[alsa-devel] [PATCH 3/3] ALSA: seq: Protect racy pool manipulation from OSS sequencer

[Takashi Iwai]

On Mon, 15 Apr 2019 08:37:18 +0200,
Kai Vehmanen wrote:
> 
> Hi Takashi,
> 
> On Fri, 12 Apr 2019, Takashi Iwai wrote:
> 
> > +/* Unlock and unref the given client; for OSS sequencer use only */
> > +void snd_seq_client_ioctl_unlock(int clientid)
> > +{
> > +	struct snd_seq_client *client;
> > +
> > +	client = snd_seq_client_use_ptr(clientid);
> > +	if (WARN_ON(!client))
> > +		return;
> > +	mutex_unlock(&client->ioctl_mutex);
> > +	snd_use_lock_free(&client->use_lock);
> > +	snd_seq_client_unlock(client);
> 
> is that double-unlock intentional? snd_seq_client_unlock() seems to call
> the same snd_use_lock_free for the same handle as on the previous line.

Yes, it's intentional.  The trick is snd_seq_client_ioctl_lock()
doesn't call snd_seq_client_unlock(), i.e. keeps refcount up.  This
is, in turn, released in snd_seq_client_ioctl_unlock().
snd_seq_client_ioctl_unlock() gets its refcount at use_ptr(), hence
this releases twice.  Maybe it's worth for more comments.


thanks,

Takashi