Commit 7aba7242 authored by Takashi Iwai's avatar Takashi Iwai Committed by Ben Hutchings

ALSA: timer: Fix race between read and ioctl

commit d11662f4 upstream.

The read from ALSA timer device, the function snd_timer_user_tread(),
may access to an uninitialized struct snd_timer_user fields when the
read is concurrently performed while the ioctl like
snd_timer_user_tselect() is invoked.  We have already fixed the races
among ioctls via a mutex, but we seem to have forgotten the race
between read vs ioctl.

This patch simply applies (more exactly extends the already applied
range of) tu->ioctl_lock in snd_timer_user_tread() for closing the
race window.
Reported-by: default avatarAlexander Potapenko <glider@google.com>
Tested-by: default avatarAlexander Potapenko <glider@google.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent cea299eb
...@@ -1930,6 +1930,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, ...@@ -1930,6 +1930,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
tu = file->private_data; tu = file->private_data;
unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read); unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read);
mutex_lock(&tu->ioctl_lock);
spin_lock_irq(&tu->qlock); spin_lock_irq(&tu->qlock);
while ((long)count - result >= unit) { while ((long)count - result >= unit) {
while (!tu->qused) { while (!tu->qused) {
...@@ -1945,7 +1946,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, ...@@ -1945,7 +1946,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
add_wait_queue(&tu->qchange_sleep, &wait); add_wait_queue(&tu->qchange_sleep, &wait);
spin_unlock_irq(&tu->qlock); spin_unlock_irq(&tu->qlock);
mutex_unlock(&tu->ioctl_lock);
schedule(); schedule();
mutex_lock(&tu->ioctl_lock);
spin_lock_irq(&tu->qlock); spin_lock_irq(&tu->qlock);
remove_wait_queue(&tu->qchange_sleep, &wait); remove_wait_queue(&tu->qchange_sleep, &wait);
...@@ -1961,7 +1964,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, ...@@ -1961,7 +1964,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
tu->qused--; tu->qused--;
spin_unlock_irq(&tu->qlock); spin_unlock_irq(&tu->qlock);
mutex_lock(&tu->ioctl_lock);
if (tu->tread) { if (tu->tread) {
if (copy_to_user(buffer, &tu->tqueue[qhead], if (copy_to_user(buffer, &tu->tqueue[qhead],
sizeof(struct snd_timer_tread))) sizeof(struct snd_timer_tread)))
...@@ -1971,7 +1973,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, ...@@ -1971,7 +1973,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
sizeof(struct snd_timer_read))) sizeof(struct snd_timer_read)))
err = -EFAULT; err = -EFAULT;
} }
mutex_unlock(&tu->ioctl_lock);
spin_lock_irq(&tu->qlock); spin_lock_irq(&tu->qlock);
if (err < 0) if (err < 0)
...@@ -1981,6 +1982,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, ...@@ -1981,6 +1982,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
} }
_error: _error:
spin_unlock_irq(&tu->qlock); spin_unlock_irq(&tu->qlock);
mutex_unlock(&tu->ioctl_lock);
return result > 0 ? result : err; return result > 0 ? result : err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment