From 129c859297a6f62c5daa5b14bfee979a081f7930 Mon Sep 17 00:00:00 2001 From: hselasky Date: Thu, 25 Oct 2018 14:57:33 +0000 Subject: [PATCH] MFC r339582: Drop sequencer mutex around uiomove() and make sure we don't move more bytes than is available, else a panic might happen. Found by: Peter Holm Sponsored by: Mellanox Technologies git-svn-id: svn://svn.freebsd.org/base/stable/9@339722 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/dev/sound/midi/sequencer.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/sys/dev/sound/midi/sequencer.c b/sys/dev/sound/midi/sequencer.c index abfb662fc..57f460cdd 100644 --- a/sys/dev/sound/midi/sequencer.c +++ b/sys/dev/sound/midi/sequencer.c @@ -928,7 +928,9 @@ seq_read(struct cdev *i_dev, struct uio *uio, int ioflag) SEQ_DEBUG(8, printf("midiread: uiomove cc=%d\n", used)); MIDIQ_DEQ(scp->in_q, buf, used); + mtx_unlock(&scp->seq_lock); retval = uiomove(buf, used, uio); + mtx_lock(&scp->seq_lock); if (retval) goto err1; } @@ -1003,7 +1005,9 @@ seq_write(struct cdev *i_dev, struct uio *uio, int ioflag) retval = ENXIO; goto err0; } + mtx_unlock(&scp->seq_lock); retval = uiomove(event, used, uio); + mtx_lock(&scp->seq_lock); if (retval) goto err0; @@ -1041,7 +1045,9 @@ seq_write(struct cdev *i_dev, struct uio *uio, int ioflag) SEQ_DEBUG(2, printf("seq_write: SEQ_FULLSIZE flusing buffer.\n")); while (uio->uio_resid > 0) { - retval = uiomove(event, EV_SZ, uio); + mtx_unlock(&scp->seq_lock); + retval = uiomove(event, MIN(EV_SZ, uio->uio_resid), uio); + mtx_lock(&scp->seq_lock); if (retval) goto err0; @@ -1052,6 +1058,7 @@ seq_write(struct cdev *i_dev, struct uio *uio, int ioflag) } retval = EINVAL; if (ev_code >= 128) { + int error; /* * Some sort of an extended event. The size is eight @@ -1061,7 +1068,13 @@ seq_write(struct cdev *i_dev, struct uio *uio, int ioflag) SEQ_DEBUG(2, printf("seq_write: invalid level two event %x.\n", ev_code)); goto err0; } - if (uiomove((caddr_t)&event[4], 4, uio)) { + mtx_unlock(&scp->seq_lock); + if (uio->uio_resid < 4) + error = EINVAL; + else + error = uiomove((caddr_t)&event[4], 4, uio); + mtx_lock(&scp->seq_lock); + if (error) { SEQ_DEBUG(2, printf("seq_write: user memory mangled?\n")); goto err0; -- 2.42.0