Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 25 Oct 2018 14:53:24 +0000 (UTC)
From:      Hans Petter Selasky <hselasky@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org
Subject:   svn commit: r339719 - stable/12/sys/dev/sound/midi
Message-ID:  <201810251453.w9PErOdU057660@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: hselasky
Date: Thu Oct 25 14:53:24 2018
New Revision: 339719
URL: https://svnweb.freebsd.org/changeset/base/339719

Log:
  MFC r339582:
  Drop sequencer mutex around uiomove() and make sure we don't move more bytes
  than is available, else a panic might happen.
  
  Found by:		Peter Holm <peter@holm.cc>
  Approved by:		re (rgrimes)
  Sponsored by:		Mellanox Technologies

Modified:
  stable/12/sys/dev/sound/midi/sequencer.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/dev/sound/midi/sequencer.c
==============================================================================
--- stable/12/sys/dev/sound/midi/sequencer.c	Thu Oct 25 14:38:03 2018	(r339718)
+++ stable/12/sys/dev/sound/midi/sequencer.c	Thu Oct 25 14:53:24 2018	(r339719)
@@ -921,7 +921,9 @@ mseq_read(struct cdev *i_dev, struct uio *uio, int iof
 
 		SEQ_DEBUG(8, printf("midiread: uiomove cc=%d\n", used));
 		MIDIQ_DEQ(scp->in_q, buf, used);
+		mtx_unlock(&scp->seq_lock);
 		retval = uiomove(buf, used, uio);
+		mtx_lock(&scp->seq_lock);
 		if (retval)
 			goto err1;
 	}
@@ -996,7 +998,9 @@ mseq_write(struct cdev *i_dev, struct uio *uio, int io
 			retval = ENXIO;
 			goto err0;
 		}
+		mtx_unlock(&scp->seq_lock);
 		retval = uiomove(event, used, uio);
+		mtx_lock(&scp->seq_lock);
 		if (retval)
 			goto err0;
 
@@ -1034,7 +1038,9 @@ mseq_write(struct cdev *i_dev, struct uio *uio, int io
 			SEQ_DEBUG(2,
 			   printf("seq_write: SEQ_FULLSIZE flusing buffer.\n"));
 			while (uio->uio_resid > 0) {
-				retval = uiomove(event, EV_SZ, uio);
+				mtx_unlock(&scp->seq_lock);
+				retval = uiomove(event, MIN(EV_SZ, uio->uio_resid), uio);
+				mtx_lock(&scp->seq_lock);
 				if (retval)
 					goto err0;
 
@@ -1045,6 +1051,7 @@ mseq_write(struct cdev *i_dev, struct uio *uio, int io
 		}
 		retval = EINVAL;
 		if (ev_code >= 128) {
+			int error;
 
 			/*
 			 * Some sort of an extended event. The size is eight
@@ -1054,7 +1061,13 @@ mseq_write(struct cdev *i_dev, struct uio *uio, int io
 				SEQ_DEBUG(2, printf("seq_write: invalid level two event %x.\n", ev_code));
 				goto err0;
 			}
-			if (uiomove((caddr_t)&event[4], 4, uio)) {
+			mtx_unlock(&scp->seq_lock);
+			if (uio->uio_resid < 4)
+				error = EINVAL;
+			else
+				error = uiomove((caddr_t)&event[4], 4, uio);
+			mtx_lock(&scp->seq_lock);
+			if (error) {
 				SEQ_DEBUG(2,
 				   printf("seq_write: user memory mangled?\n"));
 				goto err0;



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201810251453.w9PErOdU057660>