Unverified Commit 21f8f50c authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5718 CVE-2024-26654 

Merge Pull Request from: @ci-robot 
 
PR sync from: liwei <liwei728@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/AHCPVFUDRK4XKI3EQILNIRMVCAF4LURP/ 
CVE-2024-26654

Duoming Zhou (1):
  ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs

Takashi Iwai (1):
  ALSA: aica: Fix a long-time build breakage


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I9DD86 
 
Link:https://gitee.com/openeuler/kernel/pulls/5718

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarWei Li <liwei391@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 491f9044 6c1e3e8a

sound/sh/aica.c

+17 −12
Original line number Diff line number Diff line
@@ -295,6 +295,7 @@ static void run_spu_dma(struct work_struct *work) 
		dreamcastcard->clicks++;

		if (unlikely(dreamcastcard->clicks >= AICA_PERIOD_NUMBER))

			dreamcastcard->clicks %= AICA_PERIOD_NUMBER;

		if (snd_pcm_running(dreamcastcard->substream))

			mod_timer(&dreamcastcard->timer, jiffies + 1);

	}

}
@@ -303,10 +304,12 @@ static void aica_period_elapsed(struct timer_list *t) 
{

	struct snd_card_aica *dreamcastcard = from_timer(dreamcastcard,

							      t, timer);

	struct snd_pcm_substream *substream = dreamcastcard->timer_substream;

	struct snd_pcm_substream *substream = dreamcastcard->substream;

	/*timer function - so cannot sleep */

	int play_period;

	struct snd_pcm_runtime *runtime;

	if (!snd_pcm_running(substream))

		return;

	runtime = substream->runtime;

	dreamcastcard = substream->pcm->private_data;

	/* Have we played out an additional period? */
@@ -335,13 +338,6 @@ static void spu_begin_dma(struct snd_pcm_substream *substream) 
	dreamcastcard = substream->pcm->private_data;

	/*get the queue to do the work */

	schedule_work(&(dreamcastcard->spu_dma_work));

	/* Timer may already be running */

	if (unlikely(dreamcastcard->timer_substream)) {

		mod_timer(&dreamcastcard->timer, jiffies + 4);

		return;

	}

	timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);

	dreamcastcard->timer_substream = substream;

	mod_timer(&dreamcastcard->timer, jiffies + 4);

}
@@ -374,13 +370,20 @@ static int snd_aicapcm_pcm_open(struct snd_pcm_substream 
	return 0;

}



static int snd_aicapcm_pcm_sync_stop(struct snd_pcm_substream *substream)

{

	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;



	del_timer_sync(&dreamcastcard->timer);

	cancel_work_sync(&dreamcastcard->spu_dma_work);

	return 0;

}



static int snd_aicapcm_pcm_close(struct snd_pcm_substream

				 *substream)

{

	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;

	flush_work(&(dreamcastcard->spu_dma_work));

	if (dreamcastcard->timer_substream)

		del_timer(&dreamcastcard->timer);

	dreamcastcard->substream = NULL;

	kfree(dreamcastcard->channel);

	spu_disable();

	return 0;
@@ -445,6 +448,7 @@ static const struct snd_pcm_ops snd_aicapcm_playback_ops = { 
	.prepare = snd_aicapcm_pcm_prepare,

	.trigger = snd_aicapcm_pcm_trigger,

	.pointer = snd_aicapcm_pcm_pointer,

	.sync_stop = snd_aicapcm_pcm_sync_stop,

};



/* TO DO: set up to handle more than one pcm instance */
@@ -615,6 +619,7 @@ static int snd_aica_probe(struct platform_device *devptr) 
	       "Yamaha AICA Super Intelligent Sound Processor for SEGA Dreamcast");

	/* Prepare to use the queue */

	INIT_WORK(&(dreamcastcard->spu_dma_work), run_spu_dma);

	timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);

	/* Load the PCM 'chip' */

	err = snd_aicapcmchip(dreamcastcard, 0);

	if (unlikely(err < 0))