projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| 64e30f16 GKH |
1 | From 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e Mon Sep 17 00:00:00 2001 |
| 2 | From: Takashi Iwai <tiwai@suse.de> | |
| 3 | Date: Fri, 12 Apr 2019 11:37:19 +0200 | |
| 4 | Subject: ALSA: seq: Cover unsubscribe_port() in list_mutex | |
| 5 | ||
| 6 | From: Takashi Iwai <tiwai@suse.de> | |
| 7 | ||
| 8 | commit 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e upstream. | |
| 9 | ||
| 10 | The call of unsubscribe_port() which manages the group count and | |
| 11 | module refcount from delete_and_unsubscribe_port() looks racy; it's | |
| 12 | not covered by the group list lock, and it's likely a cause of the | |
| 13 | reported unbalance at port deletion. Let's move the call inside the | |
| 14 | group list_mutex to plug the hole. | |
| 15 | ||
| 16 | Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com | |
| 17 | Signed-off-by: Takashi Iwai <tiwai@suse.de> | |
| 18 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| 19 | ||
| 20 | --- | |
| 21 | sound/core/seq/seq_ports.c | 2 +- | |
| 22 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
| 23 | ||
| 24 | --- a/sound/core/seq/seq_ports.c | |
| 25 | +++ b/sound/core/seq/seq_ports.c | |
| 26 | @@ -550,10 +550,10 @@ static void delete_and_unsubscribe_port( | |
| 27 | list_del_init(list); | |
| 28 | grp->exclusive = 0; | |
| 29 | write_unlock_irq(&grp->list_lock); | |
| 30 | - up_write(&grp->list_mutex); | |
| 31 | ||
| 32 | if (!empty) | |
| 33 | unsubscribe_port(client, port, grp, &subs->info, ack); | |
| 34 | + up_write(&grp->list_mutex); | |
| 35 | } | |
| 36 | ||
| 37 | /* connect two ports */ |