linux-toradex.git/sound/drivers, branch v4.4.53

ALSA: dummy: Fix a use-after-free at closing

2016-07-27T16:47:37+00:00

commit d5dbbe6569481bf12dcbe3e12cff72c5f78d272c upstream.

syzkaller fuzzer spotted a potential use-after-free case in snd-dummy
driver when hrtimer is used as backend:
> ==================================================================
> BUG: KASAN: use-after-free in rb_erase+0x1b17/0x2010 at addr ffff88005e5b6f68
>  Read of size 8 by task syz-executor/8984
> =============================================================================
> BUG kmalloc-192 (Not tainted): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> Disabling lock debugging due to kernel taint
> INFO: Allocated in 0xbbbbbbbbbbbbbbbb age=18446705582212484632
> ....
> [<      none      >] dummy_hrtimer_create+0x49/0x1a0 sound/drivers/dummy.c:464
> ....
> INFO: Freed in 0xfffd8e09 age=18446705496313138713 cpu=2164287125 pid=-1
> [<      none      >] dummy_hrtimer_free+0x68/0x80 sound/drivers/dummy.c:481
> ....
> Call Trace:
>  [] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:333
>  [<     inline     >] rb_set_parent include/linux/rbtree_augmented.h:111
>  [<     inline     >] __rb_erase_augmented include/linux/rbtree_augmented.h:218
>  [] rb_erase+0x1b17/0x2010 lib/rbtree.c:427
>  [] timerqueue_del+0x78/0x170 lib/timerqueue.c:86
>  [] __remove_hrtimer+0x90/0x220 kernel/time/hrtimer.c:903
>  [<     inline     >] remove_hrtimer kernel/time/hrtimer.c:945
>  [] hrtimer_try_to_cancel+0x22a/0x570 kernel/time/hrtimer.c:1046
>  [] hrtimer_cancel+0x22/0x40 kernel/time/hrtimer.c:1066
>  [] dummy_hrtimer_stop+0x91/0xb0 sound/drivers/dummy.c:417
>  [] dummy_pcm_trigger+0x17f/0x1e0 sound/drivers/dummy.c:507
>  [] snd_pcm_do_stop+0x160/0x1b0 sound/core/pcm_native.c:1106
>  [] snd_pcm_action_single+0x76/0x120 sound/core/pcm_native.c:956
>  [] snd_pcm_action+0x231/0x290 sound/core/pcm_native.c:974
>  [<     inline     >] snd_pcm_stop sound/core/pcm_native.c:1139
>  [] snd_pcm_drop+0x12d/0x1d0 sound/core/pcm_native.c:1784
>  [] snd_pcm_common_ioctl1+0xfae/0x2150 sound/core/pcm_native.c:2805
>  [] snd_pcm_capture_ioctl1+0x2a1/0x5e0 sound/core/pcm_native.c:2976
>  [] snd_pcm_kernel_ioctl+0x11c/0x160 sound/core/pcm_native.c:3020
>  [] snd_pcm_oss_sync+0x3a4/0xa30 sound/core/oss/pcm_oss.c:1693
>  [] snd_pcm_oss_release+0x1ad/0x280 sound/core/oss/pcm_oss.c:2483
>  .....

A workaround is to call hrtimer_cancel() in dummy_hrtimer_sync() which
is called certainly before other blocking ops.

Reported-by: Dmitry Vyukov 
Tested-by: Dmitry Vyukov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: dummy: Implement timer backend switching more safely

2016-02-17T20:31:00+00:00

commit ddce57a6f0a2d8d1bfacfa77f06043bc760403c2 upstream.

Currently the selected timer backend is referred at any moment from
the running PCM callbacks.  When the backend is switched, it's
possible to lead to inconsistency from the running backend.  This was
pointed by syzkaller fuzzer, and the commit [7ee96216c31a: ALSA:
dummy: Disable switching timer backend via sysfs] disabled the dynamic
switching for avoiding the crash.

