Alsa-Devel Archive on lore.kernel.org
 help / color / Atom feed
From: paulhsia <paulhsia@chromium.org>
To: linux-kernel@vger.kernel.org
Cc: alsa-devel@alsa-project.org, Mark Brown <broonie@kernel.org>,
	paulhsia <paulhsia@chromium.org>, Takashi Iwai <tiwai@suse.com>
Subject: [alsa-devel] [PATCH 1/2] ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()
Date: Wed, 13 Nov 2019 01:17:14 +0800
Message-ID: <20191112171715.128727-2-paulhsia@chromium.org> (raw)
In-Reply-To: <20191112171715.128727-1-paulhsia@chromium.org>

If the nullity check for `substream->runtime` is outside of the lock
region, it is possible to have a null runtime in the critical section
if snd_pcm_detach_substream is called right before the lock.

Signed-off-by: paulhsia <paulhsia@chromium.org>
---
 sound/core/pcm_lib.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index d80041ea4e01..2236b5e0c1f2 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1782,11 +1782,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
 	struct snd_pcm_runtime *runtime;
 	unsigned long flags;
 
-	if (PCM_RUNTIME_CHECK(substream))
+	if (snd_BUG_ON(!substream))
 		return;
-	runtime = substream->runtime;
 
 	snd_pcm_stream_lock_irqsave(substream, flags);
+	if (PCM_RUNTIME_CHECK(substream))
+		goto _unlock;
+	runtime = substream->runtime;
+
 	if (!snd_pcm_running(substream) ||
 	    snd_pcm_update_hw_ptr0(substream, 1) < 0)
 		goto _end;
@@ -1797,6 +1800,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
 #endif
  _end:
 	kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
+ _unlock:
 	snd_pcm_stream_unlock_irqrestore(substream, flags);
 }
 EXPORT_SYMBOL(snd_pcm_period_elapsed);
-- 
2.24.0.rc1.363.gb1bccd3e3d-goog

_______________________________________________
Alsa-devel mailing list
Alsa-devel@alsa-project.org
https://mailman.alsa-project.org/mailman/listinfo/alsa-devel

  reply index

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-12 17:17 [alsa-devel] [PATCH 0/2] ALSA: pcm: Fix race condition in runtime access paulhsia
2019-11-12 17:17 ` paulhsia [this message]
2019-11-12 17:17 ` [alsa-devel] [PATCH 2/2] ALSA: pcm: Use stream lock in snd_pcm_detach_substream() paulhsia
2019-11-12 18:16 ` [alsa-devel] [PATCH 0/2] ALSA: pcm: Fix race condition in runtime access Takashi Iwai
2019-11-13  7:24   ` Chih-Yang Hsia
2019-11-13  9:47     ` Takashi Iwai
2019-11-13 11:36       ` Takashi Iwai
2019-11-14 14:16         ` Chih-Yang Hsia
2019-11-14 14:20           ` Takashi Iwai
2019-11-14 16:37             ` Chih-Yang Hsia
2019-11-14 17:00               ` Takashi Iwai
2019-11-15 15:36                 ` Chih-Yang Hsia
     [not found]                 ` <CAJaf1Ta1tqYMCTaWxeL82gfY8Fg6hidLjHO3FFiqU7yyn5oVPg@mail.gmail.com>
     [not found]                   ` <s5hy2whi1gw.wl-tiwai@suse.de>
2019-11-15 17:04                     ` Chih-Yang Hsia
2019-11-15 17:07                       ` Takashi Iwai

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191112171715.128727-2-paulhsia@chromium.org \
    --to=paulhsia@chromium.org \
    --cc=alsa-devel@alsa-project.org \
    --cc=broonie@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=tiwai@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Alsa-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/alsa-devel/0 alsa-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 alsa-devel alsa-devel/ https://lore.kernel.org/alsa-devel \
		alsa-devel@alsa-project.org
	public-inbox-index alsa-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.alsa-project.alsa-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git