Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1319508
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.14 17/59] ALSA: timer: Fix race among timer ioctls |
| Date | 2016-01-27 20:40 +0100 |
| Message-ID | <qVE6D-8tR-45@gated-at.bofh.it> (permalink) |
| References | <qVDNg-8kN-11@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit af368027a49a751d6ff4ee9e3f9961f35bb4fede upstream.
ALSA timer ioctls have an open race and this may lead to a
use-after-free of timer instance object. A simplistic fix is to make
each ioctl exclusive. We have already tread_sem for controlling the
tread, and extend this as a global mutex to be applied to each ioctl.
The downside is, of course, the worse concurrency. But these ioctls
aren't to be parallel accessible, in anyway, so it should be fine to
serialize there.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/timer.c | 32 +++++++++++++++++++-------------
1 file changed, 19 insertions(+), 13 deletions(-)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -73,7 +73,7 @@ struct snd_timer_user {
struct timespec tstamp; /* trigger tstamp */
wait_queue_head_t qchange_sleep;
struct fasync_struct *fasync;
- struct mutex tread_sem;
+ struct mutex ioctl_lock;
};
/* list of timers */
@@ -1266,7 +1266,7 @@ static int snd_timer_user_open(struct in
return -ENOMEM;
spin_lock_init(&tu->qlock);
init_waitqueue_head(&tu->qchange_sleep);
- mutex_init(&tu->tread_sem);
+ mutex_init(&tu->ioctl_lock);
tu->ticks = 1;
tu->queue_size = 128;
tu->queue = kmalloc(tu->queue_size * sizeof(struct snd_timer_read),
@@ -1286,8 +1286,10 @@ static int snd_timer_user_release(struct
if (file->private_data) {
tu = file->private_data;
file->private_data = NULL;
+ mutex_lock(&tu->ioctl_lock);
if (tu->timeri)
snd_timer_close(tu->timeri);
+ mutex_unlock(&tu->ioctl_lock);
kfree(tu->queue);
kfree(tu->tqueue);
kfree(tu);
@@ -1525,7 +1527,6 @@ static int snd_timer_user_tselect(struct
int err = 0;
tu = file->private_data;
- mutex_lock(&tu->tread_sem);
if (tu->timeri) {
snd_timer_close(tu->timeri);
tu->timeri = NULL;
@@ -1569,7 +1570,6 @@ static int snd_timer_user_tselect(struct
}
__err:
- mutex_unlock(&tu->tread_sem);
return err;
}
@@ -1782,7 +1782,7 @@ enum {
SNDRV_TIMER_IOCTL_PAUSE_OLD = _IO('T', 0x23),
};
-static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
+static long __snd_timer_user_ioctl(struct file *file, unsigned int cmd,
unsigned long arg)
{
struct snd_timer_user *tu;
@@ -1799,17 +1799,11 @@ static long snd_timer_user_ioctl(struct
{
int xarg;
- mutex_lock(&tu->tread_sem);
- if (tu->timeri) { /* too late */
- mutex_unlock(&tu->tread_sem);
+ if (tu->timeri) /* too late */
return -EBUSY;
- }
- if (get_user(xarg, p)) {
- mutex_unlock(&tu->tread_sem);
+ if (get_user(xarg, p))
return -EFAULT;
- }
tu->tread = xarg ? 1 : 0;
- mutex_unlock(&tu->tread_sem);
return 0;
}
case SNDRV_TIMER_IOCTL_GINFO:
@@ -1842,6 +1836,18 @@ static long snd_timer_user_ioctl(struct
return -ENOTTY;
}
+static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
+ unsigned long arg)
+{
+ struct snd_timer_user *tu = file->private_data;
+ long ret;
+
+ mutex_lock(&tu->ioctl_lock);
+ ret = __snd_timer_user_ioctl(file, cmd, arg);
+ mutex_unlock(&tu->ioctl_lock);
+ return ret;
+}
+
static int snd_timer_user_fasync(int fd, struct file * file, int on)
{
struct snd_timer_user *tu;
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.14 00/59] 3.14.60-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 18/59] ALSA: timer: Fix double unlink of active_list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 42/59] ipv6: update skb->csum when CE mark is propagated Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 45/59] team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 05/59] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 08/59] ALSA: hda - Add Intel Lewisburg device IDs Audio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 22/59] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 02/59] xen/gntdev: Grant maps should not be subject to NUMA balancing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 03/59] x86/xen: dont reset vcpu_info on a cancelled suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 27/59] usb: xhci: fix config fail of FS hub behind a HS hub with MTT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 26/59] ASoC: compress: Fix compress device direction check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 24/59] ASoC: wm8974: set cache type for regmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 