From patchwork Wed Jul 15 17:23:14 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Lopez Cruz, Misael" X-Patchwork-Id: 6799781 Return-Path: X-Original-To: patchwork-alsa-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 87148C05AC for ; Wed, 15 Jul 2015 17:23:42 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id B406D206B5 for ; Wed, 15 Jul 2015 17:23:41 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.kernel.org (Postfix) with ESMTP id 45AF5206C7 for ; Wed, 15 Jul 2015 17:23:40 +0000 (UTC) Received: by alsa0.perex.cz (Postfix, from userid 1000) id BD6BB265DF8; Wed, 15 Jul 2015 19:23:38 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from alsa0.perex.cz (localhost [IPv6:::1]) by alsa0.perex.cz (Postfix) with ESMTP id 7E0D8265D9F; Wed, 15 Jul 2015 19:23:26 +0200 (CEST) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 7EE11265DA4; Wed, 15 Jul 2015 19:23:24 +0200 (CEST) Received: from bear.ext.ti.com (bear.ext.ti.com [192.94.94.41]) by alsa0.perex.cz (Postfix) with ESMTP id E8C04265D92 for ; Wed, 15 Jul 2015 19:23:16 +0200 (CEST) Received: from dlelxv90.itg.ti.com ([172.17.2.17]) by bear.ext.ti.com (8.13.7/8.13.7) with ESMTP id t6FHNFKW015494; Wed, 15 Jul 2015 12:23:15 -0500 Received: from DFLE73.ent.ti.com (dfle73.ent.ti.com [128.247.5.110]) by dlelxv90.itg.ti.com (8.14.3/8.13.8) with ESMTP id t6FHNEk0010828; Wed, 15 Jul 2015 12:23:14 -0500 Received: from dlep32.itg.ti.com (157.170.170.100) by DFLE73.ent.ti.com (128.247.5.110) with Microsoft SMTP Server id 14.3.224.2; Wed, 15 Jul 2015 12:22:50 -0500 Received: from legion.dal.design.ti.com (legion.dal.design.ti.com [128.247.22.53]) by dlep32.itg.ti.com (8.14.3/8.13.8) with ESMTP id t6FHNEns014803; Wed, 15 Jul 2015 12:23:14 -0500 Received: from localhost ([128.247.91.174]) by legion.dal.design.ti.com (8.11.7p1+Sun/8.11.7) with ESMTP id t6FHNE908323; Wed, 15 Jul 2015 12:23:14 -0500 (CDT) From: Misael Lopez Cruz To: Date: Wed, 15 Jul 2015 12:23:14 -0500 Message-ID: <1436980994-29340-1-git-send-email-misael.lopez@ti.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 Cc: Peter Ujfalusi , Misael Lopez Cruz , Mark Brown , Liam Girdwood , Lars-Peter Clausen Subject: [alsa-devel] [PATCH] ALSA: pcm_dmaengine: Run complete cb only if runtime check passes X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP The DMA complete callback uses substream's runtime data, so make sure the runtime check passes before going forward. The callback could run while the stream is closing or after it's already closed. By then, the substream's runtime data might already been freed and cause NULL pointer dereferences. Signed-off-by: Misael Lopez Cruz Reviewed-by: Peter Ujfalusi --- sound/core/pcm_dmaengine.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c index fba365a..061a8f7 100644 --- a/sound/core/pcm_dmaengine.c +++ b/sound/core/pcm_dmaengine.c @@ -133,7 +133,12 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_set_config_from_dai_data); static void dmaengine_pcm_dma_complete(void *arg) { struct snd_pcm_substream *substream = arg; - struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); + struct dmaengine_pcm_runtime_data *prtd; + + if (PCM_RUNTIME_CHECK(substream)) + return; + + prtd = substream_to_prtd(substream); prtd->pos += snd_pcm_lib_period_bytes(substream); if (prtd->pos >= snd_pcm_lib_buffer_bytes(substream))