lkml.org 
[lkml]   [2020]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject回复: 回复: [PATCH] ALSA: seq: KASAN: use-aft er-free Read in delete and unsubscribe port
Date


________________________________________
发件人: Takashi Iwai <tiwai@suse.de>
发送时间: 2020年8月3日 14:16
收件人: Zhang, Qiang
抄送: perex@perex.cz; tiwai@suse.com; alsa-devel@alsa-project.org; linux-kernel@vger.kernel.org
主题: Re: 回复: [PATCH] ALSA: seq: KASAN: use-after-free Read in delete_and_unsubscribe_port

On Mon, 03 Aug 2020 03:35:05 +0200,
Zhang, Qiang wrote:
>
> >Thanks for the patch. But I'm afraid that this change would break the
> >existing behavior and might have a bad side-effect.
>
> >It's likely the same issue as reported in another syzkaller report
> >("KASAN: invalid-free in snd_seq_port_disconnect"), and Hillf's patch
> >below should covert this as well. Could you check whether it works?
>
> yes It's should same issue, add mutex lock in odev_ioctl, ensure serialization.
> however, it should not be necessary to mutually exclusive with open and close.

>>>That's a big-hammer approach indeed, but it should be more reasonable
>>>in this case. It makes the patch shorter and simpler, while the OSS
>>>sequencer is an ancient interface that wasn't considered much for the
>>>concurrency, and this might also cover the case where the access to
>>>another sequencer object that is being to be closed.

>>>So, it'd be great if you can confirm that the patch actually works.
>>>Then we can brush up and merge it for 5.9-rc1.

Just like you said, this change is more reasonable. It makes the patch shorter and simpler.


>>>thanks,

>>>Takashi

>
>
>
> >thanks,
>
> >Takashi
>
> >---
> >--- a/sound/core/seq/oss/seq_oss.c
> >+++ b/sound/core/seq/oss/seq_oss.c
> >@@ -167,11 +167,17 @@ odev_write(struct file *file, const char
> >static long
> >odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
> >{
> >+ long rc;
> > struct seq_oss_devinfo *dp;
> >+
> >+ mutex_lock(&register_mutex);
> > dp = file->private_data;
> > if (snd_BUG_ON(!dp))
> >- return -ENXIO;
> >- return snd_seq_oss_ioctl(dp, cmd, arg);
> >+ rc = -ENXIO;
> >+ else
> >+ rc = snd_seq_oss_ioctl(dp, cmd, arg);
> >+ mutex_unlock(&register_mutex);
> >+ return rc;
> >}
>
> >#ifdef CONFIG_COMPAT
\
 
 \ /
  Last update: 2020-08-03 11:44    [W:0.067 / U:0.836 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site