diff options
| author | Takashi Iwai <tiwai@suse.de> | 2017-03-21 13:56:04 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2017-03-21 14:01:10 +0100 |
| commit | c520ff3d03f0b5db7146d9beed6373ad5d2a5e0e (patch) | |
| tree | ded14dbde99a6392416d92153ebfa248a2493616 /sound/core/seq/seq_clientmgr.c | |
| parent | c6736a94d0e527ddc0d1eb99dbc59886a9ecf471 (diff) | |
| download | linux-stable-c520ff3d03f0b5db7146d9beed6373ad5d2a5e0e.tar.gz linux-stable-c520ff3d03f0b5db7146d9beed6373ad5d2a5e0e.tar.bz2 linux-stable-c520ff3d03f0b5db7146d9beed6373ad5d2a5e0e.zip | |
ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()
When snd_seq_pool_done() is called, it marks the closing flag to
refuse the further cell insertions. But snd_seq_pool_done() itself
doesn't clear the cells but just waits until all cells are cleared by
the caller side. That is, it's racy, and this leads to the endless
stall as syzkaller spotted.
This patch addresses the racy by splitting the setup of pool->closing
flag out of snd_seq_pool_done(), and calling it properly before
snd_seq_pool_done().
BugLink: http://lkml.kernel.org/r/CACT4Y+aqqy8bZA1fFieifNxR2fAfFQQABcBHj801+u5ePV0URw@mail.gmail.com
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core/seq/seq_clientmgr.c')
| -rw-r--r-- | sound/core/seq/seq_clientmgr.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 4c935202ce23..f3b1d7f50b81 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -1832,6 +1832,7 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client, info->output_pool != client->pool->size)) { if (snd_seq_write_pool_allocated(client)) { /* remove all existing cells */ + snd_seq_pool_mark_closing(client->pool); snd_seq_queue_client_leave_cells(client->number); snd_seq_pool_done(client->pool); } |