Skip to content

Commit d11662f

Browse files
committed
ALSA: timer: Fix race between read and ioctl
The read from ALSA timer device, the function snd_timer_user_tread(), may access to an uninitialized struct snd_timer_user fields when the read is concurrently performed while the ioctl like snd_timer_user_tselect() is invoked. We have already fixed the races among ioctls via a mutex, but we seem to have forgotten the race between read vs ioctl. This patch simply applies (more exactly extends the already applied range of) tu->ioctl_lock in snd_timer_user_tread() for closing the race window. Reported-by: Alexander Potapenko <glider@google.com> Tested-by: Alexander Potapenko <glider@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent dd8038e commit d11662f

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

Diff for: sound/core/timer.c

+4-2
Original file line numberDiff line numberDiff line change
@@ -1959,6 +1959,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
19591959

19601960
tu = file->private_data;
19611961
unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read);
1962+
mutex_lock(&tu->ioctl_lock);
19621963
spin_lock_irq(&tu->qlock);
19631964
while ((long)count - result >= unit) {
19641965
while (!tu->qused) {
@@ -1974,7 +1975,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
19741975
add_wait_queue(&tu->qchange_sleep, &wait);
19751976

19761977
spin_unlock_irq(&tu->qlock);
1978+
mutex_unlock(&tu->ioctl_lock);
19771979
schedule();
1980+
mutex_lock(&tu->ioctl_lock);
19781981
spin_lock_irq(&tu->qlock);
19791982

19801983
remove_wait_queue(&tu->qchange_sleep, &wait);
@@ -1994,7 +1997,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
19941997
tu->qused--;
19951998
spin_unlock_irq(&tu->qlock);
19961999

1997-
mutex_lock(&tu->ioctl_lock);
19982000
if (tu->tread) {
19992001
if (copy_to_user(buffer, &tu->tqueue[qhead],
20002002
sizeof(struct snd_timer_tread)))
@@ -2004,7 +2006,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
20042006
sizeof(struct snd_timer_read)))
20052007
err = -EFAULT;
20062008
}
2007-
mutex_unlock(&tu->ioctl_lock);
20082009

20092010
spin_lock_irq(&tu->qlock);
20102011
if (err < 0)
@@ -2014,6 +2015,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
20142015
}
20152016
_error:
20162017
spin_unlock_irq(&tu->qlock);
2018+
mutex_unlock(&tu->ioctl_lock);
20172019
return result > 0 ? result : err;
20182020
}
20192021

0 commit comments

Comments
 (0)