diff options
| author | Takashi Iwai <tiwai@suse.de> | 2019-08-25 09:21:44 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2019-08-25 09:31:10 +0200 |
| commit | 75545304eba6a3d282f923b96a466dc25a81e359 (patch) | |
| tree | 0b05723013a1044e1518b8b2612fe6f4f1cd5135 /sound/core/seq/seq_clientmgr.c | |
| parent | f9f0e9ed350e15d51ad07364b4cf910de50c472a (diff) | |
ALSA: seq: Fix potential concurrent access to the deleted pool
The input pool of a client might be deleted via the resize ioctl, the
the access to it should be covered by the proper locks. Currently the
only missing place is the call in snd_seq_ioctl_get_client_pool(), and
this patch papers over it.
Reported-by: syzbot+4a75454b9ca2777f35c7@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core/seq/seq_clientmgr.c')
| -rw-r--r-- | sound/core/seq/seq_clientmgr.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 7737b2670064..6d9592f0ae1d 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -1835,8 +1835,7 @@ static int snd_seq_ioctl_get_client_pool(struct snd_seq_client *client, if (cptr->type == USER_CLIENT) { info->input_pool = cptr->data.user.fifo_pool_size; info->input_free = info->input_pool; - if (cptr->data.user.fifo) - info->input_free = snd_seq_unused_cells(cptr->data.user.fifo->pool); + info->input_free = snd_seq_fifo_unused_cells(cptr->data.user.fifo); } else { info->input_pool = 0; info->input_free = 0; |