linux-kernel - Re: [PATCH AUTOSEL 4.18 27/48] sound: enable interrupt after dma buffer initialization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181008093412.GA5684@sirena.org.uk>
Date:   Mon, 8 Oct 2018 10:34:12 +0100
From:   Mark Brown <broonie@...nel.org>
To:     Sasha Levin <sashal@...nel.org>
Cc:     stable@...r.kernel.org, linux-kernel@...r.kernel.org,
        Yu Zhao <yuzhao@...gle.com>,
        Sasha Levin <alexander.levin@...rosoft.com>, tiwai@...e.de
Subject: Re: [PATCH AUTOSEL 4.18 27/48] sound: enable interrupt after dma
 buffer initialization

On Fri, Oct 05, 2018 at 12:14:03PM -0400, Sasha Levin wrote:
> From: Yu Zhao <yuzhao@...gle.com>
> 
> [ Upstream commit b61749a89f826eb61fc59794d9e4697bd246eb61 ]
> 
> In snd_hdac_bus_init_chip(), we enable interrupt before
> snd_hdac_bus_init_cmd_io() initializing dma buffers. If irq has
> been acquired and irq handler uses the dma buffer, kernel may crash
> when interrupt comes in.

CCing Takashi who's the maintainer here for review.

> 
> Fix the problem by postponing enabling irq after dma buffer
> initialization. And warn once on null dma buffer pointer during the
> initialization.
> 
> Reviewed-by: Takashi Iwai <tiwai@...e.de>
> Signed-off-by: Yu Zhao <yuzhao@...gle.com>
> Signed-off-by: Mark Brown <broonie@...nel.org>
> Signed-off-by: Sasha Levin <alexander.levin@...rosoft.com>
> ---
>  sound/hda/hdac_controller.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
> index 560ec0986e1a..11057d9f84ec 100644
> --- a/sound/hda/hdac_controller.c
> +++ b/sound/hda/hdac_controller.c
> @@ -40,6 +40,8 @@ static void azx_clear_corbrp(struct hdac_bus *bus)
>   */
>  void snd_hdac_bus_init_cmd_io(struct hdac_bus *bus)
>  {
> +	WARN_ON_ONCE(!bus->rb.area);
> +
>  	spin_lock_irq(&bus->reg_lock);
>  	/* CORB set up */
>  	bus->corb.addr = bus->rb.addr;
> @@ -479,13 +481,15 @@ bool snd_hdac_bus_init_chip(struct hdac_bus *bus, bool full_reset)
>  	/* reset controller */
>  	azx_reset(bus, full_reset);
>  
> -	/* initialize interrupts */
> +	/* clear interrupts */
>  	azx_int_clear(bus);
> -	azx_int_enable(bus);
>  
>  	/* initialize the codec command I/O */
>  	snd_hdac_bus_init_cmd_io(bus);
>  
> +	/* enable interrupts after CORB/RIRB buffers are initialized above */
> +	azx_int_enable(bus);
> +
>  	/* program the position buffer */
>  	if (bus->use_posbuf && bus->posbuf.addr) {
>  		snd_hdac_chip_writel(bus, DPLBASE, (u32)bus->posbuf.addr);
> -- 
> 2.17.1
> 

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)