linux.git/sound/core/timer.c, branch v4.9

ALSA: timer: Fix zero-division by continue of uninitialized instance

2016-09-08T08:45:05+00:00

When a user timer instance is continued without the explicit start
beforehand, the system gets eventually zero-division error like:

  divide error: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
  CPU: 1 PID: 27320 Comm: syz-executor Not tainted 4.8.0-rc3-next-20160825+ #8
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
   task: ffff88003c9b2280 task.stack: ffff880027280000
   RIP: 0010:[]  [<     inline     >] ktime_divns include/linux/ktime.h:195
   RIP: 0010:[]  [] snd_hrtimer_callback+0x1bc/0x3c0 sound/core/hrtimer.c:62
  Call Trace:
   
   [<     inline     >] __run_hrtimer kernel/time/hrtimer.c:1238
   [] __hrtimer_run_queues+0x325/0xe70 kernel/time/hrtimer.c:1302
   [] hrtimer_interrupt+0x18b/0x420 kernel/time/hrtimer.c:1336
   [] local_apic_timer_interrupt+0x6f/0xe0 arch/x86/kernel/apic/apic.c:933
   [] smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:957
   [] apic_timer_interrupt+0x8c/0xa0 arch/x86/entry/entry_64.S:487
   
   .....

Although a similar issue was spotted and a fix patch was merged in
commit [6b760bb2c63a: ALSA: timer: fix division by zero after
SNDRV_TIMER_IOCTL_CONTINUE], it seems covering only a part of
iceberg.

In this patch, we fix the issue a bit more drastically.  Basically the
continue of an uninitialized timer is supposed to be a fresh start, so
we do it for user timers.  For the direct snd_timer_continue() call,
there is no way to pass the initial tick value, so we kick out for the
uninitialized case.

Reported-by: Dmitry Vyukov 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: timer: fix NULL pointer dereference in read()/ioctl() race

2016-09-02T13:13:08+00:00

I got this with syzkaller:

    ==================================================================
    BUG: KASAN: null-ptr-deref on address 0000000000000020
    Read of size 32 by task syz-executor/22519
    CPU: 1 PID: 22519 Comm: syz-executor Not tainted 4.8.0-rc2+ #169
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2
    014
     0000000000000001 ffff880111a17a00 ffffffff81f9f141 ffff880111a17a90
     ffff880111a17c50 ffff880114584a58 ffff880114584a10 ffff880111a17a80
     ffffffff8161fe3f ffff880100000000 ffff880118d74a48 ffff880118d74a68
    Call Trace:
     [] dump_stack+0x83/0xb2
     [] kasan_report_error+0x41f/0x4c0
     [] kasan_report+0x34/0x40
     [] ? snd_timer_user_read+0x554/0x790
     [] check_memory_region+0x13e/0x1a0
     [] kasan_check_read+0x11/0x20
     [] snd_timer_user_read+0x554/0x790
     [] ? snd_timer_user_info_compat.isra.5+0x2b0/0x2b0
     [] ? proc_fault_inject_write+0x1c1/0x250
     [] ? next_tgid+0x2a0/0x2a0
     [] ? do_group_exit+0x108/0x330
     [] ? fsnotify+0x72a/0xca0
     [] __vfs_read+0x10e/0x550
     [] ? snd_timer_user_info_compat.isra.5+0x2b0/0x2b0
     [] ? do_sendfile+0xc50/0xc50
     [] ? __fsnotify_update_child_dentry_flags+0x60/0x60
     [] ? kcov_ioctl+0x56/0x190
     [] ? common_file_perm+0x2e2/0x380
     [] ? __fsnotify_parent+0x5e/0x2b0
     [] ? security_file_permission+0x86/0x1e0
     [] ? rw_verify_area+0xe5/0x2b0
     [] vfs_read+0x115/0x330
     [] SyS_read+0xd1/0x1a0
     [] ? vfs_write+0x4b0/0x4b0
     [] ? __this_cpu_preempt_check+0x1c/0x20
     [] ? __context_tracking_exit.part.4+0x3a/0x1e0
     [] ? vfs_write+0x4b0/0x4b0
     [] do_syscall_64+0x1c4/0x4e0
     [] ? syscall_return_slowpath+0x16c/0x1d0
     [] entry_SYSCALL64_slow_path+0x25/0x25
    ==================================================================

There are a couple of problems that I can see:

 - ioctl(SNDRV_TIMER_IOCTL_SELECT), which potentially sets
   tu->queue/tu->tqueue to NULL on memory allocation failure, so read()
   would get a NULL pointer dereference like the above splat

 - the same ioctl() can free tu->queue/to->tqueue which means read()
   could potentially see (and dereference) the freed pointer

We can fix both by taking the ioctl_lock mutex when dereferencing
->queue/->tqueue, since that's always held over all the ioctl() code.

Just looking at the code I find it likely that there are more problems
here such as tu->qhead pointing outside the buffer if the size is
changed concurrently using SNDRV_TIMER_IOCTL_PARAMS.

