[v3] usb: gadget: function: fix missing spinlock in f_uac1_legacy

Commit Message

Zhang, Qiang July 5, 2020, 12:40 p.m. UTC

From: Zhang Qiang <[e-mail]>

Add a missing spinlock protection for play_queue, because
the play_queue may be destroyed when the "playback_work"
work func and "f_audio_out_ep_complete" callback func
operate this paly_queue at the same time.

Cc: stable <[e-mail]>
Signed-off-by: Zhang Qiang <[e-mail]>
---
 v1->v2->v3:
 Add changelog text and Cc tags.

 drivers/usb/gadget/function/f_uac1_legacy.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Greg Kroah-Hartman July 6, 2020, 7:55 p.m. UTC | #1

On Sun, Jul 05, 2020 at 08:40:27PM +0800, [e-mail] wrote:
> From: Zhang Qiang <[e-mail]>
> 
> Add a missing spinlock protection for play_queue, because
> the play_queue may be destroyed when the "playback_work"
> work func and "f_audio_out_ep_complete" callback func
> operate this paly_queue at the same time.

"play_queue", right?

> 
> Cc: stable <[e-mail]>
> Signed-off-by: Zhang Qiang <[e-mail]>

Because you do not have a Fixes: tag in here, how far back do you want
the stable patch to go to?  That's why, if you can, it's always good to
have a "Fixes:" tag in there to show what commit caused the problem you
are fixing here.

So, what commit caused this?

thanks,

gre gk-h

Zhang, Qiang July 7, 2020, 2:28 a.m. UTC | #2

Hi Greg KH
In the early submission:
"commit id c6994e6f067cf0fc4c6cca3d164018b1150916f8" which add USB Audio Gadget driver "   
the "audio->play_queue" was protected from "audio->lock"
spinlock in "playback_work" func, But in "f_audio_out_ep_complete" func 
there is no protection for the operation of this "audio->play_queue". there
are missing spinlock,  Fix tags should add up here commit？

Greg Kroah-Hartman July 7, 2020, 6:51 a.m. UTC | #3

A: http://en.wikipedia.org/wiki/Top_post
Q: Were do I find info about this thing called top-posting?
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in e-mail?

A: No.
Q: Should I include quotations after my reply?

http://daringfireball.net/2007/07/on_top


On Tue, Jul 07, 2020 at 02:28:36AM +0000, Zhang, Qiang wrote:
> Hi Greg KH
> In the early submission:
> "commit id c6994e6f067cf0fc4c6cca3d164018b1150916f8" which add USB Audio Gadget driver "   
> the "audio->play_queue" was protected from "audio->lock"
> spinlock in "playback_work" func, But in "f_audio_out_ep_complete" func 
> there is no protection for the operation of this "audio->play_queue". there
> are missing spinlock,  Fix tags should add up here commit？

I really do not understand what you are asking here, sorry.

greg k-h

Sergei Shtylyov July 7, 2020, 8:35 a.m. UTC | #4

On 05.07.2020 15:40, [e-mail] wrote:

> From: Zhang Qiang <[e-mail]>
> 
> Add a missing spinlock protection for play_queue, because
> the play_queue may be destroyed when the "playback_work"
> work func and "f_audio_out_ep_complete" callback func
> operate this paly_queue at the same time.

    It's play_queue. :-)

> Cc: stable <[e-mail]>
> Signed-off-by: Zhang Qiang <[e-mail]>
[...]

MBR, Sergei

Patch

diff --git a/drivers/usb/gadget/function/f_uac1_legacy.c b/drivers/usb/gadget/function/f_uac1_legacy.c
index 349deae7cabd..e2d7f69128a0 100644
--- a/drivers/usb/gadget/function/f_uac1_legacy.c
+++ b/drivers/usb/gadget/function/f_uac1_legacy.c
@@ -336,7 +336,9 @@  static int f_audio_out_ep_complete(struct usb_ep *ep, struct usb_request *req)
 
 	/* Copy buffer is full, add it to the play_queue */
 	if (audio_buf_size - copy_buf->actual < req->actual) {
+		spin_lock_irq(&audio->lock);
 		list_add_tail(&copy_buf->list, &audio->play_queue);
+		spin_unlock_irq(&audio->lock);
 		schedule_work(&audio->playback_work);
 		copy_buf = f_audio_buffer_alloc(audio_buf_size);
 		if (IS_ERR(copy_buf))