Commit e3cd33ab authored by Takashi Iwai's avatar Takashi Iwai
Browse files

ALSA: seq: Improve data consistency at polling 



snd_seq_poll() calls snd_seq_write_pool_allocated() that reads out a
field in client->pool object, while it can be updated concurrently via
ioctls, as reported by syzbot.  The data race itself is harmless, as
it's merely a poll() call, and the state is volatile.  OTOH, the read
out of poll object info from the caller side is fragile, and we can
leave it better in snd_seq_pool_poll_wait() alone.

A similar pattern is seen in snd_seq_kernel_client_write_poll(), too,
which is called from the OSS sequencer.

This patch drops the pool checks from the caller side and add the
pool->lock in snd_seq_pool_poll_wait() for better data consistency.

Reported-by: default avatar <syzbot+2d373c9936c00d7e120c@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/67c88903.050a0220.15b4b9.0028.GAE@google.com
Link: https://patch.msgid.link/20250307084246.29271-1-tiwai@suse.de


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent aa85822c

sound/core/seq/seq_clientmgr.c

+1 −4
Original line number Diff line number Diff line
@@ -1130,8 +1130,7 @@ static __poll_t snd_seq_poll(struct file *file, poll_table * wait) 
	if (snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT) {



		/* check if data is available in the pool */

		if (!snd_seq_write_pool_allocated(client) ||

		    snd_seq_pool_poll_wait(client->pool, file, wait))

		if (snd_seq_pool_poll_wait(client->pool, file, wait))

			mask |= EPOLLOUT | EPOLLWRNORM;

	}
@@ -2566,8 +2565,6 @@ int snd_seq_kernel_client_write_poll(int clientid, struct file *file, poll_table 
	if (client == NULL)

		return -ENXIO;



	if (! snd_seq_write_pool_allocated(client))

		return 1;

	if (snd_seq_pool_poll_wait(client->pool, file, wait))

		return 1;

	return 0;

sound/core/seq/seq_memory.c

+1 −0
Original line number Diff line number Diff line
@@ -427,6 +427,7 @@ int snd_seq_pool_poll_wait(struct snd_seq_pool *pool, struct file *file, 
			   poll_table *wait)

{

	poll_wait(file, &pool->output_sleep, wait);

	guard(spinlock_irq)(&pool->lock);

	return snd_seq_output_ok(pool);

}