Re: [PATCH] sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND)

2015-04-18 Thread Takashi Iwai 
At Sat, 18 Apr 2015 02:53:25 +0300,
Alexey Khoroshilov wrote:
> 
> A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND)
> on /dev/sequencer with TMR_ECHO midi event.
> 
> In this case the control flow is:
> sound_ioctl()
> -> case SND_DEV_SEQ:
>case SND_DEV_SEQ2:
>  sequencer_ioctl()
>  -> case SNDCTL_SEQ_OUTOFBAND:
>   spin_lock_irqsave(,flags);
>   play_event();
>   -> case EV_TIMING:
>seq_timing_event()
>-> case TMR_ECHO:
> seq_copy_to_input()
> -> spin_lock_irqsave(,flags);
> 
> It seems that spin_lock_irqsave() around play_event() is not necessary,
> because the only other call location in seq_startplay() makes the call
> without acquiring spinlock.
> 
> So, the patch just removes spinlocks around play_event().
> By the way, it removes unreachable code in seq_timing_event(),
> since (seq_mode == SEQ_2) case is handled in the beginning.
> 
> Compile tested only.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Alexey Khoroshilov 

Applied, thanks.


Takashi

> ---
>  sound/oss/sequencer.c | 12 ++--
>  1 file changed, 2 insertions(+), 10 deletions(-)
> 
> diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
> index c0eea1dfe90f..f19da4b47c1d 100644
> --- a/sound/oss/sequencer.c
> +++ b/sound/oss/sequencer.c
> @@ -681,13 +681,8 @@ static int seq_timing_event(unsigned char *event_rec)
>   break;
>  
>   case TMR_ECHO:
> - if (seq_mode == SEQ_2)
> - seq_copy_to_input(event_rec, 8);
> - else
> - {
> - parm = (parm << 8 | SEQ_ECHO);
> - seq_copy_to_input((unsigned char *) , 4);
> - }
> + parm = (parm << 8 | SEQ_ECHO);
> + seq_copy_to_input((unsigned char *) , 4);
>   break;
>  
>   default:;
> @@ -1324,7 +1319,6 @@ int sequencer_ioctl(int dev, struct file *file, 
> unsigned int cmd, void __user *a
>   int mode = translate_mode(file);
>   struct synth_info inf;
>   struct seq_event_rec event_rec;
> - unsigned long flags;
>   int __user *p = arg;
>  
>   orig_dev = dev = dev >> 4;
> @@ -1479,9 +1473,7 @@ int sequencer_ioctl(int dev, struct file *file, 
> unsigned int cmd, void __user *a
>   case SNDCTL_SEQ_OUTOFBAND:
>   if (copy_from_user(_rec, arg, sizeof(event_rec)))
>   return -EFAULT;
> - spin_lock_irqsave(,flags);
>   play_event(event_rec.arr);
> - spin_unlock_irqrestore(,flags);
>   return 0;
>  
>   case SNDCTL_MIDI_INFO:
> -- 
> 1.9.1
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND)

2015-04-18 Thread Takashi Iwai 
At Sat, 18 Apr 2015 02:53:25 +0300,
Alexey Khoroshilov wrote:
 
 A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND)
 on /dev/sequencer with TMR_ECHO midi event.
 
 In this case the control flow is:
 sound_ioctl()
 - case SND_DEV_SEQ:
case SND_DEV_SEQ2:
  sequencer_ioctl()
  - case SNDCTL_SEQ_OUTOFBAND:
   spin_lock_irqsave(lock,flags);
   play_event();
   - case EV_TIMING:
seq_timing_event()
- case TMR_ECHO:
 seq_copy_to_input()
 - spin_lock_irqsave(lock,flags);
 
 It seems that spin_lock_irqsave() around play_event() is not necessary,
 because the only other call location in seq_startplay() makes the call
 without acquiring spinlock.
 
 So, the patch just removes spinlocks around play_event().
 By the way, it removes unreachable code in seq_timing_event(),
 since (seq_mode == SEQ_2) case is handled in the beginning.
 
 Compile tested only.
 
 Found by Linux Driver Verification project (linuxtesting.org).
 
 Signed-off-by: Alexey Khoroshilov khoroshi...@ispras.ru

Applied, thanks.


Takashi

 ---
  sound/oss/sequencer.c | 12 ++--
  1 file changed, 2 insertions(+), 10 deletions(-)
 
 diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
 index c0eea1dfe90f..f19da4b47c1d 100644
 --- a/sound/oss/sequencer.c
 +++ b/sound/oss/sequencer.c
 @@ -681,13 +681,8 @@ static int seq_timing_event(unsigned char *event_rec)
   break;
  
   case TMR_ECHO:
 - if (seq_mode == SEQ_2)
 - seq_copy_to_input(event_rec, 8);
 - else
 - {
 - parm = (parm  8 | SEQ_ECHO);
 - seq_copy_to_input((unsigned char *) parm, 4);
 - }
 + parm = (parm  8 | SEQ_ECHO);
 + seq_copy_to_input((unsigned char *) parm, 4);
   break;
  
   default:;
 @@ -1324,7 +1319,6 @@ int sequencer_ioctl(int dev, struct file *file, 
 unsigned int cmd, void __user *a
   int mode = translate_mode(file);
   struct synth_info inf;
   struct seq_event_rec event_rec;
 - unsigned long flags;
   int __user *p = arg;
  
   orig_dev = dev = dev  4;
 @@ -1479,9 +1473,7 @@ int sequencer_ioctl(int dev, struct file *file, 
 unsigned int cmd, void __user *a
   case SNDCTL_SEQ_OUTOFBAND:
   if (copy_from_user(event_rec, arg, sizeof(event_rec)))
   return -EFAULT;
 - spin_lock_irqsave(lock,flags);
   play_event(event_rec.arr);
 - spin_unlock_irqrestore(lock,flags);
   return 0;
  
   case SNDCTL_MIDI_INFO:
 -- 
 1.9.1
 
--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND)

2015-04-17 Thread Alexey Khoroshilov 
A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND)
on /dev/sequencer with TMR_ECHO midi event.

