LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, DaeRyong Jeong <threeearcat@gmail.com>,
	Takashi Iwai <tiwai@suse.de>
Subject: [PATCH 4.9 09/32] ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
Date: Tue,  8 May 2018 10:10:49 +0200	[thread overview]
Message-ID: <20180508074010.330421454@linuxfoundation.org> (raw)
In-Reply-To: <20180508074008.800421598@linuxfoundation.org>

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 8f22e52528cc372b218b5f100457469615c733ce upstream.

The sequencer virmidi code has an open race at its output trigger
callback: namely, virmidi keeps only one event packet for processing
while it doesn't protect for concurrent output trigger calls.

snd_virmidi_output_trigger() tries to process the previously
unfinished event before starting encoding the given MIDI stream, but
this is done without any lock.  Meanwhile, if another rawmidi stream
starts the output trigger, this proceeds further, and overwrites the
event package that is being processed in another thread.  This
eventually corrupts and may lead to the invalid memory access if the
event type is like SYSEX.

The fix is just to move the spinlock to cover both the pending event
and the new stream.

The bug was spotted by a new fuzzer, RaceFuzzer.

BugLink: http://lkml.kernel.org/r/20180426045223.GA15307@dragonet.kaist.ac.kr
Reported-by: DaeRyong Jeong <threeearcat@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/seq/seq_virmidi.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -174,12 +174,12 @@ static void snd_virmidi_output_trigger(s
 			}
 			return;
 		}
+		spin_lock_irqsave(&substream->runtime->lock, flags);
 		if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
 			if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
-				return;
+				goto out;
 			vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
 		}
-		spin_lock_irqsave(&substream->runtime->lock, flags);
 		while (1) {
 			count = __snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
 			if (count <= 0)

  parent reply	other threads:[~2018-05-08  8:10 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-08  8:10 [PATCH 4.9 00/32] 4.9.99-stable review Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 01/32] perf/core: Fix the perf_cpu_time_max_percent check Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 02/32] percpu: include linux/sched.h for cond_resched() Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 03/32] bpf: map_get_next_key to return first key on NULL Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 04/32] arm/arm64: KVM: Add PSCI version selection API Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 05/32] crypto: talitos - fix IPsec cipher in length Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 06/32] serial: imx: ensure UCR3 and UFCR are setup correctly Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 07/32] USB: serial: option: Add support for Quectel EP06 Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 08/32] ALSA: pcm: Check PCM state at xfern compat ioctl Greg Kroah-Hartman
2018-05-08  8:10 ` Greg Kroah-Hartman [this message]
2018-05-08  8:10 ` [PATCH 4.9 10/32] ALSA: aloop: Mark paused device as inactive Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 11/32] ALSA: aloop: Add missing cable lock to ctl API callbacks Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 12/32] tracepoint: Do not warn on ENOMEM Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 13/32] Input: leds - fix out of bound access Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 14/32] Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 15/32] xfs: prevent creating negative-sized file via INSERT_RANGE Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 16/32] RDMA/cxgb4: release hw resources on device removal Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 17/32] RDMA/ucma: Allow resolving address w/o specifying source address Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 18/32] RDMA/mlx5: Protect from shift operand overflow Greg Kroah-Hartman
2018-05-08  8:10 ` [PATCH 4.9 19/32] NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2 Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 20/32] IB/mlx5: Use unlimited rate when static rate is not supported Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 21/32] IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 22/32] drm/vmwgfx: Fix a buffer object leak Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 23/32] drm/bridge: vga-dac: Fix edid memory leak Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 24/32] test_firmware: fix setting old custom fw path back on exit, second try Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 25/32] USB: serial: visor: handle potential invalid device configuration Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 26/32] USB: Accept bulk endpoints with 1024-byte maxpacket Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 27/32] USB: serial: option: reimplement interface masking Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 28/32] USB: serial: option: adding support for ublox R410M Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 29/32] usb: musb: host: fix potential NULL pointer dereference Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 30/32] usb: musb: trace: fix NULL pointer dereference in musb_g_tx() Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 31/32] platform/x86: asus-wireless: Fix NULL pointer dereference Greg Kroah-Hartman
2018-05-08  8:11 ` [PATCH 4.9 32/32] s390/facilites: use stfle_fac_list array size for MAX_FACILITY_BIT Greg Kroah-Hartman
2018-05-08 14:25 ` [PATCH 4.9 00/32] 4.9.99-stable review kernelci.org bot
2018-05-08 16:21 ` Guenter Roeck
2018-05-08 18:13 ` Naresh Kamboju
2018-05-08 23:56 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180508074010.330421454@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=threeearcat@gmail.com \
    --cc=tiwai@suse.de \
    --subject='Re: [PATCH 4.9 09/32] ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).