diff options
author | Evan Green <evgreen@chromium.org> | 2019-07-01 10:30:30 -0700 |
---|---|---|
committer | Takashi Iwai <tiwai@suse.de> | 2019-07-01 20:13:04 +0200 |
commit | 98482377dc7295d0c70e251925b7cc14aff4c5ac (patch) | |
tree | 3e66beae9641f23b3337b163b587d8a96adc6d80 | |
parent | 7fbd1753b64eafe21cf842348a40a691d0dee440 (diff) | |
download | linux-stable-98482377dc7295d0c70e251925b7cc14aff4c5ac.tar.gz linux-stable-98482377dc7295d0c70e251925b7cc14aff4c5ac.tar.bz2 linux-stable-98482377dc7295d0c70e251925b7cc14aff4c5ac.zip |
ALSA: hda: Fix widget_mutex incomplete protection
The widget_mutex was introduced to serialize callers to
hda_widget_sysfs_{re}init. However, its protection of the sysfs widget array
is incomplete. For example, it is acquired around the call to
hda_widget_sysfs_reinit(), which actually creates the new array, but isn't
still acquired when codec->num_nodes and codec->start_nid is updated. So
the lock ensures one thread sets up the new array at a time, but doesn't
ensure which thread's value will end up in codec->num_nodes. If a larger
num_nodes wins but a smaller array was set up, the next call to
refresh_widgets() will touch free memory as it iterates over codec->num_nodes
that aren't there.
The widget_lock really protects both the tree as well as codec->num_nodes,
start_nid, and end_nid, so make sure it's held across that update. It should
also be held during snd_hdac_get_sub_nodes(), so that a very old read from that
function doesn't end up clobbering a later update.
Fixes: ed180abba7f1 ("ALSA: hda: Fix race between creating and refreshing sysfs entries")
Signed-off-by: Evan Green <evgreen@chromium.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
-rw-r--r-- | sound/hda/hdac_device.c | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c index 4769f4c03e14..11050bfd8068 100644 --- a/sound/hda/hdac_device.c +++ b/sound/hda/hdac_device.c @@ -399,27 +399,33 @@ static void setup_fg_nodes(struct hdac_device *codec) int snd_hdac_refresh_widgets(struct hdac_device *codec, bool sysfs) { hda_nid_t start_nid; - int nums, err; + int nums, err = 0; + /* + * Serialize against multiple threads trying to update the sysfs + * widgets array. + */ + mutex_lock(&codec->widget_lock); nums = snd_hdac_get_sub_nodes(codec, codec->afg, &start_nid); if (!start_nid || nums <= 0 || nums >= 0xff) { dev_err(&codec->dev, "cannot read sub nodes for FG 0x%02x\n", codec->afg); - return -EINVAL; + err = -EINVAL; + goto unlock; } if (sysfs) { - mutex_lock(&codec->widget_lock); err = hda_widget_sysfs_reinit(codec, start_nid, nums); - mutex_unlock(&codec->widget_lock); if (err < 0) - return err; + goto unlock; } codec->num_nodes = nums; codec->start_nid = start_nid; codec->end_nid = start_nid + nums; - return 0; +unlock: + mutex_unlock(&codec->widget_lock); + return err; } EXPORT_SYMBOL_GPL(snd_hdac_refresh_widgets); |