Signed-off-by: Vegard Nossum 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: timer: fix NULL pointer dereference on memory allocation failure

2016-08-29T07:06:15+00:00

I hit this with syzkaller:

    kasan: CONFIG_KASAN_INLINE enabled
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] PREEMPT SMP KASAN
    CPU: 0 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #190
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
    task: ffff88011278d600 task.stack: ffff8801120c0000
    RIP: 0010:[]  [] snd_hrtimer_start+0x77/0x100
    RSP: 0018:ffff8801120c7a60  EFLAGS: 00010006
    RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000007
    RDX: 0000000000000009 RSI: 1ffff10023483091 RDI: 0000000000000048
    RBP: ffff8801120c7a78 R08: ffff88011a5cf768 R09: ffff88011a5ba790
    R10: 0000000000000002 R11: ffffed00234b9ef1 R12: ffff880114843980
    R13: ffffffff84213c00 R14: ffff880114843ab0 R15: 0000000000000286
    FS:  00007f72958f3700(0000) GS:ffff88011aa00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000603001 CR3: 00000001126ab000 CR4: 00000000000006f0
    Stack:
     ffff880114843980 ffff880111eb2dc0 ffff880114843a34 ffff8801120c7ad0
     ffffffff82c81ab1 0000000000000000 ffffffff842138e0 0000000100000000
     ffff880111eb2dd0 ffff880111eb2dc0 0000000000000001 ffff880111eb2dc0
    Call Trace:
     [] snd_timer_start1+0x331/0x670
     [] snd_timer_start+0x5d/0xa0
     [] snd_timer_user_ioctl+0x88e/0x2830
     [] ? __follow_pte.isra.49+0x430/0x430
     [] ? snd_timer_pause+0x80/0x80
     [] ? do_wp_page+0x3aa/0x1c90
     [] ? put_prev_entity+0x108f/0x21a0
     [] ? snd_timer_pause+0x80/0x80
     [] do_vfs_ioctl+0x193/0x1050
     [] ? cpuacct_account_field+0x12f/0x1a0
     [] ? ioctl_preallocate+0x200/0x200
     [] ? syscall_trace_enter+0x3cf/0xdb0
     [] ? __context_tracking_exit.part.4+0x9a/0x1e0
     [] ? exit_to_usermode_loop+0x190/0x190
     [] ? check_preemption_disabled+0x37/0x1e0
     [] ? security_file_ioctl+0x89/0xb0
     [] SyS_ioctl+0x8f/0xc0
     [] ? do_vfs_ioctl+0x1050/0x1050
     [] do_syscall_64+0x1c4/0x4e0
     [] entry_SYSCALL64_slow_path+0x25/0x25
    Code: c7 c7 c4 b9 c8 82 48 89 d9 4c 89 ee e8 63 88 7f fe e8 7e 46 7b fe 48 8d 7b 48 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 04 84 c0 7e 65 80 7b 48 00 74 0e e8 52 46
    RIP  [] snd_hrtimer_start+0x77/0x100
     RSP 
    ---[ end trace 5955b08db7f2b029 ]---

This can happen if snd_hrtimer_open() fails to allocate memory and
returns an error, which is currently not checked by snd_timer_open():

    ioctl(SNDRV_TIMER_IOCTL_SELECT)
     - snd_timer_user_tselect()
	- snd_timer_close()
	   - snd_hrtimer_close()
	      - (struct snd_timer *) t->private_data = NULL
        - snd_timer_open()
           - snd_hrtimer_open()
              - kzalloc() fails; t->private_data is still NULL

    ioctl(SNDRV_TIMER_IOCTL_START)
     - snd_timer_user_start()
	- snd_timer_start()
	   - snd_timer_start1()
	      - snd_hrtimer_start()
		- t->private_data == NULL // boom

Signed-off-by: Vegard Nossum 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE

2016-08-29T07:05:49+00:00

I got this:

    divide error: 0000 [#1] PREEMPT SMP KASAN
    CPU: 1 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #189
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
    task: ffff8801120a9580 task.stack: ffff8801120b0000
    RIP: 0010:[]  [] snd_hrtimer_callback+0x1da/0x3f0
    RSP: 0018:ffff88011aa87da8  EFLAGS: 00010006
    RAX: 0000000000004f76 RBX: ffff880112655e88 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: ffff880112655ea0 RDI: 0000000000000001
    RBP: ffff88011aa87e00 R08: ffff88013fff905c R09: ffff88013fff9048
    R10: ffff88013fff9050 R11: 00000001050a7b8c R12: ffff880114778a00
    R13: ffff880114778ab4 R14: ffff880114778b30 R15: 0000000000000000
    FS:  00007f071647c700(0000) GS:ffff88011aa80000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000603001 CR3: 0000000112021000 CR4: 00000000000006e0
    Stack:
     0000000000000000 ffff880114778ab8 ffff880112655ea0 0000000000004f76
     ffff880112655ec8 ffff880112655e80 ffff880112655e88 ffff88011aa98fc0
     00000000b97ccf2b dffffc0000000000 ffff88011aa98fc0 ffff88011aa87ef0
    Call Trace:
     
