lkml.org 
[lkml]   [2018]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 05/43] ALSA: aloop: Fix access to not-yet-ready substream via cable
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Takashi Iwai <tiwai@suse.de>

    commit 8e6b1a72a75bb5067ccb6b56d8ca4aa3a300a64e upstream.

    In loopback_open() and loopback_close(), we assign and release the
    substream object to the corresponding cable in a racy way. It's
    neither locked nor done in the right position. The open callback
    assigns the substream before its preparation finishes, hence the other
    side of the cable may pick it up, which may lead to the invalid memory
    access.

    This patch addresses these: move the assignment to the end of the open
    callback, and wrap with cable->lock for avoiding concurrent accesses.

    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/drivers/aloop.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    --- a/sound/drivers/aloop.c
    +++ b/sound/drivers/aloop.c
    @@ -666,7 +666,9 @@ static void free_cable(struct snd_pcm_su
    return;
    if (cable->streams[!substream->stream]) {
    /* other stream is still alive */
    + spin_lock_irq(&cable->lock);
    cable->streams[substream->stream] = NULL;
    + spin_unlock_irq(&cable->lock);
    } else {
    /* free the cable */
    loopback->cables[substream->number][dev] = NULL;
    @@ -706,7 +708,6 @@ static int loopback_open(struct snd_pcm_
    loopback->cables[substream->number][dev] = cable;
    }
    dpcm->cable = cable;
    - cable->streams[substream->stream] = dpcm;

    snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);

    @@ -738,6 +739,11 @@ static int loopback_open(struct snd_pcm_
    runtime->hw = loopback_pcm_hardware;
    else
    runtime->hw = cable->hw;
    +
    + spin_lock_irq(&cable->lock);
    + cable->streams[substream->stream] = dpcm;
    + spin_unlock_irq(&cable->lock);
    +
    unlock:
    if (err < 0) {
    free_cable(substream);

    \
     
     \ /
      Last update: 2018-03-27 18:29    [W:3.229 / U:0.372 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site