Skip to content
  • Takashi Iwai's avatar
    ALSA: seq: Fix copy_from_user() call inside lock · 5803b023
    Takashi Iwai authored
    
    
    The event handler in the virmidi sequencer code takes a read-lock for
    the linked list traverse, while it's calling snd_seq_dump_var_event()
    in the loop.  The latter function may expand the user-space data
    depending on the event type.  It eventually invokes copy_from_user(),
    which might be a potential dead-lock.
    
    The sequencer core guarantees that the user-space data is passed only
    with atomic=0 argument, but snd_virmidi_dev_receive_event() ignores it
    and always takes read-lock().  For avoiding the problem above, this
    patch introduces rwsem for non-atomic case, while keeping rwlock for
    atomic case.
    
    Also while we're at it: the superfluous irq flags is dropped in
    snd_virmidi_input_open().
    
    Reported-by: default avatarJia-Ju Bai <baijiaju1990@163.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    5803b023