ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer

commit 47c27c9c9c720bc93fdc69605d0ecd9382e99047 upstream.

Handle the error code from snd_pcm_buffer_access_lock() in
snd_pcm_runtime_buffer_set_silence() function.

Found by Alexandros Panagiotou <apanagio@redhat.com>

Fixes: 93a81ca06577 ("ALSA: pcm: Fix race of buffer access at PCM OSS layer")
Cc: stable@vger.kernel.org # 6.15
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Link: https://patch.msgid.link/20260107213642.332954-1-perex@perex.cz
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index d9baf24b8cebfdcc72aeb059a71b8e35d55361c7..43586392b6134683288dbb3c7da1f79b9bb698be 100644 (file)
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -1428,7 +1428,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream, struct vm_area_s
 #define snd_pcm_lib_mmap_iomem NULL
 #endif
 
-void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime);
+int snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime);
 
 /**
  * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer

diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 4ecb17bd5436e7829d607e0be03c794768eb4632..9f8dabe2727cebb2ef2bf2a6adc0a810ea8ed887 100644 (file)
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1074,7 +1074,9 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
        runtime->oss.params = 0;
        runtime->oss.prepare = 1;
        runtime->oss.buffer_used = 0;
-       snd_pcm_runtime_buffer_set_silence(runtime);
+       err = snd_pcm_runtime_buffer_set_silence(runtime);
+       if (err < 0)
+               goto failure;
 
        runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size);
 

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index d15de21f6ebf09fa86f617d055b53e252a75126e..6417178ca0978643fba304a93396c69c392bdbd9 100644 (file)
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -730,13 +730,18 @@ static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime)
 }
 
 /* fill the PCM buffer with the current silence format; called from pcm_oss.c */
-void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime)
+int snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime)
 {
-       snd_pcm_buffer_access_lock(runtime);
+       int err;
+
+       err = snd_pcm_buffer_access_lock(runtime);
+       if (err < 0)
+               return err;
        if (runtime->dma_area)
                snd_pcm_format_set_silence(runtime->format, runtime->dma_area,
                                           bytes_to_samples(runtime, runtime->dma_bytes));
        snd_pcm_buffer_access_unlock(runtime);
+       return 0;
 }
 EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence);