In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: seq: oss: Serialize readq reset state with q->lock<\/p>\n
snd_seq_oss_readq_clear() resets qlen, head, and tail without
\nq->lock even though the normal reader and producer paths serialize the
\nsame ring state under that spinlock. A reset can therefore race
\nsnd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave
\nstale records in the queue, drop freshly queued ones, or report the
\nwrong readiness after wakeup. KCSAN reports a data race between
\nsnd_seq_oss_readq_clear() and snd_seq_oss_readq_free().<\/p>\n
Take q->lock while clearing the ring and resetting input_time. Factor
\nthe enqueue logic into a caller-locked helper so
\nsnd_seq_oss_readq_put_timestamp() updates its suppression state under
\nthe same lock instead of racing the reset path.<\/p>\n
The buggy scenario involves two paths, with each column showing the
\norder within that path:<\/p>\n
reset path: locked readq updater:
\n1. snd_seq_oss_reset() or 1. A reader or callback producer
\n release reaches takes q->lock on the same queue.
\n snd_seq_oss_readq_clear().
\n2. snd_seq_oss_readq_clear() 2. The updater tests or modifies
\n resets qlen, head, tail, qlen, head, and tail.
\n and input_time.
\n3. snd_seq_oss_readq_clear() 3. The updater completes its
\n wakes sleepers on read-modify-write sequence.
\n q->midi_sleep.
\n4. Without q->lock, the reset 4. The resulting ring state drives
\n can overlap the locked later reads and readiness.
\n update.<\/p>\n
KCSAN reports:<\/p>\n
BUG: KCSAN: data-race in snd_seq_oss_readq_clear \/
\nsnd_seq_oss_readq_free<\/p>\n
write to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:
\n snd_seq_oss_readq_free+0x6c\/0x80
\n snd_seq_oss_read+0xcb\/0x250
\n odev_read+0x38\/0x60
\n vfs_read+0xff\/0x600
\n ksys_read+0xb4\/0x140
\n __x64_sys_read+0x46\/0x60
\n do_syscall_64+0xbb\/0x2f0
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
read to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:
\n snd_seq_oss_readq_clear+0x1f\/0x90
\n snd_seq_oss_reset+0xa7\/0xf0
\n snd_seq_oss_ioctl+0x6f6\/0x7e0
\n odev_ioctl+0x56\/0xc0
\n __x64_sys_ioctl+0xd1\/0x120
\n do_syscall_64+0xbb\/0x2f0
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
value changed: 0x00000001 -> 0x00000000<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: seq: oss: Serialize readq reset state with q->lock<\/p>\n
snd_seq_oss_readq_clear() resets qlen, head, and tail without
\nq->lock eve<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12310","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}