lkml.org 
[lkml]   [2020]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.7 139/388] ALSA: usb-audio: Fix racy list management in output queue
    Date
    From: Takashi Iwai <tiwai@suse.de>

    [ Upstream commit 5b6cc38f3f3f37109ce72b60bda215a5f6892c0b ]

    The linked list entry from FIFO is peeked at
    queue_pending_output_urbs() but the actual element pop-out is
    performed outside the spinlock, and it's potentially racy.

    Do delete the link at the right place inside the spinlock.

    Fixes: 8fdff6a319e7 ("ALSA: snd-usb: implement new endpoint streaming model")
    Link: https://lore.kernel.org/r/20200424074016.14301-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    sound/usb/endpoint.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
    index d8dc7cb56d43..50104f658ed4 100644
    --- a/sound/usb/endpoint.c
    +++ b/sound/usb/endpoint.c
    @@ -346,17 +346,17 @@ static void queue_pending_output_urbs(struct snd_usb_endpoint *ep)
    ep->next_packet_read_pos %= MAX_URBS;

    /* take URB out of FIFO */
    - if (!list_empty(&ep->ready_playback_urbs))
    + if (!list_empty(&ep->ready_playback_urbs)) {
    ctx = list_first_entry(&ep->ready_playback_urbs,
    struct snd_urb_ctx, ready_list);
    + list_del_init(&ctx->ready_list);
    + }
    }
    spin_unlock_irqrestore(&ep->lock, flags);

    if (ctx == NULL)
    return;

    - list_del_init(&ctx->ready_list);
    -
    /* copy over the length information */
    for (i = 0; i < packet->packets; i++)
    ctx->packet_size[i] = packet->packet_size[i];
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-18 04:45    [W:3.746 / U:1.500 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site