diff options
author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2019-09-15 15:42:27 -0400 |
---|---|---|
committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2019-09-15 15:42:27 -0400 |
commit | ffdb5b175e0384f5becc6731a5d7ac09d738c049 (patch) | |
tree | e7d153c1c79434531e22a4ce18bdc2d3dfdc9682 | |
parent | 4af68d280d85ada9691fee90da9c4400d384addf (diff) | |
download | longterm-queue-4.18-ffdb5b175e0384f5becc6731a5d7ac09d738c049.tar.gz |
alsa: drop pointless addition and revert
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r-- | queue/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch | 49 | ||||
-rw-r--r-- | queue/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch | 46 | ||||
-rw-r--r-- | queue/series | 2 |
3 files changed, 0 insertions, 97 deletions
diff --git a/queue/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch b/queue/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch deleted file mode 100644 index 1701288..0000000 --- a/queue/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch +++ /dev/null @@ -1,49 +0,0 @@ -From feb689025fbb6f0aa6297d3ddf97de945ea4ad32 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Tue, 9 Apr 2019 17:35:22 +0200 -Subject: [PATCH] ALSA: seq: Protect in-kernel ioctl calls with mutex - -commit feb689025fbb6f0aa6297d3ddf97de945ea4ad32 upstream. - -ALSA OSS sequencer calls the ioctl function indirectly via -snd_seq_kernel_client_ctl(). While we already applied the protection -against races between the normal ioctls and writes via the client's -ioctl_mutex, this code path was left untouched. And this seems to be -the cause of still remaining some rare UAF as spontaneously triggered -by syzkaller. - -For the sake of robustness, wrap the ioctl_mutex also for the call via -snd_seq_kernel_client_ctl(), too. - -Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com -Signed-off-by: Takashi Iwai <tiwai@suse.de> - -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 933bde3843d9..976404691261 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -2340,14 +2340,19 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg) - { - const struct ioctl_handler *handler; - struct snd_seq_client *client; -+ int err; - - client = clientptr(clientid); - if (client == NULL) - return -ENXIO; - - for (handler = ioctl_handlers; handler->cmd > 0; ++handler) { -- if (handler->cmd == cmd) -- return handler->func(client, arg); -+ if (handler->cmd == cmd) { -+ mutex_lock(&client->ioctl_mutex); -+ err = handler->func(client, arg); -+ mutex_unlock(&client->ioctl_mutex); -+ return err; -+ } - } - - pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n", --- -2.7.4 - diff --git a/queue/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch b/queue/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch deleted file mode 100644 index f14b7c8..0000000 --- a/queue/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch +++ /dev/null @@ -1,46 +0,0 @@ -From f0654ba94e33699b295ce4f3dc73094db6209035 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai <tiwai@suse.de> -Date: Thu, 11 Apr 2019 19:58:32 +0200 -Subject: [PATCH] Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex" - -commit f0654ba94e33699b295ce4f3dc73094db6209035 upstream. - -This reverts commit feb689025fbb6f0aa6297d3ddf97de945ea4ad32. - -The fix attempt was incorrect, leading to the mutex deadlock through -the close of OSS sequencer client. The proper fix needs more -consideration, so let's revert it now. - -Fixes: feb689025fbb ("ALSA: seq: Protect in-kernel ioctl calls with mutex") -Reported-by: syzbot+47ded6c0f23016cde310@syzkaller.appspotmail.com -Signed-off-by: Takashi Iwai <tiwai@suse.de> - -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index f256704dc401..de320b1b90de 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -2334,19 +2334,14 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg) - { - const struct ioctl_handler *handler; - struct snd_seq_client *client; -- int err; - - client = clientptr(clientid); - if (client == NULL) - return -ENXIO; - - for (handler = ioctl_handlers; handler->cmd > 0; ++handler) { -- if (handler->cmd == cmd) { -- mutex_lock(&client->ioctl_mutex); -- err = handler->func(client, arg); -- mutex_unlock(&client->ioctl_mutex); -- return err; -- } -+ if (handler->cmd == cmd) -+ return handler->func(client, arg); - } - - pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n", --- -2.7.4 - diff --git a/queue/series b/queue/series index 8b938f8..f54ff68 100644 --- a/queue/series +++ b/queue/series @@ -130,9 +130,7 @@ ASoC-cs42xx8-Add-regcache-mask-dirty.patch ASoC-fsl_asrc-Fix-the-issue-about-unsupported-rate.patch drm-i915-sdvo-Implement-proper-HDMI-audio-support-fo.patch x86-uaccess-kcov-Disable-stack-protector.patch -ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch -Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch s390-kasan-fix-strncpy_from_user-kasan-checks.patch Drivers-misc-fix-out-of-bounds-access-in-function-pa.patch f2fs-fix-to-avoid-accessing-xattr-across-the-boundar.patch |