kernel/linux.git/sound/core/pcm.c, branch v6.2

ALSA: pcm: Avoid reference to status->state

2022-09-27T06:44:05+00:00

In the PCM core and driver code, there are lots place referring to the current PCM state via runtime->status->state. This patch introduced a local PCM state in runtime itself and replaces those references with runtime->state. It has improvements in two aspects: - The reduction of a indirect access leads to more code optimization - It avoids a possible (unexpected) modification of the state via mmap of the status record The status->state is updated together with runtime->state, so that user-space can still read the current state via mmap like before, too. This patch touches only the ALSA core code. The changes in each driver will follow in later patches. Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20220926135558.26580-2-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: Replace sprintf() with sysfs_emit()

2022-08-02T14:03:46+00:00

For sysfs outputs, it's safer to use a new helper, sysfs_emit(), instead of the raw sprintf() & co. This patch replaces such a sprintf() call straightforwardly with the new helper. Link: https://lore.kernel.org/r/20220801165639.26030-6-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: Use deferred fasync helper

2022-07-29T10:57:11+00:00

For avoiding the potential deadlock via kill_fasync() call, use the new fasync helpers to defer the invocation from timer API. Note that it's merely a workaround. Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com Reported-by: syzbot+669c9abf11a6a011dd09@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220728125945.29533-4-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: Fix missing return value comments for kernel docs

2022-07-13T11:42:34+00:00

Each kernel doc comment expects the definition of the return value in a proper format. This patch adds or fixes the missing entries for PCM API. Link: https://lore.kernel.org/r/20220713104759.4365-3-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock

2022-03-30T12:29:49+00:00

syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm->mmap_mutex is already held. Meanwhile, the copy_from/to_user calls at read/write operations also take the mm->mmap_lock internally, hence it may lead to a AB/BA deadlock. A similar problem was already seen in the past and we fixed it with a refcount (in commit b248371628aa). The former fix covered only the call paths with OSS read/write and OSS ioctls, while we need to cover the concurrent access via both ALSA and OSS APIs now. This patch addresses the problem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for OSS. The new field, runtime->buffer_accessing, keeps the number of concurrent read/write operations. Unlike the former buffer_mutex protection, this protects only around the copy_from/to_user() calls; the other codes are basically protected by the PCM stream lock. The refcount can be a negative, meaning blocked by the ioctls. If a negative value is seen, the read/write aborts with -EBUSY. In the ioctl side, OTOH, they check this refcount, too, and set to a negative value for blocking unless it's already being accessed. Reported-by: syzbot+6e5c88838328e99c7e1c@syzkaller.appspotmail.com Fixes: dca947d4d26d ("ALSA: pcm: Fix races among concurrent read/write and buffer changes") Cc: Link: https://lore.kernel.org/r/000000000000381a0d05db622a81@google.com Link: https://lore.kernel.org/r/20220330120903.4738-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: Fix races among concurrent hw_params and hw_free calls

2022-03-22T19:56:07+00:00

Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls. This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity. Reported-by: Hu Jiahui Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20220322170720.3529-2-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls

2021-11-16T07:13:55+00:00

snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: a8ff48cb7083 ("ALSA: pcm: Free chmap at PCM free callback, too") Link: https://lore.kernel.org/r/20211116071314.15065-2-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: use DEVICE_ATTR_RO macro

2021-05-25T07:00:04+00:00

Use DEVICE_ATTR_RO() helper instead of plain DEVICE_ATTR(), which makes the code a bit shorter and easier to read. Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20210524120007.39728-1-yuehaibing@huawei.com Signed-off-by: Takashi Iwai

ALSA: pcm: Use for_each_pcm_substream() macro

2021-02-08T15:01:01+00:00

There are a few places doing the same loop iterating all PCM substreams belonging to the PCM object. Introduce a local helper macro, for_each_pcm_substream(), to simplify the code. Link: https://lore.kernel.org/r/20210206203656.15959-5-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: Call sync_stop at disconnection

2021-02-08T15:00:28+00:00

The PCM core should perform the sync for the pending stop operations at disconnection. Otherwise it may lead to unexpected access. Currently the old user of sync_stop, USB-audio driver, has its own sync, so this isn't needed, but it's better to guarantee the sync in the PCM core level. This patch adds the missing sync_stop call at PCM disconnection callback. It also assures the IRQ sync if it's specified in the card. snd_pcm_sync_stop() is slightly modified to be called also for any PCM substream object now. Fixes: 1e850beea278 ("ALSA: pcm: Add the support for sync-stop operation") Cc: Link: https://lore.kernel.org/r/20210206203656.15959-2-tiwai@suse.de Signed-off-by: Takashi Iwai