tree 8afb6bf06f9886c2c94d4b73cefbaf4f311d67e8
parent 5d4a9ee58f51ac5f4cfd200b3845cc5d4447f10a
author Takashi Sakamoto <o-takashi@sakamocchi.jp> 1679678290 +0100
committer Alexander Martinz <amartinz@shiftphones.com> 1698213811 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEioN3RtFSeUXyJOKbzxW92aMhqbIFAmU4r7MACgkQzxW92aMh
 qbJEJA/+LLCEWFRQ462icqJR491JnFtN6flyBAHaIZ3aU42NYPBPZ31wn74F0+LV
 Hcy+mz6tdj28/8fLkjlDPSisLIOS7rpzJIk+SNIE99Bcav/NsrvBFS7hCONQ747b
 YEDg8ZlU6whlaFYd1Xe9ndSYF//knzZNjZISHxXNfzve3bHEhu4gfV7JhK3Ok8U4
 fJeaFG7h1iHqtNqPiOQuQp5Wme62Rh3tuiz6w0xHzNEVXX7yxb43Xs7xova5hDyA
 gosrK7Y4d6Gl6nvUB7Uwv2XFZoO94mwxe1GEl1kmAwMxeDXFbG8ytStMNrW4sy5C
 CbL88dM37xaFeaH6R2sdyY9S02u6gxrbWSRnCo/way095cvxVe4lFcIz7+kjCVeI
 mZN0RHGdFDC8aUmLE8M8Y9ptDd1SSo1ZvdA4trsKSa0HLXVSHvhJVBQM8TcAdpTh
 8MH3j9y58+LUXYR0eZTYiIB4GxIlO4Ozb+rzeTTcol9XDIn78LmYMvAZTDk8faNl
 zgG0jv88DkTuPCpVyp3KPnzBnkvMZLKt5NTzqfrJ9fXh7MxcnMzUuCwGeQA2uF0C
 rFe+xlffwYqGrGdb+7tHtnJdpIr3Sgw4oEBScJGA58eHue48wmm07LXkOB/k8fsw
 38mgJAB0G2Idwr46dYyT3oEkgJqIEyYAB/WQaSt7cgDgiXUd7Zc=
 =BtgA
 -----END PGP SIGNATURE-----

ALSA: control: code refactoring for ELEM_READ/ELEM_WRITE operations

commit becf9e5d553c2389d857a3c178ce80fdb34a02e1 upstream.

ALSA control core handles ELEM_READ/ELEM_WRITE requests within lock
acquisition of a counting semaphore. The lock is acquired in helper
functions in the end of call path before calling implementations of each
driver.

ioctl(2) with SNDRV_CTL_ELEM_READ
...
->snd_ctl_ioctl()
  ->snd_ctl_elem_read_user()
    ->snd_ctl_elem_read()
      ->down_read(controls_rwsem)
      ->snd_ctl_find_id()
      ->struct snd_kcontrol.get()
      ->up_read(controls_rwsem)

ioctl(2) with SNDRV_CTL_ELEM_WRITE
...
->snd_ctl_ioctl()
  ->snd_ctl_elem_write_user()
    ->snd_ctl_elem_write()
      ->down_read(controls_rwsem)
      ->snd_ctl_find_id()
      ->struct snd_kcontrol.put()
      ->up_read(controls_rwsem)

This commit moves the lock acquisition to middle of the call graph to
simplify the helper functions. As a result:

ioctl(2) with SNDRV_CTL_ELEM_READ
...
->snd_ctl_ioctl()
  ->snd_ctl_elem_read_user()
    ->down_read(controls_rwsem)
    ->snd_ctl_elem_read()
      ->snd_ctl_find_id()
      ->struct snd_kcontrol.get()
    ->up_read(controls_rwsem)

ioctl(2) with SNDRV_CTL_ELEM_WRITE
...
->snd_ctl_ioctl()
  ->snd_ctl_elem_write_user()
    ->down_read(controls_rwsem)
    ->snd_ctl_elem_write()
      ->snd_ctl_find_id()
      ->struct snd_kcontrol.put()
    ->up_read(controls_rwsem)

Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Fixes: e8064dec769e6 "ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF"
Signed-off-by: Alexander Grund <theflamefire89@gmail.com>
[uli: added upstream commit id]
Signed-off-by: Ulrich Hecht <uli+cip@fpond.eu>
Change-Id: I72ea6a8b828938b56935fc4ce08021e5e91135a1