-
由 Takashi Iwai 提交于
stable inclusion from linux-4.19.243 commit 47cef5937a43a412405ea54ad6e0a91d2890493e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I50WAS CVE: CVE-2022-1048 -------------------------------- commit 3c3201f8 upstream. Like the previous fixes to hw_params and hw_free ioctl races, we need to paper over the concurrent prepare ioctl calls against hw_params and hw_free, too. This patch implements the locking with the existing runtime->buffer_mutex for prepare ioctls. Unlike the previous case for snd_pcm_hw_hw_params() and snd_pcm_hw_free(), snd_pcm_prepare() is performed to the linked streams, hence the lock can't be applied simply on the top. For tracking the lock in each linked substream, we modify snd_pcm_action_group() slightly and apply the buffer_mutex for the case stream_lock=false (formerly there was no lock applied) there. Cc: <stable@vger.kernel.org> Reviewed-by: NJaroslav Kysela <perex@perex.cz> Link: https://lore.kernel.org/r/20220322170720.3529-4-tiwai@suse.deSigned-off-by: NTakashi Iwai <tiwai@suse.de> [OP: backport to 4.19: adjusted context] Signed-off-by: NOvidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: NRui Xiang <rui.xiang@huawei.com> Reviewed-by: Nzhangxiaoxu <zhangxiaoxu5@huawei.com> Reviewed-by: NXiu Jianfeng <xiujianfeng@huawei.com> Signed-off-by: NYongqiang Liu <liuyongqiang13@huawei.com>
2c34260b