ALSA: core: Fix card races between register and disconnect [Linux 5.1]

ALSA: core: Fix card races between register and disconnect [Linux 5.1]

This Linux kernel change "ALSA: core: Fix card races between register and disconnect" is included in the Linux 5.1 release. This change is authored by Takashi Iwai <tiwai [at] suse.de> on Tue Apr 16 17:06:33 2019 +0200. The commit for this change in Linux stable tree is 2a3f722 (patch).

ALSA: core: Fix card races between register and disconnect

There is a small race window in the card disconnection code that
allows the registration of another card with the very same card id.
This leads to a warning in procfs creation as caught by syzkaller.

The problem is that we delete snd_cards and snd_cards_lock entries at
the very beginning of the disconnection procedure.  This makes the
slot available to be assigned for another card object while the
disconnection procedure is being processed.  Then it becomes possible
to issue a procfs registration with the existing file name although we
check the conflict beforehand.

The fix is simply to move the snd_cards and snd_cards_lock clearances
at the end of the disconnection procedure.  The references to these
entries are merely either from the global proc files like
/proc/asound/cards or from the card registration / disconnection, so
it should be fine to shift at the very end.

Reported-by: [email protected]
Cc: <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>

There are 18 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 sound/core/init.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/sound/core/init.c b/sound/core/init.c
index 0c4dc40..079c12d 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -382,14 +382,7 @@ int snd_card_disconnect(struct snd_card *card)
    card->shutdown = 1;
    spin_unlock(&card->files_lock);

-   /* phase 1: disable fops (user space) operations for ALSA API */
-   mutex_lock(&snd_card_mutex);
-   snd_cards[card->number] = NULL;
-   clear_bit(card->number, snd_cards_lock);
-   mutex_unlock(&snd_card_mutex);
-   
-   /* phase 2: replace file->f_op with special dummy operations */
-   
+   /* replace file->f_op with special dummy operations */
    spin_lock(&card->files_lock);
    list_for_each_entry(mfile, &card->files_list, list) {
        /* it's critical part, use endless loop */
@@ -405,7 +398,7 @@ int snd_card_disconnect(struct snd_card *card)
    }
    spin_unlock(&card->files_lock); 

-   /* phase 3: notify all connected devices about disconnection */
+   /* notify all connected devices about disconnection */
    /* at this point, they cannot respond to any calls except release() */

 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
@@ -421,6 +414,13 @@ int snd_card_disconnect(struct snd_card *card)
        device_del(&card->card_dev);
        card->registered = false;
    }
+
+   /* disable fops (user space) operations for ALSA API */
+   mutex_lock(&snd_card_mutex);
+   snd_cards[card->number] = NULL;
+   clear_bit(card->number, snd_cards_lock);
+   mutex_unlock(&snd_card_mutex);
+
 #ifdef CONFIG_PM
    wake_up(&card->power_sleep);
 #endif

Leave a Reply

Your email address will not be published. Required fields are marked *