summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPaul Gortmaker <paul.gortmaker@windriver.com>2019-09-15 15:42:27 -0400
committerPaul Gortmaker <paul.gortmaker@windriver.com>2019-09-15 15:42:27 -0400
commitffdb5b175e0384f5becc6731a5d7ac09d738c049 (patch)
treee7d153c1c79434531e22a4ce18bdc2d3dfdc9682
parent4af68d280d85ada9691fee90da9c4400d384addf (diff)
downloadlongterm-queue-4.18-ffdb5b175e0384f5becc6731a5d7ac09d738c049.tar.gz
alsa: drop pointless addition and revert
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r--queue/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch49
-rw-r--r--queue/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch46
-rw-r--r--queue/series2
3 files changed, 0 insertions, 97 deletions
diff --git a/queue/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch b/queue/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch
deleted file mode 100644
index 1701288..0000000
--- a/queue/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From feb689025fbb6f0aa6297d3ddf97de945ea4ad32 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Tue, 9 Apr 2019 17:35:22 +0200
-Subject: [PATCH] ALSA: seq: Protect in-kernel ioctl calls with mutex
-
-commit feb689025fbb6f0aa6297d3ddf97de945ea4ad32 upstream.
-
-ALSA OSS sequencer calls the ioctl function indirectly via
-snd_seq_kernel_client_ctl(). While we already applied the protection
-against races between the normal ioctls and writes via the client's
-ioctl_mutex, this code path was left untouched. And this seems to be
-the cause of still remaining some rare UAF as spontaneously triggered
-by syzkaller.
-
-For the sake of robustness, wrap the ioctl_mutex also for the call via
-snd_seq_kernel_client_ctl(), too.
-
-Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-
-diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
-index 933bde3843d9..976404691261 100644
---- a/sound/core/seq/seq_clientmgr.c
-+++ b/sound/core/seq/seq_clientmgr.c
-@@ -2340,14 +2340,19 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
- {
- const struct ioctl_handler *handler;
- struct snd_seq_client *client;
-+ int err;
-
- client = clientptr(clientid);
- if (client == NULL)
- return -ENXIO;
-
- for (handler = ioctl_handlers; handler->cmd > 0; ++handler) {
-- if (handler->cmd == cmd)
-- return handler->func(client, arg);
-+ if (handler->cmd == cmd) {
-+ mutex_lock(&client->ioctl_mutex);
-+ err = handler->func(client, arg);
-+ mutex_unlock(&client->ioctl_mutex);
-+ return err;
-+ }
- }
-
- pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n",
---
-2.7.4
-
diff --git a/queue/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch b/queue/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch
deleted file mode 100644
index f14b7c8..0000000
--- a/queue/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From f0654ba94e33699b295ce4f3dc73094db6209035 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Thu, 11 Apr 2019 19:58:32 +0200
-Subject: [PATCH] Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
-
-commit f0654ba94e33699b295ce4f3dc73094db6209035 upstream.
-
-This reverts commit feb689025fbb6f0aa6297d3ddf97de945ea4ad32.
-
-The fix attempt was incorrect, leading to the mutex deadlock through
-the close of OSS sequencer client. The proper fix needs more
-consideration, so let's revert it now.
-
-Fixes: feb689025fbb ("ALSA: seq: Protect in-kernel ioctl calls with mutex")
-Reported-by: syzbot+47ded6c0f23016cde310@syzkaller.appspotmail.com
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-
-diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
-index f256704dc401..de320b1b90de 100644
---- a/sound/core/seq/seq_clientmgr.c
-+++ b/sound/core/seq/seq_clientmgr.c
-@@ -2334,19 +2334,14 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
- {
- const struct ioctl_handler *handler;
- struct snd_seq_client *client;
-- int err;
-
- client = clientptr(clientid);
- if (client == NULL)
- return -ENXIO;
-
- for (handler = ioctl_handlers; handler->cmd > 0; ++handler) {
-- if (handler->cmd == cmd) {
-- mutex_lock(&client->ioctl_mutex);
-- err = handler->func(client, arg);
-- mutex_unlock(&client->ioctl_mutex);
-- return err;
-- }
-+ if (handler->cmd == cmd)
-+ return handler->func(client, arg);
- }
-
- pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n",
---
-2.7.4
-
diff --git a/queue/series b/queue/series
index 8b938f8..f54ff68 100644
--- a/queue/series
+++ b/queue/series
@@ -130,9 +130,7 @@ ASoC-cs42xx8-Add-regcache-mask-dirty.patch
ASoC-fsl_asrc-Fix-the-issue-about-unsupported-rate.patch
drm-i915-sdvo-Implement-proper-HDMI-audio-support-fo.patch
x86-uaccess-kcov-Disable-stack-protector.patch
-ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch
ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch
-Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch
s390-kasan-fix-strncpy_from_user-kasan-checks.patch
Drivers-misc-fix-out-of-bounds-access-in-function-pa.patch
f2fs-fix-to-avoid-accessing-xattr-across-the-boundar.patch