From: Greg Kroah-Hartman Date: Thu, 15 Nov 2012 22:57:55 +0000 (-0800) Subject: 3.0-stable patches X-Git-Tag: v3.0.52~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=612ac374d7a91632d02e145aa0031e0b13b356b5;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: alsa-fix-card-refcount-unbalance.patch alsa-usb-audio-fix-mutex-deadlock-at-disconnection.patch --- diff --git a/queue-3.0/alsa-fix-card-refcount-unbalance.patch b/queue-3.0/alsa-fix-card-refcount-unbalance.patch new file mode 100644 index 00000000000..3943491abac --- /dev/null +++ b/queue-3.0/alsa-fix-card-refcount-unbalance.patch @@ -0,0 +1,93 @@ +From 8bb4d9ce08b0a92ca174e41d92c180328f86173f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 8 Nov 2012 14:36:18 +0100 +Subject: ALSA: Fix card refcount unbalance + +From: Takashi Iwai + +commit 8bb4d9ce08b0a92ca174e41d92c180328f86173f upstream. + +There are uncovered cases whether the card refcount introduced by the +commit a0830dbd isn't properly increased or decreased: +- OSS PCM and mixer success paths +- When lookup function gets NULL + +This patch fixes these places. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=50251 + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/oss/mixer_oss.c | 1 + + sound/core/oss/pcm_oss.c | 1 + + sound/core/pcm_native.c | 6 ++++-- + sound/core/sound.c | 2 +- + sound/core/sound_oss.c | 2 +- + 5 files changed, 8 insertions(+), 4 deletions(-) + +--- a/sound/core/oss/mixer_oss.c ++++ b/sound/core/oss/mixer_oss.c +@@ -75,6 +75,7 @@ static int snd_mixer_oss_open(struct ino + snd_card_unref(card); + return -EFAULT; + } ++ snd_card_unref(card); + return 0; + } + +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -2454,6 +2454,7 @@ static int snd_pcm_oss_open(struct inode + mutex_unlock(&pcm->open_mutex); + if (err < 0) + goto __error; ++ snd_card_unref(pcm->card); + return err; + + __error: +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -2110,7 +2110,8 @@ static int snd_pcm_playback_open(struct + pcm = snd_lookup_minor_data(iminor(inode), + SNDRV_DEVICE_TYPE_PCM_PLAYBACK); + err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK); +- snd_card_unref(pcm->card); ++ if (pcm) ++ snd_card_unref(pcm->card); + return err; + } + +@@ -2123,7 +2124,8 @@ static int snd_pcm_capture_open(struct i + pcm = snd_lookup_minor_data(iminor(inode), + SNDRV_DEVICE_TYPE_PCM_CAPTURE); + err = snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE); +- snd_card_unref(pcm->card); ++ if (pcm) ++ snd_card_unref(pcm->card); + return err; + } + +--- a/sound/core/sound.c ++++ b/sound/core/sound.c +@@ -115,7 +115,7 @@ void *snd_lookup_minor_data(unsigned int + mreg = snd_minors[minor]; + if (mreg && mreg->type == type) { + private_data = mreg->private_data; +- if (mreg->card_ptr) ++ if (private_data && mreg->card_ptr) + atomic_inc(&mreg->card_ptr->refcount); + } else + private_data = NULL; +--- a/sound/core/sound_oss.c ++++ b/sound/core/sound_oss.c +@@ -53,7 +53,7 @@ void *snd_lookup_oss_minor_data(unsigned + mreg = snd_oss_minors[minor]; + if (mreg && mreg->type == type) { + private_data = mreg->private_data; +- if (mreg->card_ptr) ++ if (private_data && mreg->card_ptr) + atomic_inc(&mreg->card_ptr->refcount); + } else + private_data = NULL; diff --git a/queue-3.0/alsa-usb-audio-fix-mutex-deadlock-at-disconnection.patch b/queue-3.0/alsa-usb-audio-fix-mutex-deadlock-at-disconnection.patch new file mode 100644 index 00000000000..cbf253e7b23 --- /dev/null +++ b/queue-3.0/alsa-usb-audio-fix-mutex-deadlock-at-disconnection.patch @@ -0,0 +1,66 @@ +From 10e44239f67d0b6fb74006e61a7e883b8075247a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 13 Nov 2012 11:22:48 +0100 +Subject: ALSA: usb-audio: Fix mutex deadlock at disconnection + +From: Takashi Iwai + +commit 10e44239f67d0b6fb74006e61a7e883b8075247a upstream. + +The recent change for USB-audio disconnection race fixes introduced a +mutex deadlock again. There is a circular dependency between +chip->shutdown_rwsem and pcm->open_mutex, depicted like below, when a +device is opened during the disconnection operation: + +A. snd_usb_audio_disconnect() -> + card.c::register_mutex -> + chip->shutdown_rwsem (write) -> + snd_card_disconnect() -> + pcm.c::register_mutex -> + pcm->open_mutex + +B. snd_pcm_open() -> + pcm->open_mutex -> + snd_usb_pcm_open() -> + chip->shutdown_rwsem (read) + +Since the chip->shutdown_rwsem protection in the case A is required +only for turning on the chip->shutdown flag and it doesn't have to be +taken for the whole operation, we can reduce its window in +snd_usb_audio_disconnect(). + +Reported-by: Jiri Slaby +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -554,9 +554,11 @@ static void snd_usb_audio_disconnect(str + + chip = ptr; + card = chip->card; +- mutex_lock(®ister_mutex); + down_write(&chip->shutdown_rwsem); + chip->shutdown = 1; ++ up_write(&chip->shutdown_rwsem); ++ ++ mutex_lock(®ister_mutex); + chip->num_interfaces--; + if (chip->num_interfaces <= 0) { + snd_card_disconnect(card); +@@ -573,11 +575,9 @@ static void snd_usb_audio_disconnect(str + snd_usb_mixer_disconnect(p); + } + usb_chip[chip->index] = NULL; +- up_write(&chip->shutdown_rwsem); + mutex_unlock(®ister_mutex); + snd_card_free_when_closed(card); + } else { +- up_write(&chip->shutdown_rwsem); + mutex_unlock(®ister_mutex); + } + } diff --git a/queue-3.0/series b/queue-3.0/series index ed58929c8fe..a0b94588649 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -36,3 +36,5 @@ drm-i915-clear-the-entire-sdvo-infoframe-buffer.patch usb-mos7840-remove-unused-variable.patch xfs-fix-reading-of-wrapped-log-data.patch intel-iommu-fix-ab-ba-lockdep-report.patch +alsa-fix-card-refcount-unbalance.patch +alsa-usb-audio-fix-mutex-deadlock-at-disconnection.patch