From patchwork Thu Apr 24 07:34:36 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Nikula X-Patchwork-Id: 4045951 Return-Path: X-Original-To: patchwork-alsa-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 82725BFF02 for ; Thu, 24 Apr 2014 07:35:40 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id B79C02025A for ; Thu, 24 Apr 2014 07:35:39 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.kernel.org (Postfix) with ESMTP id 95B0820219 for ; Thu, 24 Apr 2014 07:35:37 +0000 (UTC) Received: by alsa0.perex.cz (Postfix, from userid 1000) id 5D9212651EB; Thu, 24 Apr 2014 09:35:35 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from alsa0.perex.cz (localhost [IPv6:::1]) by alsa0.perex.cz (Postfix) with ESMTP id 5A660261684; Thu, 24 Apr 2014 09:35:24 +0200 (CEST) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id BB71B2610CF; Thu, 24 Apr 2014 09:35:22 +0200 (CEST) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by alsa0.perex.cz (Postfix) with ESMTP id 411EB2610CF for ; Thu, 24 Apr 2014 09:35:13 +0200 (CEST) Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga102.fm.intel.com with ESMTP; 24 Apr 2014 00:35:11 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.97,917,1389772800"; d="scan'208";a="526220634" Received: from mylly.fi.intel.com (HELO mylly.fi.intel.com.) ([10.237.72.74]) by fmsmga002.fm.intel.com with ESMTP; 24 Apr 2014 00:34:42 -0700 From: Jarkko Nikula To: alsa-devel@alsa-project.org Date: Thu, 24 Apr 2014 10:34:36 +0300 Message-Id: <1398324876-901-1-git-send-email-jarkko.nikula@linux.intel.com> X-Mailer: git-send-email 1.9.2 Cc: Wenkai Du , Derek Basehore , Liam Girdwood , Liam Girdwood , Mark Brown , Jarkko Nikula Subject: [alsa-devel] [PATCH] ASoC: Intel: Cancel hsw_notification_work before freeing the stream X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP I suppose there is a possibility that hsw_notification_work() may run after sst_hsw_stream_free() which can lead to a kernel crash since struct sst_hsw_stream is freed at that point and stream = container_of(work, struct sst_hsw_stream, notify_work) is not valid when hsw_notification_work() is run. Reported-by: Derek Basehore Reported-by: Wenkai Du Signed-off-by: Jarkko Nikula --- Untested, I don't have at the moment Haswell to test this and Liam hasn't seen this patch yet so ack/tested-by from him might be good to have :-) --- sound/soc/intel/sst-haswell-ipc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/intel/sst-haswell-ipc.c b/sound/soc/intel/sst-haswell-ipc.c index 6c0b4f247a86..5bcf5963a0ba 100644 --- a/sound/soc/intel/sst-haswell-ipc.c +++ b/sound/soc/intel/sst-haswell-ipc.c @@ -1207,6 +1207,7 @@ int sst_hsw_stream_free(struct sst_hsw *hsw, struct sst_hsw_stream *stream) trace_hsw_stream_free_req(stream, &stream->free_req); out: + cancel_work_sync(&stream->notify_work); spin_lock_irqsave(&sst->spinlock, flags); list_del(&stream->node); kfree(stream);