This patch improves the handling of timer backend switching.  It keeps
the reference to the selected backend during the whole operation of an
opened stream so that it won't be changed by other streams.

Together with this change, the hrtimer parameter is reenabled as
writable now.

NOTE: this patch also turned out to fix the still remaining race.
Namely, ops was still replaced dynamically at dummy_pcm_open:

  static int dummy_pcm_open(struct snd_pcm_substream *substream)
  {
  ....
          dummy->timer_ops = &dummy_systimer_ops;
          if (hrtimer)
                  dummy->timer_ops = &dummy_hrtimer_ops;

Since dummy->timer_ops is common among all streams, and when the
replacement happens during accesses of other streams, it may lead to a
crash.  This was actually triggered by syzkaller fuzzer and KASAN.

This patch rewrites the code not to use the ops shared by all streams
any longer, too.

BugLink: http://lkml.kernel.org/r/CACT4Y+aZ+xisrpuM6cOXbL21DuM0yVxPYXf4cD4Md9uw0C3dBQ@mail.gmail.com
Reported-by: Dmitry Vyukov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: dummy: Disable switching timer backend via sysfs

2016-02-17T20:30:58+00:00

commit 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 upstream.

ALSA dummy driver can switch the timer backend between system timer
and hrtimer via its hrtimer module option.  This can be also switched
dynamically via sysfs, but it may lead to a memory corruption when
switching is done while a PCM stream is running; the stream instance
for the newly switched timer method tries to access the memory that
was allocated by another timer method although the sizes differ.

As the simplest fix, this patch just disables the switch via sysfs by
dropping the writable bit.

BugLink: http://lkml.kernel.org/r/CACT4Y+ZGEeEBntHW5WHn2GoeE0G_kRrCmUh6=dWyy-wfzvuJLg@mail.gmail.com
Reported-by: Dmitry Vyukov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'sound-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

2015-06-26T00:15:18+00:00

Pull sound updates from Takashi Iwai:
 "It was a busy development cycle at this time, as you can see a wide
  range of changes in diffstat.  There are no big changes but many
  refactoring and improvements.  Here we go some highlights:

  ALSA core:
   - Procfs codes were cleaned up to use seq_file
   - Procfs can be opt out via Kconfig (only for EXPERT)
   - Two types of jack API were unified finally; now both kctl and input
     jack devs are handled via a single function call.

  HD-audio:
   - Continued code restructuring for the future ASoC driver; now HDA
     controller driver is split to a core helper module.
   - Preliminary codes for Skylake audio support in HDA core.
   - Proper i915 gfx power well management for SKL & co
   - Enabled runtime PM as default for Intel HDMI/DP codecs
   - Newer Tegra chip supports
   - More quirks for Dell headsets, Alienware (with CA0132), etc.
   - A couple of DRM ELD helper API functions

  ASoC:
   - Support for loading ASoC topology maps from firmware, intended to
     be used to allow self-describing DSP firmware images to be built
     which can map controls added by the DSP to userspace without the
     kernel needing to know about individual DSP firmwares
   - Lots of refactoring to avoid direct access to snd_soc_codec where
     it's not needed supporting future refactoring
   - Big refactoring, cleanup and enhancement for the Wolfson ADSP
     driver
   - Cleanup series for TI TAS2552 and R-CAR drivers
   - Fixes and improvements on RT56xx codecs
   - Support for TI TAS571x power amplifiers
   - Support for Qualcomm APQ8016 and ZTE ZX296702 SoCs
   - Support for x86 systems with RT5650 and Qualcomm Storm
   - Support for Mediatek AFE (Audio Front End) unit
   - Other various small fixes to ASoC codec drivers

  Firewire:
   - Enhanced to allow non-blocking streams to use timestamp
     synchronization
   - Improve support for DM1500 and BeBoBv3

  Misc:
   - Cleanup of old pci API functions over all PCI sound drivers
   - Fix long-standing regression of the old powermac i2c setup"

