kernel_samsung_smdk4412/sound, branch replicant-6.0

ALSA: pcm : Call kill_fasync() in stream lock

2017-01-08T12:55:35+00:00

Currently kill_fasync() is called outside the stream lock in
snd_pcm_period_elapsed().  This is potentially racy, since the stream
may get released even during the irq handler is running.  Although
snd_pcm_release_substream() calls snd_pcm_drop(), this doesn't
guarantee that the irq handler finishes, thus the kill_fasync() call
outside the stream spin lock may be invoked after the substream is
detached, as recently reported by KASAN.

As a quick workaround, move kill_fasync() call inside the stream
lock.  The fasync is rarely used interface, so this shouldn't have a
big impact from the performance POV.

Ideally, we should implement some sync mechanism for the proper finish
of stream and irq handler.  But this oneliner should suffice for most
cases, so far.

Change-Id: I5dbc5260abe527261b4b8c4699400b317af8451e
Reported-by: Baozeng Ding 
Signed-off-by: Takashi Iwai

ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call

2016-11-11T02:26:51+00:00

commit 836b34a935abc91e13e63053d0a83b24dfb5ea78 upstream.

create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and
create_uaxx_quirk() functions allocate the audioformat object by themselves
and free it upon error before returning. However, once the object is linked
to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be
double-freed, eventually resulting in a memory corruption.

This patch fixes these failures in the error paths by unlinking the audioformat
object before freeing it.

Based on a patch by Takashi Iwai 

[Note for stable backports:
 this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor
 code cleanup in create_fixed_stream_quirk()')]

Change-Id: Ia332409f06bbd20c0abf9cf915f4a041200e4736
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Ben Hutchings

ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()

2016-11-11T02:26:51+00:00

commit 902eb7fd1e4af3ac69b9b30f8373f118c92b9729 upstream.

Just a minor code cleanup: unify the error paths.

Change-Id: Idbac50c4d1602ea3b075c747a716cc6eab905b52
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()

2016-11-11T02:26:51+00:00

commit 0f886ca12765d20124bd06291c82951fd49a33be upstream.

create_fixed_stream_quirk() may cause a NULL-pointer dereference by
accessing the non-existing endpoint when a USB device with a malformed
USB descriptor is used.

This patch avoids it simply by adding a sanity check of bNumEndpoints
before the accesses.

Change-Id: I94025f3eec256347b50805b388940774e559dae2
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=971125
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.2:
 - There's no altsd variable
 - Adjust context]
Signed-off-by: Ben Hutchings

UPSTREAM: ALSA: control: Fix replacing user controls

2016-10-18T14:07:20+00:00

(cherry pick from commit 82262a46627bebb0febcc26664746c25cef08563)

There are two issues with the current implementation for replacing user
controls. The first is that the code does not check if the control is
actually a user control and neither does it check if the control is
owned by the process that tries to remove it. That allows userspace
applications to remove arbitrary controls, which can cause a user after
free if a for example a driver does not expect a control to be removed
from under its feed.

The second issue is that on one hand when a control is replaced the
user_ctl_count limit is not checked and on the other hand the
user_ctl_count is increased (even though the number of user controls
does not change). This allows userspace, once the user_ctl_count limit
has been reached, to repeatedly replace a control until user_ctl_count
overflows. Once that happens new controls can be added effectively
bypassing the user_ctl_count limit.

Both issues can be fixed by instead of open-coding the removal of the
control that is to be replaced to use snd_ctl_remove_user_ctl(). This
function does proper permission checks as well as decrements
user_ctl_count after the control has been removed.

Note that by using snd_ctl_remove_user_ctl() the check which returns
-EBUSY at beginning of the function if the control already exists is
removed. This is not a problem though since the check is quite
useless, because the lock that is protecting the control list is
released between the check and before adding the new control to the
list, which means that it is possible that a different control with
the same settings is added to the list after the check. Luckily there
is another check that is done while holding the lock in snd_ctl_add(),
so we'll rely on that to make sure that the same control is not added
twice.

Signed-off-by: Lars-Peter Clausen 
Acked-by: Jaroslav Kysela 
Cc: 
Signed-off-by: Takashi Iwai 
Change-Id: I0b183e2d52afe8e747f59e1ecca6f6fbbac2d016
Bug: 29916012

ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt

2016-05-17T12:11:13+00:00

The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Change-Id: Ie3dcdee7da8ad292712814e8402c571a717ab8d1
Signed-off-by: Kangjie Lu 
Signed-off-by: Takashi Iwai

ALSA: timer: Fix leak in events via snd_timer_user_ccallback

2016-05-17T12:11:13+00:00

The stack object “r1” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Change-Id: I5ece63432f6ca6251fa31c046c211c8c03313a59
Signed-off-by: Kangjie Lu 
Signed-off-by: Takashi Iwai

ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS

2016-05-17T12:11:13+00:00

The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Change-Id: Ibf2868136a538eed0f2e75395a5f14a8608dd86d
Signed-off-by: Kangjie Lu 
Signed-off-by: Takashi Iwai

ALSA: hrtimer: Fix stall by hrtimer_cancel()

2016-05-05T11:06:11+00:00

hrtimer_cancel() waits for the completion from the callback, thus it
must not be called inside the callback itself.  This was already a
problem in the past with ALSA hrtimer driver, and the early commit
[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.

However, the previous fix is still insufficient: it may still cause a
lockup when the ALSA timer instance reprograms itself in its callback.
Then it invokes the start function even in snd_timer_interrupt() that
is called in hrtimer callback itself, results in a CPU stall.  This is
no hypothetical problem but actually triggered by syzkaller fuzzer.

This patch tries to fix the issue again.  Now we call
hrtimer_try_to_cancel() at both start and stop functions so that it
won't fall into a deadlock, yet giving some chance to cancel the queue
if the functions have been called outside the callback.  The proper
hrtimer_cancel() is called in anyway at closing, so this should be
enough.

Change-Id: Id6224b2a3ade0d217e891e6af09744df4d0b2e5c
Reported-and-tested-by: Dmitry Vyukov 
Cc: 
Signed-off-by: Takashi Iwai

ALSA: timer: Harden slave timer list handling

2016-05-03T12:55:13+00:00

A slave timer instance might be still accessible in a racy way while
operating the master instance as it lacks of locking.  Since the
master operation is mostly protected with timer->lock, we should cope
with it while changing the slave instance, too.  Also, some linked
lists (active_list and ack_list) of slave instances aren't unlinked
immediately at stopping or closing, and this may lead to unexpected
accesses.

This patch tries to address these issues.  It adds spin lock of
timer->lock (either from master or slave, which is equivalent) in a
few places.  For avoiding a deadlock, we ensure that the global
slave_active_lock is always locked at first before each timer lock.

Also, ack and active_list of slave instances are properly unlinked at
snd_timer_stop() and snd_timer_close().

Last but not least, remove the superfluous call of _snd_timer_stop()
at removing slave links.  This is a noop, and calling it may confuse
readers wrt locking.  Further cleanup will follow in a later patch.

Actually we've got reports of use-after-free by syzkaller fuzzer, and
this hopefully fixes these issues.

Change-Id: I572878b909dda522dbedc84633414185802bc974
Reported-by: Dmitry Vyukov 
Cc: 
Signed-off-by: Takashi Iwai