linux/sound/core
Takashi Iwai fc27fe7e8d ALSA: seq: Cancel pending autoload work at unbinding device
ALSA sequencer core has a mechanism to load the enumerated devices
automatically, and it's performed in an off-load work.  This seems
causing some race when a sequencer is removed while the pending
autoload work is running.  As syzkaller spotted, it may lead to some
use-after-free:
  BUG: KASAN: use-after-free in snd_rawmidi_dev_seq_free+0x69/0x70
  sound/core/rawmidi.c:1617
  Write of size 8 at addr ffff88006c611d90 by task kworker/2:1/567

  CPU: 2 PID: 567 Comm: kworker/2:1 Not tainted 4.13.0+ #29
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  Workqueue: events autoload_drivers
  Call Trace:
   __dump_stack lib/dump_stack.c:16 [inline]
   dump_stack+0x192/0x22c lib/dump_stack.c:52
   print_address_description+0x78/0x280 mm/kasan/report.c:252
   kasan_report_error mm/kasan/report.c:351 [inline]
   kasan_report+0x230/0x340 mm/kasan/report.c:409
   __asan_report_store8_noabort+0x1c/0x20 mm/kasan/report.c:435
   snd_rawmidi_dev_seq_free+0x69/0x70 sound/core/rawmidi.c:1617
   snd_seq_dev_release+0x4f/0x70 sound/core/seq_device.c:192
   device_release+0x13f/0x210 drivers/base/core.c:814
   kobject_cleanup lib/kobject.c:648 [inline]
   kobject_release lib/kobject.c:677 [inline]
   kref_put include/linux/kref.h:70 [inline]
   kobject_put+0x145/0x240 lib/kobject.c:694
   put_device+0x25/0x30 drivers/base/core.c:1799
   klist_devices_put+0x36/0x40 drivers/base/bus.c:827
   klist_next+0x264/0x4a0 lib/klist.c:403
   next_device drivers/base/bus.c:270 [inline]
   bus_for_each_dev+0x17e/0x210 drivers/base/bus.c:312
   autoload_drivers+0x3b/0x50 sound/core/seq_device.c:117
   process_one_work+0x9fb/0x1570 kernel/workqueue.c:2097
   worker_thread+0x1e4/0x1350 kernel/workqueue.c:2231
   kthread+0x324/0x3f0 kernel/kthread.c:231
   ret_from_fork+0x25/0x30 arch/x86/entry/entry_64.S:425

The fix is simply to assure canceling the autoload work at removing
the device.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-09-12 12:41:20 +02:00
..
oss sound updates for 4.13-rc1 2017-07-06 10:56:51 -07:00
seq ALSA: seq: 2nd attempt at fixing race creating a queue 2017-08-15 08:02:35 +02:00
compress_offload.c ALSA: compress: fix some missing and misplaced \n in messages 2016-09-16 19:24:13 +02:00
control_compat.c ALSA: Get rid of card power_lock 2017-08-30 20:44:29 +02:00
control.c ALSA: Get rid of card power_lock 2017-08-30 20:44:29 +02:00
ctljack.c ALSA: declare snd_kcontrol_new structures as const 2017-05-30 10:29:25 +02:00
device.c ALSA: core: Use %pS printk format for direct addresses 2017-09-07 10:36:02 +02:00
hrtimer.c ktime: Get rid of the union 2016-12-25 17:21:22 +01:00
hwdep_compat.c
hwdep.c sched/wait: Rename wait_queue_t => wait_queue_entry_t 2017-06-20 12:18:27 +02:00
info_oss.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
info.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
init.c ALSA: Get rid of card power_lock 2017-08-30 20:44:29 +02:00
isadma.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
jack.c ALSA: jack: Allow building the jack layer without input device 2016-02-23 09:03:07 +01:00
Kconfig ALSA: seq: Allow the modular sequencer registration 2017-06-12 08:43:33 +02:00
Makefile ALSA: seq: Allow the modular sequencer registration 2017-06-12 08:43:33 +02:00
memalloc.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
memory.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
misc.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
pcm_compat.c ALSA: pcm: Unify ioctl functions for playback and capture streams 2017-08-30 20:44:55 +02:00
pcm_dmaengine.c ASoC: dmaengine_pcm: Add support for packed transfers 2016-04-27 17:34:11 +01:00
pcm_drm_eld.c ALSA: pcm: use helper function to refer parameter as read-only 2017-05-17 07:24:39 +02:00
pcm_iec958.c ALSA: pcm: Allow 32 bit sample format in IEC958 channel status helper 2016-04-06 14:33:38 -07:00
pcm_lib.c sound updates for 4.13-rc1 2017-07-06 10:56:51 -07:00
pcm_local.h ALSA: pcm: unify codes to operate application-side position on PCM buffer 2017-06-12 08:49:22 +02:00
pcm_memory.c ALSA: pcm: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:18:58 +02:00
pcm_misc.c ALSA: pcm: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:18:58 +02:00
pcm_native.c ALSA: pcm: Unify ioctl functions for playback and capture streams 2017-08-30 20:44:55 +02:00
pcm_param_trace.h ALSA: pcm: use friendly name for id of PCM substream in trace print 2017-06-09 16:27:23 +02:00
pcm_timer.c ALSA: pcm: include pcm_local.h and remove some extraneous tabs 2017-05-30 18:04:47 +02:00
pcm_trace.h ALSA: pcm: use %s instead of %c for format of PCM buffer tracepoints 2017-06-12 08:49:24 +02:00
pcm.c ALSA: pcm: Correct broken procfs set up 2017-08-25 00:05:16 +02:00
rawmidi_compat.c ALSA: rawmidi: Fix ioctls X32 ABI 2016-02-28 17:44:51 +01:00
rawmidi.c sound updates for 4.13-rc1 2017-07-06 10:56:51 -07:00
seq_device.c ALSA: seq: Cancel pending autoload work at unbinding device 2017-09-12 12:41:20 +02:00
sgbuf.c ALSA: core: Deletion of unnecessary checks before two function calls 2014-11-21 20:06:57 +01:00
sound_oss.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
sound.c ALSA: core: Follow standard EXPORT_SYMBOL() declarations 2017-06-16 16:19:16 +02:00
timer_compat.c ALSA: timer: fix gparams ioctl compatibility for different architectures 2016-03-23 08:06:16 +01:00
timer.c ALSA: timer: Use common error handling code in alsa_timer_init() 2017-08-23 10:39:09 +02:00
vmaster.c ALSA: core: Use standard printk helpers 2014-02-14 08:14:15 +01:00