Patch "ALSA: fireworks: accessing to user space outside spinlock" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

ALSA: fireworks: accessing to user space outside spinlock

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
alsa-fireworks-accessing-to-user-space-outside-spinlock.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Takashi Sakamoto <[email protected]>
Date: Wed, 31 Aug 2016 22:58:42 +0900
Subject: ALSA: fireworks: accessing to user space outside spinlock

From: Takashi Sakamoto <[email protected]>

commit 6b1ca4bcadf9ef077cc5f03c6822ba276ed14902 upstream.

In hwdep interface of fireworks driver, accessing to user space is in a critical section with disabled local interrupt. Depending on architecture, accessing to user space can cause page fault exception. Then local processor stores machine status and handles the synchronous event. A handler corresponding to the event can call task scheduler to wait for preparing pages. In a case of usage of single core processor, the state to disable local interrupt is worse because it don't handle usual interrupts from hardware.

This commit fixes this bug, performing the accessing outside spinlock. This commit also gives up counting the number of queued response messages to simplify ring-buffer management.

---
 sound/firewire/fireworks/fireworks.h             |    1 
 sound/firewire/fireworks/fireworks_hwdep.c       |   71 ++++++++++++++++-------
 sound/firewire/fireworks/fireworks_proc.c        |    4 -
 sound/firewire/fireworks/fireworks_transaction.c |    5 -
 4 files changed, 56 insertions(+), 25 deletions(-)

@@ -106,7 +106,6 @@ struct snd_efw {
 	u8 *resp_buf;
 	u8 *pull_ptr;
 	u8 *push_ptr;
-	unsigned int resp_queues;
 };
 
 int snd_efw_transaction_cmd(struct fw_unit *unit,

@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_e
 	else
 		consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr);
 
-	snd_iprintf(buffer, "%d %d/%d\n",
-		    efw->resp_queues, consumed, snd_efw_resp_buf_size);
+	snd_iprintf(buffer, "%d/%d\n",
+		    consumed, snd_efw_resp_buf_size);
 }
 
 static void

@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, vo
 	size_t capacity, till_end;
 	struct snd_efw_transaction *t;
 
-	spin_lock_irq(&efw->lock);
-
 	t = (struct snd_efw_transaction *)data;
 	length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
 
+	spin_lock_irq(&efw->lock);
+
 	if (efw->push_ptr < efw->pull_ptr)
 		capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
 	else

@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, vo
 	}
 
 	/* for hwdep */
-	efw->resp_queues++;
 	wake_up(&efw->hwdep_wait);
 
 	*rcode = RCODE_COMPLETE;

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/alsa-fireworks-accessing-to-user-space-outside-spinlock.patch queue-4.4/alsa-firewire-tascam-accessing-to-user-space-outside-spinlock.patch