Vulnerability: In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring.
Vulnerability ID: CVE-2019-19807
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2019-12-15
File: sound/core/timer.c
Commit message: ALSA: timer: Fix incorrectly assigned timer instance

The clean up commit 41672c0c24a6 ("ALSA: timer: Simplify error path in
snd_timer_open()") unified the error handling code paths with the
standard goto, but it introduced a subtle bug: the timer instance is
stored in snd_timer_open() incorrectly even if it returns an error.
This may eventually lead to UAF, as spotted by fuzzer.

The culprit is the snd_timer_open() code checks the
SNDRV_TIMER_IFLG_EXCLUSIVE flag with the common variable timeri.
This variable is supposed to be the newly created instance, but we
(ab-)used it for a temporary check before the actual creation of a
timer instance.  After that point, there is another check for the max
number of instances, and it bails out if over the threshold.  Before
the refactoring above, it worked fine because the code returned
directly from that point.  After the refactoring, however, it jumps to
the unified error path that stores the timeri variable in return --
even if it returns an error.  Unfortunately this stored value is kept
in the caller side (snd_timer_user_tselect()) in tu->timeri.  This
causes inconsistency later, as if the timer was successfully
assigned.

In this patch, we fix it by not re-using timeri variable but a
temporary variable for testing the exclusive connection, so timeri
remains NULL at that point.

Fixes: 41672c0c24a6 ("ALSA: timer: Simplify error path in snd_timer_open()")
Reported-and-tested-by: Tristan Madani <tristmd@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191106165547.23518-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Takashi Iwai

Vulnerable version (before fix):
 int snd_timer_open(struct snd_timer_instance **ti, 		goto unlock; 	} 	if (!list_empty(&timer->open_list_head)) { 		timeri = list_entry(timer->open_list_head.next, 				    struct snd_timer_instance, open_list); 		if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) { 			err = -EBUSY; 			timeri = NULL; 			goto unlock; 		} 	}

Fixed version (after fix):
 int snd_timer_open(struct snd_timer_instance **ti, 		goto unlock; 	} 	if (!list_empty(&timer->open_list_head)) { 		struct snd_timer_instance *t = 			list_entry(timer->open_list_head.next, 				    struct snd_timer_instance, open_list); 		if (t->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) { 			err = -EBUSY; 			goto unlock; 		} 	}

Patch:
patch: @@ -284,11 +284,11 @@ int snd_timer_open(struct snd_timer_instance **ti,
 		goto unlock;
 	}
 	if (!list_empty(&timer->open_list_head)) {
-		timeri = list_entry(timer->open_list_head.next,
+		struct snd_timer_instance *t =
+			list_entry(timer->open_list_head.next,
 				    struct snd_timer_instance, open_list);
-		if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
+		if (t->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
 			err = -EBUSY;
-			timeri = NULL;
 			goto unlock;
 		}
 	}
path: sound/core/timer.c