ALSA: pcm: Use deferred fasync helper

For avoiding the potential deadlock via kill_fasync() call, use the
new fasync helpers to defer the invocation from timer API.  Note that
it's merely a workaround.

Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com
Reported-by: syzbot+669c9abf11a6a011dd09@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20220728125945.29533-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index 2d03c10f6a360f688101b07e82233ae3df3e5d2f..8c48a5bce88c166026fdece07e60603eba733ef9 100644 (file)
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -399,7 +399,7 @@ struct snd_pcm_runtime {
        snd_pcm_uframes_t twake;        /* do transfer (!poll) wakeup if non-zero */
        wait_queue_head_t sleep;        /* poll sleep */
        wait_queue_head_t tsleep;       /* transfer sleep */
-       struct fasync_struct *fasync;
+       struct snd_fasync *fasync;
        bool stop_operating;            /* sync_stop will be called */
        struct mutex buffer_mutex;      /* protect for buffer changes */
        atomic_t buffer_accessing;      /* >0: in r/w operation, <0: blocked */

diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 03fc5fa5813efb3fd6ced3c3ba1e825a72cd0809..2ac742035310d3a6796d103d4fdbec0f59f90649 100644 (file)
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -1007,6 +1007,7 @@ void snd_pcm_detach_substream(struct snd_pcm_substream *substream)
                substream->runtime = NULL;
        }
        mutex_destroy(&runtime->buffer_mutex);
+       snd_fasync_free(runtime->fasync);
        kfree(runtime);
        put_pid(substream->pid);
        substream->pid = NULL;

diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 1fc7c50ffa625bc3ec38486b1cf251c96acb39b4..40751e5aff09f13f665e0fed717210a2bdad1086 100644 (file)
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1822,7 +1822,7 @@ void snd_pcm_period_elapsed_under_stream_lock(struct snd_pcm_substream *substrea
                snd_timer_interrupt(substream->timer, 1);
 #endif
  _end:
-       kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
+       snd_kill_fasync(runtime->fasync, SIGIO, POLL_IN);
 }
 EXPORT_SYMBOL(snd_pcm_period_elapsed_under_stream_lock);
 

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index aa0453e515956ddd3ffe6c29904dfc60a05693c3..ad0541e9e88808424aee75cdfcdc4f4d4098a02b 100644 (file)
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3951,7 +3951,7 @@ static int snd_pcm_fasync(int fd, struct file * file, int on)
        runtime = substream->runtime;
        if (runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
                return -EBADFD;
-       return fasync_helper(fd, file, on, &runtime->fasync);
+       return snd_fasync_helper(fd, file, on, &runtime->fasync);
 }
 
 /*