From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Takashi Iwai <tiwai@suse.de>,
syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 5.1 05/60] ALSA: seq: Cover unsubscribe_port() in list_mutex
Date: Tue, 4 Jun 2019 19:21:15 -0400 [thread overview]
Message-ID: <20190604232212.6753-5-sashal@kernel.org> (raw)
In-Reply-To: <20190604232212.6753-1-sashal@kernel.org>
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e ]
The call of unsubscribe_port() which manages the group count and
module refcount from delete_and_unsubscribe_port() looks racy; it's
not covered by the group list lock, and it's likely a cause of the
reported unbalance at port deletion. Let's move the call inside the
group list_mutex to plug the hole.
Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/seq/seq_ports.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index a31e16cc012e..16289aefb443 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -550,10 +550,10 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
list_del_init(list);
grp->exclusive = 0;
write_unlock_irq(&grp->list_lock);
- up_write(&grp->list_mutex);
if (!empty)
unsubscribe_port(client, port, grp, &subs->info, ack);
+ up_write(&grp->list_mutex);
}
/* connect two ports */
--
2.20.1
next prev parent reply other threads:[~2019-06-04 23:33 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-04 23:21 [PATCH AUTOSEL 5.1 01/60] x86/uaccess, kcov: Disable stack protector Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 02/60] ALSA: seq: Protect in-kernel ioctl calls with mutex Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 03/60] ALSA: seq: Fix race of get-subscription call vs port-delete ioctls Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 04/60] Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex" Sasha Levin
2019-06-04 23:21 ` Sasha Levin [this message]
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 06/60] driver core: platform: Fix the usage of platform device name(pdev->name) Sasha Levin
2019-06-05 4:58 ` Greg Kroah-Hartman
2019-06-15 22:26 ` Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 07/60] Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 08/60] configfs: fix possible use-after-free in configfs_register_group Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 09/60] f2fs: fix to avoid accessing xattr across the boundary Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 10/60] ipc: prevent lockup on alloc_msg and free_msg Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 11/60] drivers/perf: arm_spe: Don't error on high-order pages for aux buf Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 12/60] bpf: sockmap, only stop/flush strp if it was enabled at some point Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 13/60] bpf: sockmap remove duplicate queue free Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 14/60] bpf: sockmap fix msg->sg.size account on ingress skb Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 15/60] scsi: qla2xxx: Add cleanup for PCI EEH recovery Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 16/60] scsi: qedi: remove memset/memcpy to nfunc and use func instead Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 17/60] scsi: qedi: remove set but not used variables 'cdev' and 'udev' Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 18/60] scsi: lpfc: resolve lockdep warnings Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 19/60] scsi: lpfc: correct rcu unlock issue in lpfc_nvme_info_show Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 20/60] scsi: lpfc: add check for loss of ndlp when sending RRQ Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 21/60] arm64: Print physical address of page table base in show_pte() Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 22/60] net: macb: fix error format in dev_err() Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 23/60] enetc: Fix NULL dma address unmap for Tx BD extensions Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 24/60] bpf, tcp: correctly handle DONT_WAIT flags and timeo == 0 Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 25/60] arm64/mm: Inhibit huge-vmap with ptdump Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 26/60] tools/bpftool: move set_max_rlimit() before __bpf_object__open_xattr() Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 27/60] selftests/bpf: fix bpf_get_current_task Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 28/60] nvme-pci: Fix controller freeze wait disabling Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 29/60] nvme: fix srcu locking on error return in nvme_get_ns_from_disk Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 30/60] nvme: remove the ifdef around nvme_nvm_ioctl Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 31/60] nvme: merge nvme_ns_ioctl into nvme_ioctl Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 32/60] nvme: release namespace SRCU protection before performing controller ioctls Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 33/60] nvme: fix memory leak for power latency tolerance Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 34/60] platform/x86: pmc_atom: Add Lex 3I380D industrial PC to critclk_systems DMI table Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 35/60] platform/x86: pmc_atom: Add several Beckhoff Automation boards " Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 36/60] scsi: myrs: Fix uninitialized variable Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 37/60] scsi: bnx2fc: fix incorrect cast to u64 on shift operation Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 38/60] drm/amdgpu: keep stolen memory on picasso Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 39/60] libnvdimm: Fix compilation warnings with W=1 Sasha Levin
2019-06-04 23:21 ` [PATCH AUTOSEL 5.1 40/60] selftests: fib_rule_tests: fix local IPv4 address typo Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190604232212.6753-5-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox