Skip to content

Commit

Permalink
ALSA: seq: oss: Fix races at processing SysEx messages
Browse files Browse the repository at this point in the history
commit 0179488ca992d79908b8e26b9213f1554fc5bacc upstream.

OSS sequencer handles the SysEx messages split in 6 bytes packets, and
ALSA sequencer OSS layer tries to combine those.  It stores the data
in the internal buffer and this access is racy as of now, which may
lead to the out-of-bounds access.

As a temporary band-aid fix, introduce a mutex for serializing the
process of the SysEx message packets.

Reported-by: Kun Hu <huk23@m.fudan.edu.cn>
Closes: https://lore.kernel.org/2B7E93E4-B13A-4AE4-8E87-306A8EE9BBB7@m.fudan.edu.cn
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20241230110543.32454-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
tiwai authored and gregkh committed Jan 9, 2025
1 parent 7d1f59d commit d2392b7
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions sound/core/seq/oss/seq_oss_synth.c
Original file line number Diff line number Diff line change
@@ -66,6 +66,7 @@ static struct seq_oss_synth midi_synth_dev = {
};

static DEFINE_SPINLOCK(register_lock);
static DEFINE_MUTEX(sysex_mutex);

/*
* prototypes
@@ -497,6 +498,7 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
if (!info)
return -ENXIO;

guard(mutex)(&sysex_mutex);
sysex = info->sysex;
if (sysex == NULL) {
sysex = kzalloc(sizeof(*sysex), GFP_KERNEL);

0 comments on commit d2392b7

Please sign in to comment.