mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
55 lines
2.0 KiB
Diff
55 lines
2.0 KiB
Diff
|
From 2ba1fe7a06d3624f9a7586d672b55f08f7c670f3 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Takashi Iwai <tiwai@suse.de>
|
||
|
|
Date: Mon, 18 Jan 2016 13:52:47 +0100
|
||
|
|
Subject: ALSA: hrtimer: Fix stall by hrtimer_cancel()
|
||
|
|
|
||
|
|
hrtimer_cancel() waits for the completion from the callback, thus it
|
||
|
|
must not be called inside the callback itself. This was already a
|
||
|
|
problem in the past with ALSA hrtimer driver, and the early commit
|
||
|
|
[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.
|
||
|
|
|
||
|
|
However, the previous fix is still insufficient: it may still cause a
|
||
|
|
lockup when the ALSA timer instance reprograms itself in its callback.
|
||
|
|
Then it invokes the start function even in snd_timer_interrupt() that
|
||
|
|
is called in hrtimer callback itself, results in a CPU stall. This is
|
||
|
|
no hypothetical problem but actually triggered by syzkaller fuzzer.
|
||
|
|
|
||
|
|
This patch tries to fix the issue again. Now we call
|
||
|
|
hrtimer_try_to_cancel() at both start and stop functions so that it
|
||
|
|
won't fall into a deadlock, yet giving some chance to cancel the queue
|
||
|
|
if the functions have been called outside the callback. The proper
|
||
|
|
hrtimer_cancel() is called in anyway at closing, so this should be
|
||
|
|
enough.
|
||
|
|
|
||
|
|
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
|
||
|
|
Cc: <stable@vger.kernel.org>
|
||
|
|
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||
|
|
---
|
||
|
|
sound/core/hrtimer.c | 3 ++-
|
||
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/sound/core/hrtimer.c b/sound/core/hrtimer.c
|
||
|
|
index f845ecf..656d9a9 100644
|
||
|
|
--- a/sound/core/hrtimer.c
|
||
|
|
+++ b/sound/core/hrtimer.c
|
||
|
|
@@ -90,7 +90,7 @@ static int snd_hrtimer_start(struct snd_timer *t)
|
||
|
|
struct snd_hrtimer *stime = t->private_data;
|
||
|
|
|
||
|
|
atomic_set(&stime->running, 0);
|
||
|
|
- hrtimer_cancel(&stime->hrt);
|
||
|
|
+ hrtimer_try_to_cancel(&stime->hrt);
|
||
|
|
hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution),
|
||
|
|
HRTIMER_MODE_REL);
|
||
|
|
atomic_set(&stime->running, 1);
|
||
|
|
@@ -101,6 +101,7 @@ static int snd_hrtimer_stop(struct snd_timer *t)
|
||
|
|
{
|
||
|
|
struct snd_hrtimer *stime = t->private_data;
|
||
|
|
atomic_set(&stime->running, 0);
|
||
|
|
+ hrtimer_try_to_cancel(&stime->hrt);
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
--
|
||
|
|
cgit v1.1
|
||
|
|
|