Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1334047
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 044/117] ALSA: seq: Fix yet another races among ALSA timer accesses |
| Date | 2016-02-15 01:40 +0100 |
| Message-ID | <r2fmR-1Of-67@gated-at.bofh.it> (permalink) |
| References | <r2dl0-tX-11@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 2cdc7b636d55cbcf42e1e6c8accd85e62d3e9ae8 upstream.
ALSA sequencer may open/close and control ALSA timer instance
dynamically either via sequencer events or direct ioctls. These are
done mostly asynchronously, and it may call still some timer action
like snd_timer_start() while another is calling snd_timer_close().
Since the instance gets removed by snd_timer_close(), it may lead to
a use-after-free.
This patch tries to address such a race by protecting each
snd_timer_*() call via the existing spinlock and also by avoiding the
access to timer during close call.
BugLink: http://lkml.kernel.org/r/CACT4Y+Z6RzW5MBr-HUdV-8zwg71WQfKTdPpYGvOeS7v4cyurNQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/seq_timer.c | 87 ++++++++++++++++++++++++++++++++++-----------
1 file changed, 67 insertions(+), 20 deletions(-)
--- a/sound/core/seq/seq_timer.c
+++ b/sound/core/seq/seq_timer.c
@@ -90,6 +90,9 @@ void snd_seq_timer_delete(struct snd_seq
void snd_seq_timer_defaults(struct snd_seq_timer * tmr)
{
+ unsigned long flags;
+
+ spin_lock_irqsave(&tmr->lock, flags);
/* setup defaults */
tmr->ppq = 96; /* 96 PPQ */
tmr->tempo = 500000; /* 120 BPM */
@@ -105,21 +108,25 @@ void snd_seq_timer_defaults(struct snd_s
tmr->preferred_resolution = seq_default_timer_resolution;
tmr->skew = tmr->skew_base = SKEW_BASE;
+ spin_unlock_irqrestore(&tmr->lock, flags);
}
-void snd_seq_timer_reset(struct snd_seq_timer * tmr)
+static void seq_timer_reset(struct snd_seq_timer *tmr)
{
- unsigned long flags;
-
- spin_lock_irqsave(&tmr->lock, flags);
-
/* reset time & songposition */
tmr->cur_time.tv_sec = 0;
tmr->cur_time.tv_nsec = 0;
tmr->tick.cur_tick = 0;
tmr->tick.fraction = 0;
+}
+
+void snd_seq_timer_reset(struct snd_seq_timer *tmr)
+{
+ unsigned long flags;
+ spin_lock_irqsave(&tmr->lock, flags);
+ seq_timer_reset(tmr);
spin_unlock_irqrestore(&tmr->lock, flags);
}
@@ -138,8 +145,11 @@ static void snd_seq_timer_interrupt(stru
tmr = q->timer;
if (tmr == NULL)
return;
- if (!tmr->running)
+ spin_lock_irqsave(&tmr->lock, flags);
+ if (!tmr->running) {
+ spin_unlock_irqrestore(&tmr->lock, flags);
return;
+ }
resolution *= ticks;
if (tmr->skew != tmr->skew_base) {
@@ -148,8 +158,6 @@ static void snd_seq_timer_interrupt(stru
(((resolution & 0xffff) * tmr->skew) >> 16);
}
- spin_lock_irqsave(&tmr->lock, flags);
-
/* update timer */
snd_seq_inc_time_nsec(&tmr->cur_time, resolution);
@@ -296,26 +304,30 @@ int snd_seq_timer_open(struct snd_seq_qu
t->callback = snd_seq_timer_interrupt;
t->callback_data = q;
t->flags |= SNDRV_TIMER_IFLG_AUTO;
+ spin_lock_irq(&tmr->lock);
tmr->timeri = t;
+ spin_unlock_irq(&tmr->lock);
return 0;
}
int snd_seq_timer_close(struct snd_seq_queue *q)
{
struct snd_seq_timer *tmr;
+ struct snd_timer_instance *t;
tmr = q->timer;
if (snd_BUG_ON(!tmr))
return -EINVAL;
- if (tmr->timeri) {
- snd_timer_stop(tmr->timeri);
- snd_timer_close(tmr->timeri);
- tmr->timeri = NULL;
- }
+ spin_lock_irq(&tmr->lock);
+ t = tmr->timeri;
+ tmr->timeri = NULL;
+ spin_unlock_irq(&tmr->lock);
+ if (t)
+ snd_timer_close(t);
return 0;
}
-int snd_seq_timer_stop(struct snd_seq_timer * tmr)
+static int seq_timer_stop(struct snd_seq_timer *tmr)
{
if (! tmr->timeri)
return -EINVAL;
@@ -326,6 +338,17 @@ int snd_seq_timer_stop(struct snd_seq_ti
return 0;
}
+int snd_seq_timer_stop(struct snd_seq_timer *tmr)
+{
+ unsigned long flags;
+ int err;
+
+ spin_lock_irqsave(&tmr->lock, flags);
+ err = seq_timer_stop(tmr);
+ spin_unlock_irqrestore(&tmr->lock, flags);
+ return err;
+}
+
static int initialize_timer(struct snd_seq_timer *tmr)
{
struct snd_timer *t;
@@ -358,13 +381,13 @@ static int initialize_timer(struct snd_s
return 0;
}
-int snd_seq_timer_start(struct snd_seq_timer * tmr)
+static int seq_timer_start(struct snd_seq_timer *tmr)
{
if (! tmr->timeri)
return -EINVAL;
if (tmr->running)
- snd_seq_timer_stop(tmr);
- snd_seq_timer_reset(tmr);
+ seq_timer_stop(tmr);
+ seq_timer_reset(tmr);
if (initialize_timer(tmr) < 0)
return -EINVAL;
snd_timer_start(tmr->timeri, tmr->ticks);
@@ -373,14 +396,25 @@ int snd_seq_timer_start(struct snd_seq_t
return 0;
}
-int snd_seq_timer_continue(struct snd_seq_timer * tmr)
+int snd_seq_timer_start(struct snd_seq_timer *tmr)
+{
+ unsigned long flags;
+ int err;
+
+ spin_lock_irqsave(&tmr->lock, flags);
+ err = seq_timer_start(tmr);
+ spin_unlock_irqrestore(&tmr->lock, flags);
+ return err;
+}
+
+static int seq_timer_continue(struct snd_seq_timer *tmr)
{
if (! tmr->timeri)
return -EINVAL;
if (tmr->running)
return -EBUSY;
if (! tmr->initialized) {
- snd_seq_timer_reset(tmr);
+ seq_timer_reset(tmr);
if (initialize_timer(tmr) < 0)
return -EINVAL;
}
@@ -390,11 +424,24 @@ int snd_seq_timer_continue(struct snd_se
return 0;
}
+int snd_seq_timer_continue(struct snd_seq_timer *tmr)
+{
+ unsigned long flags;
+ int err;
+
+ spin_lock_irqsave(&tmr->lock, flags);
+ err = seq_timer_continue(tmr);
+ spin_unlock_irqrestore(&tmr->lock, flags);
+ return err;
+}
+
/* return current 'real' time. use timeofday() to get better granularity. */
snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
{
