Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 04 Oct 2018 07:24:56 +0200
Message-ID: <s5hmurunv13.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     Jia-Ju Bai <baijiaju1990@gmail.com>
Cc:     keescook@chromium.org, perex@perex.cz, alsa-devel@alsa-project.org,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [BUG] sound: pci: trident: a possible data race
In-Reply-To: <e334c065-5768-7710-bd70-059f7316157b@gmail.com>
References: <864e211c-8be5-6a34-902a-a71f176111db@gmail.com>
        <s5hk1mzowkd.wl-tiwai@suse.de>
        <e334c065-5768-7710-bd70-059f7316157b@gmail.com>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka)
 FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/26
 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, 04 Oct 2018 05:08:45 +0200,
Jia-Ju Bai wrote:
> 
> Thanks for the reply :)
> 
> 
> On 2018/10/3 23:54, Takashi Iwai wrote:
> > On Wed, 03 Oct 2018 14:50:25 +0200,
> > Jia-Ju Bai wrote:
> >> CPU0:
> >> snd_trident_hw_free
> >>      snd_trident_free_voice
> >>              line 3870: spin_lock_irqsave()
> >>              line 3881: voice->substream = NULL; [WRITE]
> >> CPU1:
> >> snd_trident_interrupt
> >>      line 3798: snd_pcm_period_elapsed(voice->substream);  [READ]
> >>
> >> As for voice->substream, the WRITE operation in CPU0 is performed
> >> with holding a spinlock, but the READ operation in CPU1 is performed
> >> without holding this spinlock, so there may exist a data race.
> > Thanks for the report.
> >
> > The actual crash must be very unlikely, almost 0%, though.
> > snd_trident_hw_free() is called always after the PCM stream gets
> > stopped via trigger callback, i.e. at the moment, there is no
> > corresponding interrupt is generated for that voice entry.
> 
> How about the case that playback and capture are performed concurrently?
> Namely, snd_trident_hw_free() is called for playback, and the
> interrupt is generated for capture.

They are different substreams, hence it won't pick up the substream
object.

> > And the hardware is very old, I bet only a handful people still using
> > in the whole world :)
> 
> I have this hardware, so I am the one of these handful people ;)

Wow, that's fun.  Then we can really fix the issue, if any.
Did you actually hit any relevant bug?


thanks,

Takashi