dsp_clone uses function-static cdev pointer shared across concurrent clone opens (race)
Summary
dsp_clone at dsp.c:2381: static struct cdev *dev = NULL. snd_clone_alloc at :2495 reads/writes *dev. make_only_dev at :2506 writes. ap->a_dev=dev at :2520 reads. devfs drops devfs_lock before calling clone handler (devfs_core.c:2333) -> two opens race on shared pointer. Result: wrong cdev returned, orphaned cdev leak. Fix: make dev a local.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1261 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 871 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 329 B | view raw |
DF-1261 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
dsp_clone uses function-static cdev pointer shared across concurrent clone opens (race)
Source Location
sys/dev/sound/pcm/dsp.c:2370-2520
Verdict
Source-confirmed: dsp_clone uses function-static cdev pointer shared across concurrent c. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
dsp_clone at dsp.c:2381: static struct cdev dev = NULL. snd_clone_alloc at :2495 reads/writes dev. make_only_dev at :2506 writes. ap->a_dev=dev at :2520 reads. devfs drops devfs_lock before calling clone handler (devfs_core.c:2333) -> two opens race on shared pointer. Result: wrong cdev returned, orphaned cdev leak. Fix: make dev a local.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: dsp_clone uses function-static struct cdev *dev shared across concurrent clone opens, race condition. Removed static qualifier.
Verified recommended fix
Source-confirmed: dsp_clone uses function-static struct cdev *dev shared across concurrent clone opens, race condition. Removed static qualifier.
Verdict
Source-confirmed: dsp_clone uses function-static struct cdev *dev shared across concurrent clone opens, race condition. Removed static qualifier.
No comments yet.