Commit 7439b395 authored by Al Viro's avatar Al Viro Committed by Takashi Iwai
Browse files

ALSA: compress_offload: fix remaining descriptor races in sound/core/compress_offload.c 



3d3f43fa ("ALSA: compress_offload: improve file descriptors
installation for dma-buf") fixed some of descriptor races in
snd_compr_task_new(), but there's a couple more left.

We need to grab the references to dmabuf before moving them into
descriptor table - trying to do that by descriptor afterwards might
end up getting a different object, with a dangling reference left in
task->{input,output}

Fixes: 3d3f43fa ("ALSA: compress_offload: improve file descriptors installation for dma-buf")
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Link: https://patch.msgid.link/20241229185232.GA1977892@ZenIV


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent ac9fae79

sound/core/compress_offload.c

+3 −3
Original line number Diff line number Diff line
@@ -1053,13 +1053,13 @@ static int snd_compr_task_new(struct snd_compr_stream *stream, struct snd_compr_ 
		put_unused_fd(fd_i);

		goto cleanup;

	}

	/* keep dmabuf reference until freed with task free ioctl */

	get_dma_buf(task->input);

	get_dma_buf(task->output);

	fd_install(fd_i, task->input->file);

	fd_install(fd_o, task->output->file);

	utask->input_fd = fd_i;

	utask->output_fd = fd_o;

	/* keep dmabuf reference until freed with task free ioctl */

	dma_buf_get(utask->input_fd);

	dma_buf_get(utask->output_fd);

	list_add_tail(&task->list, &stream->runtime->tasks);

	stream->runtime->total_tasks++;

	return 0;