Home Home > GIT Browse > SLE15
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-07-19 14:16:05 +0200
committerTakashi Iwai <tiwai@suse.de>2019-07-19 14:16:13 +0200
commitee65de2f844b423cf3818fcb6b6235f78d873309 (patch)
tree2fa5541ace7421e71bcb4e22ca93d84e9f3ac907
parent3b55281294cb520fd518558c8dd7783316ff0c0e (diff)
ALSA: seq: Break too long mutex context in the write loop
(bsc#1051510).
-rw-r--r--patches.drivers/ALSA-seq-Break-too-long-mutex-context-in-the-write-l.patch76
-rw-r--r--series.conf1
2 files changed, 77 insertions, 0 deletions
diff --git a/patches.drivers/ALSA-seq-Break-too-long-mutex-context-in-the-write-l.patch b/patches.drivers/ALSA-seq-Break-too-long-mutex-context-in-the-write-l.patch
new file mode 100644
index 0000000000..123538a072
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Break-too-long-mutex-context-in-the-write-l.patch
@@ -0,0 +1,76 @@
+From ede34f397ddb063b145b9e7d79c6026f819ded13 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Jul 2019 22:50:27 +0200
+Subject: [PATCH] ALSA: seq: Break too long mutex context in the write loop
+Git-commit: ede34f397ddb063b145b9e7d79c6026f819ded13
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+The fix for the racy writes and ioctls to sequencer widened the
+application of client->ioctl_mutex to the whole write loop. Although
+it does unlock/relock for the lengthy operation like the event dup,
+the loop keeps the ioctl_mutex for the whole time in other
+situations. This may take quite long time if the user-space would
+give a huge buffer, and this is a likely cause of some weird behavior
+spotted by syzcaller fuzzer.
+
+This patch puts a simple workaround, just adding a mutex break in the
+loop when a large number of events have been processed. This
+shouldn't hit any performance drop because the threshold is set high
+enough for usual operations.
+
+Fixes: 7bd800915677 ("ALSA: seq: More protection for concurrent write and ioctl races")
+Reported-by: syzbot+97aae04ce27e39cbfca9@syzkaller.appspotmail.com
+Reported-by: syzbot+4c595632b98bb8ffcc66@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index a60e7a17f0b8..7737b2670064 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1021,7 +1021,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ {
+ struct snd_seq_client *client = file->private_data;
+ int written = 0, len;
+- int err;
++ int err, handled;
+ struct snd_seq_event event;
+
+ if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
+@@ -1034,6 +1034,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ if (!client->accept_output || client->pool == NULL)
+ return -ENXIO;
+
++ repeat:
++ handled = 0;
+ /* allocate the pool now if the pool is not allocated yet */
+ mutex_lock(&client->ioctl_mutex);
+ if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
+@@ -1093,12 +1095,19 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
+ 0, 0, &client->ioctl_mutex);
+ if (err < 0)
+ break;
++ handled++;
+
+ __skip_event:
+ /* Update pointers and counts */
+ count -= len;
+ buf += len;
+ written += len;
++
++ /* let's have a coffee break if too many events are queued */
++ if (++handled >= 200) {
++ mutex_unlock(&client->ioctl_mutex);
++ goto repeat;
++ }
+ }
+
+ out:
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index 9a2f310d77..b928d7309e 100644
--- a/series.conf
+++ b/series.conf
@@ -22946,6 +22946,7 @@
patches.drivers/PCI-Always-allow-probing-with-driver_override.patch
patches.drivers/ALSA-hda-realtek-Fixed-Headphone-Mic-can-t-record-on.patch
patches.drivers/ALSA-hda-realtek-apply-ALC891-headset-fixup-to-one-D.patch
+ patches.drivers/ALSA-seq-Break-too-long-mutex-context-in-the-write-l.patch
# powerpc/linux next
patches.arch/powerpc-pseries-dlpar-Fix-a-missing-check-in-dlpar_p.patch