summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorEvan Green <evgreen@chromium.org>2019-07-01 10:30:30 -0700
committerTakashi Iwai <tiwai@suse.de>2019-07-01 20:13:04 +0200
commit98482377dc7295d0c70e251925b7cc14aff4c5ac (patch)
tree3e66beae9641f23b3337b163b587d8a96adc6d80 /include
parent7fbd1753b64eafe21cf842348a40a691d0dee440 (diff)
ALSA: hda: Fix widget_mutex incomplete protection
The widget_mutex was introduced to serialize callers to hda_widget_sysfs_{re}init. However, its protection of the sysfs widget array is incomplete. For example, it is acquired around the call to hda_widget_sysfs_reinit(), which actually creates the new array, but isn't still acquired when codec->num_nodes and codec->start_nid is updated. So the lock ensures one thread sets up the new array at a time, but doesn't ensure which thread's value will end up in codec->num_nodes. If a larger num_nodes wins but a smaller array was set up, the next call to refresh_widgets() will touch free memory as it iterates over codec->num_nodes that aren't there. The widget_lock really protects both the tree as well as codec->num_nodes, start_nid, and end_nid, so make sure it's held across that update. It should also be held during snd_hdac_get_sub_nodes(), so that a very old read from that function doesn't end up clobbering a later update. Fixes: ed180abba7f1 ("ALSA: hda: Fix race between creating and refreshing sysfs entries") Signed-off-by: Evan Green <evgreen@chromium.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions