ALSA: timer: Add missing mutex lock for compat ioctls

commit 79fb0518fec8c8b4ea7f1729f54f293724b3dbb0 upstream.

The races among ioctl and other operations were protected by the
commit af368027a49a ("ALSA: timer: Fix race among timer ioctls") and
later fixes, but one code path was forgotten in the scenario: the
32bit compat ioctl.  As syzkaller recently spotted, a very similar
use-after-free may happen with the combination of compat ioctls.

The fix is simply to apply the same ioctl_lock to the compat_ioctl
callback, too.

Fixes: af368027a49a ("ALSA: timer: Fix race among timer ioctls")
Reference: http://lkml.kernel.org/r/089e082686ac9b482e055c832617@google.com
Reported-by: syzbot <bot+e5f3c9783e7048a74233054febbe9f1bdf54b6da@syzkaller.appspotmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c
index 8e7eddf..bfd2b8d 100644 (file)
--- a/sound/core/timer_compat.c
+++ b/sound/core/timer_compat.c
@@ -97,7 +97,8 @@ enum {
        SNDRV_TIMER_IOCTL_STATUS32 = _IOW('T', 0x14, struct snd_timer_status32),
 };
 
        SNDRV_TIMER_IOCTL_STATUS32 = _IOW('T', 0x14, struct snd_timer_status32),
 };
 

-static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg)
+static long __snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd,
+                                         unsigned long arg)

 {
        void __user *argp = compat_ptr(arg);
 
 {
        void __user *argp = compat_ptr(arg);
 


@@ -118,7 +119,7 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns
        case SNDRV_TIMER_IOCTL_PAUSE:
        case SNDRV_TIMER_IOCTL_PAUSE_OLD:
        case SNDRV_TIMER_IOCTL_NEXT_DEVICE:
        case SNDRV_TIMER_IOCTL_PAUSE:
        case SNDRV_TIMER_IOCTL_PAUSE_OLD:
        case SNDRV_TIMER_IOCTL_NEXT_DEVICE:

-               return snd_timer_user_ioctl(file, cmd, (unsigned long)argp);
+               return __snd_timer_user_ioctl(file, cmd, (unsigned long)argp);

        case SNDRV_TIMER_IOCTL_INFO32:
                return snd_timer_user_info_compat(file, argp);
        case SNDRV_TIMER_IOCTL_STATUS32:
        case SNDRV_TIMER_IOCTL_INFO32:
                return snd_timer_user_info_compat(file, argp);
        case SNDRV_TIMER_IOCTL_STATUS32:


@@ -126,3 +127,15 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns
        }
        return -ENOIOCTLCMD;
 }
        }
        return -ENOIOCTLCMD;
 }

+
+static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd,
+                                       unsigned long arg)
+{
+       struct snd_timer_user *tu = file->private_data;
+       long ret;
+
+       mutex_lock(&tu->ioctl_lock);
+       ret = __snd_timer_user_ioctl_compat(file, cmd, arg);
+       mutex_unlock(&tu->ioctl_lock);
+       return ret;
+}