Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d15c33d6 authored by Meng Wang's avatar Meng Wang
Browse files

ALSA: pcm: use lock to protect substream runtime resource 



Use a spinlock to protect runtime resource in substream
against race conditions which may lead to use-after-free.

CRs-fixed: 2112713
Change-Id: I37dee68cad5eae05b21cfade3dabc0c2b79be6b8
Signed-off-by: default avatarKarthikeyan Mani <kmani@codeaurora.org>
Signed-off-by: default avatarMeng Wang <mengw@codeaurora.org>
parent 4a775613

sound/core/pcm.c

+12 −0
Original line number Diff line number Diff line
@@ -691,6 +691,9 @@ int snd_pcm_new_stream(struct snd_pcm *pcm, int stream, int substream_count) 
			}

		}

		substream->group = &substream->self_group;

#ifdef CONFIG_AUDIO_QGKI

		spin_lock_init(&substream->runtime_lock);

#endif

		snd_pcm_group_init(&substream->self_group);

		list_add_tail(&substream->link_list, &substream->self_group.substreams);

		atomic_set(&substream->mmap_count, 0);
@@ -979,9 +982,15 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream, 
void snd_pcm_detach_substream(struct snd_pcm_substream *substream)

{

	struct snd_pcm_runtime *runtime;

#ifdef CONFIG_AUDIO_QGKI

	unsigned long flags = 0;

#endif



	if (PCM_RUNTIME_CHECK(substream))

		return;

#ifdef CONFIG_AUDIO_QGKI

	spin_lock_irqsave(&substream->runtime_lock, flags);

#endif

	runtime = substream->runtime;

	if (runtime->private_free != NULL)

		runtime->private_free(runtime);
@@ -1000,6 +1009,9 @@ void snd_pcm_detach_substream(struct snd_pcm_substream *substream) 
	put_pid(substream->pid);

	substream->pid = NULL;

	substream->pstr->substream_opened--;

#ifdef CONFIG_AUDIO_QGKI

	spin_unlock_irqrestore(&substream->runtime_lock, flags);

#endif

}



static ssize_t show_pcm_class(struct device *dev,

sound/core/pcm_timer.c

+14 −0
Original line number Diff line number Diff line
@@ -52,9 +52,23 @@ void snd_pcm_timer_resolution_change(struct snd_pcm_substream *substream) 
static unsigned long snd_pcm_timer_resolution(struct snd_timer * timer)

{

	struct snd_pcm_substream *substream;

#ifdef CONFIG_AUDIO_QGKI

	unsigned long ret = 0, flags = 0;

#endif



	substream = timer->private_data;

#ifdef CONFIG_AUDIO_QGKI

	spin_lock_irqsave(&substream->runtime_lock, flags);

	if (substream->runtime)

		ret = substream->runtime->timer_resolution;

	else

		ret = 0;

	spin_unlock_irqrestore(&substream->runtime_lock, flags);



	return ret;

#else

	return substream->runtime ? substream->runtime->timer_resolution : 0;

#endif

}



static int snd_pcm_timer_start(struct snd_timer * timer)