stuartl/linux-mainline
1
0
Fork 0
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux synced 2025-11-04 08:34:47 +10:00
Code Issues Releases Wiki Activity

ALSA: compress_offload: fix remaining descriptor races in sound/core/compress_offload.c

Browse Source 
3d3f43fab4 ("ALSA: compress_offload: improve file descriptors
installation for dma-buf") fixed some of descriptor races in
snd_compr_task_new(), but there's a couple more left.

We need to grab the references to dmabuf before moving them into
descriptor table - trying to do that by descriptor afterwards might
end up getting a different object, with a dangling reference left in
task->{input,output}

Fixes: 3d3f43fab4 ("ALSA: compress_offload: improve file descriptors installation for dma-buf")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://patch.msgid.link/20241229185232.GA1977892@ZenIV
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Al Viro 2024-12-29 18:52:32 +00:00 committed by Takashi Iwai
parent ac9fae799e
commit 7439b39521
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sound/core/compress_offload.c
View File

@ -1053,13 +1053,13 @@ static int snd_compr_task_new(struct snd_compr_stream *stream, struct snd_compr_
put_unused_fd(fd_i);
goto cleanup;
}
/* keep dmabuf reference until freed with task free ioctl */
get_dma_buf(task->input);
get_dma_buf(task->output);
fd_install(fd_i, task->input->file);
fd_install(fd_o, task->output->file);
utask->input_fd = fd_i;
utask->output_fd = fd_o;
/* keep dmabuf reference until freed with task free ioctl */
dma_buf_get(utask->input_fd);
dma_buf_get(utask->output_fd);
list_add_tail(&task->list, &stream->runtime->tasks);
stream->runtime->total_tasks++;
return 0;