lkml.org 
[lkml]   [2011]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[003/105] ALSA: Fix yet another race in disconnection
    2.6.38-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Takashi Iwai <tiwai@suse.de>

    commit a45e3d6b13e97506b616980c0f122c3389bcefa4 upstream.

    This patch fixes a race between snd_card_file_remove() and
    snd_card_disconnect(). When the card is added to shutdown_files list
    in snd_card_disconnect(), but it's freed in snd_card_file_remove() at
    the same time, the shutdown_files list gets corrupted. The list member
    must be freed in snd_card_file_remove() as well.

    Reported-and-tested-by: Russ Dill <russ.dill@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    sound/core/init.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/sound/core/init.c
    +++ b/sound/core/init.c
    @@ -848,6 +848,7 @@ int snd_card_file_add(struct snd_card *c
    return -ENOMEM;
    mfile->file = file;
    mfile->disconnected_f_op = NULL;
    + INIT_LIST_HEAD(&mfile->shutdown_list);
    spin_lock(&card->files_lock);
    if (card->shutdown) {
    spin_unlock(&card->files_lock);
    @@ -883,6 +884,9 @@ int snd_card_file_remove(struct snd_card
    list_for_each_entry(mfile, &card->files_list, list) {
    if (mfile->file == file) {
    list_del(&mfile->list);
    + spin_lock(&shutdown_lock);
    + list_del(&mfile->shutdown_list);
    + spin_unlock(&shutdown_lock);
    if (mfile->disconnected_f_op)
    fops_put(mfile->disconnected_f_op);
    found = mfile;



    \
     
     \ /
      Last update: 2011-04-12 17:03    [W:0.018 / U:186.400 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site