mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 07:38:10 +00:00
ALSA: seq: oss: Fix racy open/close of MIDI devices
[ Upstream commit 297224fc09
]
Although snd_seq_oss_midi_open() and snd_seq_oss_midi_close() can be
called concurrently from different code paths, we have no proper data
protection against races. Introduce open_mutex to each seq_oss_midi
object for avoiding the races.
Reported-by: "Gong, Sishuai" <sishuai@purdue.edu>
Closes: https://lore.kernel.org/r/7DC9AF71-F481-4ABA-955F-76C535661E33@purdue.edu
Link: https://lore.kernel.org/r/20230612125533.27461-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
c28a38a03e
commit
97d3472b43
1 changed files with 22 additions and 13 deletions
|
@ -50,6 +50,7 @@ struct seq_oss_midi {
|
||||||
struct snd_midi_event *coder; /* MIDI event coder */
|
struct snd_midi_event *coder; /* MIDI event coder */
|
||||||
struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */
|
struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */
|
||||||
snd_use_lock_t use_lock;
|
snd_use_lock_t use_lock;
|
||||||
|
struct mutex open_mutex;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
|
@ -184,6 +185,7 @@ snd_seq_oss_midi_check_new_port(struct snd_seq_port_info *pinfo)
|
||||||
mdev->flags = pinfo->capability;
|
mdev->flags = pinfo->capability;
|
||||||
mdev->opened = 0;
|
mdev->opened = 0;
|
||||||
snd_use_lock_init(&mdev->use_lock);
|
snd_use_lock_init(&mdev->use_lock);
|
||||||
|
mutex_init(&mdev->open_mutex);
|
||||||
|
|
||||||
/* copy and truncate the name of synth device */
|
/* copy and truncate the name of synth device */
|
||||||
strlcpy(mdev->name, pinfo->name, sizeof(mdev->name));
|
strlcpy(mdev->name, pinfo->name, sizeof(mdev->name));
|
||||||
|
@ -332,14 +334,16 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
|
||||||
int perm;
|
int perm;
|
||||||
struct seq_oss_midi *mdev;
|
struct seq_oss_midi *mdev;
|
||||||
struct snd_seq_port_subscribe subs;
|
struct snd_seq_port_subscribe subs;
|
||||||
|
int err;
|
||||||
|
|
||||||
if ((mdev = get_mididev(dp, dev)) == NULL)
|
if ((mdev = get_mididev(dp, dev)) == NULL)
|
||||||
return -ENODEV;
|
return -ENODEV;
|
||||||
|
|
||||||
|
mutex_lock(&mdev->open_mutex);
|
||||||
/* already used? */
|
/* already used? */
|
||||||
if (mdev->opened && mdev->devinfo != dp) {
|
if (mdev->opened && mdev->devinfo != dp) {
|
||||||
snd_use_lock_free(&mdev->use_lock);
|
err = -EBUSY;
|
||||||
return -EBUSY;
|
goto unlock;
|
||||||
}
|
}
|
||||||
|
|
||||||
perm = 0;
|
perm = 0;
|
||||||
|
@ -349,14 +353,14 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
|
||||||
perm |= PERM_READ;
|
perm |= PERM_READ;
|
||||||
perm &= mdev->flags;
|
perm &= mdev->flags;
|
||||||
if (perm == 0) {
|
if (perm == 0) {
|
||||||
snd_use_lock_free(&mdev->use_lock);
|
err = -ENXIO;
|
||||||
return -ENXIO;
|
goto unlock;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* already opened? */
|
/* already opened? */
|
||||||
if ((mdev->opened & perm) == perm) {
|
if ((mdev->opened & perm) == perm) {
|
||||||
snd_use_lock_free(&mdev->use_lock);
|
err = 0;
|
||||||
return 0;
|
goto unlock;
|
||||||
}
|
}
|
||||||
|
|
||||||
perm &= ~mdev->opened;
|
perm &= ~mdev->opened;
|
||||||
|
@ -381,13 +385,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
|
||||||
}
|
}
|
||||||
|
|
||||||
if (! mdev->opened) {
|
if (! mdev->opened) {
|
||||||
snd_use_lock_free(&mdev->use_lock);
|
err = -ENXIO;
|
||||||
return -ENXIO;
|
goto unlock;
|
||||||
}
|
}
|
||||||
|
|
||||||
mdev->devinfo = dp;
|
mdev->devinfo = dp;
|
||||||
|
err = 0;
|
||||||
|
|
||||||
|
unlock:
|
||||||
|
mutex_unlock(&mdev->open_mutex);
|
||||||
snd_use_lock_free(&mdev->use_lock);
|
snd_use_lock_free(&mdev->use_lock);
|
||||||
return 0;
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -401,10 +409,9 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
|
||||||
|
|
||||||
if ((mdev = get_mididev(dp, dev)) == NULL)
|
if ((mdev = get_mididev(dp, dev)) == NULL)
|
||||||
return -ENODEV;
|
return -ENODEV;
|
||||||
if (! mdev->opened || mdev->devinfo != dp) {
|
mutex_lock(&mdev->open_mutex);
|
||||||
snd_use_lock_free(&mdev->use_lock);
|
if (!mdev->opened || mdev->devinfo != dp)
|
||||||
return 0;
|
goto unlock;
|
||||||
}
|
|
||||||
|
|
||||||
memset(&subs, 0, sizeof(subs));
|
memset(&subs, 0, sizeof(subs));
|
||||||
if (mdev->opened & PERM_WRITE) {
|
if (mdev->opened & PERM_WRITE) {
|
||||||
|
@ -423,6 +430,8 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
|
||||||
mdev->opened = 0;
|
mdev->opened = 0;
|
||||||
mdev->devinfo = NULL;
|
mdev->devinfo = NULL;
|
||||||
|
|
||||||
|
unlock:
|
||||||
|
mutex_unlock(&mdev->open_mutex);
|
||||||
snd_use_lock_free(&mdev->use_lock);
|
snd_use_lock_free(&mdev->use_lock);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue