queue-4.4/alsa-seq-cover-unsubscribe_port-in-list_mutex.patch

   1 From 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e Mon Sep 17 00:00:00 2001
   2 From: Takashi Iwai <tiwai@suse.de>
   3 Date: Fri, 12 Apr 2019 11:37:19 +0200
   4 Subject: ALSA: seq: Cover unsubscribe_port() in list_mutex
   5
   6 From: Takashi Iwai <tiwai@suse.de>
   7
   8 commit 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e upstream.
   9
  10 The call of unsubscribe_port() which manages the group count and
  11 module refcount from delete_and_unsubscribe_port() looks racy; it's
  12 not covered by the group list lock, and it's likely a cause of the
  13 reported unbalance at port deletion.  Let's move the call inside the
  14 group list_mutex to plug the hole.
  15
  16 Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
  17 Signed-off-by: Takashi Iwai <tiwai@suse.de>
  18 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19
  20 ---
  21  sound/core/seq/seq_ports.c |    2 +-
  22  1 file changed, 1 insertion(+), 1 deletion(-)
  23
  24 --- a/sound/core/seq/seq_ports.c
  25 +++ b/sound/core/seq/seq_ports.c
  26 @@ -550,10 +550,10 @@ static void delete_and_unsubscribe_port(
  27                 list_del_init(list);
  28         grp->exclusive = 0;
  29         write_unlock_irq(&grp->list_lock);
  30 -       up_write(&grp->list_mutex);
  31
  32         if (!empty)
  33                 unsubscribe_port(client, port, grp, &subs->info, ack);
  34 +       up_write(&grp->list_mutex);
  35  }
  36
  37  /* connect two ports */