Skip to contentSkip to conversation

Patch "ALSA: aloop: Release cable upon open error path" has been added to the 4.14-stable tree

PATCH [email protected] 1 participant 1 message Jan 11, 2018

Subsystems (2)
Stable branch Sound
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

ALSA: aloop: Release cable upon open error path

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
alsa-aloop-release-cable-upon-open-error-path.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 9685347aa0a5c2869058ca6ab79fd8e93084a67f Mon Sep 17 00:00:00 2001

From: Takashi Iwai <[email protected]>
Date: Fri, 5 Jan 2018 16:09:47 +0100
Subject: ALSA: aloop: Release cable upon open error path

From: Takashi Iwai <[email protected]>

commit 9685347aa0a5c2869058ca6ab79fd8e93084a67f upstream.

The aloop runtime object and its assignment in the cable are left even when opening a substream fails. This doesn't mean any memory leak, but it still keeps the invalid pointer that may be referred by the another side of the cable spontaneously, which is a potential Oops cause.

Clean up the cable assignment and the empty cable upon the error path properly.

Fixes 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback")
Signed-off-by Takashi Iwai <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 sound/drivers/aloop.c |   38 +++++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 13 deletions(-)
sound/drivers/aloop.c +25 -13
@@ -658,12 +658,31 @@ static int rule_channels(struct snd_pcm_
 	return snd_interval_refine(hw_param_interval(params, rule->var), &t);
 }
 
+static void free_cable(struct snd_pcm_substream *substream)
+{
+	struct loopback *loopback = substream->private_data;
+	int dev = get_cable_index(substream);
+	struct loopback_cable *cable;
+
+	cable = loopback->cables[substream->number][dev];
+	if (!cable)
+		return;
+	if (cable->streams[!substream->stream]) {
+		/* other stream is still alive */
+		cable->streams[substream->stream] = NULL;
+	} else {
+		/* free the cable */
+		loopback->cables[substream->number][dev] = NULL;
+		kfree(cable);
+	}
+}
+
 static int loopback_open(struct snd_pcm_substream *substream)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct loopback *loopback = substream->private_data;
 	struct loopback_pcm *dpcm;
-	struct loopback_cable *cable;
+	struct loopback_cable *cable = NULL;
 	int err = 0;
 	int dev = get_cable_index(substream);
 

@@ -682,7 +701,6 @@ static int loopback_open(struct snd_pcm_
 	if (!cable) {
 		cable = kzalloc(sizeof(*cable), GFP_KERNEL);
 		if (!cable) {
-			kfree(dpcm);
 			err = -ENOMEM;
 			goto unlock;
 		}

@@ -724,6 +742,10 @@ static int loopback_open(struct snd_pcm_
 	else
 		runtime->hw = cable->hw;
  unlock:
+	if (err < 0) {
+		free_cable(substream);
+		kfree(dpcm);
+	}
 	mutex_unlock(&loopback->cable_lock);
 	return err;
 }

@@ -732,20 +754,10 @@ static int loopback_close(struct snd_pcm
 {
 	struct loopback *loopback = substream->private_data;
 	struct loopback_pcm *dpcm = substream->runtime->private_data;
-	struct loopback_cable *cable;
-	int dev = get_cable_index(substream);
 
 	loopback_timer_stop(dpcm);
 	mutex_lock(&loopback->cable_lock);
-	cable = loopback->cables[substream->number][dev];
-	if (cable->streams[!substream->stream]) {
-		/* other stream is still alive */
-		cable->streams[substream->stream] = NULL;
-	} else {
-		/* free the cable */
-		loopback->cables[substream->number][dev] = NULL;
-		kfree(cable);
-	}
+	free_cable(substream);
 	mutex_unlock(&loopback->cable_lock);
 	return 0;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/alsa-pcm-remove-incorrect-snd_bug_on-usages.patch queue-4.14/alsa-aloop-fix-inconsistent-format-due-to-incomplete-rule.patch queue-4.14/alsa-pcm-workaround-for-weird-pulseaudio-behavior-on-rewind-error.patch queue-4.14/alsa-pcm-add-missing-error-checks-in-oss-emulation-plugin-builder.patch queue-4.14/alsa-pcm-abort-properly-at-pending-signal-in-oss-read-write-loops.patch queue-4.14/alsa-pcm-allow-aborting-mutex-lock-at-oss-read-write-loops.patch queue-4.14/alsa-aloop-fix-racy-hw-constraints-adjustment.patch queue-4.14/alsa-aloop-release-cable-upon-open-error-path.patch