Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-27 05:11:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

ALSA: info: Fix racy addition/deletion of nodes

Browse Source 
The ALSA proc helper manages the child nodes in a linked list, but its
addition and deletion is done without any lock.  This leads to a
corruption if they are operated concurrently.  Usually this isn't a
problem because the proc entries are added sequentially in the driver
probe procedure itself.  But the card registrations are done often
asynchronously, and the crash could be actually reproduced with
syzkaller.

This patch papers over it by protecting the link addition and deletion
with the parent's mutex.  There is "access" mutex that is used for the
file access, and this can be reused for this purpose as well.

Reported-by: syzbot+48df349490c36f9f54ab@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2019-04-16 15:25:00 +02:00
parent 183ab39eb0
commit 8c2f870890
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sound/core/info.c
View File

@ -713,8 +713,11 @@ snd_info_create_entry(const char *name, struct snd_info_entry *parent,
INIT_LIST_HEAD(&entry->list); INIT_LIST_HEAD(&entry->list);
entry->parent = parent; entry->parent = parent;
entry->module = module; entry->module = module;
if (parent) if (parent) {
mutex_lock(&parent->access);
list_add_tail(&entry->list, &parent->children); list_add_tail(&entry->list, &parent->children);
mutex_unlock(&parent->access);
}
return entry; return entry;
} }
@ -792,7 +795,12 @@ void snd_info_free_entry(struct snd_info_entry * entry)
list_for_each_entry_safe(p, n, &entry->children, list) list_for_each_entry_safe(p, n, &entry->children, list)
snd_info_free_entry(p); snd_info_free_entry(p);
list_del(&entry->list); p = entry->parent;
if (p) {
mutex_lock(&p->access);
list_del(&entry->list);
mutex_unlock(&p->access);
}
kfree(entry->name); kfree(entry->name);
if (entry->private_free) if (entry->private_free)
entry->private_free(entry); entry->private_free(entry);