Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 01 Jul 2019 20:14:03 +0200
Message-ID: <s5hy31hoc5w.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     "Evan Green" <evgreen@chromium.org>
Cc:     <alsa-devel@alsa-project.org>,
        "Thomas Gleixner" <tglx@linutronix.de>,
        "Amadeusz S*awi*ski" <amadeuszx.slawinski@linux.intel.com>,
        "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
        "Jaroslav Kysela" <perex@perex.cz>, <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v3] ALSA: hda: Fix widget_mutex incomplete protection
In-Reply-To: <20190701173030.168346-1-evgreen@chromium.org>
References: <20190701173030.168346-1-evgreen@chromium.org>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka)
 FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3
 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, 01 Jul 2019 19:30:30 +0200,
Evan Green wrote:
> 
> The widget_mutex was introduced to serialize callers to
> hda_widget_sysfs_{re}init. However, its protection of the sysfs widget array
> is incomplete. For example, it is acquired around the call to
> hda_widget_sysfs_reinit(), which actually creates the new array, but isn't
> still acquired when codec->num_nodes and codec->start_nid is updated. So
> the lock ensures one thread sets up the new array at a time, but doesn't
> ensure which thread's value will end up in codec->num_nodes. If a larger
> num_nodes wins but a smaller array was set up, the next call to
> refresh_widgets() will touch free memory as it iterates over codec->num_nodes
> that aren't there.
> 
> The widget_lock really protects both the tree as well as codec->num_nodes,
> start_nid, and end_nid, so make sure it's held across that update. It should
> also be held during snd_hdac_get_sub_nodes(), so that a very old read from that
> function doesn't end up clobbering a later update.
> 
> Fixes: ed180abba7f1 ("ALSA: hda: Fix race between creating and refreshing sysfs entries")
> 
> Signed-off-by: Evan Green <evgreen@chromium.org>

Applied now.  Thanks.


Takashi