mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-02 07:04:24 +00:00
Code Issues Releases Wiki Activity

ALSA: fireface: fix locking bug in ff400_copy_msg_to_user()

Browse source 
The ff400_copy_msg_to_user() function drops the spin lock to call
copy_to_user().  However, if the copy_to_user() fails, then it must
take the lock again before returning.  Failure to take the lock leads
to a double unlock in the caller, hwdep_read().

Fixes: acdebd8b4c ("ALSA: fireface: implement message parser for Fireface 400")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/Y8at+W/7OGvEBY8O@kili
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Dan Carpenter 2023-01-17 17:17:29 +03:00 committed by Takashi Iwai
parent 3ee0fe7fa3
commit 81c254a65c
1 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
sound/firewire/fireface/ff-protocol-former.c
View file

@ -680,28 +680,30 @@ static long ff400_copy_msg_to_user(struct snd_ff *ff, char __user *buf, long cou
struct ff400_msg_parser *parser = ff->msg_parser;
u32 type = SNDRV_FIREWIRE_EVENT_FF400_MESSAGE;
long consumed = 0;
int ret = 0;
if (count < 8)
return 0;
spin_unlock_irq(&ff->lock);
if (copy_to_user(buf, &type, sizeof(type)))
return -EFAULT;
ret = -EFAULT;
spin_lock_irq(&ff->lock);
if (ret)
return ret;
count -= sizeof(type);
consumed += sizeof(type);
while (count >= sizeof(*parser->msgs) && parser->pull_pos != parser->push_pos) {
spin_unlock_irq(&ff->lock);
if (copy_to_user(buf + consumed, parser->msgs + parser->pull_pos,
sizeof(*parser->msgs)))
return -EFAULT;
ret = -EFAULT;
spin_lock_irq(&ff->lock);
if (ret)
return ret;
++parser->pull_pos;
if (parser->pull_pos >= FF400_QUEUE_SIZE)
parser->pull_pos = 0;