From f3674eb0fbb8e56ee6a240e88f7898ae8420627d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 28 Mar 2022 17:30:06 +0200 Subject: [PATCH] ANDROID: fix up abi issue with struct snd_pcm_runtime A portion of the fix for CVE-2022-1048, commit 9cb6c40a6ebe ("ALSA: pcm: Fix races among concurrent hw_params and hw_free calls") and 40f4cffbe13a ("ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock"), caused an ABI break by adding a new field to struct snd_pcm_runtime. Because we have to keep this new addition, it is safe to move it to the end of the structure because this is only ever created by the sound core, and referenced as a pointer everywhere else. This does require a .xml update also to handle the increased structure size: Leaf changes summary: 1 artifact changed Changed leaf types summary: 1 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 'struct snd_pcm_runtime at pcm.h:367:1' changed: type size changed from 6144 to 6464 (in bits) 2 data member insertions: 'mutex buffer_mutex', at offset 6144 (in bits) at pcm.h:454:1 'atomic_t buffer_accessing', at offset 6400 (in bits) at pcm.h:455:1 59 impacted interfaces Bug: 161946584 Fixes: 9cb6c40a6ebe ("ALSA: pcm: Fix races among concurrent hw_params and hw_free calls") Fixes: 40f4cffbe13a ("ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock") Signed-off-by: Greg Kroah-Hartman Change-Id: I525799616e06c1d2c5513821a3361e99dcb7e553 --- android/abi_gki_aarch64.xml | 912 ++++++++++++++++++------------------ include/sound/pcm.h | 6 +- 2 files changed, 466 insertions(+), 452 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index bb987bc783d9..c8e6be671be4 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -102971,6 +102971,14 @@ + + + + + + + + @@ -103325,14 +103333,6 @@ - - - - - - - - @@ -119205,570 +119205,570 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -119777,86 +119777,86 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -119864,24 +119864,24 @@ - + - + - + - + - + - + - + @@ -133899,51 +133899,51 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -134538,7 +134538,7 @@ - + @@ -134710,40 +134710,46 @@ + + + + + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -135591,111 +135597,111 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -135768,18 +135774,18 @@ - + - + - + - + - + @@ -137454,193 +137460,193 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -137827,7 +137833,7 @@ - + @@ -137999,6 +138005,12 @@ + + + + + + @@ -138109,18 +138121,18 @@ - + - + - + - + - + @@ -138252,12 +138264,12 @@ - + - + - + @@ -138272,77 +138284,77 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -138362,8 +138374,8 @@ - - + + @@ -138428,66 +138440,66 @@ - - - - - - - + + + + + + + - - - - - - - - + + + + + + + + - - - - - - - + + + + + + + - - - - - - + + + + + + - - - + + + - - - + + + - - + + - - + + - - - - + + + + @@ -138506,13 +138518,13 @@ - - + + - - - + + + diff --git a/include/sound/pcm.h b/include/sound/pcm.h index 95604d02b94f..9f6bee423ac3 100644 --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -421,8 +421,6 @@ struct snd_pcm_runtime { wait_queue_head_t sleep; /* poll sleep */ wait_queue_head_t tsleep; /* transfer sleep */ struct fasync_struct *fasync; - struct mutex buffer_mutex; /* protect for buffer changes */ - atomic_t buffer_accessing; /* >0: in r/w operation, <0: blocked */ /* -- private section -- */ void *private_data; @@ -452,6 +450,10 @@ struct snd_pcm_runtime { /* -- OSS things -- */ struct snd_pcm_oss_runtime oss; #endif +#ifndef __GENKSYMS__ + struct mutex buffer_mutex; /* protect for buffer changes */ + atomic_t buffer_accessing; /* >0: in r/w operation, <0: blocked */ +#endif }; struct snd_pcm_group { /* keep linked substreams */