Takashi Iwai
unread,Sep 12, 2017, 6:46:18 AM9/12/17Sign in to reply to author
Sign in to forward
You do not have permission to delete messages in this group
Sign in to report message as abuse
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to Andrey Konovalov, alsa-...@alsa-project.org, Ingo Molnar, Jaroslav Kysela, Takashi Sakamoto, Fabian Frederick, LKML, Dmitry Vyukov, Kostya Serebryany, syzkaller
Thanks, I merged the fix now.
FWIW, below is the official patch I merged.
Takashi
-- 8< --
From: Takashi Iwai <
ti...@suse.de>
Subject: [PATCH] ALSA: seq: Cancel pending autoload work at unbinding device
ALSA sequencer core has a mechanism to load the enumerated devices
automatically, and it's performed in an off-load work. This seems
causing some race when a sequencer is removed while the pending
autoload work is running. As syzkaller spotted, it may lead to some
use-after-free:
The fix is simply to assure canceling the autoload work at removing
the device.
Reported-by: Andrey Konovalov <
andre...@google.com>
Tested-by: Andrey Konovalov <
andre...@google.com>
Cc: <
sta...@vger.kernel.org>
Signed-off-by: Takashi Iwai <
ti...@suse.de>
---
sound/core/seq_device.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/core/seq_device.c b/sound/core/seq_device.c
index c4acf17e9f5e..e40a2cba5002 100644
--- a/sound/core/seq_device.c
+++ b/sound/core/seq_device.c
@@ -148,8 +148,10 @@ void snd_seq_device_load_drivers(void)
flush_work(&autoload_work);
}
EXPORT_SYMBOL(snd_seq_device_load_drivers);
+#define cancel_autoload_drivers() cancel_work_sync(&autoload_work)
#else
#define queue_autoload_drivers() /* NOP */
+#define cancel_autoload_drivers() /* NOP */
#endif
/*
@@ -159,6 +161,7 @@ static int snd_seq_device_dev_free(struct snd_device *device)
{
struct snd_seq_device *dev = device->device_data;
+ cancel_autoload_drivers();
put_device(&dev->dev);
return 0;
}
--
2.14.1