Skip to content

Commit

Permalink
ALSA: line6: Fix racy loopback handling
Browse files Browse the repository at this point in the history 
The impulse and monitor handling in submit_audio_out_urb() isn't
protected thus this can be racy with the capture stream handling.
This patch extends the range to protect via each stream's spinlock
(now the whole submit_audio_*_urb() are covered), and take the capture
stream lock additionally for the impulse and monitor handling part.

Tested-by: Chris Rorvick <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
  • Loading branch information
@tiwai
tiwai committed Jan 28, 2015
1 parent d6ca69d commit 3d3ae44
Show file tree
Hide file tree
Showing 2 changed files with 24 additions and 20 deletions.
20 changes: 11 additions & 9 deletions sound/usb/line6/capture.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,21 +20,19 @@

/*
Find a free URB and submit it.
must be called in line6pcm->in.lock context
*/
static int submit_audio_in_urb(struct snd_line6_pcm *line6pcm)
{
int index;
unsigned long flags;
int i, urb_size;
int ret;
struct urb *urb_in;

spin_lock_irqsave(&line6pcm->in.lock, flags);
index =
find_first_zero_bit(&line6pcm->in.active_urbs, LINE6_ISO_BUFFERS);

if (index < 0 || index >= LINE6_ISO_BUFFERS) {
spin_unlock_irqrestore(&line6pcm->in.lock, flags);
dev_err(line6pcm->line6->ifcdev, "no free URB found\n");
return -EINVAL;
}
Expand Down Expand Up @@ -64,7 +62,6 @@ static int submit_audio_in_urb(struct snd_line6_pcm *line6pcm)
dev_err(line6pcm->line6->ifcdev,
"URB in #%d submission failed (%d)\n", index, ret);

spin_unlock_irqrestore(&line6pcm->in.lock, flags);
return 0;
}

Expand All @@ -73,15 +70,18 @@ static int submit_audio_in_urb(struct snd_line6_pcm *line6pcm)
*/
int line6_submit_audio_in_all_urbs(struct snd_line6_pcm *line6pcm)
{
int ret, i;
unsigned long flags;
int ret = 0, i;

spin_lock_irqsave(&line6pcm->in.lock, flags);
for (i = 0; i < LINE6_ISO_BUFFERS; ++i) {
ret = submit_audio_in_urb(line6pcm);
if (ret < 0)
return ret;
break;
}

return 0;
spin_unlock_irqrestore(&line6pcm->in.lock, flags);
return ret;
}

/*
Expand Down Expand Up @@ -137,7 +137,9 @@ void line6_capture_check_period(struct snd_line6_pcm *line6pcm, int length)
line6pcm->in.bytes += length;
if (line6pcm->in.bytes >= line6pcm->in.period) {
line6pcm->in.bytes %= line6pcm->in.period;
spin_unlock(&line6pcm->in.lock);
snd_pcm_period_elapsed(substream);
spin_lock(&line6pcm->in.lock);
}
}

Expand Down Expand Up @@ -196,8 +198,6 @@ static void audio_in_callback(struct urb *urb)
if (test_and_clear_bit(index, &line6pcm->in.unlink_urbs))
shutdown = 1;

spin_unlock_irqrestore(&line6pcm->in.lock, flags);

if (!shutdown) {
submit_audio_in_urb(line6pcm);

Expand All @@ -206,6 +206,8 @@ static void audio_in_callback(struct urb *urb)
&line6pcm->flags))
line6_capture_check_period(line6pcm, length);
}

spin_unlock_irqrestore(&line6pcm->in.lock, flags);
}

/* open capture callback */
Expand Down
24 changes: 13 additions & 11 deletions sound/usb/line6/playback.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -134,11 +134,11 @@ static void add_monitor_signal(struct urb *urb_out, unsigned char *signal,

/*
Find a free URB, prepare audio data, and submit URB.
must be called in line6pcm->out.lock context
*/
static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
{
int index;
unsigned long flags;
int i, urb_size, urb_frames;
int ret;
const int bytes_per_frame = line6pcm->properties->bytes_per_frame;
Expand All @@ -149,12 +149,10 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
(USB_INTERVALS_PER_SECOND / LINE6_ISO_INTERVAL);
struct urb *urb_out;

spin_lock_irqsave(&line6pcm->out.lock, flags);
index =
find_first_zero_bit(&line6pcm->out.active_urbs, LINE6_ISO_BUFFERS);

if (index < 0 || index >= LINE6_ISO_BUFFERS) {
spin_unlock_irqrestore(&line6pcm->out.lock, flags);
dev_err(line6pcm->line6->ifcdev, "no free URB found\n");
return -EINVAL;
}
Expand Down Expand Up @@ -187,7 +185,6 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)

if (urb_size == 0) {
/* can't determine URB size */
spin_unlock_irqrestore(&line6pcm->out.lock, flags);
dev_err(line6pcm->line6->ifcdev, "driver bug: urb_size = 0\n");
return -EINVAL;
}
Expand Down Expand Up @@ -242,7 +239,8 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
urb_out->transfer_buffer_length);
}

if (line6pcm->prev_fbuf != NULL) {
spin_lock_nested(&line6pcm->in.lock, SINGLE_DEPTH_NESTING);
if (line6pcm->prev_fbuf) {
if (line6pcm->flags & LINE6_BITS_PCM_IMPULSE) {
create_impulse_test_signal(line6pcm, urb_out,
bytes_per_frame);
Expand All @@ -266,6 +264,7 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
bytes_per_frame);
}
}
spin_unlock(&line6pcm->in.lock);

ret = usb_submit_urb(urb_out, GFP_ATOMIC);

Expand All @@ -275,7 +274,6 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
dev_err(line6pcm->line6->ifcdev,
"URB out #%d submission failed (%d)\n", index, ret);

spin_unlock_irqrestore(&line6pcm->out.lock, flags);
return 0;
}

Expand All @@ -284,15 +282,18 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm)
*/
int line6_submit_audio_out_all_urbs(struct snd_line6_pcm *line6pcm)
{
int ret, i;
unsigned long flags;
int ret = 0, i;

spin_lock_irqsave(&line6pcm->out.lock, flags);
for (i = 0; i < LINE6_ISO_BUFFERS; ++i) {
ret = submit_audio_out_urb(line6pcm);
if (ret < 0)
return ret;
break;
}

return 0;
spin_unlock_irqrestore(&line6pcm->out.lock, flags);
return ret;
}

/*
Expand Down Expand Up @@ -346,8 +347,6 @@ static void audio_out_callback(struct urb *urb)
if (test_and_clear_bit(index, &line6pcm->out.unlink_urbs))
shutdown = 1;

spin_unlock_irqrestore(&line6pcm->out.lock, flags);

if (!shutdown) {
submit_audio_out_urb(line6pcm);

Expand All @@ -356,10 +355,13 @@ static void audio_out_callback(struct urb *urb)
line6pcm->out.bytes += length;
if (line6pcm->out.bytes >= line6pcm->out.period) {
line6pcm->out.bytes %= line6pcm->out.period;
spin_unlock(&line6pcm->out.lock);
snd_pcm_period_elapsed(substream);
spin_lock(&line6pcm->out.lock);
}
}
}
spin_unlock_irqrestore(&line6pcm->out.lock, flags);
}

/* open playback callback */
Expand Down

0 comments on commit 3d3ae44

Please sign in to comment.