]> git.karo-electronics.de Git - karo-tx-linux.git/commit
ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()
authorTakashi Iwai <tiwai@suse.de>
Tue, 21 Mar 2017 12:56:04 +0000 (13:56 +0100)
committerTakashi Iwai <tiwai@suse.de>
Tue, 21 Mar 2017 13:01:10 +0000 (14:01 +0100)
commitc520ff3d03f0b5db7146d9beed6373ad5d2a5e0e
treeded14dbde99a6392416d92153ebfa248a2493616
parentc6736a94d0e527ddc0d1eb99dbc59886a9ecf471
ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()

When snd_seq_pool_done() is called, it marks the closing flag to
refuse the further cell insertions.  But snd_seq_pool_done() itself
doesn't clear the cells but just waits until all cells are cleared by
the caller side.  That is, it's racy, and this leads to the endless
stall as syzkaller spotted.

This patch addresses the racy by splitting the setup of pool->closing
flag out of snd_seq_pool_done(), and calling it properly before
snd_seq_pool_done().

BugLink: http://lkml.kernel.org/r/CACT4Y+aqqy8bZA1fFieifNxR2fAfFQQABcBHj801+u5ePV0URw@mail.gmail.com
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/seq/seq_clientmgr.c
sound/core/seq/seq_fifo.c
sound/core/seq/seq_memory.c
sound/core/seq/seq_memory.h