From: <gregkh@linuxfoundation.org>
To: tiwai@suse.de, dvyukov@google.com, gregkh@linuxfoundation.org
Cc: <stable@vger.kernel.org>, <stable-commits@vger.kernel.org>
Subject: Patch "ALSA: timer: Fix race among timer ioctls" has been added to the 4.1-stable tree
Date: Mon, 25 Jan 2016 16:52:49 -0800 [thread overview]
Message-ID: <145376956923223@kroah.com> (raw)
This is a note to let you know that I've just added the patch titled
ALSA: timer: Fix race among timer ioctls
to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-timer-fix-race-among-timer-ioctls.patch
and it can be found in the queue-4.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From af368027a49a751d6ff4ee9e3f9961f35bb4fede Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 13 Jan 2016 17:48:01 +0100
Subject: ALSA: timer: Fix race among timer ioctls
From: Takashi Iwai <tiwai@suse.de>
commit af368027a49a751d6ff4ee9e3f9961f35bb4fede upstream.
ALSA timer ioctls have an open race and this may lead to a
use-after-free of timer instance object. A simplistic fix is to make
each ioctl exclusive. We have already tread_sem for controlling the
tread, and extend this as a global mutex to be applied to each ioctl.
The downside is, of course, the worse concurrency. But these ioctls
aren't to be parallel accessible, in anyway, so it should be fine to
serialize there.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/timer.c | 32 +++++++++++++++++++-------------
1 file changed, 19 insertions(+), 13 deletions(-)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -73,7 +73,7 @@ struct snd_timer_user {
struct timespec tstamp; /* trigger tstamp */
wait_queue_head_t qchange_sleep;
struct fasync_struct *fasync;
- struct mutex tread_sem;
+ struct mutex ioctl_lock;
};
/* list of timers */
@@ -1263,7 +1263,7 @@ static int snd_timer_user_open(struct in
return -ENOMEM;
spin_lock_init(&tu->qlock);
init_waitqueue_head(&tu->qchange_sleep);
- mutex_init(&tu->tread_sem);
+ mutex_init(&tu->ioctl_lock);
tu->ticks = 1;
tu->queue_size = 128;
tu->queue = kmalloc(tu->queue_size * sizeof(struct snd_timer_read),
@@ -1283,8 +1283,10 @@ static int snd_timer_user_release(struct
if (file->private_data) {
tu = file->private_data;
file->private_data = NULL;
+ mutex_lock(&tu->ioctl_lock);
if (tu->timeri)
snd_timer_close(tu->timeri);
+ mutex_unlock(&tu->ioctl_lock);
kfree(tu->queue);
kfree(tu->tqueue);
kfree(tu);
@@ -1522,7 +1524,6 @@ static int snd_timer_user_tselect(struct
int err = 0;
tu = file->private_data;
- mutex_lock(&tu->tread_sem);
if (tu->timeri) {
snd_timer_close(tu->timeri);
tu->timeri = NULL;
@@ -1566,7 +1567,6 @@ static int snd_timer_user_tselect(struct
}
__err:
- mutex_unlock(&tu->tread_sem);
return err;
}
@@ -1779,7 +1779,7 @@ enum {
SNDRV_TIMER_IOCTL_PAUSE_OLD = _IO('T', 0x23),
};
-static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
+static long __snd_timer_user_ioctl(struct file *file, unsigned int cmd,
unsigned long arg)
{
struct snd_timer_user *tu;
@@ -1796,17 +1796,11 @@ static long snd_timer_user_ioctl(struct
{
int xarg;
- mutex_lock(&tu->tread_sem);
- if (tu->timeri) { /* too late */
- mutex_unlock(&tu->tread_sem);
+ if (tu->timeri) /* too late */
return -EBUSY;
- }
- if (get_user(xarg, p)) {
