kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/sound/drivers
History
Cássio Gabriel 345c24b2bc ALSA: aloop: Fix peer runtime UAF during format-change stop 
[ Upstream commit e5c33cdc6f ]

loopback_check_format() may stop the capture side when playback starts
with parameters that no longer match a running capture stream. Commit
826af7fa62 ("ALSA: aloop: Fix racy access at PCM trigger") moved
the peer lookup under cable->lock, but the actual snd_pcm_stop() still
runs after dropping that lock.

A concurrent close can clear the capture entry from cable->streams[] and
detach or free its runtime while the playback trigger path still holds a
stale peer substream pointer.

Keep a per-cable count of in-flight peer stops before dropping
cable->lock, and make free_cable() wait for those stops before
detaching the runtime. This preserves the existing behavior while
making the peer runtime lifetime explicit.

Reported-by: syzbot+8fa95c41eafbc9d2ff6f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8fa95c41eafbc9d2ff6f
Fixes: 597603d615 ("ALSA: introduce the snd-aloop module for the PCM loopback")
Cc: stable@vger.kernel.org
Suggested-by: Takashi Iwai <tiwai@suse.com>
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260424-alsa-aloop-peer-stop-uaf-v2-1-94e68101db8a@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ collapsed inc/snd_pcm_stop/dec into the existing inline call site and used spin_lock_irq/unlock_irq instead of scoped_guard ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-19 13:33:42 +02:00
..
mpu401 ALSA: mpu401: Allocate resources with device-managed APIs 2021-07-19 16:17:30 +02:00
opl3 ALSA: drivers: opl3: Fix incorrect use of vp->state 2021-12-29 12:28:50 +01:00
opl4 ALSA: opl4: More constification 2020-01-05 16:15:08 +01:00
pcsp ALSA: pcsp: Make hrtimer forwarding more robust 2021-09-28 10:58:08 +02:00
vx ALSA: vx: Manage vx_core object with devres 2021-07-19 16:17:09 +02:00
aloop.c ALSA: aloop: Fix peer runtime UAF during format-change stop 2026-06-19 13:33:42 +02:00
dummy.c ALSA: dummy: Allocate resources with device-managed APIs 2021-07-19 16:17:32 +02:00
Kconfig ALSA: aloop: Fix spelling mistake "synchronization" -> "synchronization" 2021-07-19 15:44:30 +02:00
Makefile sound: ac97: Remove sound driver for ancient platform 2020-05-28 23:24:34 +10:00
mtpav.c ALSA: mtpav: Don't call card private_free at probe error path 2022-04-20 09:34:12 +02:00
mts64.c ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt 2022-12-31 13:14:16 +01:00
portman2x4.c ALSA: serial: Fix assignment in if condition 2021-06-09 17:30:34 +02:00
serial-u16550.c ALSA: serial-u16550: Allocate resources with device-managed APIs 2021-07-19 16:17:30 +02:00
virmidi.c ALSA: virmidi: Allocate resources with device-managed APIs 2021-07-19 16:17:28 +02:00