40/59] bonding: Prevent IPv6 link local address on enslaved devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 21/59] ALSA: hrtimer: Fix stall by hrtimer_cancel() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 07/59] ipmi: move timer init to before irq is setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 41/59] phonet: properly unshare skbs in phonet_rcv() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 04/59] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 20/59] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 28/59] USB: ipaq.c: fix a timeout loop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 30/59] xhci: refuse loading if nousb is used Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
Re: [PATCH 3.14 30/59] xhci: refuse loading if nousb is used Luis Henriques <luis.henriques@canonical.com> - 2016-01-28 19:00 +0100
Re: [PATCH 3.14 30/59] xhci: refuse loading if nousb is used Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-31 20:20 +0100
Re: [PATCH 3.14 30/59] xhci: refuse loading if nousb is used Luis Henriques <luis.henriques@canonical.com> - 2016-02-02 18:40 +0100
[PATCH 3.14 52/59] arm64: fix building without CONFIG_UID16 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 19/59] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 09/59] ALSA: hda - Apply pin fixup for HP ProBook 6550b Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 53/59] arm64: Clear out any singlestep state on a ptrace detach operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 49/59] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 43/59] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 39/59] tcp_yeah: dont set ssthresh below 2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 46/59] powerpc/tm: Block signal return setting invalid MSR state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 06/59] x86/boot: Double BOOT_HEAP_SIZE to 64KB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 51/59] arm64: KVM: Fix AArch32 to AArch64 register mapping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:30 +0100
[PATCH 3.14 11/59] ALSA: hda - Add inverted dmic for Packard Bell DOTS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 14/59] ALSA: seq: Fix missing NULL check at remove_events ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 23/59] ASoC: wm8962: correct addresses for HPF_C_0/1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 16/59] ALSA: timer: Harden slave timer list handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 17/59] ALSA: timer: Fix race among timer ioctls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 25/59] ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 10/59] ALSA: rme96: Fix unexpected volume reset after rate changes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 13/59] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 01/59] x86/signal: Fix restart_syscall number for x32 tasks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 12/59] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 15/59] ALSA: seq: Fix race at timer setup and close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 20:40 +0100
[PATCH 3.14 32/59] ipv6/addrlabel: fix ip6addrlbl_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
[PATCH 3.14 59/59] arm64: restore bogomips information in /proc/cpuinfo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
[PATCH 3.14 38/59] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:00 +0100
[PATCH 3.14 29/59] USB: cp210x: add ID for ELV Marble Sound Board 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
[PATCH 3.14 35/59] unix: properly account for FDs passed over unix sockets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
[PATCH 3.14 34/59] connector: bump skb->users before callback invocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
[PATCH 3.14 36/59] bridge: Only call /sbin/bridge-stp for the initial network namespace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
[PATCH 3.14 58/59] mn10300: Select CONFIG_HAVE_UID16 to fix build failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
[PATCH 3.14 37/59] net: possible use after free in dst_release Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
[PATCH 3.14 33/59] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-27 21:10 +0100
Re: [PATCH 3.14 00/59] 3.14.60-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-01-28 00:30 +0100
Re: [PATCH 3.14 00/59] 3.14.60-stable review Guenter Roeck <linux@roeck-us.net> - 2016-01-28 03:10 +0100
csiph-web