ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()

If the nullity check for `substream->runtime` is outside of the lock
region, it is possible to have a null runtime in the critical section
if snd_pcm_detach_substream is called right before the lock.

Signed-off-by: paulhsia <paulhsia@chromium.org>
Link: https://lore.kernel.org/r/20191112171715.128727-2-paulhsia@chromium.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index d80041ea4e01c22e9b0e21383d38cbcc6424b7a8..2236b5e0c1f25d04e2ca2f2fa91114e118a4c47d 100644 (file)
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1782,11 +1782,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
        struct snd_pcm_runtime *runtime;
        unsigned long flags;
 
-       if (PCM_RUNTIME_CHECK(substream))
+       if (snd_BUG_ON(!substream))
                return;
-       runtime = substream->runtime;
 
        snd_pcm_stream_lock_irqsave(substream, flags);
+       if (PCM_RUNTIME_CHECK(substream))
+               goto _unlock;
+       runtime = substream->runtime;
+
        if (!snd_pcm_running(substream) ||
            snd_pcm_update_hw_ptr0(substream, 1) < 0)
                goto _end;
@@ -1797,6 +1800,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
 #endif
  _end:
        kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
+ _unlock:
        snd_pcm_stream_unlock_irqrestore(substream, flags);
 }
 EXPORT_SYMBOL(snd_pcm_period_elapsed);