diff options
| author | Takashi Iwai <tiwai@suse.de> | 2011-02-22 10:21:18 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2011-02-23 08:15:43 +0100 |
| commit | 382225e62bdb8059b7f915b133426425516dd300 (patch) | |
| tree | 25f85ecb38145f3ca1547685066b2bf9057e3c72 /sound/usb/usbaudio.h | |
| parent | ALSA: HDA: Fix mic initialization in VIA auto parser (diff) | |
| download | linux-382225e62bdb8059b7f915b133426425516dd300.tar.xz linux-382225e62bdb8059b7f915b133426425516dd300.zip | |
ALSA: usb-audio: fix oops due to cleanup race when disconnecting
When a USB audio device is disconnected, snd_usb_audio_disconnect()
kills all audio URBs. At the same time, the application, after being
notified of the disconnection, might close the device, in which case
ALSA calls the .hw_free callback, which should free the URBs too.
Commit de1b8b93a0ba "[ALSA] Fix hang-up at disconnection of usb-audio"
prevented snd_usb_hw_free() from freeing the URBs to avoid a hang that
resulted from this race, but this introduced another race because the
URB callbacks could now be executed after snd_usb_hw_free() has
returned, and try to access already freed data.
Fix the first race by introducing a mutex to serialize the disconnect
callback and all PCM callbacks that manage URBs (hw_free and hw_params).
Reported-and-tested-by: Pierre-Louis Bossart <pierre-louis.bossart@intel.com>
Cc: <stable@kernel.org>
[CL: also serialize hw_params callback]
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/usb/usbaudio.h')
| -rw-r--r-- | sound/usb/usbaudio.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h index db3eb21627ee..6e66fffe87f5 100644 --- a/sound/usb/usbaudio.h +++ b/sound/usb/usbaudio.h @@ -36,6 +36,7 @@ struct snd_usb_audio { struct snd_card *card; u32 usb_id; int shutdown; + struct mutex shutdown_mutex; unsigned int txfr_quirk:1; /* Subframe boundaries on transfers */ int num_interfaces; int num_suspended_intf; |