diff options
| author | Takashi Iwai <tiwai@suse.de> | 2020-04-24 10:40:16 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-06-24 18:50:22 +0300 |
| commit | d7852661f9fd3c448d05a079ca303a9f151f463d (patch) | |
| tree | 7549495e9b9d4c54bfc0317bf437778b4fd96be6 /sound | |
| parent | aba41867dd66939d336fdf604e4d73b805d8039f (diff) | |
| download | linux-d7852661f9fd3c448d05a079ca303a9f151f463d.tar.xz | |
ALSA: usb-audio: Fix racy list management in output queue
[ Upstream commit 5b6cc38f3f3f37109ce72b60bda215a5f6892c0b ]
The linked list entry from FIFO is peeked at
queue_pending_output_urbs() but the actual element pop-out is
performed outside the spinlock, and it's potentially racy.
Do delete the link at the right place inside the spinlock.
Fixes: 8fdff6a319e7 ("ALSA: snd-usb: implement new endpoint streaming model")
Link: https://lore.kernel.org/r/20200424074016.14301-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/usb/endpoint.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c index d8dc7cb56d43..50104f658ed4 100644 --- a/sound/usb/endpoint.c +++ b/sound/usb/endpoint.c @@ -346,17 +346,17 @@ static void queue_pending_output_urbs(struct snd_usb_endpoint *ep) ep->next_packet_read_pos %= MAX_URBS; /* take URB out of FIFO */ - if (!list_empty(&ep->ready_playback_urbs)) + if (!list_empty(&ep->ready_playback_urbs)) { ctx = list_first_entry(&ep->ready_playback_urbs, struct snd_urb_ctx, ready_list); + list_del_init(&ctx->ready_list); + } } spin_unlock_irqrestore(&ep->lock, flags); if (ctx == NULL) return; - list_del_init(&ctx->ready_list); - /* copy over the length information */ for (i = 0; i < packet->packets; i++) ctx->packet_size[i] = packet->packet_size[i]; |