mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-30 22:03:17 +01:00
Nguyen Ngoc Thang
1e713f9bb2
snd_pcm_timer_init() calls snd_device_register() to link the new
struct snd_timer into the global timer list while it still carries
hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop),
and only afterwards sets timer->private_data = substream.
Once the timer is on the list under register_mutex, a concurrent
reader can already reach it through the same mutex and invoke these
callbacks. /proc/asound/timers does this via c_resolution(), and
snd_timer_open()+snd_timer_start() reach start()/stop() the same way.
All three dereference timer->private_data, which for this brief
window is NULL, giving a NULL-pointer dereference:
substream = timer->private_data;
return substream->runtime ? ... // substream is NULL
Move the private_data/private_free assignment before
snd_device_register() so the timer is never visible on the list
without its private_data set. On the snd_device_register() failure
path, private_free() (snd_pcm_timer_free()) can now run, but it only
does substream->timer = NULL, which is already NULL at that point
since substream->timer is set to the new timer just once, after a
successful registration -- so the failure path stays safe.
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=19da64013c46df87f971
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Nguyen Ngoc Thang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Takashi Iwai <[email protected]>
133 lines
3.1 KiB
C
133 lines
3.1 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Digital Audio (PCM) abstract layer
|
|
* Copyright (c) by Jaroslav Kysela <[email protected]>
|
|
*/
|
|
|
|
#include <linux/time.h>
|
|
#include <linux/gcd.h>
|
|
#include <sound/core.h>
|
|
#include <sound/pcm.h>
|
|
#include <sound/timer.h>
|
|
|
|
#include "pcm_local.h"
|
|
|
|
/*
|
|
* Timer functions
|
|
*/
|
|
|
|
void snd_pcm_timer_resolution_change(struct snd_pcm_substream *substream)
|
|
{
|
|
unsigned long rate, mult, fsize, l, post;
|
|
struct snd_pcm_runtime *runtime = substream->runtime;
|
|
|
|
mult = 1000000000;
|
|
rate = runtime->rate;
|
|
if (snd_BUG_ON(!rate))
|
|
return;
|
|
l = gcd(mult, rate);
|
|
mult /= l;
|
|
rate /= l;
|
|
fsize = runtime->period_size;
|
|
if (snd_BUG_ON(!fsize))
|
|
return;
|
|
l = gcd(rate, fsize);
|
|
rate /= l;
|
|
fsize /= l;
|
|
post = 1;
|
|
while ((mult * fsize) / fsize != mult) {
|
|
mult /= 2;
|
|
post *= 2;
|
|
}
|
|
if (rate == 0) {
|
|
pcm_err(substream->pcm,
|
|
"pcm timer resolution out of range (rate = %u, period_size = %lu)\n",
|
|
runtime->rate, runtime->period_size);
|
|
runtime->timer_resolution = -1;
|
|
return;
|
|
}
|
|
runtime->timer_resolution = (mult * fsize / rate) * post;
|
|
}
|
|
|
|
static unsigned long snd_pcm_timer_resolution(struct snd_timer * timer)
|
|
{
|
|
struct snd_pcm_substream *substream;
|
|
|
|
substream = timer->private_data;
|
|
return substream->runtime ? substream->runtime->timer_resolution : 0;
|
|
}
|
|
|
|
static int snd_pcm_timer_start(struct snd_timer * timer)
|
|
{
|
|
struct snd_pcm_substream *substream;
|
|
|
|
substream = snd_timer_chip(timer);
|
|
substream->timer_running = 1;
|
|
return 0;
|
|
}
|
|
|
|
static int snd_pcm_timer_stop(struct snd_timer * timer)
|
|
{
|
|
struct snd_pcm_substream *substream;
|
|
|
|
substream = snd_timer_chip(timer);
|
|
substream->timer_running = 0;
|
|
return 0;
|
|
}
|
|
|
|
static const struct snd_timer_hardware snd_pcm_timer =
|
|
{
|
|
.flags = SNDRV_TIMER_HW_AUTO | SNDRV_TIMER_HW_SLAVE,
|
|
.resolution = 0,
|
|
.ticks = 1,
|
|
.c_resolution = snd_pcm_timer_resolution,
|
|
.start = snd_pcm_timer_start,
|
|
.stop = snd_pcm_timer_stop,
|
|
};
|
|
|
|
/*
|
|
* Init functions
|
|
*/
|
|
|
|
static void snd_pcm_timer_free(struct snd_timer *timer)
|
|
{
|
|
struct snd_pcm_substream *substream = timer->private_data;
|
|
substream->timer = NULL;
|
|
}
|
|
|
|
void snd_pcm_timer_init(struct snd_pcm_substream *substream)
|
|
{
|
|
struct snd_timer_id tid;
|
|
struct snd_timer *timer;
|
|
|
|
tid.dev_sclass = SNDRV_TIMER_SCLASS_NONE;
|
|
tid.dev_class = SNDRV_TIMER_CLASS_PCM;
|
|
tid.card = substream->pcm->card->number;
|
|
tid.device = substream->pcm->device;
|
|
tid.subdevice = (substream->number << 1) | (substream->stream & 1);
|
|
if (snd_timer_new(substream->pcm->card, "PCM", &tid, &timer) < 0)
|
|
return;
|
|
sprintf(timer->name, "PCM %s %i-%i-%i",
|
|
snd_pcm_direction_name(substream->stream),
|
|
tid.card, tid.device, tid.subdevice);
|
|
timer->hw = snd_pcm_timer;
|
|
/* Set before registering: a concurrent reader can invoke our hw
|
|
* callbacks as soon as the timer is on the global list.
|
|
*/
|
|
timer->private_data = substream;
|
|
timer->private_free = snd_pcm_timer_free;
|
|
if (snd_device_register(timer->card, timer) < 0) {
|
|
snd_device_free(timer->card, timer);
|
|
return;
|
|
}
|
|
substream->timer = timer;
|
|
}
|
|
|
|
void snd_pcm_timer_done(struct snd_pcm_substream *substream)
|
|
{
|
|
if (substream->timer) {
|
|
snd_device_free(substream->pcm->card, substream->timer);
|
|
substream->timer = NULL;
|
|
}
|
|
}
|