On Wed, Nov 13, 2019 at 2:16 AM Takashi Iwai <tiwai@xxxxxxx> wrote: > > On Tue, 12 Nov 2019 18:17:13 +0100, > paulhsia wrote: > > > > Since > > - snd_pcm_detach_substream sets runtime to null without stream lock and > > - snd_pcm_period_elapsed checks the nullity of the runtime outside of > > stream lock. > > > > This will trigger null memory access in snd_pcm_running() call in > > snd_pcm_period_elapsed. > > Well, if a stream is detached, it means that the stream must have been > already closed; i.e. it's already a clear bug in the driver that > snd_pcm_period_elapsed() is called against such a stream. > > Or am I missing other possible case? > > > thanks, > > Takashi > In multithreaded environment, it is possible to have to access both `interrupt_handler` (from irq) and `substream close` (from snd_pcm_release) at the same time. Therefore, in driver implementation, if "substream close function" and the "code section where snd_pcm_period_elapsed() in" do not hold the same lock, then the following things can happen: 1. interrupt_handler -> goes into snd_pcm_period_elapsed with a valid sustream pointer 2. snd_pcm_release_substream: call close without blocking 3. snd_pcm_release_substream: call snd_pcm_detache_substream and set substream->runtime to NULL 4. interrupt_handler -> call snd_pcm_runtime() and crash while accessing fields in `substream->runtime` e.g. In intel8x0.c driver for ac97 device, In driver intel8x0.c, `snd_pcm_period_elapsed` is called after checking `ichdev->substream` in `snd_intel8x0_update`. And if a `snd_pcm_release` call from alsa-lib and pass through close() and run to snd_pcm_detach_substream() in another thread, it's possible to trigger a crash. I can reproduce the issue within a multithread VM easily. My patches are trying to provide a basic protection for this situation (and internal pcm lock between detach and elapsed), since - the usage of `snd_pcm_period_elapsed` does not warn callers about the possible race if the driver does not force the order for `calling snd_pcm_period_elapsed` and `close` by lock and - lots of drivers already have this hidden issue and I can't fix them one by one (You can check the "snd_pcm_period_elapsed usage" and the "close implementation" within all the drivers). The most common mistake is that - Checking if the substream is null and call into snd_pcm_period_elapsed - But `close` can happen anytime, pass without block and snd_pcm_detach_substream will be trigger right after it Best, Paul > > > > paulhsia (2): > > ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() > > ALSA: pcm: Use stream lock in snd_pcm_detach_substream() > > > > sound/core/pcm.c | 8 +++++++- > > sound/core/pcm_lib.c | 8 ++++++-- > > 2 files changed, 13 insertions(+), 3 deletions(-) > > > > -- > > 2.24.0.rc1.363.gb1bccd3e3d-goog > > _______________________________________________ Alsa-devel mailing list Alsa-devel@xxxxxxxxxxxxxxxx https://mailman.alsa-project.org/mailman/listinfo/alsa-devel
