title: ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
description: In the Linux kernel, the following vulnerability has been resolved:
ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
The dreamcastcard->timer could schedule the spu_dma_work and the
spu_dma_work could also arm the dreamcastcard->timer.
When the snd_pcm_substream is closing, the aica_channel will be
deallocated. But it could still be dereferenced in the worker
thread. The reason is that del_timer() will return directly
regardless of whether the timer handler is running or not and
the worker could be rescheduled in the timer handler. As a result,
the UAF bug will happen. The racy situation is shown below:
(Thread 1)                 |      (Thread 2)
snd_aicapcm_pcm_close()          |
...                             |  run_spu_dma() //worker
|    mod_timer()
flush_work()                   |
del_timer()                    |  aica_period_elapsed() //timer
kfree(dreamcastcard->channel)  |    schedule_work()
|  run_spu_dma() //worker
...                            |    dreamcastcard->channel-> //USE
In order to mitigate this bug and other possible corner cases,
call mod_timer() conditionally in run_spu_dma(), then implement
PCM sync_stop op to cancel both the timer and worker. The sync_stop
op will be called from PCM core appropriately when needed.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 198de43d758c, lessThan: 9d66ae0e7bb7, status: affected, versionType: git
version: 198de43d758c, lessThan: 61d4787692c1, status: affected, versionType: git
version: 198de43d758c, lessThan: e955e8a7f38a, status: affected, versionType: git
version: 198de43d758c, lessThan: 3c907bf56905, status: affected, versionType: git
version: 198de43d758c, lessThan: 051e0840ffa8, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 2.6.23, status: affected
version: 0, lessThan: 2.6.23, status: unaffected, versionType: custom
version: 6.1.84, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.24, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.12, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8.3, lessThanOrEqual: 6.8.*, status: unaffected, versionType: custom
version: 6.9-rc2, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
