diff options
| author | Takashi Iwai <tiwai@suse.de> | 2018-03-05 22:06:09 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2018-03-08 12:05:37 +0100 |
| commit | 7bd80091567789f1c0cb70eb4737aac8bcd2b6b9 (patch) | |
| tree | f89b49a8c3e7efa67e1983274ffcd60889fdf574 /sound/core/seq/seq_fifo.c | |
| parent | d85739367c6d56e475c281945c68fdb05ca74b4c (diff) | |
| download | linux-7bd80091567789f1c0cb70eb4737aac8bcd2b6b9.tar.gz linux-7bd80091567789f1c0cb70eb4737aac8bcd2b6b9.tar.bz2 linux-7bd80091567789f1c0cb70eb4737aac8bcd2b6b9.zip | |
ALSA: seq: More protection for concurrent write and ioctl races
This patch is an attempt for further hardening against races between
the concurrent write and ioctls. The previous fix d15d662e89fc
("ALSA: seq: Fix racy pool initializations") covered the race of the
pool initialization at writer and the pool resize ioctl by the
client->ioctl_mutex (CVE-2018-1000004). However, basically this mutex
should be applied more widely to the whole write operation for
avoiding the unexpected pool operations by another thread.
The only change outside snd_seq_write() is the additional mutex
argument to helper functions, so that we can unlock / relock the given
mutex temporarily during schedule() call for blocking write.
Fixes: d15d662e89fc ("ALSA: seq: Fix racy pool initializations")
Reported-by: 范龙飞 <long7573@126.com>
Reported-by: Nicolai Stange <nstange@suse.de>
Reviewed-and-tested-by: Nicolai Stange <nstange@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core/seq/seq_fifo.c')
| -rw-r--r-- | sound/core/seq/seq_fifo.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c index a8c2822e0198..72c0302a55d2 100644 --- a/sound/core/seq/seq_fifo.c +++ b/sound/core/seq/seq_fifo.c @@ -125,7 +125,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, return -EINVAL; snd_use_lock_use(&f->use_lock); - err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */ + err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */ if (err < 0) { if ((err == -ENOMEM) || (err == -EAGAIN)) atomic_inc(&f->overflow); |