sound: use-after-free in snd_seq_queue_alloc

[Dmitry Vyukov]

Hello,


I've got the following report while running syzkaller fuzzer on
8b1b41ee74f9712c355d66dc105bbea663ae0afd:

BUG: KASAN: use-after-free in snd_seq_queue_alloc+0x663/0x690
sound/core/seq/seq_queue.c:200 at addr ffff880086ba1d00
Read of size 4 by task syz-executor2/31851
CPU: 2 PID: 31851 Comm: syz-executor2 Not tainted 4.10.0-rc5+ #201
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011

Call Trace:
__asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:327
snd_seq_queue_alloc+0x663/0x690 sound/core/seq/seq_queue.c:200
snd_seq_ioctl_create_queue+0xad/0x310 sound/core/seq/seq_clientmgr.c:1508
snd_seq_ioctl+0x2da/0x4d0 sound/core/seq/seq_clientmgr.c:2130
vfs_ioctl fs/ioctl.c:43 [inline]
do_vfs_ioctl+0x1bf/0x1790 fs/ioctl.c:683
SYSC_ioctl fs/ioctl.c:698 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:689
entry_SYSCALL_64_fastpath+0x1f/0xc2

Allocated:
PID = 31851
[<ffffffff83483a17>] kzalloc include/linux/slab.h:490 [inline]
[<ffffffff83483a17>] queue_new sound/core/seq/seq_queue.c:113 [inline]
[<ffffffff83483a17>] snd_seq_queue_alloc+0x107/0x690
sound/core/seq/seq_queue.c:191
[<ffffffff834748dd>] snd_seq_ioctl_create_queue+0xad/0x310
sound/core/seq/seq_clientmgr.c:1508
[<ffffffff8347878a>] snd_seq_ioctl+0x2da/0x4d0
sound/core/seq/seq_clientmgr.c:2130
[<ffffffff81aa41cf>] vfs_ioctl fs/ioctl.c:43 [inline]
[<ffffffff81aa41cf>] do_vfs_ioctl+0x1bf/0x1790 fs/ioctl.c:683
[<ffffffff81aa582f>] SYSC_ioctl fs/ioctl.c:698 [inline]
[<ffffffff81aa582f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:689
[<ffffffff841c9c81>] entry_SYSCALL_64_fastpath+0x1f/0xc2

Freed:
PID = 31854
[<ffffffff81a0b5c3>] kfree+0xd3/0x250 mm/slab.c:3822
[<ffffffff834817e0>] queue_delete+0x90/0xb0 sound/core/seq/seq_queue.c:156
[<ffffffff834826cc>] snd_seq_queue_delete+0x3c/0x50
sound/core/seq/seq_queue.c:213
[<ffffffff8347480a>] snd_seq_ioctl_delete_queue+0x6a/0x90
sound/core/seq/seq_clientmgr.c:1534
[<ffffffff8347878a>] snd_seq_ioctl+0x2da/0x4d0
sound/core/seq/seq_clientmgr.c:2130
[<ffffffff81aa41cf>] vfs_ioctl fs/ioctl.c:43 [inline]
[<ffffffff81aa41cf>] do_vfs_ioctl+0x1bf/0x1790 fs/ioctl.c:683
[<ffffffff81aa582f>] SYSC_ioctl fs/ioctl.c:698 [inline]
[<ffffffff81aa582f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:689



Looking at the code:

int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
{
struct snd_seq_queue *q;

q = queue_new(client, locked);
if (q == NULL)
return -ENOMEM;
q->info_flags = info_flags;
if (queue_list_add(q) < 0) {
queue_delete(q);
return -ENOMEM;
}
snd_seq_queue_use(q->queue, client, 1); /* use this queue */
return q->queue;
}

After queue_list_add(q) q can be deleted by another thread, so
snd_seq_queue_use(q->queue, client, 1) already potentially operates on
deleted object.

[Takashi Iwai]

A good catch! The fix patch is below.


thanks,

Takashi

-- 8< --
From: Takashi Iwai <ti...@suse.de>
Subject: [PATCH] ALSA: seq: Fix race at creating a queue

When a sequencer queue is created in snd_seq_queue_alloc(),it adds the
new queue element to the public list before referencing it. Thus the
queue might be deleted before the call of snd_seq_queue_use(), and it
results in the use-after-free error, as spotted by syzkaller.

The fix is to reference the queue object at the right time.

Reported-by: Dmitry Vyukov <dvy...@google.com>
Cc: <sta...@vger.kernel.org>
Signed-off-by: Takashi Iwai <ti...@suse.de>
---
sound/core/seq/seq_queue.c | 33 ++++++++++++++++++++-------------
1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 0bec02e89d51..450c5187eecb 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -181,6 +181,8 @@ void __exit snd_seq_queues_delete(void)
}
}

+static void queue_use(struct snd_seq_queue *queue, int client, int use);
+
/* allocate a new queue -
* return queue index value or negative value for error
*/
@@ -192,11 +194,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)

if (q == NULL)
return -ENOMEM;
q->info_flags = info_flags;

+ queue_use(q, client, 1);

if (queue_list_add(q) < 0) {
queue_delete(q);
return -ENOMEM;
}

- snd_seq_queue_use(q->queue, client, 1); /* use this queue */
return q->queue;
}

@@ -502,19 +504,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client,
return result;
}

-
-/* use or unuse this queue -
- * if it is the first client, starts the timer.
- * if it is not longer used by any clients, stop the timer.
- */
-int snd_seq_queue_use(int queueid, int client, int use)
+/* use or unuse this queue */
+static void queue_use(struct snd_seq_queue *queue, int client, int use)
{
- struct snd_seq_queue *queue;
-
- queue = queueptr(queueid);
- if (queue == NULL)
- return -EINVAL;
- mutex_lock(&queue->timer_mutex);
if (use) {
if (!test_and_set_bit(client, queue->clients_bitmap))
queue->clients++;
@@ -529,6 +521,21 @@ int snd_seq_queue_use(int queueid, int client, int use)
} else {
snd_seq_timer_close(queue);
}
+}
+
+/* use or unuse this queue -
+ * if it is the first client, starts the timer.
+ * if it is not longer used by any clients, stop the timer.
+ */
+int snd_seq_queue_use(int queueid, int client, int use)
+{
+ struct snd_seq_queue *queue;
+
+ queue = queueptr(queueid);
+ if (queue == NULL)
+ return -EINVAL;
+ mutex_lock(&queue->timer_mutex);
+ queue_use(queue, client, use);
mutex_unlock(&queue->timer_mutex);
queuefree(queue);
return 0;
--
2.11.0