linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Yu Zhao <yuzhao@google.com>
To: Mark Brown <broonie@kernel.org>, Takashi Iwai <tiwai@suse.com>
Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>,
	Liam Girdwood <liam.r.girdwood@linux.intel.com>,
	Jie Yang <yang.jie@linux.intel.com>,
	Jaroslav Kysela <perex@perex.cz>,
	Rakesh Ughreja <rakesh.a.ughreja@intel.com>,
	Guneshwor Singh <guneshwor.o.singh@intel.com>,
	Naveen Manohar <naveen.m@intel.com>, Yu Zhao <yuzhao@google.com>,
	Sriram Periyasamy <sriramx.periyasamy@intel.com>,
	Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>,
	Sanyog Kale <sanyog.r.kale@intel.com>,
	alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2 1/3] Revert "ASoC: Intel: Skylake: Acquire irq after RIRB allocation"
Date: Tue, 11 Sep 2018 15:12:46 -0600	[thread overview]
Message-ID: <20180911211246.31914-1-yuzhao@google.com> (raw)
In-Reply-To: <20180910211718.200802-1-yuzhao@google.com>

This reverts commit 12eeeb4f4733bbc4481d01df35933fc15beb8b19.

The patch doesn't fix accessing memory with null pointer in
skl_interrupt().

There are two problems: 1) skl_init_chip() is called twice, before
and after dma buffer is allocate. The first call sets bus->chip_init
which prevents the second from initializing bus->corb.buf and
rirb.buf from bus->rb.area. 2) snd_hdac_bus_init_chip() enables
interrupt before snd_hdac_bus_init_cmd_io() initializing dma buffers.
There is a small window which skl_interrupt() can be called if irq
has been acquired. If so, it crashes when using null dma buffer
pointers.

Will fix the problems in the following patches. Also attaching the
crash for future reference.

[   16.949148] general protection fault: 0000 [#1] PREEMPT SMP KASAN PTI
<snipped>
[   16.950903] Call Trace:
[   16.950906]  <IRQ>
[   16.950918]  skl_interrupt+0x19e/0x2d6 [snd_soc_skl]
[   16.950926]  ? dma_supported+0xb5/0xb5 [snd_soc_skl]
[   16.950933]  __handle_irq_event_percpu+0x27a/0x6c8
[   16.950937]  ? __irq_wake_thread+0x1d1/0x1d1
[   16.950942]  ? __do_softirq+0x57a/0x69e
[   16.950944]  handle_irq_event_percpu+0x95/0x1ba
[   16.950948]  ? _raw_spin_unlock+0x65/0xdc
[   16.950951]  ? __handle_irq_event_percpu+0x6c8/0x6c8
[   16.950953]  ? _raw_spin_unlock+0x65/0xdc
[   16.950957]  ? time_cpufreq_notifier+0x483/0x483
[   16.950959]  handle_irq_event+0x89/0x123
[   16.950962]  handle_fasteoi_irq+0x16f/0x425
[   16.950965]  handle_irq+0x1fe/0x28e
[   16.950969]  do_IRQ+0x6e/0x12e
[   16.950972]  common_interrupt+0x7a/0x7a
[   16.950974]  </IRQ>
<snipped>
[   16.951031] RIP: snd_hdac_bus_update_rirb+0x19b/0x4cf [snd_hda_core] RSP: ffff88015c807c08
[   16.951036] ---[ end trace 58bf9ece1775bc92 ]---

Fixes: 2eeeb4f4733b ("ASoC: Intel: Skylake: Acquire irq after RIRB allocation")
Signed-off-by: Yu Zhao <yuzhao@google.com>
---
 sound/soc/intel/skylake/skl.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index e7fd14daeb4f..d174cbe35f7a 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -912,7 +912,11 @@ static int skl_first_init(struct hdac_bus *bus)
 
 	snd_hdac_bus_parse_capabilities(bus);
 
+	if (skl_acquire_irq(bus, 0) < 0)
+		return -EBUSY;
+
 	pci_set_master(pci);
+	synchronize_irq(bus->irq);
 
 	gcap = snd_hdac_chip_readw(bus, GCAP);
 	dev_dbg(bus->dev, "chipset global capabilities = 0x%x\n", gcap);
@@ -945,12 +949,6 @@ static int skl_first_init(struct hdac_bus *bus)
 	if (err < 0)
 		return err;
 
-	err = skl_acquire_irq(bus, 0);
-	if (err < 0)
-		return err;
-
-	synchronize_irq(bus->irq);
-
 	/* initialize chip */
 	skl_init_pci(skl);
 
-- 
2.19.0.rc2.392.g5ba43deb5a-goog


  parent reply	other threads:[~2018-09-11 21:13 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-10 21:17 [PATCH 1/3] Revert "ASoC: Intel: Skylake: Acquire irq after RIRB allocation" Yu Zhao
2018-09-10 21:21 ` [PATCH 2/3] sound: enable interrupt after dma buffer initialization Yu Zhao
2018-09-10 21:23   ` [PATCH 3/3] sound: don't call skl_init_chip() to reset intel skl soc Yu Zhao
2018-09-11  6:17     ` Takashi Iwai
2018-09-11  6:06   ` [PATCH 2/3] sound: enable interrupt after dma buffer initialization Takashi Iwai
2018-09-11 20:58     ` Yu Zhao
2018-09-12  4:04       ` Vinod
2018-09-11  6:03 ` [PATCH 1/3] Revert "ASoC: Intel: Skylake: Acquire irq after RIRB allocation" Takashi Iwai
2018-09-11 16:36   ` Mark Brown
2018-09-11 20:44     ` Yu Zhao
2018-09-11 21:12 ` Yu Zhao [this message]
2018-09-11 21:14   ` [PATCH v2 2/3] sound: enable interrupt after dma buffer initialization Yu Zhao
2018-09-11 21:15     ` [PATCH v2 3/3] sound: don't call skl_init_chip() to reset intel skl soc Yu Zhao
2018-09-12 10:20   ` [PATCH v2 1/3] Revert "ASoC: Intel: Skylake: Acquire irq after RIRB allocation" Mark Brown
2018-09-12 19:32     ` Yu Zhao
2018-09-13 11:31       ` Mark Brown
2018-09-12 19:43   ` [PATCH v3 1/3] ASoC: " Yu Zhao
2018-09-12 19:44     ` [PATCH v3 2/3] ASoC: enable interrupt after dma buffer initialization Yu Zhao
2018-09-12 19:45       ` [PATCH v3 3/3] ASoC: don't call skl_init_chip() to reset intel skl soc Yu Zhao
2018-09-13 11:31       ` [PATCH v3 2/3] ASoC: enable interrupt after dma buffer initialization Mark Brown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180911211246.31914-1-yuzhao@google.com \
    --to=yuzhao@google.com \
    --cc=alsa-devel@alsa-project.org \
    --cc=broonie@kernel.org \
    --cc=guneshwor.o.singh@intel.com \
    --cc=liam.r.girdwood@linux.intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=naveen.m@intel.com \
    --cc=pankaj.laxminarayan.bharadiya@intel.com \
    --cc=perex@perex.cz \
    --cc=pierre-louis.bossart@linux.intel.com \
    --cc=rakesh.a.ughreja@intel.com \
    --cc=sanyog.r.kale@intel.com \
    --cc=sriramx.periyasamy@intel.com \
    --cc=tiwai@suse.com \
    --cc=yang.jie@linux.intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).