ALSA: pcm: Use deferred fasync helper

[ Upstream commit 96b097091c66df4f6fbf5cbff21df6cc02a2f055 ]

For avoiding the potential deadlock via kill_fasync() call, use the
new fasync helpers to defer the invocation from timer API.  Note that
it's merely a workaround.

Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com
Reported-by: syzbot+669c9abf11a6a011dd09@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20220728125945.29533-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index 6b99310b5b8890bd7ceacbae4f347a30c6a0324f..6987110843f038d75e4c6590090af89491641288 100644 (file)
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -399,7 +399,7 @@ struct snd_pcm_runtime {
        snd_pcm_uframes_t twake;        /* do transfer (!poll) wakeup if non-zero */
        wait_queue_head_t sleep;        /* poll sleep */
        wait_queue_head_t tsleep;       /* transfer sleep */
-       struct fasync_struct *fasync;
+       struct snd_fasync *fasync;
        bool stop_operating;            /* sync_stop will be called */
        struct mutex buffer_mutex;      /* protect for buffer changes */
        atomic_t buffer_accessing;      /* >0: in r/w operation, <0: blocked */

diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 977d54320a5cabd858f6fce624de9c4f9fd430d0..c917ac84a7e588911f0984237b57699968451d5b 100644 (file)
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -1005,6 +1005,7 @@ void snd_pcm_detach_substream(struct snd_pcm_substream *substream)
                substream->runtime = NULL;
        }
        mutex_destroy(&runtime->buffer_mutex);
+       snd_fasync_free(runtime->fasync);
        kfree(runtime);
        put_pid(substream->pid);
        substream->pid = NULL;

diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 1fc7c50ffa625bc3ec38486b1cf251c96acb39b4..40751e5aff09f13f665e0fed717210a2bdad1086 100644 (file)
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1822,7 +1822,7 @@ void snd_pcm_period_elapsed_under_stream_lock(struct snd_pcm_substream *substrea
                snd_timer_interrupt(substream->timer, 1);
 #endif
  _end:
-       kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
+       snd_kill_fasync(runtime->fasync, SIGIO, POLL_IN);
 }
 EXPORT_SYMBOL(snd_pcm_period_elapsed_under_stream_lock);
 

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 4adaee62ef33329d2f3f4d967be9be7d9b26dbbd..16fcf57c6f030482eacc4db7cb85ee10de776fdc 100644 (file)
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3945,7 +3945,7 @@ static int snd_pcm_fasync(int fd, struct file * file, int on)
        runtime = substream->runtime;
        if (runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
                return -EBADFD;
-       return fasync_helper(fd, file, on, &runtime->fasync);
+       return snd_fasync_helper(fd, file, on, &runtime->fasync);
 }
 
 /*