lkml.org 
[lkml]   [2019]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 42/44] ALSA: info: Fix racy addition/deletion of nodes
    Date
    From: Takashi Iwai <tiwai@suse.de>

    commit 8c2f870890fd28e023b0fcf49dcee333f2c8bad7 upstream.

    The ALSA proc helper manages the child nodes in a linked list, but its
    addition and deletion is done without any lock. This leads to a
    corruption if they are operated concurrently. Usually this isn't a
    problem because the proc entries are added sequentially in the driver
    probe procedure itself. But the card registrations are done often
    asynchronously, and the crash could be actually reproduced with
    syzkaller.

    This patch papers over it by protecting the link addition and deletion
    with the parent's mutex. There is "access" mutex that is used for the
    file access, and this can be reused for this purpose as well.

    Reported-by: syzbot+48df349490c36f9f54ab@syzkaller.appspotmail.com
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/core/info.c | 12 ++++++++++--
    1 file changed, 10 insertions(+), 2 deletions(-)

    --- a/sound/core/info.c
    +++ b/sound/core/info.c
    @@ -724,8 +724,11 @@ snd_info_create_entry(const char *name,
    INIT_LIST_HEAD(&entry->children);
    INIT_LIST_HEAD(&entry->list);
    entry->parent = parent;
    - if (parent)
    + if (parent) {
    + mutex_lock(&parent->access);
    list_add_tail(&entry->list, &parent->children);
    + mutex_unlock(&parent->access);
    + }
    return entry;
    }

    @@ -809,7 +812,12 @@ void snd_info_free_entry(struct snd_info
    list_for_each_entry_safe(p, n, &entry->children, list)
    snd_info_free_entry(p);

    - list_del(&entry->list);
    + p = entry->parent;
    + if (p) {
    + mutex_lock(&p->access);
    + list_del(&entry->list);
    + mutex_unlock(&p->access);
    + }
    kfree(entry->name);
    if (entry->private_free)
    entry->private_free(entry);

    \
     
     \ /
      Last update: 2019-04-24 19:26    [W:4.053 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site