On Mon, 01 Jul 2019 19:30:30 +0200,
Evan Green wrote:
>
> The widget_mutex was introduced to serialize callers to
> hda_widget_sysfs_{re}init. However, its protection of the sysfs widget array
> is incomplete. For example, it is acquired around the call to
> hda_widget_sysfs_reinit(), which actually creates the new array, but isn't
> still acquired when codec->num_nodes and codec->start_nid is updated. So
> the lock ensures one thread sets up the new array at a time, but doesn't
> ensure which thread's value will end up in codec->num_nodes. If a larger
> num_nodes wins but a smaller array was set up, the next call to
> refresh_widgets() will touch free memory as it iterates over codec->num_nodes
> that aren't there.
>
> The widget_lock really protects both the tree as well as codec->num_nodes,
> start_nid, and end_nid, so make sure it's held across that update. It should
> also be held during snd_hdac_get_sub_nodes(), so that a very old read from that
> function doesn't end up clobbering a later update.
>
> Fixes: ed180abba7f1 ("ALSA: hda: Fix race between creating and refreshing sysfs entries")
>
> Signed-off-by: Evan Green <evgreen@xxxxxxxxxxxx>
Applied now. Thanks.
Takashi
_______________________________________________
Alsa-devel mailing list
Alsa-devel@xxxxxxxxxxxxxxxx
https://mailman.alsa-project.org/mailman/listinfo/alsa-devel
