ALSA: aloop: Fix access to not-yet-ready substream via cable
authorTakashi Iwai <tiwai@suse.de>
Thu, 22 Mar 2018 09:40:27 +0000 (10:40 +0100)
committerTakashi Iwai <tiwai@suse.de>
Thu, 22 Mar 2018 09:40:27 +0000 (10:40 +0100)
In loopback_open() and loopback_close(), we assign and release the
substream object to the corresponding cable in a racy way.  It's
neither locked nor done in the right position.  The open callback
assigns the substream before its preparation finishes, hence the other
side of the cable may pick it up, which may lead to the invalid memory
access.

This patch addresses these: move the assignment to the end of the open
callback, and wrap with cable->lock for avoiding concurrent accesses.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/drivers/aloop.c

index 0a08e63e9c667e5a193fe9c69c8d4a259cf83afe..1063a4377502a8338bfa3237183068eefcf0da0a 100644 (file)
@@ -666,7 +666,9 @@ static void free_cable(struct snd_pcm_substream *substream)
                return;
        if (cable->streams[!substream->stream]) {
                /* other stream is still alive */
+               spin_lock_irq(&cable->lock);
                cable->streams[substream->stream] = NULL;
+               spin_unlock_irq(&cable->lock);
        } else {
                /* free the cable */
                loopback->cables[substream->number][dev] = NULL;
@@ -705,7 +707,6 @@ static int loopback_open(struct snd_pcm_substream *substream)
                loopback->cables[substream->number][dev] = cable;
        }
        dpcm->cable = cable;
-       cable->streams[substream->stream] = dpcm;
 
        snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
 
@@ -737,6 +738,11 @@ static int loopback_open(struct snd_pcm_substream *substream)
                runtime->hw = loopback_pcm_hardware;
        else
                runtime->hw = cable->hw;
+
+       spin_lock_irq(&cable->lock);
+       cable->streams[substream->stream] = dpcm;
+       spin_unlock_irq(&cable->lock);
+
  unlock:
        if (err < 0) {
                free_cable(substream);