DivestOS/Patches/Linux_CVEs/CVE-2016-8391/ANY/0001.patch
2017-11-07 17:32:46 -05:00

80 lines
2.9 KiB
Diff

From 30a4f0783d2978e27a8b8856d8e358ccaf5ddab4 Mon Sep 17 00:00:00 2001
From: Walter Yang <yandongy@codeaurora.org>
Date: Thu, 13 Oct 2016 10:48:39 +0800
Subject: ASoC: msm: lock read/write when add/free audio ion memory
As read/write get access to ion memory region as well, it's
necessary to lock them when ion memory is about to be added/freed
to avoid racing cases.
CRs-Fixed: 1071809
Change-Id: I436ead23c93384961b38ca99b9312a40c50ad03a
Signed-off-by: Walter Yang <yandongy@codeaurora.org>
---
arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
diff --git a/arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c b/arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c
index 5bdd10a..4455368 100644
--- a/arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c
+++ b/arch/arm/mach-msm/qdsp6v2/audio_utils_aio.c
@@ -1,6 +1,6 @@
/* Copyright (C) 2008 Google, Inc.
* Copyright (C) 2008 HTC Corporation
- * Copyright (c) 2009-2013, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2009-2013,2016 The Linux Foundation. All rights reserved.
*
* This software is licensed under the terms of the GNU General Public
* License version 2, as published by the Free Software Foundation, and
@@ -562,6 +562,8 @@ int audio_aio_release(struct inode *inode, struct file *file)
struct q6audio_aio *audio = file->private_data;
pr_debug("%s[%p]\n", __func__, audio);
mutex_lock(&audio->lock);
+ mutex_lock(&audio->read_lock);
+ mutex_lock(&audio->write_lock);
audio->wflush = 1;
if (audio->enabled)
audio_aio_flush(audio);
@@ -577,6 +579,8 @@ int audio_aio_release(struct inode *inode, struct file *file)
audio_aio_reset_event_queue(audio);
q6asm_audio_client_free(audio->ac);
mutex_unlock(&audio->lock);
+ mutex_unlock(&audio->write_lock);
+ mutex_unlock(&audio->read_lock);
mutex_destroy(&audio->lock);
mutex_destroy(&audio->read_lock);
mutex_destroy(&audio->write_lock);
@@ -1349,8 +1353,13 @@ long audio_aio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
mutex_lock(&audio->lock);
if (copy_from_user(&info, (void *)arg, sizeof(info)))
rc = -EFAULT;
- else
+ else{
+ mutex_lock(&audio->read_lock);
+ mutex_lock(&audio->write_lock);
rc = audio_aio_ion_add(audio, &info);
+ mutex_unlock(&audio->write_lock);
+ mutex_unlock(&audio->read_lock);
+ }
mutex_unlock(&audio->lock);
break;
}
@@ -1360,8 +1369,13 @@ long audio_aio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
pr_debug("%s[%p]:AUDIO_DEREGISTER_ION\n", __func__, audio);
if (copy_from_user(&info, (void *)arg, sizeof(info)))
rc = -EFAULT;
- else
+ else{
+ mutex_lock(&audio->read_lock);
+ mutex_lock(&audio->write_lock);
rc = audio_aio_ion_remove(audio, &info);
+ mutex_unlock(&audio->write_lock);
+ mutex_unlock(&audio->read_lock);
+ }
mutex_unlock(&audio->lock);
break;
}
--
cgit v1.1