ALSA: timer: Fix use-after-free problem
authorWang Wensheng <wangwensheng4@huawei.com>
Wed, 3 Nov 2021 03:35:17 +0000 (03:35 +0000)
committerTakashi Iwai <tiwai@suse.de>
Wed, 3 Nov 2021 15:52:13 +0000 (16:52 +0100)
commitc0317c0e87094f5b5782b6fdef5ae0a4b150496c
treea609133b6d5eb50b6c2a521779f72d94ec126bf0
parentdf0380b9539b04c1ae8854a984098da06d5f1e67
ALSA: timer: Fix use-after-free problem

When the timer instance was add into ack_list but was not currently in
process, the user could stop it via snd_timer_stop1() without delete it
from the ack_list. Then the user could free the timer instance and when
it was actually processed UAF occurred.

This issue could be reproduced via testcase snd_timer01 in ltp - running
several instances of that testcase at the same time.

What I actually met was that the ack_list of the timer broken and the
kernel went into deadloop with irqoff. That could be detected by
hardlockup detector on board or when we run it on qemu, we could use gdb
to dump the ack_list when the console has no response.

To fix this issue, we delete the timer instance from ack_list and
active_list unconditionally in snd_timer_stop1().

Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
Suggested-by: Takashi Iwai <tiwai@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211103033517.80531-1-wangwensheng4@huawei.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/timer.c