linux-stable.git/sound/drivers, branch v3.14.78

ALSA: dummy: Fix a use-after-free at closing

2016-07-27T16:55:51+00:00

commit d5dbbe6569481bf12dcbe3e12cff72c5f78d272c upstream.

syzkaller fuzzer spotted a potential use-after-free case in snd-dummy
driver when hrtimer is used as backend:
> ==================================================================
> BUG: KASAN: use-after-free in rb_erase+0x1b17/0x2010 at addr ffff88005e5b6f68
>  Read of size 8 by task syz-executor/8984
> =============================================================================
> BUG kmalloc-192 (Not tainted): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> Disabling lock debugging due to kernel taint
> INFO: Allocated in 0xbbbbbbbbbbbbbbbb age=18446705582212484632
> ....
> [<      none      >] dummy_hrtimer_create+0x49/0x1a0 sound/drivers/dummy.c:464
> ....
> INFO: Freed in 0xfffd8e09 age=18446705496313138713 cpu=2164287125 pid=-1
> [<      none      >] dummy_hrtimer_free+0x68/0x80 sound/drivers/dummy.c:481
> ....
> Call Trace:
>  [] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:333
>  [<     inline     >] rb_set_parent include/linux/rbtree_augmented.h:111
>  [<     inline     >] __rb_erase_augmented include/linux/rbtree_augmented.h:218
>  [] rb_erase+0x1b17/0x2010 lib/rbtree.c:427
>  [] timerqueue_del+0x78/0x170 lib/timerqueue.c:86
>  [] __remove_hrtimer+0x90/0x220 kernel/time/hrtimer.c:903
>  [<     inline     >] remove_hrtimer kernel/time/hrtimer.c:945
>  [] hrtimer_try_to_cancel+0x22a/0x570 kernel/time/hrtimer.c:1046
>  [] hrtimer_cancel+0x22/0x40 kernel/time/hrtimer.c:1066
>  [] dummy_hrtimer_stop+0x91/0xb0 sound/drivers/dummy.c:417
>  [] dummy_pcm_trigger+0x17f/0x1e0 sound/drivers/dummy.c:507
>  [] snd_pcm_do_stop+0x160/0x1b0 sound/core/pcm_native.c:1106
>  [] snd_pcm_action_single+0x76/0x120 sound/core/pcm_native.c:956
>  [] snd_pcm_action+0x231/0x290 sound/core/pcm_native.c:974
>  [<     inline     >] snd_pcm_stop sound/core/pcm_native.c:1139
>  [] snd_pcm_drop+0x12d/0x1d0 sound/core/pcm_native.c:1784
>  [] snd_pcm_common_ioctl1+0xfae/0x2150 sound/core/pcm_native.c:2805
>  [] snd_pcm_capture_ioctl1+0x2a1/0x5e0 sound/core/pcm_native.c:2976
>  [] snd_pcm_kernel_ioctl+0x11c/0x160 sound/core/pcm_native.c:3020
>  [] snd_pcm_oss_sync+0x3a4/0xa30 sound/core/oss/pcm_oss.c:1693
>  [] snd_pcm_oss_release+0x1ad/0x280 sound/core/oss/pcm_oss.c:2483
>  .....

A workaround is to call hrtimer_cancel() in dummy_hrtimer_sync() which
is called certainly before other blocking ops.

Reported-by: Dmitry Vyukov 
Tested-by: Dmitry Vyukov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: dummy: Implement timer backend switching more safely

2016-02-17T20:34:38+00:00

commit ddce57a6f0a2d8d1bfacfa77f06043bc760403c2 upstream.

Currently the selected timer backend is referred at any moment from
the running PCM callbacks.  When the backend is switched, it's
possible to lead to inconsistency from the running backend.  This was
pointed by syzkaller fuzzer, and the commit [7ee96216c31a: ALSA:
dummy: Disable switching timer backend via sysfs] disabled the dynamic
switching for avoiding the crash.

