Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 03 Oct 2018 17:54:10 +0200
Message-ID: <s5hk1mzowkd.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     "Jia-Ju Bai" <baijiaju1990@gmail.com>
Cc:     <keescook@chromium.org>, <perex@perex.cz>,
        <alsa-devel@alsa-project.org>,
        "Linux Kernel Mailing List" <linux-kernel@vger.kernel.org>
Subject: Re: [BUG] sound: pci: trident: a possible data race
In-Reply-To: <864e211c-8be5-6a34-902a-a71f176111db@gmail.com>
References: <864e211c-8be5-6a34-902a-a71f176111db@gmail.com>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka)
 FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/26
 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, 03 Oct 2018 14:50:25 +0200,
Jia-Ju Bai wrote:
> 
> CPU0:
> snd_trident_hw_free
>     snd_trident_free_voice
>             line 3870: spin_lock_irqsave()
>             line 3881: voice->substream = NULL; [WRITE]
> CPU1:
> snd_trident_interrupt
>     line 3798: snd_pcm_period_elapsed(voice->substream);  [READ]
> 
> As for voice->substream, the WRITE operation in CPU0 is performed
> with holding a spinlock, but the READ operation in CPU1 is performed
> without holding this spinlock, so there may exist a data race.

Thanks for the report.

The actual crash must be very unlikely, almost 0%, though.
snd_trident_hw_free() is called always after the PCM stream gets
stopped via trigger callback, i.e. at the moment, there is no
corresponding interrupt is generated for that voice entry.

And the hardware is very old, I bet only a handful people still using
in the whole world :)

If we really want to be 100% sure, we may call synchronize_irq()
before the NULL-clearing.  But there is no way to test the bug nor
the fix, so it's fairly moot, IMO.


thanks,

Takashi