From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
To: Gyeongtaek Lee <gt82.lee@samsung.com>, 'Takashi Iwai' <tiwai@suse.de>
Cc: alsa-devel@alsa-project.org, kimty@samsung.com,
lgirdwood@gmail.com, senius.park@samsung.com,
donggyun.ko@samsung.com, hmseo@samsung.com,
seungbin.lee@samsung.com, s47.kang@samsung.com,
pilsun.jang@samsung.com
Subject: Re: [PATCH] ASoC: dpcm: fix race condition to dpcm links in dpcm_be_dai_trigger
Date: Wed, 29 Sep 2021 16:01:12 -0500 [thread overview]
Message-ID: <d9e09d88-d3f8-2eab-ebe1-1ac8e64e5093@linux.intel.com> (raw)
In-Reply-To: <27786697-1309-8336-6f53-abff32e0b6c2@linux.intel.com>
>> If routing change and underrun stop is run at the same time,
>> data abort can be occurred by the following sequence.
>>
>> CPU0: Processing underrun CPU1: Processing routing change
>> dpcm_be_dai_trigger(): dpcm_be_disconnect():
>>
>> for_each_dpcm_be(fe, stream, dpcm) {
>>
>> spin_lock_irqsave(&fe->card->dpcm_lock, flags);
>> list_del(&dpcm->list_be);
>> list_del(&dpcm->list_fe);
>> spin_unlock_irqrestore(&fe->card->dpcm_lock, flags);
>> kfree(dpcm);
>>
>> struct snd_soc_pcm_runtime *be = dpcm->be; <-- Accessing freed memory
>>
>> To prevent this situation, dpcm_lock is needed during accessing
>> the lists for dpcm links.
>
> Isn't there still a possible inconsistency here introduced by the
> duplication of the BE list?
>
> You protect the list creation, but before you use it in
> dpcm_be_dai_trigger(), there's a time window where the function could be
> pre-empted and a disconnect event might have happened. As a result you
> could trigger a BE that's no longer connected.
>
> What you identified as a race is likely valid, but how to fix it isn't
> clear to me - the DPCM code isn't self-explanatory at all with its use
> in various places of the dpcm_lock spinlock, the pcm mutex, the card mutex.
>
> Ideally we would need to find a way to prevent changes in connections
> while we are doing the triggers, but triggers can take a bit of time if
> they involve any sort of communication over a bus. I really wonder if
> this dpcm_lock should be a mutex and if the model for DPCM really
> involves interrupt contexts as the irqsave/irqrestore mentions hint at.
To follow-up on this, I started experimenting with a replacement of the
'dpcm_lock' spinlock with a 'dpcm_mutex', see
https://github.com/thesofproject/linux/pull/3186
If we combine both of our results, the 'right' solution might be to take
this mutex before every use of for_each_dpcm_be(), and unlock it at the
end of the loop, which additional changes to avoid re-taking the same
mutex in helper functions.
there's still a part in DPCM that I can't figure out, there is an
elaborate trick with an explicit comment
/* if FE's runtime_update is already set, we're in race;
* process this trigger later at exit
*/
Which looks like a missing mutex somewhere, or an overkill solution that
might never be needed.
next prev parent reply other threads:[~2021-09-29 21:02 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20210929054921epcas2p2fbe35a6262405e064aac3bd92b22b1aa@epcas2p2.samsung.com>
2021-09-29 5:49 ` [PATCH] ASoC: dpcm: fix race condition to dpcm links in dpcm_be_dai_trigger Gyeongtaek Lee
2021-09-29 14:11 ` Pierre-Louis Bossart
2021-09-29 21:01 ` Pierre-Louis Bossart [this message]
2021-09-30 3:48 ` Gyeongtaek Lee
[not found] <CGME20210907012440epcas2p3cab33295dff61e84ae422457fbc795f6@epcas2p3.samsung.com>
2021-09-07 1:24 ` Gyeongtaek Lee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d9e09d88-d3f8-2eab-ebe1-1ac8e64e5093@linux.intel.com \
--to=pierre-louis.bossart@linux.intel.com \
--cc=alsa-devel@alsa-project.org \
--cc=donggyun.ko@samsung.com \
--cc=gt82.lee@samsung.com \
--cc=hmseo@samsung.com \
--cc=kimty@samsung.com \
--cc=lgirdwood@gmail.com \
--cc=pilsun.jang@samsung.com \
--cc=s47.kang@samsung.com \
--cc=senius.park@samsung.com \
--cc=seungbin.lee@samsung.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).