From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+4a75454b9ca2777f35c7@syzkaller.appspotmail.com,
Takashi Iwai <tiwai@suse.de>
Subject: [PATCH 4.14 23/57] ALSA: seq: Fix potential concurrent access to the deleted pool
Date: Wed, 4 Sep 2019 19:53:51 +0200 [thread overview]
Message-ID: <20190904175304.218543213@linuxfoundation.org> (raw)
In-Reply-To: <20190904175301.777414715@linuxfoundation.org>
From: Takashi Iwai <tiwai@suse.de>
commit 75545304eba6a3d282f923b96a466dc25a81e359 upstream.
The input pool of a client might be deleted via the resize ioctl, the
the access to it should be covered by the proper locks. Currently the
only missing place is the call in snd_seq_ioctl_get_client_pool(), and
this patch papers over it.
Reported-by: syzbot+4a75454b9ca2777f35c7@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/seq_clientmgr.c | 3 +--
sound/core/seq/seq_fifo.c | 17 +++++++++++++++++
sound/core/seq/seq_fifo.h | 2 ++
3 files changed, 20 insertions(+), 2 deletions(-)
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1821,8 +1821,7 @@ static int snd_seq_ioctl_get_client_pool
if (cptr->type == USER_CLIENT) {
info->input_pool = cptr->data.user.fifo_pool_size;
info->input_free = info->input_pool;
- if (cptr->data.user.fifo)
- info->input_free = snd_seq_unused_cells(cptr->data.user.fifo->pool);
+ info->input_free = snd_seq_fifo_unused_cells(cptr->data.user.fifo);
} else {
info->input_pool = 0;
info->input_free = 0;
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -280,3 +280,20 @@ int snd_seq_fifo_resize(struct snd_seq_f
return 0;
}
+
+/* get the number of unused cells safely */
+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f)
+{
+ unsigned long flags;
+ int cells;
+
+ if (!f)
+ return 0;
+
+ snd_use_lock_use(&f->use_lock);
+ spin_lock_irqsave(&f->lock, flags);
+ cells = snd_seq_unused_cells(f->pool);
+ spin_unlock_irqrestore(&f->lock, flags);
+ snd_use_lock_free(&f->use_lock);
+ return cells;
+}
--- a/sound/core/seq/seq_fifo.h
+++ b/sound/core/seq/seq_fifo.h
@@ -68,5 +68,7 @@ int snd_seq_fifo_poll_wait(struct snd_se
/* resize pool in fifo */
int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize);
+/* get the number of unused cells safely */
+int snd_seq_fifo_unused_cells(struct snd_seq_fifo *f);
#endif
next prev parent reply other threads:[~2019-09-04 18:23 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-04 17:53 [PATCH 4.14 00/57] 4.14.142-stable review Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 01/57] dmaengine: ste_dma40: fix unneeded variable warning Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 02/57] auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 03/57] iommu/dma: Handle SG length overflow better Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 04/57] usb: gadget: composite: Clear "suspended" on reset/disconnect Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 05/57] usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 06/57] xen/blkback: fix memory leaks Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 07/57] i2c: rcar: avoid race when unregistering slave client Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 08/57] i2c: emev2: " Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 09/57] drm/ast: Fixed reboot test may cause system hanged Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 10/57] usb: host: fotg2: restart hcd after port reset Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 11/57] tools: hv: fix KVP and VSS daemons exit code Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 12/57] watchdog: bcm2835_wdt: Fix module autoload Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 13/57] drm/bridge: tfp410: fix memleak in get_modes() Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 14/57] scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 15/57] drm/tilcdc: Register cpufreq notifier after we have initialized crtc Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 16/57] tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 17/57] ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 18/57] ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 19/57] net/smc: make sure EPOLLOUT is raised Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 20/57] tcp: make sure EPOLLOUT wont be missed Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 21/57] mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 22/57] ALSA: line6: Fix memory leak at line6_init_pcm() error path Greg Kroah-Hartman
2019-09-04 17:53 ` Greg Kroah-Hartman [this message]
2019-09-04 17:53 ` [PATCH 4.14 24/57] kvm: x86: skip populating logical dest map if apic is not sw enabled Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 25/57] KVM: x86: Dont update RIP or do single-step on faulting emulation Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 26/57] x86/apic: Do not initialize LDR and DFR for bigsmp Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 27/57] x86/apic: Include the LDR when clearing out APIC registers Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 28/57] ftrace: Fix NULL pointer dereference in t_probe_next() Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 29/57] ftrace: Check for successful allocation of hash Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 30/57] ftrace: Check for empty hash and comment the race with registering probes Greg Kroah-Hartman
2019-09-04 17:53 ` [PATCH 4.14 31/57] usb-storage: Add new JMS567 revision to unusual_devs Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 32/57] USB: cdc-wdm: fix race between write and disconnect due to flag abuse Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 33/57] usb: chipidea: udc: dont do hardware access if gadget has stopped Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 34/57] usb: host: ohci: fix a race condition between shutdown and irq Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 35/57] usb: host: xhci: rcar: Fix typo in compatible string matching Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 36/57] USB: storage: ums-realtek: Update module parameter description for auto_delink_en Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 37/57] USB: storage: ums-realtek: Whitelist auto-delink support Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 38/57] uprobes/x86: Fix detection of 32-bit user mode Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 39/57] mmc: sdhci-of-at91: add quirk for broken HS200 Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 40/57] mmc: core: Fix init of SD cards reporting an invalid VDD range Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 41/57] stm class: Fix a double free of stm_source_device Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 42/57] intel_th: pci: Add support for another Lewisburg PCH Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 43/57] intel_th: pci: Add Tiger Lake support Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 44/57] drm/i915: Dont deballoon unused ggtt drm_mm_node in linux guest Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 45/57] VMCI: Release resource if the work is already queued Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 46/57] crypto: ccp - Ignore unconfigured CCP device on suspend/resume Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 47/57] Revert "cfg80211: fix processing world regdomain when non modular" Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 48/57] mac80211: fix possible sta leak Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 49/57] KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 50/57] KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 51/57] KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 52/57] NFS: Clean up list moves of struct nfs_page Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 53/57] NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend() Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 54/57] NFS: Pass error information to the pgio error cleanup routine Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 55/57] NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0 Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 56/57] i2c: piix4: Fix port selection for AMD Family 16h Model 30h Greg Kroah-Hartman
2019-09-04 17:54 ` [PATCH 4.14 57/57] x86/ptrace: fix up botched merge of spectrev1 fix Greg Kroah-Hartman
2019-09-05 0:18 ` [PATCH 4.14 00/57] 4.14.142-stable review kernelci.org bot
2019-09-05 0:38 ` Kevin Hilman
2019-09-05 3:48 ` Guenter Roeck
2019-09-05 14:42 ` shuah
2019-09-05 16:55 ` Guenter Roeck
2019-09-05 17:27 ` Daniel Díaz
2019-09-05 19:52 ` Kelsey Skunberg
2019-09-06 7:36 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190904175304.218543213@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+4a75454b9ca2777f35c7@syzkaller.appspotmail.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).