From 681b6e77b7ae8b95b8bcc70d29f9808e859be769 Mon Sep 17 00:00:00 2001 From: Andreas Wellving Date: Fri, 26 Oct 2018 13:50:12 +0200 Subject: ALSA: CVE-2018-10902 ALSA: rawmidi: Change resized buffers atomically Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=c4f094deb3d69dcc8b4e3dc6c056c1e62a72c33e Change-Id: Ie77efba9d2c800374a5713af455877de58bd47a6 Signed-off-by: Andreas Wellving --- patches/cve/4.9.x.scc | 3 + ...rawmidi-Change-resized-buffers-atomically.patch | 89 ++++++++++++++++++++++ 2 files changed, 92 insertions(+) create mode 100644 patches/cve/CVE-2018-10902-ALSA-rawmidi-Change-resized-buffers-atomically.patch diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc index 65206d1..f521594 100644 --- a/patches/cve/4.9.x.scc +++ b/patches/cve/4.9.x.scc @@ -21,3 +21,6 @@ SRC_URI += "file://CVE-2018-9516-HID-debug-check-length-before-copy_to_user.patc #CVEs fixed in 4.9.113: SRC_URI += "file://CVE-2018-13405-Fix-up-non-directory-creation-in-SGID-directories.patch" + +#CVEs fixed in 4.9.115: +SRC_URI += "file://CVE-2018-10902-ALSA-rawmidi-Change-resized-buffers-atomically.patch" diff --git a/patches/cve/CVE-2018-10902-ALSA-rawmidi-Change-resized-buffers-atomically.patch b/patches/cve/CVE-2018-10902-ALSA-rawmidi-Change-resized-buffers-atomically.patch new file mode 100644 index 0000000..7c9f4c5 --- /dev/null +++ b/patches/cve/CVE-2018-10902-ALSA-rawmidi-Change-resized-buffers-atomically.patch @@ -0,0 +1,89 @@ +From c4f094deb3d69dcc8b4e3dc6c056c1e62a72c33e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 17 Jul 2018 17:26:43 +0200 +Subject: [PATCH] ALSA: rawmidi: Change resized buffers atomically + +commit 39675f7a7c7e7702f7d5341f1e0d01db746543a0 upstream. + +The SNDRV_RAWMIDI_IOCTL_PARAMS ioctl may resize the buffers and the +current code is racy. For example, the sequencer client may write to +buffer while it being resized. + +As a simple workaround, let's switch to the resized buffer inside the +stream runtime lock. + +CVE: CVE-2018-10902 +Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=c4f094deb3d69dcc8b4e3dc6c056c1e62a72c33e] + +Reported-by: syzbot+52f83f0ea8df16932f7f@syzkaller.appspotmail.com +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Andreas Wellving +--- + sound/core/rawmidi.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c +index 16f8124b1150..59111cadaec2 100644 +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -635,7 +635,7 @@ static int snd_rawmidi_info_select_user(struct snd_card *card, + int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream, + struct snd_rawmidi_params * params) + { +- char *newbuf; ++ char *newbuf, *oldbuf; + struct snd_rawmidi_runtime *runtime = substream->runtime; + + if (substream->append && substream->use_count > 1) +@@ -648,13 +648,17 @@ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream, + return -EINVAL; + } + if (params->buffer_size != runtime->buffer_size) { +- newbuf = krealloc(runtime->buffer, params->buffer_size, +- GFP_KERNEL); ++ newbuf = kmalloc(params->buffer_size, GFP_KERNEL); + if (!newbuf) + return -ENOMEM; ++ spin_lock_irq(&runtime->lock); ++ oldbuf = runtime->buffer; + runtime->buffer = newbuf; + runtime->buffer_size = params->buffer_size; + runtime->avail = runtime->buffer_size; ++ runtime->appl_ptr = runtime->hw_ptr = 0; ++ spin_unlock_irq(&runtime->lock); ++ kfree(oldbuf); + } + runtime->avail_min = params->avail_min; + substream->active_sensing = !params->no_active_sensing; +@@ -665,7 +669,7 @@ EXPORT_SYMBOL(snd_rawmidi_output_params); + int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream, + struct snd_rawmidi_params * params) + { +- char *newbuf; ++ char *newbuf, *oldbuf; + struct snd_rawmidi_runtime *runtime = substream->runtime; + + snd_rawmidi_drain_input(substream); +@@ -676,12 +680,16 @@ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream, + return -EINVAL; + } + if (params->buffer_size != runtime->buffer_size) { +- newbuf = krealloc(runtime->buffer, params->buffer_size, +- GFP_KERNEL); ++ newbuf = kmalloc(params->buffer_size, GFP_KERNEL); + if (!newbuf) + return -ENOMEM; ++ spin_lock_irq(&runtime->lock); ++ oldbuf = runtime->buffer; + runtime->buffer = newbuf; + runtime->buffer_size = params->buffer_size; ++ runtime->appl_ptr = runtime->hw_ptr = 0; ++ spin_unlock_irq(&runtime->lock); ++ kfree(oldbuf); + } + runtime->avail_min = params->avail_min; + return 0; + + -- cgit v1.2.3-54-g00ecf