ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams

BugLink: http://bugs.launchpad.net/bugs/1773233
commit 40cab6e88cb0b6c56d3f30b7491a20e803f948f6 upstream.

OSS PCM stream management isn't modal but it allows ioctls issued at
any time for changing the parameters.  In the previous hardening
patch ("ALSA: pcm: Avoid potential races between OSS ioctls and
read/write"), we covered these races and prevent the corruption by
protecting the concurrent accesses via params_lock mutex.  However,
this means that some ioctls that try to change the stream parameter
(e.g. channels or format) would be blocked until the read/write
finishes, and it may take really long.

Basically changing the parameter while reading/writing is an invalid
operation, hence it's even more user-friendly from the API POV if it
returns -EBUSY in such a situation.

This patch adds such checks in the relevant ioctls with the addition
of read/write access refcount.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Acked-by: Khalid Elmously <khalid.elmously@canonical.com>
Acked-by: Brad Figg <brad.figg@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/include/sound/pcm_oss.h b/include/sound/pcm_oss.h
index 760c969d885d542997010ad8486662fc35731088..12bbf8c8111209f134387d7380a1b7f8e06050ec 100644 (file)
--- a/include/sound/pcm_oss.h
+++ b/include/sound/pcm_oss.h
@@ -57,6 +57,7 @@ struct snd_pcm_oss_runtime {
        char *buffer;                           /* vmallocated period */
        size_t buffer_used;                     /* used length from period buffer */
        struct mutex params_lock;
+       atomic_t rw_ref;                /* concurrent read/write accesses */
 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
        struct snd_pcm_plugin *plugin_first;
        struct snd_pcm_plugin *plugin_last;

diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index c526cef424bd76bd85a3e681c8dc5e54983d9445..07bb3afa18b0cd63dbb540b6174f604a462cdb96 100644 (file)
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1370,6 +1370,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
        if (atomic_read(&substream->mmap_count))
                return -ENXIO;
 
+       atomic_inc(&runtime->oss.rw_ref);
        while (bytes > 0) {
                if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
                        tmp = -ERESTARTSYS;
@@ -1433,6 +1434,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
                }
                tmp = 0;
        }
+       atomic_dec(&runtime->oss.rw_ref);
        return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp;
 }
 
@@ -1478,6 +1480,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
        if (atomic_read(&substream->mmap_count))
                return -ENXIO;
 
+       atomic_inc(&runtime->oss.rw_ref);
        while (bytes > 0) {
                if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
                        tmp = -ERESTARTSYS;
@@ -1526,6 +1529,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
                }
                tmp = 0;
        }
+       atomic_dec(&runtime->oss.rw_ref);
        return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp;
 }
 
@@ -1632,8 +1636,11 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
                        goto __direct;
                if ((err = snd_pcm_oss_make_ready(substream)) < 0)
                        return err;
-               if (mutex_lock_interruptible(&runtime->oss.params_lock))
+               atomic_inc(&runtime->oss.rw_ref);
+               if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
+                       atomic_dec(&runtime->oss.rw_ref);
                        return -ERESTARTSYS;
+               }
                format = snd_pcm_oss_format_from(runtime->oss.format);
                width = snd_pcm_format_physical_width(format);
                if (runtime->oss.buffer_used > 0) {
@@ -1645,10 +1652,8 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
                                                   runtime->oss.buffer + runtime->oss.buffer_used,
                                                   size);
                        err = snd_pcm_oss_sync1(substream, runtime->oss.period_bytes);
-                       if (err < 0) {
-                               mutex_unlock(&runtime->oss.params_lock);
-                               return err;
-                       }
+                       if (err < 0)
+                               goto unlock;
                } else if (runtime->oss.period_ptr > 0) {
 #ifdef OSS_DEBUG
                        pcm_dbg(substream->pcm, "sync: period_ptr\n");
@@ -1658,10 +1663,8 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
                                                   runtime->oss.buffer,
                                                   size * 8 / width);
                        err = snd_pcm_oss_sync1(substream, size);
-                       if (err < 0) {
-                               mutex_unlock(&runtime->oss.params_lock);
-                               return err;
-                       }
+                       if (err < 0)
+                               goto unlock;
                }
                /*
                 * The ALSA's period might be a bit large than OSS one.
@@ -1675,7 +1678,11 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
                        else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED)
                                snd_pcm_lib_writev(substream, NULL, size);
                }
+unlock:
                mutex_unlock(&runtime->oss.params_lock);
+               atomic_dec(&runtime->oss.rw_ref);
+               if (err < 0)
+                       return err;
                /*
                 * finish sync: drain the buffer
                 */
@@ -1723,6 +1730,8 @@ static int snd_pcm_oss_set_rate(struct snd_pcm_oss_file *pcm_oss_file, int rate)
                        rate = 192000;
                if (mutex_lock_interruptible(&runtime->oss.params_lock))
                        return -ERESTARTSYS;
+               if (atomic_read(&runtime->oss.rw_ref))
+                       return -EBUSY;
                if (runtime->oss.rate != rate) {
                        runtime->oss.params = 1;
                        runtime->oss.rate = rate;
@@ -1757,6 +1766,8 @@ static int snd_pcm_oss_set_channels(struct snd_pcm_oss_file *pcm_oss_file, unsig
                runtime = substream->runtime;
                if (mutex_lock_interruptible(&runtime->oss.params_lock))
                        return -ERESTARTSYS;
+               if (atomic_read(&runtime->oss.rw_ref))
+                       return -EBUSY;
                if (runtime->oss.channels != channels) {
                        runtime->oss.params = 1;
                        runtime->oss.channels = channels;
@@ -1847,6 +1858,8 @@ static int snd_pcm_oss_set_format(struct snd_pcm_oss_file *pcm_oss_file, int for
                        if (substream == NULL)
                                continue;
                        runtime = substream->runtime;
+                       if (atomic_read(&runtime->oss.rw_ref))
+                               return -EBUSY;
                        if (mutex_lock_interruptible(&runtime->oss.params_lock))
                                return -ERESTARTSYS;
                        if (runtime->oss.format != format) {
@@ -1901,6 +1914,8 @@ static int snd_pcm_oss_set_subdivide(struct snd_pcm_oss_file *pcm_oss_file, int
                if (substream == NULL)
                        continue;
                runtime = substream->runtime;
+               if (atomic_read(&runtime->oss.rw_ref))
+                       return -EBUSY;
                if (mutex_lock_interruptible(&runtime->oss.params_lock))
                        return -ERESTARTSYS;
                err = snd_pcm_oss_set_subdivide1(substream, subdivide);
@@ -1939,6 +1954,8 @@ static int snd_pcm_oss_set_fragment(struct snd_pcm_oss_file *pcm_oss_file, unsig
                if (substream == NULL)
                        continue;
                runtime = substream->runtime;
+               if (atomic_read(&runtime->oss.rw_ref))
+                       return -EBUSY;
                if (mutex_lock_interruptible(&runtime->oss.params_lock))
                        return -ERESTARTSYS;
                err = snd_pcm_oss_set_fragment1(substream, val);
@@ -2333,6 +2350,7 @@ static void snd_pcm_oss_init_substream(struct snd_pcm_substream *substream,
        runtime->oss.maxfrags = 0;
        runtime->oss.subdivision = 0;
        substream->pcm_release = snd_pcm_oss_release_substream;
+       atomic_set(&runtime->oss.rw_ref, 0);
 }
 
 static int snd_pcm_oss_release_file(struct snd_pcm_oss_file *pcm_oss_file)