Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1375987

[PATCH 3.12 19/98] ALSA: seq: Fix leak of pool buffer at concurrent writes

Show all headers | View raw

From: Takashi Iwai <tiwai@suse.de>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit d99a36f4728fcbcc501b78447f625bdcce15b842 upstream.

When multiple concurrent writes happen on the ALSA sequencer device
right after the open, it may try to allocate vmalloc buffer for each
write and leak some of them.  It's because the presence check and the
assignment of the buffer is done outside the spinlock for the pool.

The fix is to move the check and the assignment into the spinlock.

(The current implementation is suboptimal, as there can be multiple
 unnecessary vmallocs because the allocation is done before the check
 in the spinlock.  But the pool size is already checked beforehand, so
 this isn't a big problem; that is, the only possible path is the
 multiple writes before any pool assignment, and practically seen, the
 current coverage should be "good enough".)

The issue was triggered by syzkaller fuzzer.

Buglink: http://lkml.kernel.org/r/CACT4Y+bSzazpXNvtAr=WXaL8hptqjHwqEyFA+VN2AWEx=aurkg@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 sound/core/seq/seq_memory.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index f478f770bf52..652350e2533f 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -383,17 +383,20 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
 
 	if (snd_BUG_ON(!pool))
 		return -EINVAL;
-	if (pool->ptr)			/* should be atomic? */
-		return 0;
 
-	pool->ptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
-	if (pool->ptr == NULL) {
-		snd_printd("seq: malloc for sequencer events failed\n");
+	cellptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
+	if (!cellptr)
 		return -ENOMEM;
-	}
 
 	/* add new cells to the free cell list */
 	spin_lock_irqsave(&pool->lock, flags);
+	if (pool->ptr) {
+		spin_unlock_irqrestore(&pool->lock, flags);
+		vfree(cellptr);
+		return 0;
+	}
+
+	pool->ptr = cellptr;
 	pool->free = NULL;
 
 	for (cell = 0; cell < pool->size; cell++) {
-- 
2.8.1

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 00/98] 3.12.58-stable review Jiri Slaby <jslaby@suse.cz> - 2016-04-11 15:30 +0200
  Re: [PATCH 3.12 00/98] 3.12.58-stable review Guenter Roeck <linux@roeck-us.net> - 2016-04-11 15:40 +0200
    Re: [PATCH 3.12 00/98] 3.12.58-stable review Jiri Slaby <jslaby@suse.cz> - 2016-04-14 10:30 +0200
  [PATCH 3.12 01/98] ipr: Fix out-of-bounds null overwrite Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 18/98] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 23/98] KVM: SVM: add rdmsr support for AMD event registers Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 08/98] xen-netback: use RING_COPY_REQUEST() throughout Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 07/98] xen-netback: don't use last request to determine minimum Tx credit Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 03/98] ipv4: Don't do expensive useless work during inetdev destroy. Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 27/98] perf, nmi: Fix unknown NMI warning Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 14/98] sched: Fix race between task_group and sched_task_group Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 20/98] memcg: do not hang on OOM when killed by userspace OOM access to memory reserves Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 19/98] ALSA: seq: Fix leak of pool buffer at concurrent writes Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 09/98] xen-blkback: only read request operation from shared ring once Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 05/98] kernel: Provide READ_ONCE and ASSIGN_ONCE Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
      Re: [PATCH 3.12 05/98] kernel: Provide READ_ONCE and ASSIGN_ONCE Christian Borntraeger <borntraeger@de.ibm.com> - 2016-04-11 16:20 +0200
    [PATCH 3.12 06/98] xen: Add RING_COPY_REQUEST() Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 17/98] drivers/base/memory.c: fix kernel warning during memory hotplug on ppc64 Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 04/98] umount: Do not allow unmounting rootfs. Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 10/98] xen-blkback: read from indirect descriptors only once Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 02/98] ipr: Fix regression when loading firmware Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
    [PATCH 3.12 15/98] Btrfs: skip locking when searching commit root Jiri Slaby <jslaby@suse.cz> - 2016-04-11 16:10 +0200
  Re: [PATCH 3.12 00/98] 3.12.58-stable review shuahkh <shuahkh@osg.sisa.samsung.com> - 2016-04-11 19:30 +0200

csiph-web