From patchwork Tue Oct 20 09:46:31 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lars-Peter Clausen X-Patchwork-Id: 7445741 Return-Path: X-Original-To: patchwork-alsa-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id C791F9F302 for ; Tue, 20 Oct 2015 09:49:26 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 1025B20888 for ; Tue, 20 Oct 2015 09:49:26 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.kernel.org (Postfix) with ESMTP id EDF8720880 for ; Tue, 20 Oct 2015 09:49:20 +0000 (UTC) Received: by alsa0.perex.cz (Postfix, from userid 1000) id C57832667A9; Tue, 20 Oct 2015 11:49:19 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_LOW, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from alsa0.perex.cz (localhost [IPv6:::1]) by alsa0.perex.cz (Postfix) with ESMTP id E7AD12667B2; Tue, 20 Oct 2015 11:46:53 +0200 (CEST) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 86D0B2664A1; Tue, 20 Oct 2015 11:46:50 +0200 (CEST) Received: from smtp-out-188.synserver.de (smtp-out-200.synserver.de [212.40.185.200]) by alsa0.perex.cz (Postfix) with ESMTP id A4D442664C2 for ; Tue, 20 Oct 2015 11:46:45 +0200 (CEST) Received: (qmail 2980 invoked by uid 0); 20 Oct 2015 09:46:44 -0000 X-SynServer-TrustedSrc: 1 X-SynServer-AuthUser: lars@metafoo.de X-SynServer-PPID: 2410 Received: from pd9e2f76f.dip0.t-ipconnect.de (HELO lars-laptop.ad.analog.com) [217.226.247.111] by 217.119.54.77 with SMTP; 20 Oct 2015 09:46:44 -0000 From: Lars-Peter Clausen To: Vinod Koul , Takashi Iwai Date: Tue, 20 Oct 2015 11:46:31 +0200 Message-Id: <1445334391-12272-5-git-send-email-lars@metafoo.de> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1445334391-12272-1-git-send-email-lars@metafoo.de> References: <1445334391-12272-1-git-send-email-lars@metafoo.de> Cc: Shengjiu Wang , Lars-Peter Clausen , Kuninori Morimoto , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, Qiao Zhou , Laurent Pinchart , Matt Campbell , dmaengine@vger.kernel.org, Russell King , Dan Williams , Jonah Petri Subject: [alsa-devel] [PATCH 4/4] ALSA: pcm_dmaengine: Properly synchronize DMA on shutdown X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP Use the new dmaengine_synchronize() function to make sure that all complete callbacks have finished running before the runtime data, which is accessed in the completed callback, is freed. This fixes a long standing use-after-free race condition that has been observed on some systems. Signed-off-by: Lars-Peter Clausen --- sound/core/pcm_dmaengine.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c index fba365a..697c166 100644 --- a/sound/core/pcm_dmaengine.c +++ b/sound/core/pcm_dmaengine.c @@ -202,13 +202,13 @@ int snd_dmaengine_pcm_trigger(struct snd_pcm_substream *substream, int cmd) if (runtime->info & SNDRV_PCM_INFO_PAUSE) dmaengine_pause(prtd->dma_chan); else - dmaengine_terminate_all(prtd->dma_chan); + dmaengine_terminate_async(prtd->dma_chan); break; case SNDRV_PCM_TRIGGER_PAUSE_PUSH: dmaengine_pause(prtd->dma_chan); break; case SNDRV_PCM_TRIGGER_STOP: - dmaengine_terminate_all(prtd->dma_chan); + dmaengine_terminate_async(prtd->dma_chan); break; default: return -EINVAL; @@ -346,6 +346,7 @@ int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream) { struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); + dmaengine_synchronize(prtd->dma_chan); kfree(prtd); return 0; @@ -362,9 +363,11 @@ int snd_dmaengine_pcm_close_release_chan(struct snd_pcm_substream *substream) { struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); + dmaengine_synchronize(prtd->dma_chan); dma_release_channel(prtd->dma_chan); + kfree(prtd); - return snd_dmaengine_pcm_close(substream); + return 0; } EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_close_release_chan);