Mark Johnston
658b24eba2
sound: Revalidate after reacquiring locks when resizing buffers
...
sndbuf_resize() and sndbuf_remalloc() drop the channel lock in order to
allocate the new buffer(s) with M_WAITOK. Before doing that they verify
that the buffer is not mapped, but this could change while the lock is
dropped, as there is no higher-level synchronization which prevents
buffer resize (e.g., via the SNDCTL_DSP_SETBLKSIZE ioctl) from happening
concurrently with mmap. Thus, these checks are insufficient.
Modify sndbuf_resize() and sndbuf_remalloc() to revalidate after
reacquiring the lock. Extend them to check for a couple of channel
flags, mirroring the check in chn_resizebuf(). Modify chn_resizebuf()
to revalidate state after reacquiring the channel lock.
We could also allocate new buffers with M_NOWAIT and so avoid dropping
the lock. Then, I think we could go even further and invoke
CHANNEL_SETBLOCKSIZE and CHANNEL_SETFRAGMENTS with the channel lock
held. But really it would be better to ensure that dsp operations are
serialized; there is no reason for mmap and chn_resizebuf() to be able
to run in parallel, we should not be relying on the channel lock for
this. So, let's keep a more minimal approach here.
Add a simple regression test.
Approved by: so
Security: FreeBSD-SA-26:71.sound
Security: CVE-2026-101308
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60554
2026-10-13 16:54:30 +00:00
..
2026-02-03 01:19:15 +08:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-07-23 18:59:18 +09:00
2026-04-25 09:50:07 -07:00
2025-04-29 10:45:07 -04:00
2025-04-29 10:45:07 -04:00
2026-04-25 09:50:07 -07:00
2026-04-30 09:52:30 +02:00
2026-06-17 06:50:25 +02:00
2026-04-25 09:50:07 -07:00
2025-04-29 10:45:07 -04:00
2025-11-19 12:24:02 +01:00
2026-04-25 09:50:07 -07:00
2024-09-30 12:44:19 +08:00
2026-04-25 09:50:07 -07:00
2024-06-27 11:27:41 -04:00
2026-04-25 09:50:07 -07:00
2025-05-13 08:53:44 -07:00
2025-11-19 12:24:28 +01:00
2024-06-27 11:27:41 -04:00
2026-04-25 09:50:07 -07:00
2024-06-09 09:37:48 -04:00
2026-02-05 14:53:21 +01:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2025-08-28 11:11:03 +02:00
2024-12-03 01:03:42 +00:00
2024-07-12 20:03:37 +08:00
2026-01-21 15:11:56 +01:00
2026-04-14 19:32:31 +02:00
2026-01-16 19:37:50 +00:00
2025-11-19 12:26:22 +01:00
2024-02-18 18:31:14 +00:00
2025-09-03 12:36:30 +08:00
2024-07-12 20:03:37 +08:00
2025-04-29 10:44:25 -04:00
2024-09-30 12:44:29 +08:00
2025-11-19 12:26:49 +01:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2024-12-03 01:03:42 +00:00
2026-01-16 19:37:51 +00:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-24 13:23:54 +02:00
2026-04-25 09:50:07 -07:00
2025-09-19 13:41:37 +02:00
2026-04-25 09:50:07 -07:00
2025-02-27 10:17:49 -05:00
2026-08-06 00:40:48 -07:00
2025-04-09 03:53:17 +03:00
2026-08-01 15:12:05 +00:00
2026-02-05 22:54:06 +01:00
2025-08-27 10:36:52 -07:00
2025-09-03 12:36:30 +08:00
2026-06-17 06:50:52 +02:00
2024-09-30 12:44:21 +08:00
2026-08-06 18:51:31 -05:00
2026-06-17 06:50:42 +02:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-02-01 02:25:01 +08:00
2026-05-31 07:17:37 +02:00
2026-04-25 09:50:07 -07:00
2024-10-21 15:03:27 +00:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2024-07-12 20:03:37 +08:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2025-06-30 14:19:31 +00:00
2025-10-02 12:41:17 -04:00
2025-02-27 10:18:05 -05:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-02-05 22:54:06 +01:00
2026-04-25 09:50:07 -07:00
2025-02-18 16:59:44 -07:00
