diff options
| author | Takashi Iwai <tiwai@suse.de> | 2020-04-24 09:40:16 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-06-25 15:32:54 +0200 |
| commit | d3a9803bc7be4e553720367bbbc1f9bd912cc47c (patch) | |
| tree | c3eec15d46f4f1cdbc2646b9ec6e232d2d9b4977 /sound/usb | |
| parent | 2d50acd7dbd0682a56968ad9551341d7fc5b6eaf (diff) | |
| download | linux-stable-d3a9803bc7be4e553720367bbbc1f9bd912cc47c.tar.gz linux-stable-d3a9803bc7be4e553720367bbbc1f9bd912cc47c.tar.bz2 linux-stable-d3a9803bc7be4e553720367bbbc1f9bd912cc47c.zip | |
ALSA: usb-audio: Fix racy list management in output queue
[ Upstream commit 5b6cc38f3f3f37109ce72b60bda215a5f6892c0b ]
The linked list entry from FIFO is peeked at
queue_pending_output_urbs() but the actual element pop-out is
performed outside the spinlock, and it's potentially racy.
Do delete the link at the right place inside the spinlock.
Fixes: 8fdff6a319e7 ("ALSA: snd-usb: implement new endpoint streaming model")
Link: https://lore.kernel.org/r/20200424074016.14301-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'sound/usb')
| -rw-r--r-- | sound/usb/endpoint.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c index 36e255d88937..48611849b79b 100644 --- a/sound/usb/endpoint.c +++ b/sound/usb/endpoint.c @@ -359,17 +359,17 @@ static void queue_pending_output_urbs(struct snd_usb_endpoint *ep) ep->next_packet_read_pos %= MAX_URBS; /* take URB out of FIFO */ - if (!list_empty(&ep->ready_playback_urbs)) + if (!list_empty(&ep->ready_playback_urbs)) { ctx = list_first_entry(&ep->ready_playback_urbs, struct snd_urb_ctx, ready_list); + list_del_init(&ctx->ready_list); + } } spin_unlock_irqrestore(&ep->lock, flags); if (ctx == NULL) return; - list_del_init(&ctx->ready_list); - /* copy over the length information */ for (i = 0; i < packet->packets; i++) ctx->packet_size[i] = packet->packet_size[i]; |