kernel/linux.git/sound/core/control.c, branch linux-6.9.y

ALSA: control: Fix unannotated kfree() cleanup

2024-03-20T06:30:48+00:00

The recent conversion to the automatic kfree() forgot to mark a variable with __free(kfree), leading to memory leaks. Fix it. Fixes: 1052d9882269 ("ALSA: control: Use automatic cleanup of kfree()") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/r/c1e2ef3c-164f-4840-9b1c-f7ca07ca422a@alu.unizg.hr Message-ID: <20240320062722.31325-1-tiwai@suse.de> Signed-off-by: Takashi Iwai

ALSA: control: Use guard() for locking

2024-02-28T14:01:21+00:00

We can simplify the code gracefully with new guard() macro and co for automatic cleanup of locks. The lops calls under multiple rwsems are factored out as a simple macro, so that it can be called easily from snd_ctl_dev_register() and snd_ctl_dev_disconnect(). There are a few remaining explicit rwsem and spinlock calls, and those are the places where the lock downgrade happens or where the temporary unlock/relocking happens -- which guard() doens't cover well yet. Only the code refactoring, and no functional changes. Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20240227085306.9764-9-tiwai@suse.de

ALSA: control: Use automatic cleanup of kfree()

2024-02-23T09:57:30+00:00

There are common patterns where a temporary buffer is allocated and freed at the exit, and those can be simplified with the recent cleanup mechanism via __free(kfree). A caveat is that some allocations are memdup_user() and they return an error pointer instead of NULL. Those need special cares and the value has to be cleared with no_free_ptr() at the allocation error path. Other than that, the conversions are straightforward. No functional changes, only code refactoring. Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20240222111509.28390-3-tiwai@suse.de

ALSA: control: Don't embed ctl_dev

2023-08-17T07:23:30+00:00

Embedding the ctl_dev in the snd_card object may result in UAF when the delayed kobj release is used; at the delayed kobj release, it still accesses the struct device itself while the card memory (that embeds the struct device) may be already gone. As a workaround, detach the struct device from the card object by allocating via the new snd_device_alloc() helper. The rest are just replacing ctl_dev access to the pointer. This is based on the fix Curtis posted initially. In this patch, the changes are split and use the new helper function instead. Link: https://lore.kernel.org/r/20230801171928.1460120-1-cujomalainey@chromium.org Reviewed-by: Jaroslav Kysela Signed-off-by: Curtis Malainey Tested-by: Curtis Malainey Link: https://lore.kernel.org/r/20230816160252.23396-3-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: control: Take lock in snd_ctl_find_id() and snd_ctl_find_numid()

2023-07-20T08:03:00+00:00

Now all needed callers have been replaced with *_locked() versions, let's turn on the locking in snd_ctl_find_id() and snd_ctl_find_numid(). This patch also adds the lockdep assertions for debugging, too. Link: https://lore.kernel.org/r/20230718141304.1032-11-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: control: Introduce unlocked version for snd_ctl_find_*() helpers

2023-07-20T08:03:00+00:00

For reducing the unnecessary use of controls_rwsem in the drivers, this patch adds a new variant for snd_ctl_find_*() helpers: snd_ctl_find_id_locked() and snd_ctl_find_numid_locked() look for a kctl element inside the card->controls_rwsem -- that is, doing the very same as what snd_ctl_find_id() and snd_ctl_find_numid() did until now. snd_ctl_find_id() and snd_ctl_find_numid() remain same, i.e. still unlocked version, but they will be switched to locked version once after all callers are replaced. The patch also replaces the calls of snd_ctl_find_id() and snd_ctl_find_numid() in a few places; all of those are places where we know that the functions are called properly with controls_rwsem held. All others are without rwsem (although they should have been). After this patch, we'll turn on the locking in snd_ctl_find_id() and snd_ctl_find_numid() to be more race-free. Link: https://lore.kernel.org/r/20230718141304.1032-10-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: control: Make snd_ctl_find_id() argument const

2023-07-20T08:02:59+00:00

The id object passed to snd_ctl_find_id() is only read, and we can mark it with const gracefully. Link: https://lore.kernel.org/r/20230718141304.1032-9-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: control: Add lockdep warning to internal functions

2023-07-20T08:01:40+00:00

To assure the proper locking, add the lockdep check to __snd_ctl_remove(), __snd_ctl_add_replace() and other internal functions to handle user controls. Link: https://lore.kernel.org/r/20230718141304.1032-6-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: control: Take controls_rwsem lock in snd_ctl_remove()

2023-07-20T08:01:27+00:00

So far, snd_ctl_remove() requires its caller to take card->controls_rwsem manually before the call for avoiding possible races. However, many callers don't care and miss the locking. Basically it's cumbersome and error-prone to enforce it to each caller. Moreover, card->controls_rwsem is a field that should be used only by internal or proper helpers, and it's not to be touched at random external places. This patch is an attempt to make those calls more consistent: now snd_ctl_remove() takes the card->controls_rwsem internally, just like other API functions for kctls. Since a few callers already take the controls_rwsem locks, the patch removes those locks at the same time, too. Link: https://lore.kernel.org/r/20230718141304.1032-5-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: control: Take card->controls_rwsem in snd_ctl_rename()

2023-07-20T08:00:02+00:00

snd_ctl_rename() expects that card->controls_rwsem is held in the caller side for avoiding possible races, but actually no one really did that. It's likely because this operation is done usually only at the device initialization where no race can happen. But, it's still safer to take a lock, so we just take the lock inside snd_ctl_rename() like most of other API functions do. Link: https://lore.kernel.org/r/20230718141304.1032-2-tiwai@suse.de Signed-off-by: Takashi Iwai