sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND)
commit bc26d4d06e
upstream.
A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND)
on /dev/sequencer with TMR_ECHO midi event.
In this case the control flow is:
sound_ioctl()
-> case SND_DEV_SEQ:
case SND_DEV_SEQ2:
sequencer_ioctl()
-> case SNDCTL_SEQ_OUTOFBAND:
spin_lock_irqsave(&lock,flags);
play_event();
-> case EV_TIMING:
seq_timing_event()
-> case TMR_ECHO:
seq_copy_to_input()
-> spin_lock_irqsave(&lock,flags);
It seems that spin_lock_irqsave() around play_event() is not necessary,
because the only other call location in seq_startplay() makes the call
without acquiring spinlock.
So, the patch just removes spinlocks around play_event().
By the way, it removes unreachable code in seq_timing_event(),
since (seq_mode == SEQ_2) case is handled in the beginning.
Compile tested only.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
8db826073e
commit
30b0fd903d
|
@ -683,13 +683,8 @@ static int seq_timing_event(unsigned char *event_rec)
|
|||
break;
|
||||
|
||||
case TMR_ECHO:
|
||||
if (seq_mode == SEQ_2)
|
||||
seq_copy_to_input(event_rec, 8);
|
||||
else
|
||||
{
|
||||
parm = (parm << 8 | SEQ_ECHO);
|
||||
seq_copy_to_input((unsigned char *) &parm, 4);
|
||||
}
|
||||
parm = (parm << 8 | SEQ_ECHO);
|
||||
seq_copy_to_input((unsigned char *) &parm, 4);
|
||||
break;
|
||||
|
||||
default:;
|
||||
|
@ -1330,7 +1325,6 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a
|
|||
int mode = translate_mode(file);
|
||||
struct synth_info inf;
|
||||
struct seq_event_rec event_rec;
|
||||
unsigned long flags;
|
||||
int __user *p = arg;
|
||||
|
||||
orig_dev = dev = dev >> 4;
|
||||
|
@ -1485,9 +1479,7 @@ int sequencer_ioctl(int dev, struct file *file, unsigned int cmd, void __user *a
|
|||
case SNDCTL_SEQ_OUTOFBAND:
|
||||
if (copy_from_user(&event_rec, arg, sizeof(event_rec)))
|
||||
return -EFAULT;
|
||||
spin_lock_irqsave(&lock,flags);
|
||||
play_event(event_rec.arr);
|
||||
spin_unlock_irqrestore(&lock,flags);
|
||||
return 0;
|
||||
|
||||
case SNDCTL_MIDI_INFO:
|
||||
|
|
Loading…
Reference in New Issue