ALSA: rawmidi: Change resized buffers atomically
authorTakashi Iwai <tiwai@suse.de>
Tue, 17 Jul 2018 15:26:43 +0000 (17:26 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 25 Jul 2018 09:25:07 +0000 (11:25 +0200)
commit5d251646ab1588077b26e89dcaa116aba105d097
treef4b766489ce413490bc38b298c5edf06ebfb56df
parent321089a0aa35bcc09f423180847aa15b69dc4f9f
ALSA: rawmidi: Change resized buffers atomically

commit 39675f7a7c7e7702f7d5341f1e0d01db746543a0 upstream.

The SNDRV_RAWMIDI_IOCTL_PARAMS ioctl may resize the buffers and the
current code is racy.  For example, the sequencer client may write to
buffer while it being resized.

As a simple workaround, let's switch to the resized buffer inside the
stream runtime lock.

Reported-by: syzbot+52f83f0ea8df16932f7f@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sound/core/rawmidi.c