~ubuntu-branches/ubuntu/karmic/alsa-lib/karmic-proposed

« back to all changes in this revision

Viewing changes to debian/patches/Dont_leak_timer_fd_on_pcm_slave_close.patch

  • Committer: Bazaar Package Importer
  • Author(s): Daniel T Chen
  • Date: 2009-12-21 06:33:01 UTC
  • Revision ID: james.westby@ubuntu.com-20091221063301-r8jxu4p2zdaq4s5g
Tags: 1.0.20-3ubuntu6.1
debian/patches/Dont_leak_timer_fd_on_pcm_slave_close.patch:
Prevent a local DoS by properly freeing timer fds when closing pcm
slaves. Backported from upstream master HEAD (LP: #451893)

Show diffs side-by-side

added added

removed removed

Lines of Context:
 
1
commit a256766c10c52cb6667de8a65f5cbb332fad4cc7
 
2
Author: Jaroslav Kysela <perex@perex.cz>
 
3
Date:   Mon Dec 21 09:09:42 2009 +0100
 
4
 
 
5
    pcm: Close event timer in pcm_hw plugin
 
6
    
 
7
    Dan McCombs discovered that snd_pcm_close() invocations are not leading
 
8
    to associated timers being closed, which results in successively more
 
9
    timers being created but not freed.
 
10
    
 
11
    Original patch from Daniel T Chen <crimsun@ubuntu.com>.
 
12
    
 
13
    BugLink: https://bugs.launchpad.net/bugs/451893
 
14
    
 
15
    Signed-off-by: Jaroslav Kysela <perex@perex.cz>
 
16
 
 
17
diff --git a/src/pcm/pcm_hw.c b/src/pcm/pcm_hw.c
 
18
index 2095b01..b557912 100644
 
19
--- a/src/pcm/pcm_hw.c
 
20
+++ b/src/pcm/pcm_hw.c
 
21
@@ -338,18 +338,6 @@ static int snd_pcm_hw_hw_params(snd_pcm_t *pcm, snd_pcm_hw_params_t * params)
 
22
        return 0;
 
23
 }
 
24
 
 
25
-static int snd_pcm_hw_hw_free(snd_pcm_t *pcm)
 
26
-{
 
27
-       snd_pcm_hw_t *hw = pcm->private_data;
 
28
-       int fd = hw->fd, err;
 
29
-       if (ioctl(fd, SNDRV_PCM_IOCTL_HW_FREE) < 0) {
 
30
-               err = -errno;
 
31
-               SYSMSG("SNDRV_PCM_IOCTL_HW_FREE failed");
 
32
-               return err;
 
33
-       }
 
34
-       return 0;
 
35
-}
 
36
-
 
37
 static void snd_pcm_hw_close_timer(snd_pcm_hw_t *hw)
 
38
 {
 
39
        if (hw->period_timer) {
 
40
@@ -421,6 +409,20 @@ static int snd_pcm_hw_change_timer(snd_pcm_t *pcm, int enable)
 
41
        } else {
 
42
                snd_pcm_hw_close_timer(hw);
 
43
                pcm->fast_ops = &snd_pcm_hw_fast_ops;
 
44
+               hw->period_event = 0;
 
45
+       }
 
46
+       return 0;
 
47
+}
 
48
+
 
49
+static int snd_pcm_hw_hw_free(snd_pcm_t *pcm)
 
50
+{
 
51
+       snd_pcm_hw_t *hw = pcm->private_data;
 
52
+       int fd = hw->fd, err;
 
53
+       snd_pcm_hw_change_timer(pcm, 0);
 
54
+       if (ioctl(fd, SNDRV_PCM_IOCTL_HW_FREE) < 0) {
 
55
+               err = -errno;
 
56
+               SYSMSG("SNDRV_PCM_IOCTL_HW_FREE failed");
 
57
+               return err;
 
58
        }
 
59
        return 0;
 
60
 }