In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: seq: midi: Serialize output teardown with event_input<\/p>\n
event_process_midi() borrows msynth->output_rfile.output and then
\npasses the substream to dump_midi() and snd_rawmidi_kernel_write()
\nwithout synchronizing with the output open\/close transition.
\nmidisynth_use() also publishes output_rfile before
\nsnd_rawmidi_output_params() has finished.<\/p>\n
The last midisynth_unuse() can therefore release the same rawmidi file
\nand free substream->runtime before snd_rawmidi_kernel_write1() takes
\nits runtime buffer reference. That leaves the event_input path using a
\nstale substream or runtime and can end in a NULL-deref or use-after-free.<\/p>\n
Fix this with two pieces of synchronization. Keep a short IRQ-safe
\nspinlock only for publishing or clearing output_rfile and for pairing
\nthe output snapshot with an snd_use_lock_t reference. Once
\nevent_process_midi() has taken that in-flight reference, it drops the
\nspinlock before calling snd_seq_dump_var_event(), dump_midi(), or
\nsnd_rawmidi_kernel_write(). midisynth_unuse() now detaches the visible
\nrawmidi file under the same spinlock, waits for the in-flight writers
\nto drain, and only then drains and releases the saved file.
\nmidisynth_use() likewise opens into a local snd_rawmidi_file and
\npublishes it only after snd_rawmidi_output_params() succeeds.<\/p>\n
The buggy scenario involves two paths, with each column showing the
\norder within that path:<\/p>\n
event_input path: last unuse path:
\n1. event_process_midi() snapshots 1. midisynth_unuse() starts
\n output_rfile.output. tearing down output_rfile.
\n2. dump_midi() reaches 2. snd_rawmidi_kernel_release()
\n snd_rawmidi_kernel_write() closes the output file.
\n before runtime is pinned. 3. close_substream() frees
\n3. The callback keeps using substream->runtime.
\n the borrowed substream.<\/p>\n
Validation reproduced this kernel report:
\nKASAN null-ptr-deref in snd_rawmidi_kernel_write1+0x56\/0x360
\nRIP: 0033:0x7fde7dd0837f
\nRIP: 0010:snd_rawmidi_kernel_write1+0x56\/0x360<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: seq: midi: Serialize output teardown with event_input<\/p>\n
event_process_midi() borrows msynth->output_rfile.output and then
\npass<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7340","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}