From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 04B5E2566 for ; Tue, 18 Apr 2023 12:24:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77B03C433D2; Tue, 18 Apr 2023 12:24:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1681820648; bh=8HEt2sEu/CmMpmBQTDTjLhkyhdkurJm2MqO+w4kVH6k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U+LgWsskt+62IHVigFAyTalrsHbaO0znJhsy6kZX+H3kdVG03pJyiU3EaWUu39zWl wAX3wkWYVClJCXP8Cr1T6zNU/u4JOmB2rrNWt8827WOJYWymFCXOzbYQEroNtnbilJ SU9+3Fjs0HcMqceMtgvhax6kf9/N7SNchJSMFA2E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Oswald Buddenhagen , Takashi Iwai Subject: [PATCH 4.14 17/37] ALSA: emu10k1: fix capture interrupt handler unlinking Date: Tue, 18 Apr 2023 14:21:27 +0200 Message-Id: <20230418120255.275863900@linuxfoundation.org> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230418120254.687480980@linuxfoundation.org> References: <20230418120254.687480980@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Oswald Buddenhagen commit b09c551c77c7e01dc6e4f3c8bf06b5ffa7b06db5 upstream. Due to two copy/pastos, closing the MIC or EFX capture device would make a running ADC capture hang due to unsetting its interrupt handler. In principle, this would have also allowed dereferencing dangling pointers, but we're actually rather thorough at disabling and flushing the ints. While it may sound like one, this actually wasn't a hypothetical bug: PortAudio will open a capture stream at startup (and close it right away) even if not asked to. If the first device is busy, it will just proceed with the next one ... thus killing a concurrent capture. Signed-off-by: Oswald Buddenhagen Cc: Link: https://lore.kernel.org/r/20230405201220.2197923-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/pci/emu10k1/emupcm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/sound/pci/emu10k1/emupcm.c +++ b/sound/pci/emu10k1/emupcm.c @@ -1251,7 +1251,7 @@ static int snd_emu10k1_capture_mic_close { struct snd_emu10k1 *emu = snd_pcm_substream_chip(substream); - emu->capture_interrupt = NULL; + emu->capture_mic_interrupt = NULL; emu->pcm_capture_mic_substream = NULL; return 0; } @@ -1359,7 +1359,7 @@ static int snd_emu10k1_capture_efx_close { struct snd_emu10k1 *emu = snd_pcm_substream_chip(substream); - emu->capture_interrupt = NULL; + emu->capture_efx_interrupt = NULL; emu->pcm_capture_efx_substream = NULL; return 0; }