     [] __hrtimer_run_queues+0x347/0xa00
     [] ? snd_hrtimer_close+0x130/0x130
     [] ? retrigger_next_event+0x1b0/0x1b0
     [] ? hrtimer_interrupt+0x136/0x4b0
     [] hrtimer_interrupt+0x1b0/0x4b0
     [] local_apic_timer_interrupt+0x6e/0xf0
     [] ? kvm_guest_apic_eoi_write+0x13/0xc0
     [] smp_apic_timer_interrupt+0x76/0xa0
     [] apic_timer_interrupt+0x8c/0xa0
     
     [] ? _raw_spin_unlock_irqrestore+0x2c/0x60
     [] snd_timer_start1+0xdd/0x670
     [] snd_timer_continue+0x45/0x80
     [] snd_timer_user_ioctl+0x1030/0x2830
     [] ? __follow_pte.isra.49+0x430/0x430
     [] ? snd_timer_pause+0x80/0x80
     [] ? do_wp_page+0x3aa/0x1c90
     [] ? handle_mm_fault+0xbc8/0x27f0
     [] ? __pmd_alloc+0x370/0x370
     [] ? snd_timer_pause+0x80/0x80
     [] do_vfs_ioctl+0x193/0x1050
     [] ? ioctl_preallocate+0x200/0x200
     [] ? syscall_trace_enter+0x3cf/0xdb0
     [] ? __context_tracking_exit.part.4+0x9a/0x1e0
     [] ? exit_to_usermode_loop+0x190/0x190
     [] ? check_preemption_disabled+0x37/0x1e0
     [] ? security_file_ioctl+0x89/0xb0
     [] SyS_ioctl+0x8f/0xc0
     [] ? do_vfs_ioctl+0x1050/0x1050
     [] do_syscall_64+0x1c4/0x4e0
     [] entry_SYSCALL64_slow_path+0x25/0x25
    Code: e8 fc 42 7b fe 8b 0d 06 8a 50 03 49 0f af cf 48 85 c9 0f 88 7c 01 00 00 48 89 4d a8 e8 e0 42 7b fe 48 8b 45 c0 48 8b 4d a8 48 99 <48> f7 f9 49 01 c7 e8 cb 42 7b fe 48 8b 55 d0 48 b8 00 00 00 00
    RIP  [] snd_hrtimer_callback+0x1da/0x3f0
     RSP 
    ---[ end trace 6aa380f756a21074 ]---

The problem happens when you call ioctl(SNDRV_TIMER_IOCTL_CONTINUE) on a
completely new/unused timer -- it will have ->sticks == 0, which causes a
divide by 0 in snd_hrtimer_callback().

Signed-off-by: Vegard Nossum 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: timer: Fix negative queue usage by racy accesses

2016-07-04T12:02:15+00:00

The user timer tu->qused counter may go to a negative value when
multiple concurrent reads are performed since both the check and the
decrement of tu->qused are done in two individual locked contexts.
This results in bogus read outs, and the endless loop in the
user-space side.

The fix is to move the decrement of the tu->qused counter into the
same spinlock context as the zero-check of the counter.

Cc: 
Signed-off-by: Takashi Iwai

ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt

2016-05-08T09:36:17+00:00

The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: Kangjie Lu 
Signed-off-by: Takashi Iwai

ALSA: timer: Fix leak in events via snd_timer_user_ccallback

2016-05-08T09:36:07+00:00

The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: Kangjie Lu 
Signed-off-by: Takashi Iwai

ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS

2016-05-08T09:31:27+00:00

The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: Kangjie Lu 
Signed-off-by: Takashi Iwai

ALSA: timer: remove legacy rtctimer

2016-04-25T08:41:46+00:00

There are no users of rtctimer left. Remove its code as this is the
in-kernel user of the legacy PC RTC driver that will hopefully be removed
at some point.

Signed-off-by: Alexandre Belloni 
Signed-off-by: Takashi Iwai

ALSA: timer: Use mod_timer() for rearming the system timer

2016-04-01T10:28:16+00:00

ALSA system timer backend stops the timer via del_timer() without sync
and leaves del_timer_sync() at the close instead.  This is because of
the restriction by the design of ALSA timer: namely, the stop callback
may be called from the timer handler, and calling the sync shall lead
to a hangup.  However, this also triggers a kernel BUG() when the
timer is rearmed immediately after stopping without sync:
 kernel BUG at kernel/time/timer.c:966!
 Call Trace:
  
  [] snd_timer_s_start+0x13e/0x1a0
  [] snd_timer_interrupt+0x504/0xec0
  [] ? debug_check_no_locks_freed+0x290/0x290
  [] snd_timer_s_function+0xb4/0x120
  [] call_timer_fn+0x162/0x520
  [] ? call_timer_fn+0xcd/0x520
  [] ? snd_timer_interrupt+0xec0/0xec0
  ....

It's the place where add_timer() checks the pending timer.  It's clear
that this may happen after the immediate restart without sync in our
cases.

So, the workaround here is just to use mod_timer() instead of
add_timer().  This looks like a band-aid fix, but it's a right move,
as snd_timer_interrupt() takes care of the continuous rearm of timer.

Reported-by: Jiri Slaby 
Cc: 
Signed-off-by: Takashi Iwai