Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79fb0518 authored by Takashi Iwai's avatar Takashi Iwai
Browse files

ALSA: timer: Add missing mutex lock for compat ioctls 

The races among ioctl and other operations were protected by the
commit af368027 ("ALSA: timer: Fix race among timer ioctls") and
later fixes, but one code path was forgotten in the scenario: the
32bit compat ioctl.  As syzkaller recently spotted, a very similar
use-after-free may happen with the combination of compat ioctls.

The fix is simply to apply the same ioctl_lock to the compat_ioctl
callback, too.

Fixes: af368027 ("ALSA: timer: Fix race among timer ioctls")
Reference: http://lkml.kernel.org/r/089e082686ac9b482e055c832617@google.com


Reported-by: default avatarsyzbot <bot+e5f3c9783e7048a74233054febbe9f1bdf54b6da@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent f265788c

sound/core/timer_compat.c

+15 −2
Original line number Diff line number Diff line
@@ -133,7 +133,8 @@ enum { 
#endif /* CONFIG_X86_X32 */

};



static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg)

static long __snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd,

					  unsigned long arg)

{

	void __user *argp = compat_ptr(arg);
@@ -153,7 +154,7 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns 
	case SNDRV_TIMER_IOCTL_PAUSE:

	case SNDRV_TIMER_IOCTL_PAUSE_OLD:

	case SNDRV_TIMER_IOCTL_NEXT_DEVICE:

		return snd_timer_user_ioctl(file, cmd, (unsigned long)argp);

		return __snd_timer_user_ioctl(file, cmd, (unsigned long)argp);

	case SNDRV_TIMER_IOCTL_GPARAMS32:

		return snd_timer_user_gparams_compat(file, argp);

	case SNDRV_TIMER_IOCTL_INFO32:
@@ -167,3 +168,15 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns 
	}

	return -ENOIOCTLCMD;

}



static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd,

					unsigned long arg)

{

	struct snd_timer_user *tu = file->private_data;

	long ret;



	mutex_lock(&tu->ioctl_lock);

	ret = __snd_timer_user_ioctl_compat(file, cmd, arg);

	mutex_unlock(&tu->ioctl_lock);

	return ret;

}