2026-08-24 19:02:58 +00:00
2026-05-11 08:28:29 +00:00
2025-04-29 10:24:32 -04:00
2026-07-10 21:15:18 +02:00
2025-05-15 21:11:55 +03:00
2024-10-17 12:32:38 -04:00
2026-03-04 23:08:34 +08:00
2026-04-25 09:50:07 -07:00
2026-08-01 21:27:09 -07:00
2026-08-06 17:53:13 -05:00
2025-05-19 14:53:00 +02:00
2026-02-01 02:25:02 +08:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2024-02-18 16:42:28 +00:00
2026-01-16 19:37:48 +00:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2024-02-18 16:42:28 +00:00
2024-02-18 16:42:28 +00:00
2024-06-12 13:56:52 +00:00
2026-07-10 16:31:56 +02:00
2026-08-04 11:41:36 -07:00
2024-06-27 11:27:42 -04:00
2025-04-29 10:45:07 -04:00
2026-04-25 09:50:07 -07:00
2024-07-12 20:03:37 +08:00
2026-02-01 02:25:07 +08:00
2024-02-18 16:42:28 +00:00
2026-05-11 08:29:49 +00:00
2025-11-08 12:12:21 +01:00
2025-02-27 12:08:57 -05:00
2025-07-12 04:41:32 +03:00
2026-05-03 21:37:15 +02:00
2025-07-22 10:03:09 -04:00
2026-04-25 09:50:07 -07:00
2024-12-03 01:01:59 +00:00
2026-04-25 09:50:07 -07:00
2026-02-22 13:11:21 +01:00
2025-07-23 06:00:21 +03:00
2026-01-16 19:37:40 +00:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-02-05 22:54:06 +01:00
2026-02-05 22:54:06 +01:00
2026-05-03 21:37:15 +02:00
2024-11-30 21:46:06 -05:00
2026-04-25 09:50:07 -07:00
2025-08-28 11:11:38 +02:00
2026-06-14 07:13:25 +02:00
2024-09-24 12:30:48 +08:00
2026-04-25 09:50:07 -07:00
2024-10-31 12:18:52 +01:00
2026-07-27 14:05:07 +00:00
2026-02-05 22:54:06 +01:00
2026-04-25 09:50:07 -07:00
2025-04-29 10:45:07 -04:00
2025-09-03 12:36:30 +08:00
2025-08-18 09:18:01 +00:00
2024-11-30 21:46:06 -05:00
2026-07-28 11:22:35 +02:00
2026-01-10 14:11:19 +01:00
2026-02-05 22:54:06 +01:00
2026-06-09 23:00:48 -05:00
2024-02-18 16:42:38 +00:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-08-06 00:39:10 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2024-06-09 09:37:59 -04:00
2024-10-21 15:03:27 +00:00
2026-04-25 09:50:07 -07:00
2025-01-11 17:09:41 +09:00
2026-07-27 19:35:19 +00:00
2026-06-17 06:51:07 +02:00
2025-09-21 14:52:38 +00:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2024-02-18 16:42:28 +00:00
2026-01-07 13:50:38 +00:00
2025-09-30 21:14:29 +00:00
2025-04-29 10:45:07 -04:00
2025-07-09 03:28:28 +03:00
2024-12-04 13:35:12 -05:00
2025-02-27 10:18:05 -05:00
2026-04-25 09:50:07 -07:00
2026-06-17 06:51:34 +02:00
2024-10-09 19:18:43 +00:00
2024-11-30 21:46:07 -05:00
2024-12-23 15:00:19 -07:00
2024-07-12 20:03:37 +08:00
2026-04-25 09:50:07 -07:00
2025-04-29 10:45:07 -04:00
2024-11-30 21:46:06 -05:00
2026-05-26 08:17:30 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-10-13 16:54:30 +00:00
2024-11-30 08:55:57 -05:00
2026-04-25 09:50:07 -07:00
2025-04-29 10:45:07 -04:00
2024-07-12 20:03:37 +08:00
2024-09-30 12:44:26 +08:00
2024-11-30 21:46:06 -05:00
2026-02-05 22:54:07 +01:00
2025-07-28 22:28:20 +09:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2026-04-25 09:50:07 -07:00
2024-07-12 20:03:37 +08:00
2026-02-05 22:54:06 +01:00
2026-04-25 09:50:07 -07:00
2026-09-28 13:07:40 +00:00
2025-04-29 10:45:07 -04:00
2026-08-06 07:09:02 +02:00
2025-07-28 22:28:20 +09:00
2025-02-27 08:09:23 -05:00
2026-08-17 18:27:46 -07:00
2025-11-19 12:25:30 +01:00
2025-04-29 10:45:07 -04:00
2026-06-07 13:12:28 -04:00
2024-07-12 20:03:37 +08:00
2024-06-27 11:27:41 -04:00
2026-07-29 17:48:54 +00:00
2024-02-18 16:42:28 +00:00
2024-04-28 07:20:25 +02:00
2026-02-01 02:25:02 +08:00
2026-02-01 02:25:02 +08:00
2026-04-25 09:50:07 -07:00
2025-04-29 10:45:07 -04:00