kernel/git/stable/linux.git/sound/drivers, branch linux-4.17.y

ALSA: aloop: Add missing cable lock to ctl API callbacks

2018-04-30T08:06:48+00:00

Some control API callbacks in aloop driver are too lazy to take the loopback->cable_lock and it results in possible races of cable access while it's being freed. It eventually lead to a UAF, as reported by fuzzer recently. This patch covers such control API callbacks and add the proper mutex locks. Reported-by: DaeRyong Jeong Cc: Signed-off-by: Takashi Iwai

ALSA: opl3: Hardening for potential Spectre v1

2018-04-25T08:37:47+00:00

As recently Smatch suggested, one place in OPL3 driver may expand the array directly from the user-space value with speculation: sound/drivers/opl3/opl3_synth.c:476 snd_opl3_set_voice() warn: potential spectre issue 'snd_opl3_regmap' This patch puts array_index_nospec() for hardening against it. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter Cc: Signed-off-by: Takashi Iwai

ALSA: aloop: Mark paused device as inactive

2018-03-27T06:00:28+00:00

Show paused ALSA aloop device as inactive, i.e. the control "PCM Slave Active" set as false. Notification sent upon state change. This makes it possible for client capturing from aloop device to know if data is expected. Without it the client expects data even if playback is paused. Signed-off-by: Robert Rosengren Signed-off-by: Takashi Iwai

ALSA: aloop: Fix access to not-yet-ready substream via cable

2018-03-22T09:40:27+00:00

In loopback_open() and loopback_close(), we assign and release the substream object to the corresponding cable in a racy way. It's neither locked nor done in the right position. The open callback assigns the substream before its preparation finishes, hence the other side of the cable may pick it up, which may lead to the invalid memory access. This patch addresses these: move the assignment to the end of the open callback, and wrap with cable->lock for avoiding concurrent accesses. Cc: Signed-off-by: Takashi Iwai

ALSA: aloop: Sync stale timer before release

2018-03-22T09:34:12+00:00

The aloop driver tries to stop the pending timer via timer_del() in the trigger callback and in the close callback. The former is correct, as it's an atomic operation, while the latter expects that the timer gets really removed and proceeds the resource releases after that. But timer_del() doesn't synchronize, hence the running timer may still access the released resources. A similar situation can be also seen in the prepare callback after trigger(STOP) where the prepare tries to re-initialize the things while a timer is still running. The problems like the above are seen indirectly in some syzkaller reports (although it's not 100% clear whether this is the only cause, as the race condition is quite narrow and not always easy to trigger). For addressing these issues, this patch adds the explicit alls of timer_del_sync() in some places, so that the pending timer is properly killed / synced. Cc: Signed-off-by: Takashi Iwai

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2018-01-30T00:50:58+00:00

Pull timer updates from Thomas Gleixner: "The timer departement presents: - A rather large rework of the hrtimer infrastructure which introduces softirq based hrtimers to replace the spread of hrtimer/tasklet combos which force the actual callback execution into softirq context. The approach is completely different from the initial implementation which you cursed at 10 years ago rightfully. The softirq based timers have their own queues and there is no nasty indirection and list reshuffling in the hard interrupt anymore. This comes with conversion of some of the hrtimer/tasklet users, the rest and the final removal of that horrible interface will come towards the end of the merge window or go through the relevant maintainer trees. Note: The top commit merged the last minute bugfix for the 10 years old CPU hotplug bug as I wanted to make sure that I fatfinger the merge conflict resolution myself. - The overhaul of the STM32 clocksource/clockevents driver - A new driver for the Spreadtrum SC9860 timer - A new driver dor the Actions Semi S700 timer - The usual set of fixes and updates all over the place" * 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (53 commits) usb/gadget/NCM: Replace tasklet with softirq hrtimer ALSA/dummy: Replace tasklet with softirq hrtimer hrtimer: Implement SOFT/HARD clock base selection hrtimer: Implement support for softirq based hrtimers hrtimer: Prepare handling of hard and softirq based hrtimers hrtimer: Add clock bases and hrtimer mode for softirq context hrtimer: Use irqsave/irqrestore around __run_hrtimer() hrtimer: Factor out __hrtimer_next_event_base() hrtimer: Factor out __hrtimer_start_range_ns() hrtimer: Remove the 'base' parameter from hrtimer_reprogram() hrtimer: Make remote enqueue decision less restrictive hrtimer: Unify remote enqueue handling hrtimer: Unify hrtimer removal handling hrtimer: Make hrtimer_force_reprogramm() unconditionally available hrtimer: Make hrtimer_reprogramm() unconditional hrtimer: Make hrtimer_cpu_base.next_timer handling unconditional hrtimer: Make the remote enqueue check unconditional hrtimer: Use accesor functions instead of direct access hrtimer: Make the hrtimer_cpu_base::hres_active field unconditional, to simplify the code hrtimer: Make room in 'struct hrtimer_cpu_base' ...

Merge branch 'timers/urgent' into timers/core

2018-01-27T14:35:29+00:00

Pick up urgent bug fix and resolve the conflict. Signed-off-by: Thomas Gleixner

ALSA/dummy: Replace tasklet with softirq hrtimer

2018-01-16T08:51:22+00:00

The tasklet is used to defer the execution of snd_pcm_period_elapsed() to the softirq context. Using the HRTIMER_MODE_SOFT mode invokes the timer callback in softirq context as well which renders the tasklet useless. [o-takashi: avoid stall due to a call of hrtimer_cancel() on a callback of hrtimer] Signed-off-by: Thomas Gleixner Signed-off-by: Anna-Maria Gleixner Reviewed-by: Takashi Iwai Cc: Christoph Hellwig Cc: Jaroslav Kysela Cc: John Stultz Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Takashi Iwai Cc: Takashi Sakamoto Cc: alsa-devel@alsa-project.org Cc: keescook@chromium.org Link: http://lkml.kernel.org/r/20171221104205.7269-35-anna-maria@linutronix.de Signed-off-by: Ingo Molnar

Merge branch 'for-linus' into for-next

2018-01-09T07:49:53+00:00

Back-merge to continue fixing the OSS emulation code. Signed-off-by: Takashi Iwai

ALSA: aloop: Fix racy hw constraints adjustment

2018-01-05T15:44:16+00:00

The aloop driver tries to update the hw constraints of the connected target on the cable of the opened PCM substream. This is done by adding the extra hw constraints rules referring to the substream runtime->hw fields, while the other substream may update the runtime hw of another side on the fly. This is, however, racy and may result in the inconsistent values when both PCM streams perform the prepare concurrently. One of the reason is that it overwrites the other's runtime->hw field; which is not only racy but also broken when it's called before the open of another side finishes. And, since the reference to runtime->hw isn't protected, the concurrent write may give the partial value update and become inconsistent. This patch is an attempt to fix and clean up: - The prepare doesn't change the runtime->hw of other side any longer, but only update the cable->hw that is referred commonly. - The extra rules refer to the loopback_pcm object instead of the runtime->hw. The actual hw is deduced from cable->hw. - The extra rules take the cable_lock to protect against the race. Fixes: b1c73fc8e697 ("ALSA: snd-aloop: Fix hw_params restrictions and checking") Cc: Signed-off-by: Takashi Iwai