linux-stable.git/sound/drivers, branch v3.18.35

ALSA: dummy: Implement timer backend switching more safely

2016-03-02T20:19:17+00:00

[ Upstream commit ddce57a6f0a2d8d1bfacfa77f06043bc760403c2 ]

Currently the selected timer backend is referred at any moment from
the running PCM callbacks.  When the backend is switched, it's
possible to lead to inconsistency from the running backend.  This was
pointed by syzkaller fuzzer, and the commit [7ee96216c31a: ALSA:
dummy: Disable switching timer backend via sysfs] disabled the dynamic
switching for avoiding the crash.

This patch improves the handling of timer backend switching.  It keeps
the reference to the selected backend during the whole operation of an
opened stream so that it won't be changed by other streams.

Together with this change, the hrtimer parameter is reenabled as
writable now.

NOTE: this patch also turned out to fix the still remaining race.
Namely, ops was still replaced dynamically at dummy_pcm_open:

  static int dummy_pcm_open(struct snd_pcm_substream *substream)
  {
  ....
          dummy->timer_ops = &dummy_systimer_ops;
          if (hrtimer)
                  dummy->timer_ops = &dummy_hrtimer_ops;

Since dummy->timer_ops is common among all streams, and when the
replacement happens during accesses of other streams, it may lead to a
crash.  This was actually triggered by syzkaller fuzzer and KASAN.

This patch rewrites the code not to use the ops shared by all streams
any longer, too.

BugLink: http://lkml.kernel.org/r/CACT4Y+aZ+xisrpuM6cOXbL21DuM0yVxPYXf4cD4Md9uw0C3dBQ@mail.gmail.com
Reported-by: Dmitry Vyukov 
Cc: 
Signed-off-by: Takashi Iwai 
Signed-off-by: Sasha Levin

ALSA: dummy: Disable switching timer backend via sysfs

2016-02-15T20:42:33+00:00

[ Upstream commit 7ee96216c31aabe1eb42fb91ff50dae9fcd014b2 ]

ALSA dummy driver can switch the timer backend between system timer
and hrtimer via its hrtimer module option.  This can be also switched
dynamically via sysfs, but it may lead to a memory corruption when
switching is done while a PCM stream is running; the stream instance
for the newly switched timer method tries to access the memory that
was allocated by another timer method although the sizes differ.

As the simplest fix, this patch just disables the switch via sysfs by
dropping the writable bit.

BugLink: http://lkml.kernel.org/r/CACT4Y+ZGEeEBntHW5WHn2GoeE0G_kRrCmUh6=dWyy-wfzvuJLg@mail.gmail.com
Reported-by: Dmitry Vyukov 
Cc: 
Signed-off-by: Takashi Iwai 
Signed-off-by: Sasha Levin

ALSA: vx: Use nonatomic PCM ops

2014-09-15T13:52:03+00:00

Rewrite VXpocket and VX222 drivers to use the new PCM nonatomic ops.
The former irq tasklet is replaced with a threaded irq handler, and
the tasklet for the PCM delayed start is simply merged into the normal
PCM trigger, as well as the replacement of spinlock with mutex.

Signed-off-by: Takashi Iwai

ALSA: drivers: Convert to snd_card_new() with a device pointer

2014-02-12T09:58:20+00:00

Also remove superfluous snd_card_set_dev() calls.

Signed-off-by: Takashi Iwai

ALSA: Drop unused name argument in snd_register_oss_device()

2014-02-12T09:58:19+00:00

The last argument, name, of snd_oss_register_device() is nowhere
referred in the function in the current code.  Let's drop it.

Signed-off-by: Takashi Iwai

ALSA: Replace with IS_ENABLED()

2014-02-10T10:42:00+00:00

Replace the lengthy #if defined(XXX) || defined(XXX_MODULE) with the
new IS_ENABLED() macro.

The patch still doesn't cover all ifdefs.  For example, the dependency
on CONFIG_GAMEPORT is still open-coded because this also has an extra
dependency on MODULE.  Similarly, an open-coded ifdef in pcm_oss.c and
some sequencer-related stuff are left untouched.

Signed-off-by: Takashi Iwai

ALSA: pcsp: Include appropriate header file in pcsp/pcsp_input.c

2014-02-07T17:24:20+00:00

Include appropriate header file in drivers/pcsp/pcsp_input.c because it
defines function whose prototype definitions are present in
drivers/pcsp/pcsp_input.h.

This eliminates the following warning in drivers/pcsp/pcsp_input.c:
sound/drivers/pcsp/pcsp_input.c:42:6: warning: no previous prototype for ‘pcspkr_stop_sound’ [-Wmissing-prototypes]
sound/drivers/pcsp/pcsp_input.c:80:5: warning: no previous prototype for ‘pcspkr_input_init’ [-Wmissing-prototypes]
sound/drivers/pcsp/pcsp_input.c:110:5: warning: no previous prototype for ‘pcspkr_input_remove’ [-Wmissing-prototypes]

Signed-off-by: Rashika Kheria 
Reviewed-by: Josh Triplett 
Signed-off-by: Takashi Iwai

ALSA: pcsp: Fix the order of input device unregistration

2013-11-14T14:50:10+00:00

The current code may access to the already freed object.  The input
device must be accessed and unregistered before freeing the top level
sound object.

Cc: 
Signed-off-by: Takashi Iwai

ALSA: pcsp: Fix initialization with nopcm=1

2013-10-29T14:15:20+00:00

When nopcm=1 is set, some initializations based on hrtimer resolution
might be bogus because the driver checks the resolution only when
nopcm=0.  Simply get the resolution always at first for fixing the
bug.

Spotted by coverity CID 139740.

Signed-off-by: Takashi Iwai

ALSA: opl3: Fix possible negative array index access

2013-10-29T14:07:19+00:00

Spotted by coverity CID 115196.

Signed-off-by: Takashi Iwai