BMC/Intel-BMC/linux.git/sound/core/seq, branch dev-5.15-intel

ALSA: seq: Set upper limit of processed events

2022-01-27T10:05:00+00:00

[ Upstream commit 6fadb494a638d8b8a55864ecc6ac58194f03f327 ] Currently ALSA sequencer core tries to process the queued events as much as possible when they become dispatchable. If applications try to queue too massive events to be processed at the very same timing, the sequencer core would still try to process such all events, either in the interrupt context or via some notifier; in either away, it might be a cause of RCU stall or such problems. As a potential workaround for those problems, this patch adds the upper limit of the amount of events to be processed. The remaining events are processed in the next batch, so they won't be lost. For the time being, it's limited up to 1000 events per queue, which should be high enough for any normal usages. Reported-by: Zqiang Reported-by: syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20211102033222.3849-1-qiang.zhang1211@gmail.com Link: https://lore.kernel.org/r/20211207165146.2888-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin

Merge branch 'for-linus' into for-next

2021-08-09T05:53:22+00:00

ALSA: seq: Fix racy deletion of subscriber

2021-08-03T11:43:40+00:00

It turned out that the current implementation of the port subscription is racy. The subscription contains two linked lists, and we have to add to or delete from both lists. Since both connection and disconnection procedures perform the same order for those two lists (i.e. src list, then dest list), when a deletion happens during a connection procedure, the src list may be deleted before the dest list addition completes, and this may lead to a use-after-free or an Oops, even though the access to both lists are protected via mutex. The simple workaround for this race is to change the access order for the disconnection, namely, dest list, then src list. This assures that the connection has been established when disconnecting, and also the concurrent deletion can be avoided. Reported-and-tested-by: folkert Cc: Link: https://lore.kernel.org/r/20210801182754.GP890690@belle.intranet.vanheusden.com Link: https://lore.kernel.org/r/20210803114312.2536-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: seq: Fix comments of wrong client number for MIDI Passthrough

2021-07-27T10:53:00+00:00

MIDI Passthrough sequencer client is assigned always to the fixed number 14, while it's wrongly documented in the comments as if 62, which was an old number that was used during development. Fix all those numbers. Link: https://lore.kernel.org/r/20210727105232.7321-1-tiwai@suse.de Signed-off-by: Takashi Iwai

Merge branch 'for-next' into for-linus

2021-07-01T06:34:15+00:00

ALSA: seq: oss: Fix error check at system port creation

2021-06-17T14:02:26+00:00

The system port creation in ALSA OSS sequencer was wrongly checked against to the port number that can be never negative. The error code should be checked rather against the ioctl call. This patch corrects the error check. Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/20210617134742.6321-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: seq: Fix race of snd_seq_timer_open()

2021-06-10T15:21:30+00:00

The timer instance per queue is exclusive, and snd_seq_timer_open() should have managed the concurrent accesses. It looks as if it's checking the already existing timer instance at the beginning, but it's not right, because there is no protection, hence any later concurrent call of snd_seq_timer_open() may override the timer instance easily. This may result in UAF, as the leftover timer instance can keep running while the queue itself gets closed, as spotted by syzkaller recently. For avoiding the race, add a proper check at the assignment of tmr->timeri again, and return -EBUSY if it's been already registered. Reported-by: syzbot+ddc1260a83ed1cbf6fb5@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/000000000000dce34f05c42f110c@google.com Link: https://lore.kernel.org/r/20210610152059.24633-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: seq: Fix assignment in if condition

2021-06-09T15:30:26+00:00

There are lots of places doing assignments in if condition in ALSA sequencer core, which is a bad coding style that may confuse readers and occasionally lead to bugs. This patch is merely for coding-style fixes, no functional changes. Link: https://lore.kernel.org/r/20210608140540.17885-57-tiwai@suse.de Signed-off-by: Takashi Iwai

Merge branch 'for-linus' into for-next

2021-01-18T16:39:23+00:00

Back-merge of 5.11 devel branch for more works on USB-audio. Signed-off-by: Takashi Iwai

ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()

2021-01-15T09:35:17+00:00

snd_seq_oss_synth_make_info() didn't check the error code from snd_seq_oss_midi_make_info(), and this leads to the call of strlcpy() with the uninitialized string as the source, which may lead to the access over the limit. Add the proper error check for avoiding the failure. Reported-by: syzbot+e42504ff21cff05a595f@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/20210115093428.15882-1-tiwai@suse.de Signed-off-by: Takashi Iwai