linux-kernel - Re: [PATCH] ASoC: soc-pcm: fix fe and be race when accessing substream->runtime

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <2f5a510b-082a-60e2-5770-58be086b5fc8@intel.com>
Date:   Tue, 27 Sep 2022 09:50:05 +0200
From:   Cezary Rojewski <cezary.rojewski@...el.com>
To:     Eugeniu Rosca <erosca@...adit-jv.com>,
        Liam Girdwood <lgirdwood@...il.com>,
        Mark Brown <broonie@...nel.org>,
        Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai <tiwai@...e.com>, <alsa-devel@...a-project.org>,
        <linux-kernel@...r.kernel.org>
CC:     Yanmin Zhang <yanmin_zhang@...ux.intel.com>,
        Eugeniu Rosca <roscaeugeniu@...il.com>,
        Jiada Wang <jiada_wang@...tor.com>,
        Zhang Yanmin <yanmin.zhang@...el.com>,
        Ramesh Babu <ramesh.babu@...el.com>,
        Dean Jenkins <Dean_Jenkins@...tor.com>,
        Ramesh Babu B <ramesh.babu.b@...el.com>,
        xiao jin <jin.xiao@...el.com>,
        Pierre-Louis Bossart <pierre-louis.bossart@...ux.intel.com>,
        Amadeusz Sławiński 
        <amadeuszx.slawinski@...ux.intel.com>
Subject: Re: [PATCH] ASoC: soc-pcm: fix fe and be race when accessing
 substream->runtime

On 2022-09-26 6:35 PM, Eugeniu Rosca wrote:
> From: xiao jin <jin.xiao@...el.com>
> 
> After start of fe and be, fe might go to close without triggering
> STOP, and substream->runtime is freed. However, be is still at
> START state and its substream->runtime still points to the
> freed runtime.
> 
> Later on, FE is opened/started again, and triggers STOP.
> snd_pcm_do_stop => dpcm_fe_dai_trigger
>                  => dpcm_fe_dai_do_trigger
>                  => dpcm_be_dai_trigger
>                  => dpcm_do_trigger
>                  => soc_pcm_trigger
>                  => skl_platform_pcm_trigger
> skl_platform_pcm_trigger accesses the freed old runtime data and
> kernel panic.
> 
> The patch fixes it by assigning be_substream->runtime in
> dpcm_be_dai_startup when be's state is START.
> 
> Signed-off-by: xiao jin <jin.xiao@...el.com>
> Signed-off-by: Zhang Yanmin <yanmin.zhang@...el.com>
> Signed-off-by: Eugeniu Rosca <erosca@...adit-jv.com>


Hello,

The change seems to be driven by the skylake-driver problem. With all 
due respect, why not ping owners of the driver first? There are some 
crucial CCs missing.

I'd like to know more about the scenario you guys reproduced the problem 
in. Configuration details and kernel base would be good to know too. 
Since our CI did not detect problem of such sort, if the problem 
actually exists, we would like to append a test or two to cover it later on.


Regards,
Czarek