diff options
author | Daniel Baluta <daniel.baluta@nxp.com> | 2018-11-02 17:20:53 +0200 |
---|---|---|
committer | Dong Aisheng <aisheng.dong@nxp.com> | 2019-11-25 15:52:06 +0800 |
commit | 3aa009e2c04696fd233f5d442cd8835c2b6b06ef (patch) | |
tree | 3cf83925adf7e8b7382093e3e9360934e8dc1a24 /sound/soc/fsl/fsl_dsp_proxy.c | |
parent | d50e2b69e8026a22c164c5009aa556652ade723d (diff) |
MLK-20094: ASoC: fsl: dsp: Fix crash in compress cleanup path
We must find a way to no longer touch resources after they are
cleand up.
Now, after a stress test we get the following crash:
[ 2156.863772] fsl-dsp 596e8000.dsp: xf_pool_alloc failed
[ 2156.869337] Unable to handle kernel NULL pointer dereference at
virtual address 00000060
[ 2157.148594] [<ffff000008d8839c>] _raw_spin_lock+0x14/0x48
[ 2157.153995] [<ffff000008b3e0b8>] xf_cmd_send_recv_complete+0x40/0xf0
[ 2157.160354] [<ffff000008b3e470>] xf_close+0x40/0x88
[ 2157.165239] [<ffff000008b3f7a4>] xaf_comp_delete+0x5c/0x70
[ 2157.170730] [<ffff000008b40530>] dsp_platform_compr_free+0xa0/0xe8
[ 2157.176917] [<ffff000008b287fc>] soc_compr_free_fe+0x144/0x1a0
[ 2157.182754] [<ffff000008b11b24>] snd_compr_free+0x64/0x98
This happens because:
1) dsp_platform_process work handler waits in a loop for
messages to arrive.
2) when cplay process finishes it cleans up most of the
resources.
3) when another cplay process starts it reinitializes the
resources including queues for example.
4) a message will be generated and kernel will crash because
dsp_platform_process uses the older queues.
A solution for this is to make sure dsp_platform_process work loop
is stopped at cleanup time.
We use is_active state and signal dsp_platform_process handler to
finish because we are on the cleanup path.
While at it replace cancel_work with cancel_work sync to be sure
that work handler ends before going on with the rest of the cleanup.
Reviewed-by: Cosmin-Gabriel Samoila <cosmin.samoila@nxp.com>
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
Diffstat (limited to 'sound/soc/fsl/fsl_dsp_proxy.c')
-rw-r--r-- | sound/soc/fsl/fsl_dsp_proxy.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sound/soc/fsl/fsl_dsp_proxy.c b/sound/soc/fsl/fsl_dsp_proxy.c index 1f4390487c78..94bffc06c608 100644 --- a/sound/soc/fsl/fsl_dsp_proxy.c +++ b/sound/soc/fsl/fsl_dsp_proxy.c @@ -557,12 +557,13 @@ struct xf_message *xf_cmd_recv(struct xf_proxy *proxy, struct xf_msg_queue *queue, int wait) { - struct xf_message *m; + struct xf_message *m = NULL; int ret; /* ...wait for message reception (take lock on success) */ ret = wait_event_interruptible(*wq, - (m = xf_msg_received(proxy, queue)) != NULL || !wait); + (m = xf_msg_received(proxy, queue)) != NULL || !wait + || !proxy->is_active); if (ret) return ERR_PTR(-EINTR); |