This patch improves the handling of timer backend switching.  It keeps
the reference to the selected backend during the whole operation of an
opened stream so that it won't be changed by other streams.

Together with this change, the hrtimer parameter is reenabled as
writable now.

NOTE: this patch also turned out to fix the still remaining race.
Namely, ops was still replaced dynamically at dummy_pcm_open:

  static int dummy_pcm_open(struct snd_pcm_substream *substream)
  {
  ....
          dummy->timer_ops = &dummy_systimer_ops;
          if (hrtimer)
                  dummy->timer_ops = &dummy_hrtimer_ops;

Since dummy->timer_ops is common among all streams, and when the
replacement happens during accesses of other streams, it may lead to a
crash.  This was actually triggered by syzkaller fuzzer and KASAN.

This patch rewrites the code not to use the ops shared by all streams
any longer, too.

BugLink: http://lkml.kernel.org/r/CACT4Y+aZ+xisrpuM6cOXbL21DuM0yVxPYXf4cD4Md9uw0C3dBQ@mail.gmail.com
Reported-by: Dmitry Vyukov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: dummy: Disable switching timer backend via sysfs

2016-02-17T20:34:36+00:00

commit 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 upstream.

ALSA dummy driver can switch the timer backend between system timer
and hrtimer via its hrtimer module option.  This can be also switched
dynamically via sysfs, but it may lead to a memory corruption when
switching is done while a PCM stream is running; the stream instance
for the newly switched timer method tries to access the memory that
was allocated by another timer method although the sizes differ.

As the simplest fix, this patch just disables the switch via sysfs by
dropping the writable bit.

BugLink: http://lkml.kernel.org/r/CACT4Y+ZGEeEBntHW5WHn2GoeE0G_kRrCmUh6=dWyy-wfzvuJLg@mail.gmail.com
Reported-by: Dmitry Vyukov 
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

ALSA: pcsp: Fix the order of input device unregistration

2013-11-14T14:50:10+00:00

The current code may access to the already freed object.  The input
device must be accessed and unregistered before freeing the top level
sound object.

Cc: 
Signed-off-by: Takashi Iwai

ALSA: pcsp: Fix initialization with nopcm=1

2013-10-29T14:15:20+00:00

When nopcm=1 is set, some initializations based on hrtimer resolution
might be bogus because the driver checks the resolution only when
nopcm=0.  Simply get the resolution always at first for fixing the
bug.

Spotted by coverity CID 139740.

Signed-off-by: Takashi Iwai

ALSA: opl3: Fix possible negative array index access

2013-10-29T14:07:19+00:00

Spotted by coverity CID 115196.

Signed-off-by: Takashi Iwai

ALSA: replace strict_strto() with kstrto()

2013-07-21T09:56:18+00:00

The usage of strict_strto*() is not preferred, because
strict_strto*() is obsolete. Thus, kstrto*() should be
used.

Signed-off-by: Jingoo Han 
Signed-off-by: Takashi Iwai

ALSA: vx_core: off by one in vx_read_status()

2013-06-21T12:32:06+00:00

This code is older than git, and I haven't tested it, but if size ==
SIZE_MAX_STATUS then we would write one space past the end of the
rmh->Stat[] array.

Signed-off-by: Dan Carpenter 
Signed-off-by: Takashi Iwai

ALSA: Remove the rest of *_set_drvdata(NULL) calls

2013-05-29T10:50:59+00:00

A few calls are still left in parport drivers after this commit, which
I'm not quite sure yet.

Signed-off-by: Takashi Iwai

ALSA: virmidi: Remove redundant platform_set_drvdata()

2013-05-23T12:35:51+00:00

Commit 0998d06310 (device-core: Ensure drvdata = NULL when no
driver is bound) removes the need to set driver data field to
NULL.

Signed-off-by: Sachin Kamat 
Signed-off-by: Takashi Iwai