kernel/linux.git/sound/core/pcm.c, branch linux-4.16.y

ALSA: pcm: Fix UAF at PCM release via PCM timer access

2018-04-24T07:43:01+00:00

commit a820ccbe21e8ce8e86c39cd1d3bc8c7d1cbb949b upstream. The PCM runtime object is created and freed dynamically at PCM stream open / close time. This is tracked via substream->runtime, and it's cleared at snd_pcm_detach_substream(). The runtime object assignment is protected by PCM open_mutex, so for all PCM operations, it's safely handled. However, each PCM substream provides also an ALSA timer interface, and user-space can access to this while closing a PCM substream. This may eventually lead to a UAF, as snd_pcm_timer_resolution() tries to access the runtime while clearing it in other side. Fortunately, it's the only concurrent access from the PCM timer, and it merely reads runtime->timer_resolution field. So, we can avoid the race by reordering kfree() and wrapping the substream->runtime clearance with the corresponding timer lock. Reported-by: syzbot+8e62ff4e07aa2ce87826@syzkaller.appspotmail.com Cc: Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman

ALSA: pcm: prevent UAF in snd_pcm_info

2017-12-05T22:28:08+00:00

When the device descriptor is closed, the `substream->runtime` pointer is freed. But another thread may be in the ioctl handler, case SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which calls snd_pcm_info() which accesses the now freed `substream->runtime`. Note: this fixes CVE-2017-0861 Signed-off-by: Robb Glasser Signed-off-by: Nick Desaulniers Cc: Signed-off-by: Takashi Iwai

ALSA: pcm: Forcibly stop at disconnect callback

2017-10-18T06:05:46+00:00

So far we assumed that each driver implements the hotplug PCM handling properly, e.g. dealing with the pending PCM stream at disconnect callback. But most codes don't care, and it eventually leaves the PCM stream inconsistent state when an abrupt disconnection like sysfs unbind happens. This patch is simple but a big-hammer solution: invoke snd_pcm_stop() at the common PCM disconnect callback always when the stream is running. Tested-by: Kuninori Morimoto Signed-off-by: Takashi Iwai

ALSA: pcm: Don't call register and disconnect callbacks for internal PCM

2017-10-18T06:05:34+00:00

The internal PCM (aka DPCM backend PCM) doesn't need any registration procedure, thus currently we bail out immediately at dev_register callback. Similarly, its counterpart, dev_disconnect callback, is superfluous for the internal PCM. For simplifying and avoiding the conflicting disconnect call for internal PCM objects, this patch drops dev_register and dev_disconnect callbacks for the internal ops. The only uncertain thing by this action is whether skipping the PCM state change to SNDRV_PCM_STATE_DISCONNECT for the internal PCM is mandatory. Looking through the current implementations, this doesn't look so, hence dropping the whole dev_disconnect would make more sense. Tested-by: Kuninori Morimoto Signed-off-by: Takashi Iwai

ALSA: pcm: Correct broken procfs set up

2017-08-24T22:05:16+00:00

The commit c8da9be4a75f ("ALSA: pcm: Adjust nine function calls together with a variable assignment") contained a badly incorrect conversion, a "status" PCM procfs creation was replaced with the next one. Luckily, this could be spotted easily by the kernel runtime warning. Fixes: c8da9be4a75f ("ALSA: pcm: Adjust nine function calls together...") Reported-by: Fabio Estevam Tested-by: Fabio Estevam Signed-off-by: Takashi Iwai

ALSA: pcm: Adjust nine function calls together with a variable assignment

2017-08-23T08:36:18+00:00

The script "checkpatch.pl" pointed information out like the following. ERROR: do not use assignment in if condition Thus fix the affected source code places. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai

ALSA: pcm: Use common error handling code in _snd_pcm_new()

2017-08-23T08:35:50+00:00

Add a jump target so that a bit of exception handling can be better reused at the end of this function. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai

ALSA: pcm: constify attribute_group structures.

2017-06-29T16:20:15+00:00

attribute_groups are not supposed to change at runtime. All functions working with attribute_groups provided by work with const attribute_group. So mark the non-const structs as const. File size before: text data bss dec hex filename 9781 240 8 10029 272d sound/core/pcm.o File size After adding 'const': text data bss dec hex filename 9813 176 8 9997 270d sound/core/pcm.o Signed-off-by: Arvind Yadav Signed-off-by: Takashi Iwai

ALSA: pcm: add local header file for snd-pcm module

2017-05-26T06:38:14+00:00

Several files are used to construct PCM core module, a.k.a snd-pcm. Although available APIs are described in 'include/sound/pcm.h', some of them are not exported as symbols in kernel space. Such APIs are just for module local usage. This commit adds module local header file and move some function prototypes into it so that scopes of them are controlled properly and developers get no confusion from unavailable symbols. Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai

ALSA: pcm: use "do {} while (0)" for empty macro

2017-05-18T14:38:49+00:00

Recent compilers produce a harmless warning for the new pcm_call_notify() macro when CONFIG_SND_PCM_OSS is disabled: sound/core/pcm.c: In function 'snd_pcm_free': sound/core/pcm.c:905:37: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] This turns the empty macro into a 'do {} while (0)' statement to avoid the warning. Fixes: 58f30d650c7f ("ALSA: pcm: Build pcm notifier code conditionally") Signed-off-by: Arnd Bergmann Signed-off-by: Takashi Iwai