msm: audio: qdsp5: Acquire and release spinlock in async flush
-audpcm_async_flush and audpcm_async_send_data functions in mp3
and lpa driver use out_queue and delete the entry in it.
But spinlock is acquired only in audpcm_async_send_data whereas
the operation in audpcm_async_flush is not spinlock protected.
This causes a kernel panic if both try to delete an entry in
the out_queue simultaneously.
-Make audpcm_async_flush spinlock safe to avoid such issues.
Change-Id: Ie7e498a8438c60cd3af8f94ac03af0750307c87f
CRs-Fixed: 360389
Signed-off-by: Chaithanya Krishna Bacharaju <chaithan@codeaurora.org>
diff --git a/arch/arm/mach-msm/qdsp5/audio_lpa.c b/arch/arm/mach-msm/qdsp5/audio_lpa.c
index 8dfba0b..a7c2543 100644
--- a/arch/arm/mach-msm/qdsp5/audio_lpa.c
+++ b/arch/arm/mach-msm/qdsp5/audio_lpa.c
@@ -552,7 +552,9 @@
struct audpcm_buffer_node *buf_node;
struct list_head *ptr, *next;
union msm_audio_event_payload payload;
+ unsigned long flags;
+ spin_lock_irqsave(&audio->dsp_lock, flags);
MM_DBG("\n"); /* Macro prints the file name and function */
list_for_each_safe(ptr, next, &audio->out_queue) {
buf_node = list_entry(ptr, struct audpcm_buffer_node, list);
@@ -565,6 +567,7 @@
audio->drv_status &= ~ADRV_STATUS_OBUF_GIVEN;
audio->out_needed = 0;
atomic_set(&audio->out_bytes, 0);
+ spin_unlock_irqrestore(&audio->dsp_lock, flags);
}
static void audio_ioport_reset(struct audio *audio)
{
diff --git a/arch/arm/mach-msm/qdsp5/audio_mp3.c b/arch/arm/mach-msm/qdsp5/audio_mp3.c
index 5abdf85..7f72e25 100644
--- a/arch/arm/mach-msm/qdsp5/audio_mp3.c
+++ b/arch/arm/mach-msm/qdsp5/audio_mp3.c
@@ -836,7 +836,9 @@
struct audmp3_buffer_node *buf_node;
struct list_head *ptr, *next;
union msm_audio_event_payload payload;
+ unsigned long flags;
+ spin_lock_irqsave(&audio->dsp_lock, flags);
MM_DBG("\n"); /* Macro prints the file name and function */
list_for_each_safe(ptr, next, &audio->out_queue) {
buf_node = list_entry(ptr, struct audmp3_buffer_node, list);
@@ -849,6 +851,7 @@
audio->drv_status &= ~ADRV_STATUS_OBUF_GIVEN;
audio->out_needed = 0;
atomic_set(&audio->out_bytes, 0);
+ spin_unlock_irqrestore(&audio->dsp_lock, flags);
}
static void audio_flush(struct audio *audio)