Commit ede34f39 authored by Takashi Iwai's avatar Takashi Iwai
Browse files

ALSA: seq: Break too long mutex context in the write loop 



The fix for the racy writes and ioctls to sequencer widened the
application of client->ioctl_mutex to the whole write loop.  Although
it does unlock/relock for the lengthy operation like the event dup,
the loop keeps the ioctl_mutex for the whole time in other
situations.  This may take quite long time if the user-space would
give a huge buffer, and this is a likely cause of some weird behavior
spotted by syzcaller fuzzer.

This patch puts a simple workaround, just adding a mutex break in the
loop when a large number of events have been processed.  This
shouldn't hit any performance drop because the threshold is set high
enough for usual operations.

Fixes: 7bd80091 ("ALSA: seq: More protection for concurrent write and ioctl races")
Reported-by: default avatar <syzbot+97aae04ce27e39cbfca9@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+4c595632b98bb8ffcc66@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 4b4e0e32

sound/core/seq/seq_clientmgr.c

+10 −1
Original line number Original line Diff line number Diff line
@@ -1021,7 +1021,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, 
{

{

	struct snd_seq_client *client = file->private_data;

	struct snd_seq_client *client = file->private_data;

	int written = 0, len;

	int written = 0, len;

	int err;

	int err, handled;

	struct snd_seq_event event;

	struct snd_seq_event event;





	if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))

	if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
@@ -1034,6 +1034,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, 
	if (!client->accept_output || client->pool == NULL)

	if (!client->accept_output || client->pool == NULL)

		return -ENXIO;

		return -ENXIO;





 repeat:

	handled = 0;

	/* allocate the pool now if the pool is not allocated yet */ 

	/* allocate the pool now if the pool is not allocated yet */ 

	mutex_lock(&client->ioctl_mutex);

	mutex_lock(&client->ioctl_mutex);

	if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {

	if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
@@ -1093,12 +1095,19 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, 
						   0, 0, &client->ioctl_mutex);

						   0, 0, &client->ioctl_mutex);

		if (err < 0)

		if (err < 0)

			break;

			break;

		handled++;





	__skip_event:

	__skip_event:

		/* Update pointers and counts */

		/* Update pointers and counts */

		count -= len;

		count -= len;

		buf += len;

		buf += len;

		written += len;

		written += len;



		/* let's have a coffee break if too many events are queued */

		if (++handled >= 200) {

			mutex_unlock(&client->ioctl_mutex);

			goto repeat;

		}

	}

	}





 out:

 out:

CRA Git | Maintained and supported by SUSTech CRA and CCSE