mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 05:44:11 +00:00
ALSA: info: Fix racy addition/deletion of nodes
commit 8c2f870890
upstream.
The ALSA proc helper manages the child nodes in a linked list, but its
addition and deletion is done without any lock. This leads to a
corruption if they are operated concurrently. Usually this isn't a
problem because the proc entries are added sequentially in the driver
probe procedure itself. But the card registrations are done often
asynchronously, and the crash could be actually reproduced with
syzkaller.
This patch papers over it by protecting the link addition and deletion
with the parent's mutex. There is "access" mutex that is used for the
file access, and this can be reused for this purpose as well.
Reported-by: syzbot+48df349490c36f9f54ab@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
1343fd8f96
commit
8a6f2ea0c3
1 changed files with 10 additions and 2 deletions
|
@ -722,8 +722,11 @@ snd_info_create_entry(const char *name, struct snd_info_entry *parent)
|
|||
INIT_LIST_HEAD(&entry->children);
|
||||
INIT_LIST_HEAD(&entry->list);
|
||||
entry->parent = parent;
|
||||
if (parent)
|
||||
if (parent) {
|
||||
mutex_lock(&parent->access);
|
||||
list_add_tail(&entry->list, &parent->children);
|
||||
mutex_unlock(&parent->access);
|
||||
}
|
||||
return entry;
|
||||
}
|
||||
|
||||
|
@ -805,7 +808,12 @@ void snd_info_free_entry(struct snd_info_entry * entry)
|
|||
list_for_each_entry_safe(p, n, &entry->children, list)
|
||||
snd_info_free_entry(p);
|
||||
|
||||
list_del(&entry->list);
|
||||
p = entry->parent;
|
||||
if (p) {
|
||||
mutex_lock(&p->access);
|
||||
list_del(&entry->list);
|
||||
mutex_unlock(&p->access);
|
||||
}
|
||||
kfree(entry->name);
|
||||
if (entry->private_free)
|
||||
entry->private_free(entry);
|
||||
|
|
Loading…
Reference in a new issue