summaryrefslogtreecommitdiff
path: root/sound/usb
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2023-08-16 19:02:46 +0300
committerTakashi Iwai <tiwai@suse.de>2023-08-17 10:23:45 +0300
commitbc41a7228cedc39395d032b2502975e53b7a9180 (patch)
treeaaf5b59beebc5c9616579d4b2bd279e20af07c0a /sound/usb
parent6a66b01de48855d92450904ccfafda9d692efbb9 (diff)
downloadlinux-bc41a7228cedc39395d032b2502975e53b7a9180.tar.xz
ALSA: pcm: Don't embed device
So far we use the embedded struct device for each PCM substreams in struct snd_pcm. This may result in UAF when the delayed kobj release is used; each corresponding struct device is still accessed at the (delayed) device release, while the snd_pcm object may be already gone. As a workaround, detach the struct device from the snd_pcm object by allocating via the new snd_device_alloc() helper. A caveat is that we store the PCM substream pointer to drvdata since the device resume and others require the access to it. This patch is based on the fix Curtis posted initially. In this patch, the changes are split and use the new helper function instead. Link: https://lore.kernel.org/r/20230801171928.1460120-1-cujomalainey@chromium.org Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Curtis Malainey <cujomalainey@chromium.org> Tested-by: Curtis Malainey <cujomalainey@chromium.org> Link: https://lore.kernel.org/r/20230816160252.23396-4-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/usb')
-rw-r--r--sound/usb/media.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/usb/media.c b/sound/usb/media.c
index 6d11fedb4632..d48db6f3ae65 100644
--- a/sound/usb/media.c
+++ b/sound/usb/media.c
@@ -35,7 +35,7 @@ int snd_media_stream_init(struct snd_usb_substream *subs, struct snd_pcm *pcm,
{
struct media_device *mdev;
struct media_ctl *mctl;
- struct device *pcm_dev = &pcm->streams[stream].dev;
+ struct device *pcm_dev = pcm->streams[stream].dev;
u32 intf_type;
int ret = 0;
u16 mixer_pad;