Duoming Zhou 9d66ae0e7b ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs ... commit 051e0840ff upstream. The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer. When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below: (Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard->channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard->channel-> //USE In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed. Fixes: 198de43d75 ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device") Suggested-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Message-ID: <20240326094238.95442-1-duoming@zju.edu.cn> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-04-03 15:19:50 +02:00
..
ac97
aoa
arm
atmel
core	ALSA: seq: fix function cast warnings	2024-03-26 18:20:48 -04:00
drivers
firewire	ALSA: firewire-lib: fix to check cycle continuity	2024-03-06 14:45:09 +00:00
hda	ALSA: hda: Refer to correct stream index at loops	2024-02-05 20:12:54 +00:00
i2c
isa
mips
oss
parisc
pci	ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook	2024-04-03 15:19:42 +02:00
pcmcia
ppc
sh	ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs	2024-04-03 15:19:50 +02:00
soc	ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2"	2024-04-03 15:19:43 +02:00
sparc
spi
synth
usb	ALSA: usb-audio: Stop parsing channels bits when all channels are found.	2024-03-26 18:20:53 -04:00
virtio
x86
xen
ac97_bus.c
Kconfig
last.c
Makefile
sound_core.c