In this case the control flow is:
sound_ioctl()
-> case SND_DEV_SEQ:
   case SND_DEV_SEQ2:
 sequencer_ioctl()
 -> case SNDCTL_SEQ_OUTOFBAND:
  spin_lock_irqsave(,flags);
  play_event();
  -> case EV_TIMING:
   seq_timing_event()
   -> case TMR_ECHO:
seq_copy_to_input()
-> spin_lock_irqsave(,flags);

It seems that spin_lock_irqsave() around play_event() is not necessary,
because the only other call location in seq_startplay() makes the call
without acquiring spinlock.

So, the patch just removes spinlocks around play_event().
By the way, it removes unreachable code in seq_timing_event(),
since (seq_mode == SEQ_2) case is handled in the beginning.

Compile tested only.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
---
 sound/oss/sequencer.c | 12 ++--
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
index c0eea1dfe90f..f19da4b47c1d 100644
--- a/sound/oss/sequencer.c
+++ b/sound/oss/sequencer.c
@@ -681,13 +681,8 @@ static int seq_timing_event(unsigned char *event_rec)
break;
 
case TMR_ECHO:
-   if (seq_mode == SEQ_2)
-   seq_copy_to_input(event_rec, 8);
-   else
-   {
-   parm = (parm << 8 | SEQ_ECHO);
-   seq_copy_to_input((unsigned char *) , 4);
-   }
+   parm = (parm << 8 | SEQ_ECHO);
+   seq_copy_to_input((unsigned char *) , 4);
break;
 
default:;
@@ -1324,7 +1319,6 @@ int sequencer_ioctl(int dev, struct file *file, unsigned 
int cmd, void __user *a
int mode = translate_mode(file);
struct synth_info inf;
struct seq_event_rec event_rec;
-   unsigned long flags;
int __user *p = arg;
 
orig_dev = dev = dev >> 4;
@@ -1479,9 +1473,7 @@ int sequencer_ioctl(int dev, struct file *file, unsigned 
int cmd, void __user *a
case SNDCTL_SEQ_OUTOFBAND:
if (copy_from_user(_rec, arg, sizeof(event_rec)))
return -EFAULT;
-   spin_lock_irqsave(,flags);
play_event(event_rec.arr);
-   spin_unlock_irqrestore(,flags);
return 0;
 
case SNDCTL_MIDI_INFO:
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH] sound/oss: fix deadlock in sequencer_ioctl(SNDCTL_SEQ_OUTOFBAND)

2015-04-17 Thread Alexey Khoroshilov 
A deadlock can be initiated by userspace via ioctl(SNDCTL_SEQ_OUTOFBAND)
on /dev/sequencer with TMR_ECHO midi event.

In this case the control flow is:
sound_ioctl()
- case SND_DEV_SEQ:
   case SND_DEV_SEQ2:
 sequencer_ioctl()
 - case SNDCTL_SEQ_OUTOFBAND:
  spin_lock_irqsave(lock,flags);
  play_event();
  - case EV_TIMING:
   seq_timing_event()
   - case TMR_ECHO:
seq_copy_to_input()
- spin_lock_irqsave(lock,flags);

It seems that spin_lock_irqsave() around play_event() is not necessary,
because the only other call location in seq_startplay() makes the call
without acquiring spinlock.

So, the patch just removes spinlocks around play_event().
By the way, it removes unreachable code in seq_timing_event(),
since (seq_mode == SEQ_2) case is handled in the beginning.

Compile tested only.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov khoroshi...@ispras.ru
---
 sound/oss/sequencer.c | 12 ++--
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/sound/oss/sequencer.c b/sound/oss/sequencer.c
index c0eea1dfe90f..f19da4b47c1d 100644
--- a/sound/oss/sequencer.c
+++ b/sound/oss/sequencer.c
@@ -681,13 +681,8 @@ static int seq_timing_event(unsigned char *event_rec)
break;
 
case TMR_ECHO:
-   if (seq_mode == SEQ_2)
-   seq_copy_to_input(event_rec, 8);
-   else
-   {
-   parm = (parm  8 | SEQ_ECHO);
-   seq_copy_to_input((unsigned char *) parm, 4);
-   }
+   parm = (parm  8 | SEQ_ECHO);
+   seq_copy_to_input((unsigned char *) parm, 4);
break;
 
default:;
@@ -1324,7 +1319,6 @@ int sequencer_ioctl(int dev, struct file *file, unsigned 
int cmd, void __user *a
int mode = translate_mode(file);
struct synth_info inf;
struct seq_event_rec event_rec;
-   unsigned long flags;
int __user *p = arg;
 
orig_dev = dev = dev  4;
@@ -1479,9 +1473,7 @@ int sequencer_ioctl(int dev, struct file *file, unsigned 
int cmd, void __user *a
case SNDCTL_SEQ_OUTOFBAND:
if (copy_from_user(event_rec, arg, sizeof(event_rec)))
return -EFAULT;
-   spin_lock_irqsave(lock,flags);
play_event(event_rec.arr);
-   spin_unlock_irqrestore(lock,flags);
return 0;
 
case SNDCTL_MIDI_INFO:
-- 
1.9.1

--
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/