snd_seq_real_time_t cur_time;
+ unsigned long flags;
+ spin_lock_irqsave(&tmr->lock, flags);
cur_time = tmr->cur_time;
if (tmr->running) {
struct timeval tm;
@@ -410,7 +457,7 @@ snd_seq_real_time_t snd_seq_timer_get_cu
}
snd_seq_sanity_real_time(&cur_time);
}
-
+ spin_unlock_irqrestore(&tmr->lock, flags);
return cur_time;
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 000/117] 4.4.2-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 042/117] ALSA: pcm: Fix potential deadlock in OSS emulation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 077/117] iommu/io-pgtable-arm: Ensure we free the final level on teardown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 074/117] tty: Wait interruptibly for tty lock on reopen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 004/117] ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 046/117] ALSA: seq: Fix lockdep warnings due to double mutex locks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 069/117] usb: cdc-acm: send zero packet for intel 7260 modem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 005/117] HID: usbhid: fix recursive deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 065/117] USB: cp210x: add ID for IAI USB to RS485 adaptor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 040/117] ALSA: hda/realtek - Support headset mode for ALC225 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 070/117] usb: phy: msm: fix error handling in probe. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 041/117] ALSA: hda/realtek - Support Dell headset mode for ALC225 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 007/117] block: fix bio splitting on max sectors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 056/117] ALSA: hda - Fix speaker output from VAIO AiO machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 009/117] ocfs2/dlm: ignore cleaning the migration mle that is inuse Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 072/117] usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 057/117] ALSA: hda - Fix bad dereference of jack object Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 044/117] ALSA: seq: Fix yet another races among ALSA timer accesses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:40 +0100 [PATCH 4.4 019/117] parisc: Protect huge page pte changes with spinlocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 016/117] tracing: Fix stacktrace skip depth in trace_buffer_unlock_commit_regs() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 002/117] NFSv4.1/pnfs: Fixup an lo->plh_block_lgets imbalance in layoutreturn Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 037/117] ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 031/117] ALSA: hda - disable dynamic clock gating on Broxton before reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 020/117] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 022/117] md/raid: only permit hot-add of compatible integrity profiles Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 023/117] hrtimer: Handle remaining time proper for TIME_LOW_RES Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 030/117] ALSA: Add missing dependency on CONFIG_SND_TIMER Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 038/117] ALSA: rawmidi: Fix race at copying & updating the position Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 021/117] [media] media: i2c: Dont export ir-kbd-i2c module alias Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 017/117] tracing/stacktrace: Show entire trace if passed in function not found Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 033/117] ALSA: dummy: Disable switching timer backend via sysfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 034/117] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 035/117] ALSA: seq: Degrade the error message for too many opens Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 006/117] base/platform: Fix platform drivers with no probe callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 018/117] printk: do cond_resched() between lines while outputting to consoles Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 036/117] ALSA: rawmidi: Make snd_rawmidi_transmit() race-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 028/117] ALSA: usb-audio: avoid freeing umidi object twice Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 026/117] ALSA: usb-audio: Fix OPPO HA-1 vendor ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 003/117] block: split bios to max possible length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 039/117] ALSA: hda/realtek - New codec support of ALC225 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 027/117] ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 015/117] PCI: Fix minimum allocation address overwrite Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 010/117] ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 032/117] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 025/117] ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 [PATCH 4.4 013/117] mtd: nand: assign reasonable default name for NAND drivers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-15 01:50 +0100 Re: [PATCH 4.4 000/117] 4.4.2-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-15 17:00 +0100 Re: [PATCH 4.4 000/117] 4.4.2-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-15 18:10 +0100
csiph-web