ALSA: seq: Fix racy deletion of subscriber
authorTakashi Iwai <tiwai@suse.de>
Tue, 3 Aug 2021 11:43:12 +0000 (13:43 +0200)
committerTakashi Iwai <tiwai@suse.de>
Tue, 3 Aug 2021 11:43:40 +0000 (13:43 +0200)
commit97367c97226aab8b298ada954ce12659ee3ad2a4
tree1774f8d3cc9e5c5cff117d277df02b77354f38e6
parenteda80d7c9c4db0f55f130e38c682e19b58d5add7
ALSA: seq: Fix racy deletion of subscriber

It turned out that the current implementation of the port subscription
is racy.  The subscription contains two linked lists, and we have to
add to or delete from both lists.  Since both connection and
disconnection procedures perform the same order for those two lists
(i.e. src list, then dest list), when a deletion happens during a
connection procedure, the src list may be deleted before the dest list
addition completes, and this may lead to a use-after-free or an Oops,
even though the access to both lists are protected via mutex.

The simple workaround for this race is to change the access order for
the disconnection, namely, dest list, then src list.  This assures
that the connection has been established when disconnecting, and also
the concurrent deletion can be avoided.

Reported-and-tested-by: folkert <folkert@vanheusden.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210801182754.GP890690@belle.intranet.vanheusden.com
Link: https://lore.kernel.org/r/20210803114312.2536-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/seq/seq_ports.c