* tag 'sound-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (533 commits)
  ALSA: pcm: Fix pcm_class sysfs output
  ALSA: hda-beep: Update authors dead email address
  ASoC: wm_adsp: Move DSP Rate controls into the codec
  ASoC: wm8995: Fix setting sysclk for WM8995_SYSCLK_MCLK2 case
  ALSA: hda: provide default bus io ops extended hdac
  ALSA: hda: add hda link cleanup routine
  ALSA: hda: add hdac_ext stream creation and cleanup routines
  ASoC: rsrc-card: remove unused ret
  ALSA: HDAC: move SND_HDA_PREALLOC_SIZE to core
  ASoC: mediatek: Add machine driver for rt5650 rt5676 codec
  ASoC: mediatek: Add machine driver for MAX98090 codec
  ASoC: mediatek: Add AFE platform driver
  ASoC: rsnd: remove io from rsnd_mod
  ASoC: rsnd: move rsnd_mod_is_working() to rsnd_io_is_working()
  ASoC: rsnd: don't use rsnd_mod_to_io() on snd_kcontrol
  ASoC: rsnd: don't use rsnd_mod_to_io() on rsnd_src_xxx()
  ASoC: rsnd: don't use rsnd_mod_to_io() on rsnd_ssi_xxx()
  ASoC: rsnd: don't use rsnd_mod_to_io() on rsnd_dma_xxx()
  ASoC: rsnd: don't use rsnd_mod_to_io() on rsnd_get_adinr()
  ASoC: rsnd: add common interrupt handler for SSI/SRC/DMA
  ...

ALSA: opl4: Fix / cleanup ifdef CONFIG_PROC_FS

2015-05-29T05:49:55+00:00

Some are replaced with the new ifdef CONFIG_SND_PROC_FS.  Some are
removed by building opl4_proc.o conditionally.

Signed-off-by: Takashi Iwai

ALSA: dummy: Replace CONFIG_PROC_FS with CONFIG_SND_PROC_FS

2015-05-29T05:47:50+00:00

Although there shouldn't be a problem in practice (the compiler should
handle well), it's better to follow to the new Kconfig.

Signed-off-by: Takashi Iwai

ALSA: aloop: Drop unnecessary ifdef CONFIG_PROC_FS

2015-05-29T05:46:05+00:00

Since the compiler can optimize away the unused code, we can reduce
the messy ifdef.

Signed-off-by: Takashi Iwai

ALSA: dummy: make local data static

2015-05-26T10:59:26+00:00

Add missing prefix to make some local data static.

Spotted by sparse:
  sound/drivers/dummy.c:159:20: warning: symbol 'model_emu10k1' was not declared. Should it be static?
  sound/drivers/dummy.c:165:20: warning: symbol 'model_rme9652' was not declared. Should it be static?
  ....

Signed-off-by: Takashi Iwai

ALSA: drivers: pcsp: Fix printout of resolution

2015-05-12T07:14:51+00:00

The recent conversion of the hrtimer resolution failed to convert the
printk format from %li to %u.

Reported-by: Ingo Molnar 
Signed-off-by: Thomas Gleixner

sound: Use hrtimer_resolution instead of hrtimer_get_res()

2015-04-22T15:06:48+00:00

No point in converting a timespec now that the value is directly
accessible. Get rid of the null check while at it. Resolution is
guaranteed to be > 0.

Signed-off-by: Thomas Gleixner 
Acked-by: Takashi Iwai 
Acked-by: Peter Zijlstra 
Cc: Preeti U Murthy 
Cc: Viresh Kumar 
Cc: Marcelo Tosatti 
Cc: Frederic Weisbecker 
Cc: Jaroslav Kysela 
Cc: alsa-devel@alsa-project.org
Link: http://lkml.kernel.org/r/20150414203500.799133359@linutronix.de
Signed-off-by: Thomas Gleixner