ALSA: CVE-2018-10902

ALSA: rawmidi: Change resized buffers atomically

Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=c4f094deb3d69dcc8b4e3dc6c056c1e62a72c33e

Change-Id: Ie77efba9d2c800374a5713af455877de58bd47a6
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

2 files changed, 92 insertions, 0 deletions

diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc
index 65206d1..f521594 100644
--- a/patches/cve/4.9.x.scc
+++ b/patches/cve/4.9.x.scc
@@ -21,3 +21,6 @@ SRC_URI += "file://CVE-2018-9516-HID-debug-check-length-before-copy_to_user.patc
 
 #CVEs fixed in 4.9.113:
 SRC_URI += "file://CVE-2018-13405-Fix-up-non-directory-creation-in-SGID-directories.patch"
+
+#CVEs fixed in 4.9.115:
+SRC_URI += "file://CVE-2018-10902-ALSA-rawmidi-Change-resized-buffers-atomically.patch"
diff --git a/patches/cve/CVE-2018-10902-ALSA-rawmidi-Change-resized-buffers-atomically.patch b/patches/cve/CVE-2018-10902-ALSA-rawmidi-Change-resized-buffers-atomically.patch
new file mode 100644
index 0000000..7c9f4c5
--- /dev/null
+++ b/patches/cve/CVE-2018-10902-ALSA-rawmidi-Change-resized-buffers-atomically.patch
@@ -0,0 +1,89 @@
+From c4f094deb3d69dcc8b4e3dc6c056c1e62a72c33e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 17 Jul 2018 17:26:43 +0200
+Subject: [PATCH] ALSA: rawmidi: Change resized buffers atomically
+
+commit 39675f7a7c7e7702f7d5341f1e0d01db746543a0 upstream.
+
+The SNDRV_RAWMIDI_IOCTL_PARAMS ioctl may resize the buffers and the
+current code is racy.  For example, the sequencer client may write to
+buffer while it being resized.
+
+As a simple workaround, let's switch to the resized buffer inside the
+stream runtime lock.
+
+CVE: CVE-2018-10902
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=c4f094deb3d69dcc8b4e3dc6c056c1e62a72c33e]
+
+Reported-by: syzbot+52f83f0ea8df16932f7f@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ sound/core/rawmidi.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 16f8124b1150..59111cadaec2 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -635,7 +635,7 @@ static int snd_rawmidi_info_select_user(struct snd_card *card,
+ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
+                              struct snd_rawmidi_params * params)
+ {
+-       char *newbuf;
++       char *newbuf, *oldbuf;
+        struct snd_rawmidi_runtime *runtime = substream->runtime;
+        
+        if (substream->append && substream->use_count > 1)
+@@ -648,13 +648,17 @@ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream,
+                return -EINVAL;
+        }
+        if (params->buffer_size != runtime->buffer_size) {
+-               newbuf = krealloc(runtime->buffer, params->buffer_size,
+-                                 GFP_KERNEL);
++               newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
+                if (!newbuf)
+                        return -ENOMEM;
++               spin_lock_irq(&runtime->lock);
++               oldbuf = runtime->buffer;
+                runtime->buffer = newbuf;
+                runtime->buffer_size = params->buffer_size;
+                runtime->avail = runtime->buffer_size;
++               runtime->appl_ptr = runtime->hw_ptr = 0;
++               spin_unlock_irq(&runtime->lock);
++               kfree(oldbuf);
+        }
+        runtime->avail_min = params->avail_min;
+        substream->active_sensing = !params->no_active_sensing;
+@@ -665,7 +669,7 @@ EXPORT_SYMBOL(snd_rawmidi_output_params);
+ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
+                             struct snd_rawmidi_params * params)
+ {
+-       char *newbuf;
++       char *newbuf, *oldbuf;
+        struct snd_rawmidi_runtime *runtime = substream->runtime;
+ 
+        snd_rawmidi_drain_input(substream);
+@@ -676,12 +680,16 @@ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream,
+                return -EINVAL;
+        }
+        if (params->buffer_size != runtime->buffer_size) {
+-               newbuf = krealloc(runtime->buffer, params->buffer_size,
+-                                 GFP_KERNEL);
++               newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
+                if (!newbuf)
+                        return -ENOMEM;
++               spin_lock_irq(&runtime->lock);
++               oldbuf = runtime->buffer;
+                runtime->buffer = newbuf;
+                runtime->buffer_size = params->buffer_size;
++               runtime->appl_ptr = runtime->hw_ptr = 0;
++               spin_unlock_irq(&runtime->lock);
++               kfree(oldbuf);
+        }
+        runtime->avail_min = params->avail_min;
+        return 0;
+
+