From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Takashi Iwai <tiwai@suse.de>,
syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.19 05/36] ALSA: seq: Cover unsubscribe_port() in list_mutex
Date: Tue, 4 Jun 2019 19:23:00 -0400 [thread overview]
Message-ID: <20190604232333.7185-5-sashal@kernel.org> (raw)
In-Reply-To: <20190604232333.7185-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e ]
The call of unsubscribe_port() which manages the group count and
module refcount from delete_and_unsubscribe_port() looks racy; it's
not covered by the group list lock, and it's likely a cause of the
reported unbalance at port deletion. Let's move the call inside the
group list_mutex to plug the hole.
Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/seq/seq_ports.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index a31e16cc012e..16289aefb443 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -550,10 +550,10 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
list_del_init(list);
grp->exclusive = 0;
write_unlock_irq(&grp->list_lock);
- up_write(&grp->list_mutex);
if (!empty)
unsubscribe_port(client, port, grp, &subs->info, ack);
+ up_write(&grp->list_mutex);
}
/* connect two ports */
--
2.20.1
next prev parent reply other threads:[~2019-06-04 23:30 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-04 23:22 [PATCH AUTOSEL 4.19 01/36] x86/uaccess, kcov: Disable stack protector Sasha Levin
2019-06-04 23:22 ` [PATCH AUTOSEL 4.19 02/36] ALSA: seq: Protect in-kernel ioctl calls with mutex Sasha Levin
2019-06-04 23:22 ` [PATCH AUTOSEL 4.19 03/36] ALSA: seq: Fix race of get-subscription call vs port-delete ioctls Sasha Levin
2019-06-04 23:22 ` [PATCH AUTOSEL 4.19 04/36] Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex" Sasha Levin
2019-06-04 23:23 ` Sasha Levin [this message]
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 06/36] s390/kasan: fix strncpy_from_user kasan checks Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 07/36] driver core: platform: Fix the usage of platform device name(pdev->name) Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 08/36] Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 09/36] configfs: fix possible use-after-free in configfs_register_group Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 10/36] f2fs: fix to avoid accessing xattr across the boundary Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 11/36] ipc: prevent lockup on alloc_msg and free_msg Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 12/36] scsi: qedi: remove memset/memcpy to nfunc and use func instead Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 13/36] scsi: qedi: remove set but not used variables 'cdev' and 'udev' Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 14/36] scsi: lpfc: correct rcu unlock issue in lpfc_nvme_info_show Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 15/36] scsi: lpfc: add check for loss of ndlp when sending RRQ Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 16/36] arm64/mm: Inhibit huge-vmap with ptdump Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 17/36] nvme: fix srcu locking on error return in nvme_get_ns_from_disk Sasha Levin
2019-06-04 23:23 ` Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 18/36] nvme: remove the ifdef around nvme_nvm_ioctl Sasha Levin
2019-06-04 23:23 ` Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 19/36] nvme: merge nvme_ns_ioctl into nvme_ioctl Sasha Levin
2019-06-04 23:23 ` Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 20/36] nvme: release namespace SRCU protection before performing controller ioctls Sasha Levin
2019-06-04 23:23 ` Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 21/36] nvme: fix memory leak for power latency tolerance Sasha Levin
2019-06-04 23:23 ` Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 22/36] platform/x86: pmc_atom: Add Lex 3I380D industrial PC to critclk_systems DMI table Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 23/36] platform/x86: pmc_atom: Add several Beckhoff Automation boards " Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 24/36] scsi: bnx2fc: fix incorrect cast to u64 on shift operation Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 25/36] libnvdimm: Fix compilation warnings with W=1 Sasha Levin
2019-06-04 23:23 ` Sasha Levin
2019-06-04 23:23 ` [PATCH AUTOSEL 4.19 26/36] selftests: fib_rule_tests: fix local IPv4 address typo Sasha Levin
2019-06-04 23:23 ` Sasha Levin
2019-06-04 23:23 ` sashal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190604232333.7185-5-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.