]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ALSA: seq: Improve data consistency at polling
authorTakashi Iwai <tiwai@suse.de>
Fri, 7 Mar 2025 08:42:42 +0000 (09:42 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 4 Jun 2025 12:40:08 +0000 (14:40 +0200)
commite6ca4d234b05820e88fe9dc87b632d0757b8724c
tree8e069044d88e09f4d437e7166215cad61d6f0712
parentaba0c5046336c7c715943b2897b6e4c4d881f1fb
ALSA: seq: Improve data consistency at polling

[ Upstream commit e3cd33ab17c33bd8f1a9df66ec83a15dd8f7afbb ]

snd_seq_poll() calls snd_seq_write_pool_allocated() that reads out a
field in client->pool object, while it can be updated concurrently via
ioctls, as reported by syzbot.  The data race itself is harmless, as
it's merely a poll() call, and the state is volatile.  OTOH, the read
out of poll object info from the caller side is fragile, and we can
leave it better in snd_seq_pool_poll_wait() alone.

A similar pattern is seen in snd_seq_kernel_client_write_poll(), too,
which is called from the OSS sequencer.

This patch drops the pool checks from the caller side and add the
pool->lock in snd_seq_pool_poll_wait() for better data consistency.

Reported-by: syzbot+2d373c9936c00d7e120c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/67c88903.050a0220.15b4b9.0028.GAE@google.com
Link: https://patch.msgid.link/20250307084246.29271-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
sound/core/seq/seq_clientmgr.c
sound/core/seq/seq_memory.c