github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ALSA: emux: Fix UAF of soundfont zones at note-on

Browse Source 
snd_emux_note_on() looks up the matching zones via
snd_soundfont_search_zone(), which takes sflist->lock only during the
lookup and returns the raw zone pointers after releasing it.  The
caller then stores them in vp->zone without any protection.
Meanwhile, a concurrent SNDRV_EMUX_IOCTL_REMOVE_LAST_SAMPLES ioctl may
unlink and free those zones in snd_soundfont_remove_unlocked(); this
leads to a use-after-free in snd_emux_note_on(), and later at
accessing the cached vp->zone, e.g. in snd_emux_send_effect().

Fix it by holding sflist->lock in snd_emux_note_on() over the whole
zone lookup and voice setup, and let snd_soundfont_search_zone()
require the caller to hold the lock, instead.
snd_soundfont_lock_preset() takes sflist->lock for setting
presets_locked, so the removal path now syncs with the note-on finish.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-697212bb-a434-4ff5-8778-25a84f5dad89
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261020101624.205638-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2026-10-20 12:16:20 +02:00
parent 47c3d5b885
commit 34e3e04b8a
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sound/synth/emux/emux_synth.c
View File

@ -60,6 +60,9 @@ snd_emux_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
return;
key = note; /* remember the original note */
/* hold sflist->lock for protecting against concurrent free */
guard(spinlock_irqsave)(&emu->sflist->lock);
nvoices = get_zone(emu, port, &note, vel, chan, table);
if (! nvoices)
return;

9
sound/synth/emux/soundfont.c
View File

@ -1225,6 +1225,9 @@ delete_preset(struct snd_sf_list *sflist, struct snd_sf_zone *zp)
* The found zones are stored on 'table' array. max_layers defines
* the maximum number of elements in this array.
* This function returns the number of found zones. 0 if not found.
*
* The caller must hold sflist->lock, and keep holding it as long as
* the returned zones are accessed.
*/
int
snd_soundfont_search_zone(struct snd_sf_list *sflist, int *notep, int vel,
@ -1234,11 +1237,11 @@ snd_soundfont_search_zone(struct snd_sf_list *sflist, int *notep, int vel,
{
int nvoices;
/* this function is supposed to be called atomically,
* so we check the lock. if it's busy, just returns 0 to
lockdep_assert_held(&sflist->lock);
/* if the presets are being modified, just returns 0 to
* tell the caller the busy state
*/
guard(spinlock_irqsave)(&sflist->lock);
if (sflist->presets_locked)
return 0;
nvoices = search_zones(sflist, notep, vel, preset, bank,