[Midnightbsd-cvs] [MidnightBSD/src] 1828cb: sound: fix use-after-free in the SNDCTL_DSP_SYNCST...

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 1828cbc9684a354d145ea872c3283b3d1f94117e
      https://github.com/MidnightBSD/src/commit/1828cbc9684a354d145ea872c3283b3d1f94117e
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M UPDATING
    M sys/dev/sound/pcm/channel.h
    M sys/dev/sound/pcm/dsp.c

  Log Message:
  -----------
  sound: fix use-after-free in the SNDCTL_DSP_SYNCSTART handler

dsp_oss_syncstart() looks up a sync group by id and then tries to lock
every member channel with CHN_TRYLOCK().  When a trylock failed it
dropped the locks it had taken and msleep()ed on the sync group list
lock, then continued iterating over the group's member list.  Dropping
that lock allows another thread to trigger or tear down the same sync
group, freeing both the member entries and the group itself, so the
resumed iteration walked freed memory.  An unprivileged local user with
two or more sound devices could use this to escalate privileges.

Break out of the member loop after sleeping and let the enclosing loop
re-search the sync group list by id, which handles the group having gone
away.  Only retry when msleep() timed out; a signal still aborts.

Add PCM_SG_LOCKPTR() and use it rather than naming the mutex directly.

This is CVE-2026-58091 / FreeBSD-SA-26:58.sound.

Obtained from:	FreeBSD
Signed-off-by: Lucas Holt <luke at foolishgames.com>
AI-Assisted-by: Claude Opus 5
(cherry picked from commit acf4907b8925c6a14ab2b5d624f36b9fcb90a6d6)



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications