AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

ALSA: hda: Fix potential race in unsol event handler

Browse Source 
The unsol event handling code has a loop retrieving the read/write
indices and the arrays without locking while the append to the array
may happen concurrently.  This may lead to some inconsistency.
Although there hasn't been any proof of this bad results, it's still
safer to protect the racy accesses.

This patch adds the spinlock protection around the unsol handling loop
for addressing it.  Here we take bus->reg_lock as the writer side
snd_hdac_bus_queue_event() is also protected by that lock.

Link: https://lore.kernel.org/r/20200516062556.30951-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2020-05-16 08:25:56 +02:00
parent 10ce77e481
commit c637fa1512
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sound/hda/hdac_bus.c
View File

@ -162,6 +162,7 @@ static void snd_hdac_bus_process_unsol_events(struct work_struct *work)
struct hdac_driver *drv; struct hdac_driver *drv;
unsigned int rp, caddr, res; unsigned int rp, caddr, res;
spin_lock_irq(&bus->reg_lock);
while (bus->unsol_rp != bus->unsol_wp) { while (bus->unsol_rp != bus->unsol_wp) {
rp = (bus->unsol_rp + 1) % HDA_UNSOL_QUEUE_SIZE; rp = (bus->unsol_rp + 1) % HDA_UNSOL_QUEUE_SIZE;
bus->unsol_rp = rp; bus->unsol_rp = rp;
@ -173,10 +174,13 @@ static void snd_hdac_bus_process_unsol_events(struct work_struct *work)
codec = bus->caddr_tbl[caddr & 0x0f]; codec = bus->caddr_tbl[caddr & 0x0f];
if (!codec || !codec->dev.driver) if (!codec || !codec->dev.driver)
continue; continue;
spin_unlock_irq(&bus->reg_lock);
drv = drv_to_hdac_driver(codec->dev.driver); drv = drv_to_hdac_driver(codec->dev.driver);
if (drv->unsol_event) if (drv->unsol_event)
drv->unsol_event(codec, res); drv->unsol_event(codec, res);
spin_lock_irq(&bus->reg_lock);
} }
spin_unlock_irq(&bus->reg_lock);
} }
/** /**