path: root/sound
diff options
authorEvan Green <>2019-07-01 10:30:30 -0700
committerTakashi Iwai <>2019-07-01 20:13:04 +0200
commit98482377dc7295d0c70e251925b7cc14aff4c5ac (patch)
tree3e66beae9641f23b3337b163b587d8a96adc6d80 /sound
parent7fbd1753b64eafe21cf842348a40a691d0dee440 (diff)
ALSA: hda: Fix widget_mutex incomplete protection
The widget_mutex was introduced to serialize callers to hda_widget_sysfs_{re}init. However, its protection of the sysfs widget array is incomplete. For example, it is acquired around the call to hda_widget_sysfs_reinit(), which actually creates the new array, but isn't still acquired when codec->num_nodes and codec->start_nid is updated. So the lock ensures one thread sets up the new array at a time, but doesn't ensure which thread's value will end up in codec->num_nodes. If a larger num_nodes wins but a smaller array was set up, the next call to refresh_widgets() will touch free memory as it iterates over codec->num_nodes that aren't there. The widget_lock really protects both the tree as well as codec->num_nodes, start_nid, and end_nid, so make sure it's held across that update. It should also be held during snd_hdac_get_sub_nodes(), so that a very old read from that function doesn't end up clobbering a later update. Fixes: ed180abba7f1 ("ALSA: hda: Fix race between creating and refreshing sysfs entries") Signed-off-by: Evan Green <> Signed-off-by: Takashi Iwai <>
Diffstat (limited to 'sound')
1 files changed, 12 insertions, 6 deletions
diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c
index 4769f4c03e14..11050bfd8068 100644
--- a/sound/hda/hdac_device.c
+++ b/sound/hda/hdac_device.c
@@ -399,27 +399,33 @@ static void setup_fg_nodes(struct hdac_device *codec)
int snd_hdac_refresh_widgets(struct hdac_device *codec, bool sysfs)
hda_nid_t start_nid;
- int nums, err;
+ int nums, err = 0;
+ /*
+ * Serialize against multiple threads trying to update the sysfs
+ * widgets array.
+ */
+ mutex_lock(&codec->widget_lock);
nums = snd_hdac_get_sub_nodes(codec, codec->afg, &start_nid);
if (!start_nid || nums <= 0 || nums >= 0xff) {
dev_err(&codec->dev, "cannot read sub nodes for FG 0x%02x\n",
- return -EINVAL;
+ err = -EINVAL;
+ goto unlock;
if (sysfs) {
- mutex_lock(&codec->widget_lock);
err = hda_widget_sysfs_reinit(codec, start_nid, nums);
- mutex_unlock(&codec->widget_lock);
if (err < 0)
- return err;
+ goto unlock;
codec->num_nodes = nums;
codec->start_nid = start_nid;
codec->end_nid = start_nid + nums;
- return 0;
+ mutex_unlock(&codec->widget_lock);
+ return err;