BMC/Intel-BMC/linux.git/sound/core, branch v3.16

ALSA: control: Make sure that id->index does not overflow

2014-06-18T13:13:37+00:00

The ALSA control code expects that the range of assigned indices to a control is continuous and does not overflow. Currently there are no checks to enforce this. If a control with a overflowing index range is created that control becomes effectively inaccessible and unremovable since snd_ctl_find_id() will not be able to find it. This patch adds a check that makes sure that controls with a overflowing index range can not be created. Signed-off-by: Lars-Peter Clausen Acked-by: Jaroslav Kysela Cc: Signed-off-by: Takashi Iwai

ALSA: control: Handle numid overflow

2014-06-18T13:13:23+00:00

Each control gets automatically assigned its numids when the control is created. The allocation is done by incrementing the numid by the amount of allocated numids per allocation. This means that excessive creation and destruction of controls (e.g. via SNDRV_CTL_IOCTL_ELEM_ADD/REMOVE) can cause the id to eventually overflow. Currently when this happens for the control that caused the overflow kctl->id.numid + kctl->count will also over flow causing it to be smaller than kctl->id.numid. Most of the code assumes that this is something that can not happen, so we need to make sure that it won't happen Signed-off-by: Lars-Peter Clausen Acked-by: Jaroslav Kysela Cc: Signed-off-by: Takashi Iwai

ALSA: control: Don't access controls outside of protected regions

2014-06-18T13:13:07+00:00

A control that is visible on the card->controls list can be freed at any time. This means we must not access any of its memory while not holding the controls_rw_lock. Otherwise we risk a use after free access. Signed-off-by: Lars-Peter Clausen Acked-by: Jaroslav Kysela Cc: Signed-off-by: Takashi Iwai

ALSA: control: Fix replacing user controls

2014-06-18T13:12:49+00:00

There are two issues with the current implementation for replacing user controls. The first is that the code does not check if the control is actually a user control and neither does it check if the control is owned by the process that tries to remove it. That allows userspace applications to remove arbitrary controls, which can cause a user after free if a for example a driver does not expect a control to be removed from under its feed. The second issue is that on one hand when a control is replaced the user_ctl_count limit is not checked and on the other hand the user_ctl_count is increased (even though the number of user controls does not change). This allows userspace, once the user_ctl_count limit as been reached, to repeatedly replace a control until user_ctl_count overflows. Once that happens new controls can be added effectively bypassing the user_ctl_count limit. Both issues can be fixed by instead of open-coding the removal of the control that is to be replaced to use snd_ctl_remove_user_ctl(). This function does proper permission checks as well as decrements user_ctl_count after the control has been removed. Note that by using snd_ctl_remove_user_ctl() the check which returns -EBUSY at beginning of the function if the control already exists is removed. This is not a problem though since the check is quite useless, because the lock that is protecting the control list is released between the check and before adding the new control to the list, which means that it is possible that a different control with the same settings is added to the list after the check. Luckily there is another check that is done while holding the lock in snd_ctl_add(), so we'll rely on that to make sure that the same control is not added twice. Signed-off-by: Lars-Peter Clausen Acked-by: Jaroslav Kysela Cc: Signed-off-by: Takashi Iwai

ALSA: control: Protect user controls against concurrent access

2014-06-18T13:12:33+00:00

The user-control put and get handlers as well as the tlv do not protect against concurrent access from multiple threads. Since the state of the control is not updated atomically it is possible that either two write operations or a write and a read operation race against each other. Both can lead to arbitrary memory disclosure. This patch introduces a new lock that protects user-controls from concurrent access. Since applications typically access controls sequentially than in parallel a single lock per card should be fine. Signed-off-by: Lars-Peter Clausen Acked-by: Jaroslav Kysela Cc: Signed-off-by: Takashi Iwai

ALSA: core: Use ktime_get_ts()

2014-06-12T10:58:16+00:00

do_posix_clock_monotonic_gettime() is a leftover from the initial posix timer implementation which maps to ktime_get_ts(). Signed-off-by: Thomas Gleixner Signed-off-by: Takashi Iwai

ALSA: seq: Continue broadcasting events to ports if one of them fails

2014-06-04T15:30:58+00:00

Sometimes PORT_EXIT messages are lost when a process is exiting. This happens if you subscribe to the announce port with client A, then subscribe to the announce port with client B, then kill client A. Client B will not see the PORT_EXIT message because client A's port is closing and is earlier in the announce port subscription list. The for each loop will try to send the announcement to client A and fail, then will stop trying to broadcast to other ports. Killing B works fine since the announcement will already have gone to A. The CLIENT_EXIT message does not get lost. How to reproduce problem: *** termA $ aseqdump -p 0:1 0:1 Port subscribed 0:1 -> 128:0 *** termB $ aseqdump -p 0:1 *** termA 0:1 Client start client 129 0:1 Port start 129:0 0:1 Port subscribed 0:1 -> 129:0 *** termB 0:1 Port subscribed 0:1 -> 129:0 *** termA ^C *** termB 0:1 Client exit client 128 <--- expected Port exit as well (before client exit) Signed-off-by: Adam Goode Signed-off-by: Takashi Iwai

ALSA: seq: correctly detect input buffer overflow

2014-06-04T05:12:12+00:00

snd_seq_event_dup returns -ENOMEM in some buffer-full conditions, but usually returns -EAGAIN. Make -EAGAIN trigger the overflow condition in snd_seq_fifo_event_in so that the fifo is cleared and -ENOSPC is returned to userspace as stated in the alsa-lib docs. Signed-off-by: Adam Goode Signed-off-by: Takashi Iwai

Merge branch 'for-linus' into for-next

2014-06-03T06:15:18+00:00

Just to catch up a few small fixes for HD-audio and DMA engine.

ALSA: pcm_dmaengine: Add check during device suspend

2014-05-19T09:31:24+00:00

Currently snd_dmaengine_pcm_trigger() calls dmaengine_pause() unconditinally during device suspend. In case where DMA controller doesn't support PAUSE/RESUME functionality, this call is not able to stop the DMA controller. In this scenario, audio playback doesn't resume after device resume. Calling dmaengine_pause/dmaengine_terminate_all conditionally fixes the issue. It has been tested with audio playback on Samsung platform having PL330 DMA controller which doesn't support PAUSE/RESUME. Signed-off-by: Tushar Behera Acked-by: Lars-Peter Clausen Signed-off-by: Takashi Iwai