From patchwork Tue Sep 29 11:00:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 291234 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBDC8C4727F for ; Tue, 29 Sep 2020 11:06:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 80AE7221EC for ; Tue, 29 Sep 2020 11:06:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601377613; bh=eiz7aoc8IANfM5Zam+W3qobqu1VmS3mANYdwlS2WVIc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=yvXskcsHKIEEJ/KfOUAwpi3l6piIfEX7DQpVK18y7MZR2avK0RSp3wWWufpWWeACV gr+AZUs8y1npLncZaMyu0y3Qf+zgA4leGpb3zmDCjdygMCGashGJKw7CdKgFOOw6kb 1rcKOYRvupetrlUNBqT9QXDsiCMXhVyhVUjX8/HY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728858AbgI2LGv (ORCPT ); Tue, 29 Sep 2020 07:06:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:44380 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728454AbgI2LGt (ORCPT ); Tue, 29 Sep 2020 07:06:49 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9EEB521941; Tue, 29 Sep 2020 11:06:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601377608; bh=eiz7aoc8IANfM5Zam+W3qobqu1VmS3mANYdwlS2WVIc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ej6MU18kJwA4B0KocQfS8rQNbHwoTWGwDL1e9NaRg8MD1SPKAKeZcGA3CXNKjvRZh LzoCFdv+tEvO6o68lu+erneU0prU+EAYR7noQlGVhxeGmTyZ68RxqzvzNNqFsZ7vn9 1n0F63tvvTt1WvwYc70VB0uX/Wgwe/g4A06v62GE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.4 60/85] ALSA: hda: Fix potential race in unsol event handler Date: Tue, 29 Sep 2020 13:00:27 +0200 Message-Id: <20200929105931.213540294@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200929105928.198942536@linuxfoundation.org> References: <20200929105928.198942536@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai [ Upstream commit c637fa151259c0f74665fde7cba5b7eac1417ae5 ] The unsol event handling code has a loop retrieving the read/write indices and the arrays without locking while the append to the array may happen concurrently. This may lead to some inconsistency. Although there hasn't been any proof of this bad results, it's still safer to protect the racy accesses. This patch adds the spinlock protection around the unsol handling loop for addressing it. Here we take bus->reg_lock as the writer side snd_hdac_bus_queue_event() is also protected by that lock. Link: https://lore.kernel.org/r/20200516062556.30951-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/hda/hdac_bus.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/hda/hdac_bus.c b/sound/hda/hdac_bus.c index 0e81ea89a5965..e3f68a76d90eb 100644 --- a/sound/hda/hdac_bus.c +++ b/sound/hda/hdac_bus.c @@ -155,6 +155,7 @@ static void process_unsol_events(struct work_struct *work) struct hdac_driver *drv; unsigned int rp, caddr, res; + spin_lock_irq(&bus->reg_lock); while (bus->unsol_rp != bus->unsol_wp) { rp = (bus->unsol_rp + 1) % HDA_UNSOL_QUEUE_SIZE; bus->unsol_rp = rp; @@ -166,10 +167,13 @@ static void process_unsol_events(struct work_struct *work) codec = bus->caddr_tbl[caddr & 0x0f]; if (!codec || !codec->dev.driver) continue; + spin_unlock_irq(&bus->reg_lock); drv = drv_to_hdac_driver(codec->dev.driver); if (drv->unsol_event) drv->unsol_event(codec, res); + spin_lock_irq(&bus->reg_lock); } + spin_unlock_irq(&bus->reg_lock); } /**