Commit 81c254a6 authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai
Browse files

ALSA: fireface: fix locking bug in ff400_copy_msg_to_user() 



The ff400_copy_msg_to_user() function drops the spin lock to call
copy_to_user().  However, if the copy_to_user() fails, then it must
take the lock again before returning.  Failure to take the lock leads
to a double unlock in the caller, hwdep_read().

Fixes: acdebd8b ("ALSA: fireface: implement message parser for Fireface 400")
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Acked-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/Y8at+W/7OGvEBY8O@kili


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 3ee0fe7f

sound/firewire/fireface/ff-protocol-former.c

+8 −6
Original line number Diff line number Diff line
@@ -680,28 +680,30 @@ static long ff400_copy_msg_to_user(struct snd_ff *ff, char __user *buf, long cou 
	struct ff400_msg_parser *parser = ff->msg_parser;

	u32 type = SNDRV_FIREWIRE_EVENT_FF400_MESSAGE;

	long consumed = 0;

	int ret = 0;



	if (count < 8)

		return 0;



	spin_unlock_irq(&ff->lock);



	if (copy_to_user(buf, &type, sizeof(type)))

		return -EFAULT;



		ret = -EFAULT;

	spin_lock_irq(&ff->lock);

	if (ret)

		return ret;



	count -= sizeof(type);

	consumed += sizeof(type);



	while (count >= sizeof(*parser->msgs) && parser->pull_pos != parser->push_pos) {

		spin_unlock_irq(&ff->lock);



		if (copy_to_user(buf + consumed, parser->msgs + parser->pull_pos,

				 sizeof(*parser->msgs)))

			return -EFAULT;



			ret = -EFAULT;

		spin_lock_irq(&ff->lock);

		if (ret)

			return ret;



		++parser->pull_pos;

		if (parser->pull_pos >= FF400_QUEUE_SIZE)

			parser->pull_pos = 0;