summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2018-03-22 10:40:27 +0100
committerTakashi Iwai <tiwai@suse.de>2018-03-22 10:40:27 +0100
commit8e6b1a72a75bb5067ccb6b56d8ca4aa3a300a64e (patch)
treede66818727c2bff44061cfd97a9f2001475485d0
parent67a01afaf3d34893cf7d2ea19b34555d6abb7cb0 (diff)
downloadlinux-8e6b1a72a75bb5067ccb6b56d8ca4aa3a300a64e.tar.gz
linux-8e6b1a72a75bb5067ccb6b56d8ca4aa3a300a64e.tar.bz2
linux-8e6b1a72a75bb5067ccb6b56d8ca4aa3a300a64e.zip
ALSA: aloop: Fix access to not-yet-ready substream via cable
In loopback_open() and loopback_close(), we assign and release the substream object to the corresponding cable in a racy way. It's neither locked nor done in the right position. The open callback assigns the substream before its preparation finishes, hence the other side of the cable may pick it up, which may lead to the invalid memory access. This patch addresses these: move the assignment to the end of the open callback, and wrap with cable->lock for avoiding concurrent accesses. Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
-rw-r--r--sound/drivers/aloop.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 0a08e63e9c66..1063a4377502 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -666,7 +666,9 @@ static void free_cable(struct snd_pcm_substream *substream)
return;
if (cable->streams[!substream->stream]) {
/* other stream is still alive */
+ spin_lock_irq(&cable->lock);
cable->streams[substream->stream] = NULL;
+ spin_unlock_irq(&cable->lock);
} else {
/* free the cable */
loopback->cables[substream->number][dev] = NULL;
@@ -705,7 +707,6 @@ static int loopback_open(struct snd_pcm_substream *substream)
loopback->cables[substream->number][dev] = cable;
}
dpcm->cable = cable;
- cable->streams[substream->stream] = dpcm;
snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
@@ -737,6 +738,11 @@ static int loopback_open(struct snd_pcm_substream *substream)
runtime->hw = loopback_pcm_hardware;
else
runtime->hw = cable->hw;
+
+ spin_lock_irq(&cable->lock);
+ cable->streams[substream->stream] = dpcm;
+ spin_unlock_irq(&cable->lock);
+
unlock:
if (err < 0) {
free_cable(substream);