linux-kernel - Re: [3.6-rc7] switcheroo race with Intel HDA...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 08 Oct 2012 14:58:38 +0200
From:	Takashi Iwai <tiwai@...e.de>
To:	Daniel J Blueman <daniel@...ra.org>
Cc:	Dave Airlie <airlied@...hat.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	alsa-devel@...a-project.org
Subject: Re: [3.6-rc7] switcheroo race with Intel HDA...

Hi Daniel,

sorry for the late reply.  I'm just back from vacation.

At Tue, 25 Sep 2012 13:20:05 +0800,
Daniel J Blueman wrote:
> 
> On my Macbook with a discrete Nvidia GPU, there is a race between
> selecting the integrated GPU and putting the discrete GPU into D3 [1],
> reliably causing a kernel oops [2].
> 
> Introducing a delay of ~1s between the calls prevents this. When the
> second 'OFF' write path executes, it looks like struct azx at
> card->private_data hasn't yet been allocated yet [3], so there is
> likely some locking missing.

It's rather pci_get_drvdata() returning NULL (i.e. card is NULL, thus
card->private_data causes Oops).  Could you check the patch like below
and see whether you get a kernel warning (but no Oops) or the problem
gets fixed by shifting the assignment of pci drvdata?


thanks,

Takashi

---
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index f09ff6c..152f9e1 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2609,9 +2609,15 @@ static void azx_vs_set_state(struct pci_dev *pci,
 			     enum vga_switcheroo_state state)
 {
 	struct snd_card *card = pci_get_drvdata(pci);
-	struct azx *chip = card->private_data;
+	struct azx *chip;
 	bool disabled;
 
+	if (WARN_ON(!card))
+		return;
+
+	chip = card->private_data;
+	if (WARN_ON(!chip))
+		return;
 	if (chip->init_failed)
 		return;
 
@@ -3314,6 +3320,7 @@ static int __devinit azx_probe(struct pci_dev *pci,
 	}
 
 	snd_card_set_dev(card, &pci->dev);
+	pci_set_drvdata(pci, card);
 
 	err = azx_create(card, pci, dev, pci_id->driver_data, &chip);
 	if (err < 0)
@@ -3340,8 +3347,6 @@ static int __devinit azx_probe(struct pci_dev *pci,
 			goto out_free;
 	}
 
-	pci_set_drvdata(pci, card);
-
 	if (pci_dev_run_wake(pci))
 		pm_runtime_put_noidle(&pci->dev);
 
@@ -3350,6 +3355,7 @@ static int __devinit azx_probe(struct pci_dev *pci,
 
 out_free:
 	snd_card_free(card);
+	pci_set_drvdata(pci, NULL);
 	return err;
 }
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/