tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ALSA: mixer: oss: Add card disconnect checkpoints

ALSA OSS mixer layer calls the kcontrol ops rather individually, and
pending calls might be not always caught at disconnecting the device.

For avoiding the potential UAF scenarios, add sanity checks of the
card disconnection at each entry point of OSS mixer accesses. The
rwsem is taken just before that check, hence the rest context should
be covered by that properly.

Link: https://patch.msgid.link/20260209121212.171430-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Takashi Iwai 084d5d44 ac656d7d

+16
+16
sound/core/oss/mixer_oss.c
··· 523 523 if (numid == ID_UNKNOWN) 524 524 return; 525 525 guard(rwsem_read)(&card->controls_rwsem); 526 + if (card->shutdown) 527 + return; 526 528 kctl = snd_ctl_find_numid(card, numid); 527 529 if (!kctl) 528 530 return; ··· 559 557 if (numid == ID_UNKNOWN) 560 558 return; 561 559 guard(rwsem_read)(&card->controls_rwsem); 560 + if (card->shutdown) 561 + return; 562 562 kctl = snd_ctl_find_numid(card, numid); 563 563 if (!kctl) 564 564 return; ··· 622 618 if (numid == ID_UNKNOWN) 623 619 return; 624 620 guard(rwsem_read)(&card->controls_rwsem); 621 + if (card->shutdown) 622 + return; 625 623 kctl = snd_ctl_find_numid(card, numid); 626 624 if (!kctl) 627 625 return; ··· 662 656 if (numid == ID_UNKNOWN) 663 657 return; 664 658 guard(rwsem_read)(&card->controls_rwsem); 659 + if (card->shutdown) 660 + return; 665 661 kctl = snd_ctl_find_numid(card, numid); 666 662 if (!kctl) 667 663 return; ··· 804 796 if (uinfo == NULL || uctl == NULL) 805 797 return -ENOMEM; 806 798 guard(rwsem_read)(&card->controls_rwsem); 799 + if (card->shutdown) 800 + return -ENODEV; 807 801 kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); 808 802 if (!kctl) 809 803 return -ENOENT; ··· 849 839 if (uinfo == NULL || uctl == NULL) 850 840 return -ENOMEM; 851 841 guard(rwsem_read)(&card->controls_rwsem); 842 + if (card->shutdown) 843 + return -ENODEV; 852 844 kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0); 853 845 if (!kctl) 854 846 return -ENOENT; ··· 897 885 if (!info) 898 886 return -ENOMEM; 899 887 scoped_guard(rwsem_read, &card->controls_rwsem) { 888 + if (card->shutdown) 889 + return -ENODEV; 900 890 kcontrol = snd_mixer_oss_test_id(mixer, name, index); 901 891 if (kcontrol == NULL) 902 892 return 0; ··· 1020 1006 if (snd_mixer_oss_build_test_all(mixer, ptr, &slot)) 1021 1007 return 0; 1022 1008 guard(rwsem_read)(&mixer->card->controls_rwsem); 1009 + if (mixer->card->shutdown) 1010 + return -ENODEV; 1023 1011 kctl = NULL; 1024 1012 if (!ptr->index) 1025 1013 kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);