releases/3.18.96/alsa-seq-fix-racy-pool-initializations.patch

   1 From d15d662e89fc667b90cd294b0eb45694e33144da Mon Sep 17 00:00:00 2001
   2 From: Takashi Iwai <tiwai@suse.de>
   3 Date: Mon, 12 Feb 2018 15:20:51 +0100
   4 Subject: ALSA: seq: Fix racy pool initializations
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 From: Takashi Iwai <tiwai@suse.de>
  10
  11 commit d15d662e89fc667b90cd294b0eb45694e33144da upstream.
  12
  13 ALSA sequencer core initializes the event pool on demand by invoking
  14 snd_seq_pool_init() when the first write happens and the pool is
  15 empty.  Meanwhile user can reset the pool size manually via ioctl
  16 concurrently, and this may lead to UAF or out-of-bound accesses since
  17 the function tries to vmalloc / vfree the buffer.
  18
  19 A simple fix is to just wrap the snd_seq_pool_init() call with the
  20 recently introduced client->ioctl_mutex; as the calls for
  21 snd_seq_pool_init() from other side are always protected with this
  22 mutex, we can avoid the race.
  23
  24 Reported-by: 范龙飞 <long7573@126.com>
  25 Cc: <stable@vger.kernel.org>
  26 Signed-off-by: Takashi Iwai <tiwai@suse.de>
  27 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  28
  29 ---
  30  sound/core/seq/seq_clientmgr.c |    8 ++++++--
  31  1 file changed, 6 insertions(+), 2 deletions(-)
  32
  33 --- a/sound/core/seq/seq_clientmgr.c
  34 +++ b/sound/core/seq/seq_clientmgr.c
  35 @@ -1012,7 +1012,7 @@ static ssize_t snd_seq_write(struct file
  36  {
  37         struct snd_seq_client *client = file->private_data;
  38         int written = 0, len;
  39 -       int err = -EINVAL;
  40 +       int err;
  41         struct snd_seq_event event;
  42
  43         if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
  44 @@ -1027,11 +1027,15 @@ static ssize_t snd_seq_write(struct file
  45
  46         /* allocate the pool now if the pool is not allocated yet */
  47         if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
  48 -               if (snd_seq_pool_init(client->pool) < 0)
  49 +               mutex_lock(&client->ioctl_mutex);
  50 +               err = snd_seq_pool_init(client->pool);
  51 +               mutex_unlock(&client->ioctl_mutex);
  52 +               if (err < 0)
  53                         return -ENOMEM;
  54         }
  55
  56         /* only process whole events */
  57 +       err = -EINVAL;
  58         while (count >= sizeof(struct snd_seq_event)) {
  59                 /* Read in the event header from the user */
  60                 len = sizeof(event);