hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ALSA: hda: Fix widget_mutex incomplete protection 

The widget_mutex was introduced to serialize callers to
hda_widget_sysfs_{re}init. However, its protection of the sysfs widget array
is incomplete. For example, it is acquired around the call to
hda_widget_sysfs_reinit(), which actually creates the new array, but isn't
still acquired when codec->num_nodes and codec->start_nid is updated. So
the lock ensures one thread sets up the new array at a time, but doesn't
ensure which thread's value will end up in codec->num_nodes. If a larger
num_nodes wins but a smaller array was set up, the next call to
refresh_widgets() will touch free memory as it iterates over codec->num_nodes
that aren't there.

The widget_lock really protects both the tree as well as codec->num_nodes,
start_nid, and end_nid, so make sure it's held across that update. It should
also be held during snd_hdac_get_sub_nodes(), so that a very old read from that
function doesn't end up clobbering a later update.

Fixes: ed180abba7 ("ALSA: hda: Fix race between creating and refreshing sysfs entries")
Signed-off-by: Evan Green <evgreen@chromium.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Evan Green 2019-07-01 10:30:30 -07:00 committed by Takashi Iwai
parent 7fbd1753b6
commit 98482377dc
1 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
sound/hda/hdac_device.c
View File

@ -399,27 +399,33 @@ static void setup_fg_nodes(struct hdac_device *codec)
int snd_hdac_refresh_widgets(struct hdac_device *codec, bool sysfs) int snd_hdac_refresh_widgets(struct hdac_device *codec, bool sysfs)
{ {
hda_nid_t start_nid; hda_nid_t start_nid;
int nums, err; int nums, err = 0;
/*
* Serialize against multiple threads trying to update the sysfs
* widgets array.
*/
mutex_lock(&codec->widget_lock);
nums = snd_hdac_get_sub_nodes(codec, codec->afg, &start_nid); nums = snd_hdac_get_sub_nodes(codec, codec->afg, &start_nid);
if (!start_nid || nums <= 0 || nums >= 0xff) { if (!start_nid || nums <= 0 || nums >= 0xff) {
dev_err(&codec->dev, "cannot read sub nodes for FG 0x%02x\n", dev_err(&codec->dev, "cannot read sub nodes for FG 0x%02x\n",
codec->afg); codec->afg);
return -EINVAL; err = -EINVAL;
goto unlock;
} }
if (sysfs) { if (sysfs) {
mutex_lock(&codec->widget_lock);
err = hda_widget_sysfs_reinit(codec, start_nid, nums); err = hda_widget_sysfs_reinit(codec, start_nid, nums);
mutex_unlock(&codec->widget_lock);
if (err < 0) if (err < 0)
return err; goto unlock;
} }
codec->num_nodes = nums; codec->num_nodes = nums;
codec->start_nid = start_nid; codec->start_nid = start_nid;
codec->end_nid = start_nid + nums; codec->end_nid = start_nid + nums;
return 0; unlock:
mutex_unlock(&codec->widget_lock);
return err;
} }
EXPORT_SYMBOL_GPL(snd_hdac_refresh_widgets); EXPORT_SYMBOL_GPL(snd_hdac_refresh_widgets);