linux-kernel - [PATCH 1/1] dmaengine: dw: resolve recursion lock when audio playback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <025c01d0f858$4d19c790$e74d56b0$@tangramtek.com>
Date:	Sat, 26 Sep 2015 20:38:47 +0800
From:	"yitian" <yitian.bu@...gramtek.com>
To:	<vireshk@...nel.org>, <andriy.shevchenko@...ux.intel.com>,
	<vinod.koul@...el.com>, <dan.j.williams@...el.com>
Cc:	<dmaengine@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: [PATCH 1/1] dmaengine: dw: resolve recursion lock when audio playback

when audio playback is running, user space will call
snd_pcm_lib_write1() function, it will first get pcm stream lock,
after that it may call function snd_pcm_update_hw_ptr(), the call
stack will be as below:
  snd_pcm_lib_write1  <-- got pcm stream lock
   --> snd_pcm_update_hw_ptr
     --> dwc_tx_status
      --> dwc_scan_descriptors
       --> callback
        --> dmaengine_pcm_dma_complete
         --> snd_pcm_period_elapsed <-- get stream lock again
recursion lock occurs in snd_pcm_period_elapsed function.
remove dwc_scan_descriptors from dwc_tx_status can fix this issue.

Signed-off-by: Yitian Bu <yitian.bu@...gramtek.com>
---
 drivers/dma/dw/core.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index cf1c87f..5341b44 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1078,11 +1078,7 @@ dwc_tx_status(struct dma_chan *chan,
 	ret = dma_cookie_status(chan, cookie, txstate);
 	if (ret == DMA_COMPLETE)
 		return ret;
-
-	dwc_scan_descriptors(to_dw_dma(chan->device), dwc);
-
-	ret = dma_cookie_status(chan, cookie, txstate);
-	if (ret != DMA_COMPLETE)
+	else
 		dma_set_residue(txstate, dwc_get_residue(dwc));
 
 	if (dwc->paused && ret == DMA_IN_PROGRESS)
-- 
1.7.12.4



Yitian
Best Regards




--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/