]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/commit
ALSA: seq: Fix copy_from_user() call inside lock
authorTakashi Iwai <tiwai@suse.de>
Mon, 9 Oct 2017 08:02:56 +0000 (10:02 +0200)
committerSeth Forshee <seth.forshee@canonical.com>
Thu, 19 Oct 2017 14:49:34 +0000 (09:49 -0500)
commita33af05bdd9a176319ee88f7e4f6e9977ef4678f
treee9647b397aab5b8a021ef559276dad66b3dd10a1
parentd5529c10f5e076a60e405abb821fc3dce1cf1e89
ALSA: seq: Fix copy_from_user() call inside lock

BugLink: http://bugs.launchpad.net/bugs/1724669
commit 5803b023881857db32ffefa0d269c90280a67ee0 upstream.

The event handler in the virmidi sequencer code takes a read-lock for
the linked list traverse, while it's calling snd_seq_dump_var_event()
in the loop.  The latter function may expand the user-space data
depending on the event type.  It eventually invokes copy_from_user(),
which might be a potential dead-lock.

The sequencer core guarantees that the user-space data is passed only
with atomic=0 argument, but snd_virmidi_dev_receive_event() ignores it
and always takes read-lock().  For avoiding the problem above, this
patch introduces rwsem for non-atomic case, while keeping rwlock for
atomic case.

Also while we're at it: the superfluous irq flags is dropped in
snd_virmidi_input_open().

Reported-by: Jia-Ju Bai <baijiaju1990@163.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
include/sound/seq_virmidi.h
sound/core/seq/seq_virmidi.c