Wed, 29 Sep 2021 11:30:39 -0400 Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out2.suse.de (Postfix) with ESMTP id E7D581FDF4; Wed, 29 Sep 2021 15:28:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1632929337; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=EXTYgpyqyk4d2YOzgdP/ZmF0Ij1b/ctK3pK3FhvdG+Y=; b=BSllR3wC6rJCS7sjMYq7TIxQ0yvSBF7X7gCgGyGRYjfrXJhsx7+CO/Yvb4na6jIHXlkIbJ Eb9JBMm38H4VPq9mXFAXKs+zwM/DkpCYWRZOd1V+V2AJMZl07PYSpVBUPC65G5gFGmaOra 04r8qDDXF8dqNOKWjIfjUuwOBUCPQ28= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1632929337; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=EXTYgpyqyk4d2YOzgdP/ZmF0Ij1b/ctK3pK3FhvdG+Y=; b=PyIdI0XtL4wImN5DJikdYRBF6WJYq2Kf1SP0wQ9x5yY78kIk9resfCE9iwAG2hVZ1IcSXL jsIbZ4nw1sGOcZAg== Received: from alsa1.suse.de (alsa1.suse.de [10.160.4.42]) by relay2.suse.de (Postfix) with ESMTP id DF0FBA3CE3; Wed, 29 Sep 2021 15:28:57 +0000 (UTC) Date: Wed, 29 Sep 2021 17:28:57 +0200 Message-ID: From: Takashi Iwai To: John Keeping Cc: linux-kernel@vger.kernel.org, alsa-devel@alsa-project.org, Takashi Iwai Subject: Re: [PATCH] ALSA: rawmidi: Fix potential UAF from sequencer destruction In-Reply-To: <20210929161758.49ce947f.john@metanate.com> References: <20210929113620.2194847-1-john@metanate.com> <20210929161758.49ce947f.john@metanate.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 29 Sep 2021 17:17:58 +0200, John Keeping wrote: > > On Wed, 29 Sep 2021 16:51:47 +0200 > Takashi Iwai wrote: > > > On Wed, 29 Sep 2021 13:36:20 +0200, > > John Keeping wrote: > > > > > > If the sequencer device outlives the rawmidi device, then > > > snd_rawmidi_dev_seq_free() will run after release_rawmidi_device() has > > > freed the snd_rawmidi structure. > > > > > > This can easily be reproduced with CONFIG_DEBUG_KOBJECT_RELEASE. > > > > > > Keep a reference to the rawmidi device until the sequencer has been > > > destroyed in order to avoid this. > > > > > > Signed-off-by: John Keeping > > > > Thanks for the patch. I wonder, though, how this could be triggered. > > Is this the case where the connected sequencer device is being used > > while the sound card gets released? Or is it something else? > > I'm not sure if it's possible to trigger via the ALSA API; I haven't > found a route that can trigger it, but that doesn't mean there isn't > one :-) > > Mostly this is useful to make CONFIG_DEBUG_KOBJECT_RELEASE cleaner. Hm, then could you check whether the patch below papers over it instead? thanks, Takashi --- a/sound/core/seq/seq_ports.c +++ b/sound/core/seq/seq_ports.c @@ -415,11 +415,16 @@ static int subscribe_port(struct snd_seq_client *client, grp->count--; } } - if (err >= 0 && send_ack && client->type == USER_CLIENT) + if (err < 0) + return err; + + if (send_ack && client->type == USER_CLIENT) snd_seq_client_notify_subscription(port->addr.client, port->addr.port, info, SNDRV_SEQ_EVENT_PORT_SUBSCRIBED); + else if (client->type == KERNEL_CLIENT) + get_device(&client->data.kernel.card->card_dev); - return err; + return 0; } static int unsubscribe_port(struct snd_seq_client *client, @@ -439,6 +444,8 @@ static int unsubscribe_port(struct snd_seq_client *client, snd_seq_client_notify_subscription(port->addr.client, port->addr.port, info, SNDRV_SEQ_EVENT_PORT_UNSUBSCRIBED); module_put(port->owner); + if (client->type == KERNEL_CLIENT) + snd_card_unref(client->data.kernel.card); return err; }