- mutex_unlock(&tu->tread_sem);
+ if (get_user(xarg, p))
return -EFAULT;
- }
tu->tread = xarg ? 1 : 0;
- mutex_unlock(&tu->tread_sem);
return 0;
}
case SNDRV_TIMER_IOCTL_GINFO:
@@ -1839,6 +1833,18 @@ static long snd_timer_user_ioctl(struct
return -ENOTTY;
}
+static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
+ unsigned long arg)
+{
+ struct snd_timer_user *tu = file->private_data;
+ long ret;
+
+ mutex_lock(&tu->ioctl_lock);
+ ret = __snd_timer_user_ioctl(file, cmd, arg);
+ mutex_unlock(&tu->ioctl_lock);
+ return ret;
+}
+
static int snd_timer_user_fasync(int fd, struct file * file, int on)
{
struct snd_timer_user *tu;
Patches currently in stable-queue which might be from tiwai@suse.de are
queue-4.1/alsa-hrtimer-fix-stall-by-hrtimer_cancel.patch
queue-4.1/alsa-hda-fix-white-noise-on-dell-latitude-e5550.patch
queue-4.1/alsa-hda-fix-the-headset-mic-detection-problem-for-a-dell-laptop.patch
queue-4.1/alsa-timer-harden-slave-timer-list-handling.patch
queue-4.1/alsa-timer-fix-double-unlink-of-active_list.patch
queue-4.1/alsa-hda-add-fixup-for-acer-aspire-one-cloudbook-14.patch
queue-4.1/alsa-control-avoid-kernel-warnings-from-tlv-ioctl-with-numid-0.patch
queue-4.1/alsa-hda-flush-the-pending-probe-work-at-remove.patch
queue-4.1/alsa-usb-audio-add-sample-rate-inquiry-quirk-for-audioquest-dragonfly.patch
queue-4.1/alsa-hda-apply-hp-headphone-fixups-more-generically.patch
queue-4.1/alsa-hda-set-codec-to-d3-at-reboot-shutdown-on-thinkpads.patch
queue-4.1/alsa-hda-realtek-fix-silent-headphone-output-on-macpro-4-1-v2.patch
queue-4.1/alsa-rme96-fix-unexpected-volume-reset-after-rate-changes.patch
queue-4.1/alsa-fireworks-bebob-oxfw-dice-enable-to-make-as-built-in.patch
queue-4.1/alsa-hda-set-skl-hda-controller-power-at-freeze-and-thaw.patch
queue-4.1/alsa-hda-add-inverted-dmic-for-packard-bell-dots.patch
queue-4.1/alsa-usb-add-native-dsd-support-for-oppo-ha-1.patch
queue-4.1/alsa-hda-add-intel-lewisburg-device-ids-audio.patch
queue-4.1/alsa-hda-add-a-fixup-for-thinkpad-x1-carbon-2nd.patch
queue-4.1/alsa-seq-fix-race-at-timer-setup-and-close.patch
queue-4.1/alsa-pcm-fix-snd_pcm_hw_params-struct-copy-in-compat-mode.patch
queue-4.1/alsa-seq-fix-snd_seq_call_port_info_ioctl-in-compat-mode.patch
queue-4.1/alsa-hda-disable-64bit-address-for-creative-hda-controllers.patch
queue-4.1/alsa-seq-fix-missing-null-check-at-remove_events-ioctl.patch
queue-4.1/alsa-usb-audio-fix-mixer-ctl-regression-of-native-instrument-devices.patch
queue-4.1/alsa-usb-audio-add-a-more-accurate-volume-quirk-for-audioquest-dragonfly.patch
queue-4.1/alsa-hda-fix-noise-problems-on-thinkpad-t440s.patch
queue-4.1/alsa-timer-handle-disconnection-more-safely.patch
queue-4.1/alsa-hda-fix-bass-pin-fixup-for-asus-n550jx.patch
queue-4.1/alsa-timer-fix-race-among-timer-ioctls.patch
queue-4.1/alsa-hda-apply-pin-fixup-for-hp-probook-6550b.patch
queue-4.1/alsa-hda-apply-click-noise-workaround-for-thinkpads-generically.patch
queue-4.1/alsa-hda-fix-noise-on-gigabyte-z170x-mobo.patch
reply other threads:[~2016-01-26 0:52 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=145376956923223@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=dvyukov@google.com \
--cc=stable-commits@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).