linux-kernel - Re: [PATCH AUTOSEL 4.18 27/48] sound: enable interrupt after dma buffer initialization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <s5hzhvo4w5n.wl-tiwai@suse.de>
Date:   Mon, 08 Oct 2018 11:36:52 +0200
From:   Takashi Iwai <tiwai@...e.de>
To:     Mark Brown <broonie@...nel.org>
Cc:     Sasha Levin <sashal@...nel.org>, stable@...r.kernel.org,
        linux-kernel@...r.kernel.org, Yu Zhao <yuzhao@...gle.com>,
        Sasha Levin <alexander.levin@...rosoft.com>
Subject: Re: [PATCH AUTOSEL 4.18 27/48] sound: enable interrupt after dma buffer initialization

On Mon, 08 Oct 2018 11:34:12 +0200,
Mark Brown wrote:
> 
> On Fri, Oct 05, 2018 at 12:14:03PM -0400, Sasha Levin wrote:
> > From: Yu Zhao <yuzhao@...gle.com>
> > 
> > [ Upstream commit b61749a89f826eb61fc59794d9e4697bd246eb61 ]
> > 
> > In snd_hdac_bus_init_chip(), we enable interrupt before
> > snd_hdac_bus_init_cmd_io() initializing dma buffers. If irq has
> > been acquired and irq handler uses the dma buffer, kernel may crash
> > when interrupt comes in.
> 
> CCing Takashi who's the maintainer here for review.

This is OK to take as a stable.  This shouldn't break, at least.


thanks,

Takashi

> > 
> > Fix the problem by postponing enabling irq after dma buffer
> > initialization. And warn once on null dma buffer pointer during the
> > initialization.
> > 
> > Reviewed-by: Takashi Iwai <tiwai@...e.de>
> > Signed-off-by: Yu Zhao <yuzhao@...gle.com>
> > Signed-off-by: Mark Brown <broonie@...nel.org>
> > Signed-off-by: Sasha Levin <alexander.levin@...rosoft.com>
> > ---
> >  sound/hda/hdac_controller.c | 8 ++++++--
> >  1 file changed, 6 insertions(+), 2 deletions(-)
> > 
> > diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
> > index 560ec0986e1a..11057d9f84ec 100644
> > --- a/sound/hda/hdac_controller.c
> > +++ b/sound/hda/hdac_controller.c
> > @@ -40,6 +40,8 @@ static void azx_clear_corbrp(struct hdac_bus *bus)
> >   */
> >  void snd_hdac_bus_init_cmd_io(struct hdac_bus *bus)
> >  {
> > +	WARN_ON_ONCE(!bus->rb.area);
> > +
> >  	spin_lock_irq(&bus->reg_lock);
> >  	/* CORB set up */
> >  	bus->corb.addr = bus->rb.addr;
> > @@ -479,13 +481,15 @@ bool snd_hdac_bus_init_chip(struct hdac_bus *bus, bool full_reset)
> >  	/* reset controller */
> >  	azx_reset(bus, full_reset);
> >  
> > -	/* initialize interrupts */
> > +	/* clear interrupts */
> >  	azx_int_clear(bus);
> > -	azx_int_enable(bus);
> >  
> >  	/* initialize the codec command I/O */
> >  	snd_hdac_bus_init_cmd_io(bus);
> >  
> > +	/* enable interrupts after CORB/RIRB buffers are initialized above */
> > +	azx_int_enable(bus);
> > +
> >  	/* program the position buffer */
> >  	if (bus->use_posbuf && bus->posbuf.addr) {
> >  		snd_hdac_chip_writel(bus, DPLBASE, (u32)bus->posbuf.addr);
> > -- 
> > 2.17.1
> > 
> [2 signature.asc <application/pgp-signature (7bit)>]
>