linux-kernel - [PATCH] ALSA: hda: Clear RIRB status before reading WP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 6 Feb 2020 15:40:53 +0530
From:   Viswanath L <viswanathl@...dia.com>
To:     <perex@...ex.cz>, <tiwai@...e.com>, <mkumard@...dia.com>,
        <jonathanh@...dia.com>
CC:     <arnd@...db.de>, <yung-chuan.liao@...ux.intel.com>,
        <baolin.wang@...aro.org>, <kstewart@...uxfoundation.org>,
        <Julia.Lawall@...ia.fr>, <tglx@...utronix.de>,
        <alsa-devel@...a-project.org>, <linux-kernel@...r.kernel.org>,
        <spujar@...dia.com>, <sharadg@...dia.com>, <rlokhande@...dia.com>,
        <DRAMESH@...dia.com>, <atalambedu@...dia.com>,
        Viswanath L <viswanathl@...dia.com>
Subject: [PATCH] ALSA: hda: Clear RIRB status before reading WP

From: Mohan Kumar <mkumard@...dia.com>

RIRB interrupt status getting cleared after the write pointer is read
causes a race condition, where last response(s) into RIRB may remain
unserviced by IRQ, eventually causing azx_rirb_get_response to fall
back to polling mode. Clearing the RIRB interrupt status ahead of
write pointer access ensures that this condition is avoided.

Signed-off-by: Mohan Kumar <mkumard@...dia.com>
Signed-off-by: Viswanath L <viswanathl@...dia.com>
---
 sound/pci/hda/hda_controller.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index 9757667..2609e39 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -1110,16 +1110,23 @@ irqreturn_t azx_interrupt(int irq, void *dev_id)
 		if (snd_hdac_bus_handle_stream_irq(bus, status, stream_update))
 			active = true;
 
-		/* clear rirb int */
 		status = azx_readb(chip, RIRBSTS);
 		if (status & RIRB_INT_MASK) {
+			/*
+			 * Clearing the interrupt status here ensures that no
+			 * interrupt gets masked after the RIRB wp is read in
+			 * snd_hdac_bus_update_rirb. This avoids a possible
+			 * race condition where codec response in RIRB may
+			 * remain unserviced by IRQ, eventually falling back
+			 * to polling mode in azx_rirb_get_response.
+			 */
+			azx_writeb(chip, RIRBSTS, RIRB_INT_MASK);
 			active = true;
 			if (status & RIRB_INT_RESPONSE) {
 				if (chip->driver_caps & AZX_DCAPS_CTX_WORKAROUND)
 					udelay(80);
 				snd_hdac_bus_update_rirb(bus);
 			}
-			azx_writeb(chip, RIRBSTS, RIRB_INT_MASK);
 		}
 	} while (active && ++repeat < 10);
 
-- 
2.7.4