98482377dc
The widget_mutex was introduced to serialize callers to
hda_widget_sysfs_{re}init. However, its protection of the sysfs widget array
is incomplete. For example, it is acquired around the call to
hda_widget_sysfs_reinit(), which actually creates the new array, but isn't
still acquired when codec->num_nodes and codec->start_nid is updated. So
the lock ensures one thread sets up the new array at a time, but doesn't
ensure which thread's value will end up in codec->num_nodes. If a larger
num_nodes wins but a smaller array was set up, the next call to
refresh_widgets() will touch free memory as it iterates over codec->num_nodes
that aren't there.
The widget_lock really protects both the tree as well as codec->num_nodes,
start_nid, and end_nid, so make sure it's held across that update. It should
also be held during snd_hdac_get_sub_nodes(), so that a very old read from that
function doesn't end up clobbering a later update.
Fixes:
|
||
|---|---|---|
| .. | ||
| ext | ||
| Kconfig | ||
| Makefile | ||
| array.c | ||
| hda_bus_type.c | ||
| hdac_bus.c | ||
| hdac_component.c | ||
| hdac_controller.c | ||
| hdac_device.c | ||
| hdac_i915.c | ||
| hdac_regmap.c | ||
| hdac_stream.c | ||
| hdac_sysfs.c | ||
| hdmi_chmap.c | ||
| local.h | ||
| trace.c | ||
| trace.h | ||