| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20200703074935.884736-1-maxime@cerno.tech>
Date: Fri, 3 Jul 2020 09:49:35 +0200
From: Maxime Ripard <maxime@...no.tech>
To: Liam Girdwood <lgirdwood@...il.com>,
Mark Brown <broonie@...nel.org>,
Jaroslav Kysela <perex@...ex.cz>,
Takashi Iwai <tiwai@...e.com>,
Lars-Peter Clausen <lars@...afoo.de>
Cc: alsa-devel@...a-project.org, linux-kernel@...r.kernel.org,
Dave Stevenson <dave.stevenson@...pberrypi.com>,
Tim Gover <tim.gover@...pberrypi.com>,
Phil Elwell <phil@...pberrypi.com>,
Maxime Ripard <maxime@...no.tech>
Subject: [PATCH] ASoC: core: Remove only the registered component in devm functions
The ASoC devm_ functions that register a component
(devm_snd_soc_register_component and devm_snd_dmaengine_pcm_register) will
clean their component by running snd_soc_unregister_component.
snd_soc_unregister_component will then remove all the components for the
device that was used to register the component in the first place.
However, some drivers register several components (such as a DAI and a
dmaengine PCM) on the same device, and if the dmaengine PCM is registered
first, then the DAI will be cleaned up first and
snd_dmaengine_pcm_unregister will be called next.
snd_dmaengine_pcm_unregister will then lookup the dmaengine PCM component
on the device, and if there's one unregister that component and release its
dmaengine channels. That doesn't happen in practice though since the first
call to snd_soc_unregister_component removed all the components, so we
never get the chance to release the dmaengine channels.
In order to fix this, instead of removing all the components for a given
device, we can simply remove the component that was registered in the first
place. We should have the same number of component registration than we
have components, so it should work just fine.
Signed-off-by: Maxime Ripard <maxime@...no.tech>
---
This was observed on a RaspberryPi that uses the vc4_hdmi driver
(drivers/gpu/drm/vc4/vc4_hdmi.c). This driver will register a dmaengine PCM
and two components. If the MIPI-DSI controller is enabled, it will create
an EPROBE_DEFER across the entire display pipeline, leading to multiple
bind/unbind cycles in the other display drivers including vc4_hdmi, leading
to multiple warnings since we request the same dmaengine channels on the
same device without ever releasing them.
It's not really clear to me when that bug was introduced exactly, since it
can only be seen on a rather unusual setup, and with all the drivers
built-in (otherwise we probably wouldn't get an EPROBE_DEFER for DSI), but
it still looks like something that should probably go to stable?
---
include/sound/soc.h | 2 ++
sound/soc/soc-core.c | 27 +++++++++++++++++++++++++++
sound/soc/soc-devres.c | 8 +++++---
sound/soc/soc-generic-dmaengine-pcm.c | 2 +-
4 files changed, 35 insertions(+), 4 deletions(-)
diff --git a/include/sound/soc.h b/include/sound/soc.h
index ef5dd28e10a9..0b3b31803678 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -444,6 +444,8 @@ int devm_snd_soc_register_component(struct device *dev,
const struct snd_soc_component_driver *component_driver,
struct snd_soc_dai_driver *dai_drv, int num_dai);
void snd_soc_unregister_component(struct device *dev);
+void snd_soc_unregister_component_by_driver(struct device *dev,
+ const struct snd_soc_component_driver *component_driver);
struct snd_soc_component *snd_soc_lookup_component(struct device *dev,
const char *driver_name);
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 7b387202c5db..9d24cbd9111f 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2571,6 +2571,33 @@ int snd_soc_register_component(struct device *dev,
}
EXPORT_SYMBOL_GPL(snd_soc_register_component);
+/**
+ * snd_soc_unregister_component_by_driver - Unregister component using a given driver
+ * from the ASoC core
+ *
+ * @dev: The device to unregister
+ * @component_driver: The component driver to unregister
+ */
+void snd_soc_unregister_component_by_driver(struct device *dev,
+ const struct snd_soc_component_driver *component_driver)
+{
+ struct snd_soc_component *component;
+
+ if (!component_driver)
+ return;
+
+ mutex_lock(&client_mutex);
+ component = snd_soc_lookup_component_nolocked(dev, component_driver->name);
+ if (!component)
+ goto out;
+
+ snd_soc_del_component_unlocked(component);
+
+out:
+ mutex_unlock(&client_mutex);
+}
+EXPORT_SYMBOL_GPL(snd_soc_unregister_component_by_driver);
+
/**
* snd_soc_unregister_component - Unregister all related component
* from the ASoC core
diff --git a/sound/soc/soc-devres.c b/sound/soc/soc-devres.c
index a9ea172a66a7..c6364caabc0e 100644
--- a/sound/soc/soc-devres.c
+++ b/sound/soc/soc-devres.c
@@ -11,7 +11,9 @@
static void devm_component_release(struct device *dev, void *res)
{
- snd_soc_unregister_component(*(struct device **)res);
+ const struct snd_soc_component_driver **cmpnt_drv = res;
+
+ snd_soc_unregister_component_by_driver(dev, *cmpnt_drv);
}
/**
@@ -28,7 +30,7 @@ int devm_snd_soc_register_component(struct device *dev,
const struct snd_soc_component_driver *cmpnt_drv,
struct snd_soc_dai_driver *dai_drv, int num_dai)
{
- struct device **ptr;
+ const struct snd_soc_component_driver **ptr;
int ret;
ptr = devres_alloc(devm_component_release, sizeof(*ptr), GFP_KERNEL);
@@ -37,7 +39,7 @@ int devm_snd_soc_register_component(struct device *dev,
ret = snd_soc_register_component(dev, cmpnt_drv, dai_drv, num_dai);
if (ret == 0) {
- *ptr = dev;
+ *ptr = cmpnt_drv;
devres_add(dev, ptr);
} else {
devres_free(ptr);
diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c
index f728309a0833..ab600be9e69f 100644
--- a/sound/soc/soc-generic-dmaengine-pcm.c
+++ b/sound/soc/soc-generic-dmaengine-pcm.c
@@ -490,7 +490,7 @@ void snd_dmaengine_pcm_unregister(struct device *dev)
pcm = soc_component_to_pcm(component);
- snd_soc_unregister_component(dev);
+ snd_soc_unregister_component_by_driver(dev, component->driver);
dmaengine_pcm_release_chan(pcm);
kfree(pcm);
}
--
2.26.2
Powered by blists - more mailing lists