Patch "ALSA: timer: Fix race between read and ioctl" has been added to the 4.11-stable tree

This is a note to let you know that I've just added the patch titled

ALSA: timer: Fix race between read and ioctl

to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
alsa-timer-fix-race-between-read-and-ioctl.patch
and it can be found in the queue-4.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Takashi Iwai <[email protected]>
Date: Fri, 2 Jun 2017 15:03:38 +0200
Subject: ALSA: timer: Fix race between read and ioctl

From: Takashi Iwai <[email protected]>

commit d11662f4f798b50d8c8743f433842c3e40fe3378 upstream.

The read from ALSA timer device, the function snd_timer_user_tread(), may access to an uninitialized struct snd_timer_user fields when the read is concurrently performed while the ioctl like snd_timer_user_tselect() is invoked. We have already fixed the races among ioctls via a mutex, but we seem to have forgotten the race between read vs ioctl.

This patch simply applies (more exactly extends the already applied range of) tu->ioctl_lock in snd_timer_user_tread() for closing the race window.

---
 sound/core/timer.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -1964,6 +1964,7 @@ static ssize_t snd_timer_user_read(struc
 
 	tu = file->private_data;
 	unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read);
+	mutex_lock(&tu->ioctl_lock);
 	spin_lock_irq(&tu->qlock);
 	while ((long)count - result >= unit) {
 		while (!tu->qused) {

@@ -1979,7 +1980,9 @@ static ssize_t snd_timer_user_read(struc
 			add_wait_queue(&tu->qchange_sleep, &wait);
 
 			spin_unlock_irq(&tu->qlock);
+			mutex_unlock(&tu->ioctl_lock);
 			schedule();
+			mutex_lock(&tu->ioctl_lock);
 			spin_lock_irq(&tu->qlock);
 
 			remove_wait_queue(&tu->qchange_sleep, &wait);

@@ -1999,7 +2002,6 @@ static ssize_t snd_timer_user_read(struc
 		tu->qused--;
 		spin_unlock_irq(&tu->qlock);
 
-		mutex_lock(&tu->ioctl_lock);
 		if (tu->tread) {
 			if (copy_to_user(buffer, &tu->tqueue[qhead],
 					 sizeof(struct snd_timer_tread)))

@@ -2009,7 +2011,6 @@ static ssize_t snd_timer_user_read(struc
 					 sizeof(struct snd_timer_read)))
 				err = -EFAULT;
 		}
-		mutex_unlock(&tu->ioctl_lock);
 
 		spin_lock_irq(&tu->qlock);
 		if (err < 0)

@@ -2019,6 +2020,7 @@ static ssize_t snd_timer_user_read(struc
 	}
  _error:
 	spin_unlock_irq(&tu->qlock);
+	mutex_unlock(&tu->ioctl_lock);
 	return result > 0 ? result : err;
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.11/alsa-timer-fix-race-between-read-and-ioctl.patch queue-4.11/alsa-timer-fix-missing-queue-indices-reset-at-sndrv_timer_ioctl_select.patch queue-4.11/asoc-fix-use-after-free-at-card-unregistration.patch queue-4.11/ptrace-properly-initialize-ptracer_cred-on-fork.patch queue-4.11/drm-i915-fix-runtime-pm-for-lpe-audio.patch