linux-kernel - Re: [RFC PATCH] sound: line6: Fix race condition in line6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <s5ha6oto1bb.wl-tiwai@suse.de>
Date:   Mon, 17 May 2021 16:57:28 +0200
From:   Takashi Iwai <tiwai@...e.de>
To:     Hyeonggon Yoo <42.hyeyoo@...il.com>
Cc:     Jaroslav Kysela <perex@...ex.cz>, Takashi Iwai <tiwai@...e.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Oliver Neukum <oneukum@...e.com>,
        Vasily Khoruzhick <anarsoul@...il.com>,
        alsa-devel@...a-project.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH] sound: line6: Fix race condition in line6_probe

On Mon, 17 May 2021 16:48:11 +0200,
Hyeonggon Yoo wrote:
> 
> On Mon, May 17, 2021 at 03:43:24PM +0200, Takashi Iwai wrote:
> > The actually needed initialization is
> > line6_init_mid() call, and this can be fixed by moving to the
> > appropriate place instead of inside each private_init callback.
> 
> Oh, I missed it! there was another caller of line6_init_midi.
> your fix seems promising to me. it's putting line6_init_midi
> to the right place.
> 
> by the way looking at code, I think this driver needs some
> refactoring... it doesn't handle exceptions well.

Yes, there can be likely a few other holes in this driver, but for
fixing them, we'd need an actual test device.  The initialization
procedure of this device seems complex (multi-staged) and very
sensitive.


Takashi

> 
> Thanks,
> 
> Hyeonggon
> > ---
> > diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
> > index a030dd65eb28..9602929b7de9 100644
> > --- a/sound/usb/line6/driver.c
> > +++ b/sound/usb/line6/driver.c
> > @@ -699,6 +699,10 @@ static int line6_init_cap_control(struct usb_line6 *line6)
> >  		line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL);
> >  		if (!line6->buffer_message)
> >  			return -ENOMEM;
> > +
> > +		ret = line6_init_midi(line6);
> > +		if (ret < 0)
> > +			return ret;
> >  	} else {
> >  		ret = line6_hwdep_init(line6);
> >  		if (ret < 0)
> > diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c
> > index cd44cb5f1310..16e644330c4d 100644
> > --- a/sound/usb/line6/pod.c
> > +++ b/sound/usb/line6/pod.c
> > @@ -376,11 +376,6 @@ static int pod_init(struct usb_line6 *line6,
> >  	if (err < 0)
> >  		return err;
> >  
> > -	/* initialize MIDI subsystem: */
> > -	err = line6_init_midi(line6);
> > -	if (err < 0)
> > -		return err;
> > -
> >  	/* initialize PCM subsystem: */
> >  	err = line6_init_pcm(line6, &pod_pcm_properties);
> >  	if (err < 0)
> > diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c
> > index ed158f04de80..1376fc405c7f 100644
> > --- a/sound/usb/line6/variax.c
> > +++ b/sound/usb/line6/variax.c
> > @@ -172,11 +172,6 @@ static int variax_init(struct usb_line6 *line6,
> >  	if (variax->buffer_activate == NULL)
> >  		return -ENOMEM;
> >  
> > -	/* initialize MIDI subsystem: */
> > -	err = line6_init_midi(&variax->line6);
> > -	if (err < 0)
> > -		return err;
> > -
> >  	/* initiate startup procedure: */
> >  	schedule_delayed_work(&line6->startup_work,
> >  			      msecs_to_jiffies(VARIAX_STARTUP_DELAY1));
>