TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ALSA: seq: oss: Fix racy open/close of MIDI devices

Browse Source 
[ Upstream commit 297224fc0922e7385573a30c29ffdabb67f27b7d ]

Although snd_seq_oss_midi_open() and snd_seq_oss_midi_close() can be
called concurrently from different code paths, we have no proper data
protection against races.  Introduce open_mutex to each seq_oss_midi
object for avoiding the races.

Reported-by: "Gong, Sishuai" <sishuai@purdue.edu>
Closes: https://lore.kernel.org/r/7DC9AF71-F481-4ABA-955F-76C535661E33@purdue.edu
Link: https://lore.kernel.org/r/20230612125533.27461-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Takashi Iwai
2023-06-12 14:55:33 +02:00
committed by Greg Kroah-Hartman
parent c28a38a03e
commit 97d3472b43
1 changed files with 22 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
sound/core/seq/oss/seq_oss_midi.c
View File

@@ -50,6 +50,7 @@ struct seq_oss_midi {
struct snd_midi_event *coder; /* MIDI event coder */ struct snd_midi_event *coder; /* MIDI event coder */
struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */ struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */
snd_use_lock_t use_lock; snd_use_lock_t use_lock;
struct mutex open_mutex;
}; };
@@ -184,6 +185,7 @@ snd_seq_oss_midi_check_new_port(struct snd_seq_port_info *pinfo)
mdev->flags = pinfo->capability; mdev->flags = pinfo->capability;
mdev->opened = 0; mdev->opened = 0;
snd_use_lock_init(&mdev->use_lock); snd_use_lock_init(&mdev->use_lock);
mutex_init(&mdev->open_mutex);
/* copy and truncate the name of synth device */ /* copy and truncate the name of synth device */
strlcpy(mdev->name, pinfo->name, sizeof(mdev->name)); strlcpy(mdev->name, pinfo->name, sizeof(mdev->name));
@@ -332,14 +334,16 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
int perm; int perm;
struct seq_oss_midi *mdev; struct seq_oss_midi *mdev;
struct snd_seq_port_subscribe subs; struct snd_seq_port_subscribe subs;
int err;
if ((mdev = get_mididev(dp, dev)) == NULL) if ((mdev = get_mididev(dp, dev)) == NULL)
return -ENODEV; return -ENODEV;
mutex_lock(&mdev->open_mutex);
/* already used? */ /* already used? */
if (mdev->opened && mdev->devinfo != dp) { if (mdev->opened && mdev->devinfo != dp) {
snd_use_lock_free(&mdev->use_lock); err = -EBUSY;
return -EBUSY; goto unlock;
} }
perm = 0; perm = 0;
@@ -349,14 +353,14 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
perm |= PERM_READ; perm |= PERM_READ;
perm &= mdev->flags; perm &= mdev->flags;
if (perm == 0) { if (perm == 0) {
snd_use_lock_free(&mdev->use_lock); err = -ENXIO;
return -ENXIO; goto unlock;
} }
/* already opened? */ /* already opened? */
if ((mdev->opened & perm) == perm) { if ((mdev->opened & perm) == perm) {
snd_use_lock_free(&mdev->use_lock); err = 0;
return 0; goto unlock;
} }
perm &= ~mdev->opened; perm &= ~mdev->opened;
@@ -381,13 +385,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
} }
if (! mdev->opened) { if (! mdev->opened) {
snd_use_lock_free(&mdev->use_lock); err = -ENXIO;
return -ENXIO; goto unlock;
} }
mdev->devinfo = dp; mdev->devinfo = dp;
err = 0;
unlock:
mutex_unlock(&mdev->open_mutex);
snd_use_lock_free(&mdev->use_lock); snd_use_lock_free(&mdev->use_lock);
return 0; return err;
} }
/* /*
@@ -401,10 +409,9 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
if ((mdev = get_mididev(dp, dev)) == NULL) if ((mdev = get_mididev(dp, dev)) == NULL)
return -ENODEV; return -ENODEV;
if (! mdev->opened || mdev->devinfo != dp) { mutex_lock(&mdev->open_mutex);
snd_use_lock_free(&mdev->use_lock); if (!mdev->opened || mdev->devinfo != dp)
return 0; goto unlock;
}
memset(&subs, 0, sizeof(subs)); memset(&subs, 0, sizeof(subs));
if (mdev->opened & PERM_WRITE) { if (mdev->opened & PERM_WRITE) {
@@ -423,6 +430,8 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
mdev->opened = 0; mdev->opened = 0;
mdev->devinfo = NULL; mdev->devinfo = NULL;
unlock:
mutex_unlock(&mdev->open_mutex);
snd_use_lock_free(&mdev->use_lock); snd_use_lock_free(&mdev->use_lock);
return 0; return 0;
} }