From: "Gyeongtaek Lee" <gt82.lee@samsung.com>
To: "'Takashi Iwai'" <tiwai@suse.de>
Cc: alsa-devel@alsa-project.org, kimty@samsung.com,
lgirdwood@gmail.com, senius.park@samsung.com,
donggyun.ko@samsung.com, hmseo@samsung.com,
seungbin.lee@samsung.com, s47.kang@samsung.com,
pilsun.jang@samsung.com
Subject: [PATCH] ASoC: dpcm: fix race condition to dpcm links in dpcm_be_dai_trigger
Date: Wed, 29 Sep 2021 14:49:21 +0900 [thread overview]
Message-ID: <002f01d7b4f5$c030f4a0$4092dde0$@samsung.com> (raw)
In-Reply-To:
If routing change and underrun stop is run at the same time,
data abort can be occurred by the following sequence.
CPU0: Processing underrun CPU1: Processing routing change
dpcm_be_dai_trigger(): dpcm_be_disconnect():
for_each_dpcm_be(fe, stream, dpcm) {
spin_lock_irqsave(&fe->card->dpcm_lock, flags);
list_del(&dpcm->list_be);
list_del(&dpcm->list_fe);
spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
kfree(dpcm);
struct snd_soc_pcm_runtime *be = dpcm->be; <-- Accessing freed memory
To prevent this situation, dpcm_lock is needed during accessing
the lists for dpcm links.
Signed-off-by: Gyeongtaek Lee <gt82.lee@samsung.com>
Cc: stable@vger.kernel.org
---
sound/soc/soc-pcm.c | 53 ++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 50 insertions(+), 3 deletions(-)
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 48f71bb81a2f..df2cd4c0dabe 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1993,17 +1993,63 @@ static int dpcm_fe_dai_hw_params(struct snd_pcm_substream *substream,
return ret;
}
+struct dpcm_be_list {
+ unsigned int num;
+ struct snd_soc_pcm_runtime *be[];
+};
+
+static int dpcm_create_be_list(struct snd_soc_pcm_runtime *fe, int stream,
+ struct dpcm_be_list **be_list)
+{
+ struct snd_soc_dpcm *dpcm;
+ struct dpcm_be_list *be;
+ int size = 0;
+ int ret = 0;
+ unsigned long flags;
+
+ spin_lock_irqsave(&fe->card->dpcm_lock, flags);
+
+ for_each_dpcm_be(fe, stream, dpcm)
+ size++;
+
+ be = kzalloc(struct_size(be, be, size), GFP_ATOMIC);
+ if (!be) {
+ ret = -ENOMEM;
+ } else {
+ unsigned int i = 0;
+
+ for_each_dpcm_be(fe, stream, dpcm)
+ be->be[i++] = dpcm->be;
+
+ *be_list = be;
+ }
+
+ spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
+
+ return ret;
+}
+
+static void dpcm_free_be_list(struct dpcm_be_list *be_list)
+{
+ kfree(be_list);
+}
+
int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream,
int cmd)
{
struct snd_soc_pcm_runtime *be;
- struct snd_soc_dpcm *dpcm;
+ struct dpcm_be_list *be_list;
int ret = 0;
+ int i;
- for_each_dpcm_be(fe, stream, dpcm) {
+ ret = dpcm_create_be_list(fe, stream, &be_list);
+ if (ret < 0)
+ return ret;
+
+ for(i = 0; i < be_list->num; i++) {
struct snd_pcm_substream *be_substream;
- be = dpcm->be;
+ be = be_list->be[i];
be_substream = snd_soc_dpcm_get_substream(be, stream);
/* is this op for this BE ? */
@@ -2092,6 +2138,7 @@ int dpcm_be_dai_trigger(struct snd_soc_pcm_runtime *fe, int stream,
if (ret < 0)
dev_err(fe->dev, "ASoC: %s() failed at %s (%d)\n",
__func__, be->dai_link->name, ret);
+ dpcm_free_be_list(be_list);
return ret;
}
EXPORT_SYMBOL_GPL(dpcm_be_dai_trigger);
base-commit: 4ac6d90867a4de2e12117e755dbd76e08d88697f
--
2.21.0
next parent reply other threads:[~2021-09-29 5:50 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20210929054921epcas2p2fbe35a6262405e064aac3bd92b22b1aa@epcas2p2.samsung.com>
2021-09-29 5:49 ` Gyeongtaek Lee [this message]
2021-09-29 14:11 ` [PATCH] ASoC: dpcm: fix race condition to dpcm links in dpcm_be_dai_trigger Pierre-Louis Bossart
2021-09-29 21:01 ` Pierre-Louis Bossart
2021-09-30 3:48 ` Gyeongtaek Lee
[not found] <CGME20210907012440epcas2p3cab33295dff61e84ae422457fbc795f6@epcas2p3.samsung.com>
2021-09-07 1:24 ` Gyeongtaek Lee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='002f01d7b4f5$c030f4a0$4092dde0$@samsung.com' \
--to=gt82.lee@samsung.com \
--cc=alsa-devel@alsa-project.org \
--cc=donggyun.ko@samsung.com \
--cc=hmseo@samsung.com \
--cc=kimty@samsung.com \
--cc=lgirdwood@gmail.com \
--cc=pilsun.jang@samsung.com \
--cc=s47.kang@samsung.com \
--cc=senius.park@samsung.com \
--cc=seungbin.lee@samsung.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).