ALSA: seq: Cover unsubscribe_port() in list_mutex (7c32ae35) · Commits · 戴 / test

The call of unsubscribe_port() which manages the group count and module refcount from delete_and_unsubscribe_port() looks racy; it's not covered by the group list lock, and it's likely a cause of the reported unbalance at port deletion. Let's move the call inside the group list_mutex to plug the hole. Reported-by:

<syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com> Signed-off-by:

Takashi Iwai <tiwai@suse.de>

sound/core/seq/seq_ports.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -547,10 +547,10 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
	list_del_init(list);		list_del_init(list);
	grp->exclusive = 0;		grp->exclusive = 0;
	write_unlock_irq(&grp->list_lock);		write_unlock_irq(&grp->list_lock);
	up_write(&grp->list_mutex);

	if (!empty)		if (!empty)
	unsubscribe_port(client, port, grp, &subs->info, ack);		unsubscribe_port(client, port, grp, &subs->info, ack);
			up_write(&grp->list_mutex);
	}		}

	/* connect two ports */		/* connect two ports */

Admin message