Unverified Commit 091bfd85 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5725 ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs 

Merge Pull Request from: @ci-robot 
 
PR sync from: liwei <liwei728@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/4CBR6ZRMS5XLJ77QZAPPARWW27OQ2IR7/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9DD86 
 
Link:https://gitee.com/openeuler/kernel/pulls/5725

 

Reviewed-by: default avatarWei Li <liwei391@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parents 89d647a2 7b10cb80

sound/sh/aica.c

+14 −3
Original line number Diff line number Diff line
@@ -278,6 +278,7 @@ static void run_spu_dma(struct work_struct *work) 
		dreamcastcard->clicks++;

		if (unlikely(dreamcastcard->clicks >= AICA_PERIOD_NUMBER))

			dreamcastcard->clicks %= AICA_PERIOD_NUMBER;

		if (snd_pcm_running(dreamcastcard->substream))

			mod_timer(&dreamcastcard->timer, jiffies + 1);

	}

}
@@ -290,6 +291,8 @@ static void aica_period_elapsed(struct timer_list *t) 
	/*timer function - so cannot sleep */

	int play_period;

	struct snd_pcm_runtime *runtime;

	if (!snd_pcm_running(substream))

		return;

	runtime = substream->runtime;

	dreamcastcard = substream->pcm->private_data;

	/* Have we played out an additional period? */
@@ -350,12 +353,19 @@ static int snd_aicapcm_pcm_open(struct snd_pcm_substream 
	return 0;

}



static int snd_aicapcm_pcm_sync_stop(struct snd_pcm_substream *substream)

{

	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;



	del_timer_sync(&dreamcastcard->timer);

	cancel_work_sync(&dreamcastcard->spu_dma_work);

	return 0;

}



static int snd_aicapcm_pcm_close(struct snd_pcm_substream

				 *substream)

{

	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;

	flush_work(&(dreamcastcard->spu_dma_work));

	del_timer(&dreamcastcard->timer);

	dreamcastcard->substream = NULL;

	kfree(dreamcastcard->channel);

	spu_disable();
@@ -401,6 +411,7 @@ static const struct snd_pcm_ops snd_aicapcm_playback_ops = { 
	.prepare = snd_aicapcm_pcm_prepare,

	.trigger = snd_aicapcm_pcm_trigger,

	.pointer = snd_aicapcm_pcm_pointer,

	.sync_stop = snd_aicapcm_pcm_sync_stop,

};



/* TO DO: set up to handle more than one pcm instance */