[src/trunk]: src/sys/dev/audio Fix to evaluate the validity of this track at ...

[isaki <isaki%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/8ebc7355ff94
branches:  trunk
changeset: 461775:8ebc7355ff94
user:      isaki <isaki%NetBSD.org@localhost>
date:      Sun Jul 07 06:06:46 2019 +0000

description:
Fix to evaluate the validity of this track at earlier on audio_read().
It fixes a panic on read() against descriptor opened as O_RDWR on the
half duplex device.

diffstat:

 sys/dev/audio/audio.c |  25 ++++++++++++-------------
 1 files changed, 12 insertions(+), 13 deletions(-)

diffs (61 lines):

diff -r a79a4429fdf1 -r 8ebc7355ff94 sys/dev/audio/audio.c
--- a/sys/dev/audio/audio.c     Sat Jul 06 19:45:25 2019 +0000
+++ b/sys/dev/audio/audio.c     Sun Jul 07 06:06:46 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: audio.c,v 1.23 2019/07/06 12:58:58 isaki Exp $ */
+/*     $NetBSD: audio.c,v 1.24 2019/07/07 06:06:46 isaki Exp $ */
 
 /*-
  * Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -142,7 +142,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.23 2019/07/06 12:58:58 isaki Exp $");
+__KERNEL_RCSID(0, "$NetBSD: audio.c,v 1.24 2019/07/07 06:06:46 isaki Exp $");
 
 #ifdef _KERNEL_OPT
 #include "audio.h"
@@ -2213,9 +2213,15 @@
        audio_ring_t *input;
        int error;
 
+       /*
+        * On half-duplex hardware, O_RDWR is treated as O_WRONLY.
+        * However read() system call itself can be called because it's
+        * opened with O_RDWR.  So in this case, deny this read().
+        */
        track = file->rtrack;
-       KASSERT(track);
-       TRACET(2, track, "resid=%zd", uio->uio_resid);
+       if (track == NULL) {
+               return EBADF;
+       }
 
        KASSERT(!mutex_owned(sc->sc_lock));
 
@@ -2223,6 +2229,8 @@
        if (track->mmapped)
                return EPERM;
 
+       TRACET(2, track, "resid=%zd", uio->uio_resid);
+
 #ifdef AUDIO_PM_IDLE
        mutex_enter(sc->sc_lock);
        if (device_is_active(&sc->sc_dev) || sc->sc_idle)
@@ -2230,15 +2238,6 @@
        mutex_exit(sc->sc_lock);
 #endif
 
-       /*
-        * On half-duplex hardware, O_RDWR is treated as O_WRONLY.
-        * However read() system call itself can be called because it's
-        * opened with O_RDWR.  So in this case, deny this read().
-        */
-       if ((file->mode & AUMODE_RECORD) == 0) {
-               return EBADF;
-       }
-
        usrbuf = &track->usrbuf;
        input = track->input;