On Tue, 20 Oct 2015 11:46:31 +0200,
Lars-Peter Clausen wrote:
>
> Use the new dmaengine_synchronize() function to make sure that all complete
> callbacks have finished running before the runtime data, which is accessed
> in the completed callback, is freed.
>
> This fixes a long standing use-after-free race condition that has been
> observed on some systems.
What if a substream is restarted immediately after the stop?
Takashi
>
> Signed-off-by: Lars-Peter Clausen <lars@xxxxxxxxxx>
> ---
> sound/core/pcm_dmaengine.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c
> index fba365a..697c166 100644
> --- a/sound/core/pcm_dmaengine.c
> +++ b/sound/core/pcm_dmaengine.c
> @@ -202,13 +202,13 @@ int snd_dmaengine_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
> if (runtime->info & SNDRV_PCM_INFO_PAUSE)
> dmaengine_pause(prtd->dma_chan);
> else
> - dmaengine_terminate_all(prtd->dma_chan);
> + dmaengine_terminate_async(prtd->dma_chan);
> break;
> case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
> dmaengine_pause(prtd->dma_chan);
> break;
> case SNDRV_PCM_TRIGGER_STOP:
> - dmaengine_terminate_all(prtd->dma_chan);
> + dmaengine_terminate_async(prtd->dma_chan);
> break;
> default:
> return -EINVAL;
> @@ -346,6 +346,7 @@ int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream)
> {
> struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
>
> + dmaengine_synchronize(prtd->dma_chan);
> kfree(prtd);
>
> return 0;
> @@ -362,9 +363,11 @@ int snd_dmaengine_pcm_close_release_chan(struct snd_pcm_substream *substream)
> {
> struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream);
>
> + dmaengine_synchronize(prtd->dma_chan);
> dma_release_channel(prtd->dma_chan);
> + kfree(prtd);
>
> - return snd_dmaengine_pcm_close(substream);
> + return 0;
> }
> EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_close_release_chan);
>
> --
> 2.1.4
>
>
--
To unsubscribe from this list: send the line "unsubscribe dmaengine" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
