From: Bob Song <songxiebing@kylinos.cn>
Io_uring may perform async poll after the file is closed and
private data is freed. Fix UAF by clearing private_data in
release function and adding NULL checks in poll.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+e3ec01fd2d18c9264c3b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/alsa-devel/0000000000005ea9dd05f20e5b48@google.com/
Signed-off-by: Bob Song <songxiebing@kylinos.cn>
---
sound/core/rawmidi.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 3b1034a44938..7973bace2ac5 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -606,6 +606,10 @@ static int snd_rawmidi_release(struct inode *inode, struct file *file)
struct module *module;
rfile = file->private_data;
+ if (!rfile)
+ return 0;
+
+ file->private_data = NULL;
rmidi = rfile->rmidi;
rawmidi_release_priv(rfile);
kfree(rfile);
@@ -1665,6 +1669,11 @@ static __poll_t snd_rawmidi_poll(struct file *file, poll_table *wait)
__poll_t mask;
rfile = file->private_data;
+
+ /* Prevent UAF from async io_uring poll after release */
+ if (!rfile)
+ return EPOLLERR | EPOLLHUP;
+
if (rfile->input != NULL) {
runtime = rfile->input->runtime;
snd_rawmidi_input_trigger(rfile->input, 1);
--
2.25.1