diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2024-12-29 19:52:32 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2024-12-30 11:49:38 +0100 |
| commit | 7439b395211874e20c24b2fe0e4903864357a3f5 (patch) | |
| tree | f853ce6c302434e1b5c1275e1c116835fa88cd5e /sound | |
| parent | ALSA: compress_offload: Drop unneeded no_free_ptr() (diff) | |
| download | linux-7439b395211874e20c24b2fe0e4903864357a3f5.tar.xz linux-7439b395211874e20c24b2fe0e4903864357a3f5.zip | |
ALSA: compress_offload: fix remaining descriptor races in sound/core/compress_offload.c
3d3f43fab4cf ("ALSA: compress_offload: improve file descriptors
installation for dma-buf") fixed some of descriptor races in
snd_compr_task_new(), but there's a couple more left.
We need to grab the references to dmabuf before moving them into
descriptor table - trying to do that by descriptor afterwards might
end up getting a different object, with a dangling reference left in
task->{input,output}
Fixes: 3d3f43fab4cf ("ALSA: compress_offload: improve file descriptors installation for dma-buf")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://patch.msgid.link/20241229185232.GA1977892@ZenIV
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/core/compress_offload.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index 4ed6cec5fd5c..840bb9cfe789 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -1053,13 +1053,13 @@ static int snd_compr_task_new(struct snd_compr_stream *stream, struct snd_compr_ put_unused_fd(fd_i); goto cleanup; } + /* keep dmabuf reference until freed with task free ioctl */ + get_dma_buf(task->input); + get_dma_buf(task->output); fd_install(fd_i, task->input->file); fd_install(fd_o, task->output->file); utask->input_fd = fd_i; utask->output_fd = fd_o; - /* keep dmabuf reference until freed with task free ioctl */ - dma_buf_get(utask->input_fd); - dma_buf_get(utask->output_fd); list_add_tail(&task->list, &stream->runtime->tasks); stream->runtime->total_tasks++; return 0; |