diff options
| author |   Takashi Iwai <tiwai@suse.de> | 2024-12-30 12:05:35 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2024-12-30 12:06:28 +0100 |
| commit | 0179488ca992d79908b8e26b9213f1554fc5bacc (patch) | |
| tree | c0907634866b42a8b4e1fa9d8cdda480da51a030 | |
| parent | ALSA: compress_offload: fix remaining descriptor races in sound/core/compress_offload.c (diff) | |
| download | linux-rng-0179488ca992d79908b8e26b9213f1554fc5bacc.tar.xz linux-rng-0179488ca992d79908b8e26b9213f1554fc5bacc.zip | |
ALSA: seq: oss: Fix races at processing SysEx messages
OSS sequencer handles the SysEx messages split in 6 bytes packets, and
ALSA sequencer OSS layer tries to combine those. It stores the data
in the internal buffer and this access is racy as of now, which may
lead to the out-of-bounds access.
As a temporary band-aid fix, introduce a mutex for serializing the
process of the SysEx message packets.
Reported-by: Kun Hu <huk23@m.fudan.edu.cn>
Closes: https://lore.kernel.org/2B7E93E4-B13A-4AE4-8E87-306A8EE9BBB7@m.fudan.edu.cn
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20241230110543.32454-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
| -rw-r--r-- | sound/core/seq/oss/seq_oss_synth.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c index e3394919daa0..51ee4c00a843 100644 --- a/sound/core/seq/oss/seq_oss_synth.c +++ b/sound/core/seq/oss/seq_oss_synth.c @@ -66,6 +66,7 @@ static struct seq_oss_synth midi_synth_dev = { }; static DEFINE_SPINLOCK(register_lock); +static DEFINE_MUTEX(sysex_mutex); /* * prototypes @@ -497,6 +498,7 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, if (!info) return -ENXIO; + guard(mutex)(&sysex_mutex); sysex = info->sysex; if (sysex == NULL) { sysex = kzalloc(sizeof(*sysex), GFP_KERNEL); |