korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-04 09:34:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

ALSA: seq: oss: Fix racy open/close of MIDI devices

Browse Source 
Although snd_seq_oss_midi_open() and snd_seq_oss_midi_close() can be
called concurrently from different code paths, we have no proper data
protection against races.  Introduce open_mutex to each seq_oss_midi
object for avoiding the races.

Reported-by: "Gong, Sishuai" <sishuai@purdue.edu>
Closes: https://lore.kernel.org/r/7DC9AF71-F481-4ABA-955F-76C535661E33@purdue.edu
Link: https://lore.kernel.org/r/20230612125533.27461-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2023-06-12 14:55:33 +02:00
parent a2a8714831
commit 297224fc09
1 changed files with 22 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
sound/core/seq/oss/seq_oss_midi.c
View File

@ -37,6 +37,7 @@ struct seq_oss_midi {
struct snd_midi_event *coder; /* MIDI event coder */ struct snd_midi_event *coder; /* MIDI event coder */
struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */ struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */
snd_use_lock_t use_lock; snd_use_lock_t use_lock;
struct mutex open_mutex;
}; };
@ -172,6 +173,7 @@ snd_seq_oss_midi_check_new_port(struct snd_seq_port_info *pinfo)
mdev->flags = pinfo->capability; mdev->flags = pinfo->capability;
mdev->opened = 0; mdev->opened = 0;
snd_use_lock_init(&mdev->use_lock); snd_use_lock_init(&mdev->use_lock);
mutex_init(&mdev->open_mutex);
/* copy and truncate the name of synth device */ /* copy and truncate the name of synth device */
strscpy(mdev->name, pinfo->name, sizeof(mdev->name)); strscpy(mdev->name, pinfo->name, sizeof(mdev->name));
@ -322,15 +324,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
int perm; int perm;
struct seq_oss_midi *mdev; struct seq_oss_midi *mdev;
struct snd_seq_port_subscribe subs; struct snd_seq_port_subscribe subs;
int err;
mdev = get_mididev(dp, dev); mdev = get_mididev(dp, dev);
if (!mdev) if (!mdev)
return -ENODEV; return -ENODEV;
mutex_lock(&mdev->open_mutex);
/* already used? */ /* already used? */
if (mdev->opened && mdev->devinfo != dp) { if (mdev->opened && mdev->devinfo != dp) {
snd_use_lock_free(&mdev->use_lock); err = -EBUSY;
return -EBUSY; goto unlock;
} }
perm = 0; perm = 0;
@ -340,14 +344,14 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
perm |= PERM_READ; perm |= PERM_READ;
perm &= mdev->flags; perm &= mdev->flags;
if (perm == 0) { if (perm == 0) {
snd_use_lock_free(&mdev->use_lock); err = -ENXIO;
return -ENXIO; goto unlock;
} }
/* already opened? */ /* already opened? */
if ((mdev->opened & perm) == perm) { if ((mdev->opened & perm) == perm) {
snd_use_lock_free(&mdev->use_lock); err = 0;
return 0; goto unlock;
} }
perm &= ~mdev->opened; perm &= ~mdev->opened;
@ -372,13 +376,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
} }
if (! mdev->opened) { if (! mdev->opened) {
snd_use_lock_free(&mdev->use_lock); err = -ENXIO;
return -ENXIO; goto unlock;
} }
mdev->devinfo = dp; mdev->devinfo = dp;
err = 0;
unlock:
mutex_unlock(&mdev->open_mutex);
snd_use_lock_free(&mdev->use_lock); snd_use_lock_free(&mdev->use_lock);
return 0; return err;
} }
/* /*
@ -393,10 +401,9 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
mdev = get_mididev(dp, dev); mdev = get_mididev(dp, dev);
if (!mdev) if (!mdev)
return -ENODEV; return -ENODEV;
if (! mdev->opened || mdev->devinfo != dp) { mutex_lock(&mdev->open_mutex);
snd_use_lock_free(&mdev->use_lock); if (!mdev->opened || mdev->devinfo != dp)
return 0; goto unlock;
}
memset(&subs, 0, sizeof(subs)); memset(&subs, 0, sizeof(subs));
if (mdev->opened & PERM_WRITE) { if (mdev->opened & PERM_WRITE) {
@ -415,6 +422,8 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
mdev->opened = 0; mdev->opened = 0;
mdev->devinfo = NULL; mdev->devinfo = NULL;
unlock:
mutex_unlock(&mdev->open_mutex);
snd_use_lock_free(&mdev->use_lock); snd_use_lock_free(&mdev->use_lock);
return 0; return 0;
} }