linux-kernel - Re: BUG: soft lockup in snd_virmidi_output

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <s5hbmatuue9.wl-tiwai@suse.de>
Date:   Fri, 27 Jul 2018 07:20:30 +0200
From:   Takashi Iwai <tiwai@...e.de>
To:     "Dae R. Jeong" <threeearcat@...il.com>
Cc:     perex@...ex.cz, alsa-devel@...a-project.org, kt0755@...il.com,
        syzkaller@...glegroups.com, bammanag@...due.edu,
        linux-kernel@...r.kernel.org
Subject: Re: BUG: soft lockup in snd_virmidi_output_trigger

On Fri, 27 Jul 2018 06:13:22 +0200,
Dae R. Jeong wrote:
> 
> I tested it and it worked.
> Thanks a lot!

Good to hear.  Below is the final patch with a proper comment (and
with syzbot reported-by, too) I'm going to queue to sound.git tree.


thanks,

Takashi

-- 8< --

From: Takashi Iwai <tiwai@...e.de>
Subject: [PATCH v2] ALSA: virmidi: Fix too long output trigger loop

The virmidi output trigger tries to parse the all available bytes and
process sequencer events as much as possible.  In a normal situation,
this is supposed to be relatively short, but a program may give a huge
buffer and it'll take a long time in a single spin lock, which may
eventually lead to a soft lockup.

This patch simply adds a workaround, a cond_resched() call in the loop
if applicable.  A better solution would be to move the event processor
into a work, but let's put a duct-tape quickly at first.

Reported-and-tested-by: Dae R. Jeong <threeearcat@...il.com>
Reported-by: syzbot+e4c8abb920efa77bace9@...kaller.appspotmail.com
Cc: <stable@...r.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@...e.de>
---
 sound/core/seq/seq_virmidi.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
index 289ae6bb81d9..8ebbca554e99 100644
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -163,6 +163,7 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
 	int count, res;
 	unsigned char buf[32], *pbuf;
 	unsigned long flags;
+	bool check_resched = !in_atomic();
 
 	if (up) {
 		vmidi->trigger = 1;
@@ -200,6 +201,15 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
 					vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
 				}
 			}
+			if (!check_resched)
+				continue;
+			/* do temporary unlock & cond_resched() for avoiding
+			 * CPU soft lockup, which may happen via a write from
+			 * a huge rawmidi buffer
+			 */
+			spin_unlock_irqrestore(&substream->runtime->lock, flags);
+			cond_resched();
+			spin_lock_irqsave(&substream->runtime->lock, flags);
 		}
 	out:
 		spin_unlock_irqrestore(&substream->runtime->lock, flags);
-- 
2.18.0