From 15bcbfbbbe070ac988b601c292a8db9fe542d84a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 8 Sep 2024 12:10:40 +0200 Subject: [PATCH] 5.4-stable patches added patches: asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch --- ...x-uaf-for-snd_soc_pcm_runtime-object.patch | 58 +++++++++++++++++++ queue-5.4/series | 1 + 2 files changed, 59 insertions(+) create mode 100644 queue-5.4/asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch diff --git a/queue-5.4/asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch b/queue-5.4/asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch new file mode 100644 index 00000000000..500dbf32d2e --- /dev/null +++ b/queue-5.4/asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch @@ -0,0 +1,58 @@ +From b4a90b543d9f62d3ac34ec1ab97fc5334b048565 Mon Sep 17 00:00:00 2001 +From: robelin +Date: Fri, 23 Aug 2024 14:43:41 +0000 +Subject: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object + +From: robelin + +commit b4a90b543d9f62d3ac34ec1ab97fc5334b048565 upstream. + +When using kernel with the following extra config, + + - CONFIG_KASAN=y + - CONFIG_KASAN_GENERIC=y + - CONFIG_KASAN_INLINE=y + - CONFIG_KASAN_VMALLOC=y + - CONFIG_FRAME_WARN=4096 + +kernel detects that snd_pcm_suspend_all() access a freed +'snd_soc_pcm_runtime' object when the system is suspended, which +leads to a use-after-free bug: + +[ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 +[ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 + +[ 52.047785] Call trace: +[ 52.047787] dump_backtrace+0x0/0x3c0 +[ 52.047794] show_stack+0x34/0x50 +[ 52.047797] dump_stack_lvl+0x68/0x8c +[ 52.047802] print_address_description.constprop.0+0x74/0x2c0 +[ 52.047809] kasan_report+0x210/0x230 +[ 52.047815] __asan_report_load1_noabort+0x3c/0x50 +[ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 +[ 52.047824] snd_soc_suspend+0x19c/0x4e0 + +The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before +making any access. So we need to always set 'substream->runtime' to NULL +everytime we kfree() it. + +Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables") +Signed-off-by: robelin +Signed-off-by: Sameer Pujar +Link: https://patch.msgid.link/20240823144342.4123814-2-spujar@nvidia.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/soc-dapm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -4003,6 +4003,7 @@ static int snd_soc_dai_link_event(struct + + case SND_SOC_DAPM_POST_PMD: + kfree(substream->runtime); ++ substream->runtime = NULL; + break; + + default: diff --git a/queue-5.4/series b/queue-5.4/series index 0ccb32125ab..930ae9a0b6e 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -24,3 +24,4 @@ virtio_net-fix-napi_skb_cache_put-warning.patch udf-limit-file-size-to-4tb.patch i2c-use-is_reachable-for-substituting-empty-acpi-functions.patch sch-netem-fix-use-after-free-in-netem_dequeue.patch +asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch -- 2.47.3