From c336f131c48c7567f80138bac970dc2be606d6e9 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 28 Mar 2022 17:30:06 +0200 Subject: [PATCH] ANDROID: fix up abi issue with struct snd_pcm_runtime A portion of the fix for CVE-2022-1048, commit fbeb492694ce ("ALSA: pcm: Fix races among concurrent hw_params and hw_free calls") and 9661bf674d6a ("ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock"), caused an ABI break by adding a new field to struct snd_pcm_runtime. Because we have to keep this new addition, it is safe to move it to the end of the structure because this is only ever created by the sound core, and referenced as a pointer everywhere else. This does require a .xml update also to handle the increased structure size: Leaf changes summary: 1 artifact changed Changed leaf types summary: 1 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 'struct snd_pcm_runtime at pcm.h:342:1' changed: type size changed from 6080 to 6400 (in bits) 2 data member insertions: 'mutex buffer_mutex', at offset 6080 (in bits) at pcm.h:428:1 'atomic_t buffer_accessing', at offset 6336 (in bits) at pcm.h:429:1 92 impacted interfaces Bug: 161946584 Fixes: fbeb492694ce ("ALSA: pcm: Fix races among concurrent hw_params and hw_free calls") Fixes: 9661bf674d6a ("ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock") Signed-off-by: Greg Kroah-Hartman Change-Id: I525799616e06c1d2c5513821a3361e99dcb7e553 --- android/abi_gki_aarch64.xml | 1098 ++++++++++++++++++----------------- include/sound/pcm.h | 6 +- 2 files changed, 556 insertions(+), 548 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 3b96a86d4986..a4ab6456ac5f 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -30738,7 +30738,7 @@ - + @@ -30984,7 +30984,7 @@ - + @@ -31000,7 +31000,7 @@ - + @@ -31726,7 +31726,7 @@ - + @@ -32296,7 +32296,7 @@ - + @@ -60614,7 +60614,7 @@ - + @@ -121904,7 +121904,7 @@ - + @@ -148865,17 +148865,17 @@ - - + + - - - - - - - + + + + + + + @@ -149183,26 +149183,26 @@ - - - + + + - - - - - - - + + + + + + + - - - - - - + + + + + + @@ -149210,10 +149210,10 @@ - - - - + + + + @@ -149231,33 +149231,33 @@ - - - - + + + + - - - + + + - - - + + + - - - + + + - - + + @@ -149268,12 +149268,12 @@ - - - - - - + + + + + + @@ -161270,6 +161270,26 @@ + + + + + + + + + + + + + + + + + + + + @@ -161683,26 +161703,6 @@ - - - - - - - - - - - - - - - - - - - - @@ -162529,194 +162529,14 @@ - + - + - - - - - - - - - - - - - - - - - - - - - - - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -162755,14 +162575,148 @@ - - - + + + + - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -162800,7 +162754,7 @@ - + @@ -162841,32 +162795,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -162982,20 +162910,6 @@ - - - - - - - - - - - - - - @@ -163073,79 +162987,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -163207,58 +163048,217 @@ - + - + + + + - - - - - - + - + - - + + - - - - + + - - + + - - - - + - + - - + + + + - - + + - - + + + + - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -164572,30 +164572,30 @@ - + - + - + - + - + - + - + - + - + @@ -166156,30 +166156,30 @@ - + - + - + - + - + - + - + - + - + @@ -171615,7 +171615,7 @@ - + @@ -182162,157 +182162,157 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -182476,7 +182476,7 @@ - + @@ -182645,18 +182645,13 @@ + + + + + + - - - - - - - - - - - @@ -182690,6 +182685,17 @@ + + + + + + + + + + + @@ -182766,18 +182772,18 @@ - + - + - + - + - + @@ -183102,12 +183108,12 @@ - + - + - + @@ -183145,27 +183151,27 @@ - + - + - + - + - + - + - + - + @@ -183181,8 +183187,8 @@ - - + + @@ -183264,13 +183270,13 @@ - - - - - - - + + + + + + + @@ -183282,33 +183288,33 @@ - - - - - - + + + + + + - - - - - - + + + + + + - - - + + + - - + + @@ -183352,9 +183358,9 @@ - - - + + + @@ -183362,13 +183368,13 @@ - - + + - - - + + + diff --git a/include/sound/pcm.h b/include/sound/pcm.h index b77b4c813175..6bf84843b7ce 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -395,8 +395,6 @@ struct snd_pcm_runtime { wait_queue_head_t sleep; /* poll sleep */ wait_queue_head_t tsleep; /* transfer sleep */ struct fasync_struct *fasync; - struct mutex buffer_mutex; /* protect for buffer changes */ - atomic_t buffer_accessing; /* >0: in r/w operation, <0: blocked */ /* -- private section -- */ void *private_data; @@ -426,6 +424,10 @@ struct snd_pcm_runtime { /* -- OSS things -- */ struct snd_pcm_oss_runtime oss; #endif +#ifndef __GENKSYMS__ + struct mutex buffer_mutex; /* protect for buffer changes */ + atomic_t buffer_accessing; /* >0: in r/w operation, <0: blocked */ +#endif }; struct snd_pcm_group { /* keep linked substreams */