Commit fc8e2284 authored by Takashi Iwai's avatar Takashi Iwai Committed by Luis Henriques

ALSA: seq: Fix leak of pool buffer at concurrent writes

commit d99a36f4 upstream.

When multiple concurrent writes happen on the ALSA sequencer device
right after the open, it may try to allocate vmalloc buffer for each
write and leak some of them.  It's because the presence check and the
assignment of the buffer is done outside the spinlock for the pool.

The fix is to move the check and the assignment into the spinlock.

(The current implementation is suboptimal, as there can be multiple
 unnecessary vmallocs because the allocation is done before the check
 in the spinlock.  But the pool size is already checked beforehand, so
 this isn't a big problem; that is, the only possible path is the
 multiple writes before any pool assignment, and practically seen, the
 current coverage should be "good enough".)

The issue was triggered by syzkaller fuzzer.

BugLink: http://lkml.kernel.org/r/CACT4Y+bSzazpXNvtAr=WXaL8hptqjHwqEyFA+VN2AWEx=aurkg@mail.gmail.comReported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Tested-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent 004fb6eb
...@@ -383,15 +383,20 @@ int snd_seq_pool_init(struct snd_seq_pool *pool) ...@@ -383,15 +383,20 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
if (snd_BUG_ON(!pool)) if (snd_BUG_ON(!pool))
return -EINVAL; return -EINVAL;
if (pool->ptr) /* should be atomic? */
return 0;
pool->ptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size); cellptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
if (!pool->ptr) if (!cellptr)
return -ENOMEM; return -ENOMEM;
/* add new cells to the free cell list */ /* add new cells to the free cell list */
spin_lock_irqsave(&pool->lock, flags); spin_lock_irqsave(&pool->lock, flags);
if (pool->ptr) {
spin_unlock_irqrestore(&pool->lock, flags);
vfree(cellptr);
return 0;
}
pool->ptr = cellptr;
pool->free = NULL; pool->free = NULL;
for (cell = 0; cell < pool->size; cell++) { for (cell = 0; cell < pool->size; cell++) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment