starfive-tech/linux.git/sound/core, branch visionfive

ALSA: timer: fix ida_free call while not allocated

2025-08-21T07:12:24+00:00

In the snd_utimer_create() function, if the kasprintf() function return NULL, snd_utimer_put_id() will be called, finally use ida_free() to free the unallocated id 0. the syzkaller reported the following information: ------------[ cut here ]------------ ida_free called for id=0 which is not allocated. WARNING: CPU: 1 PID: 1286 at lib/idr.c:592 ida_free+0x1fd/0x2f0 lib/idr.c:592 Modules linked in: CPU: 1 UID: 0 PID: 1286 Comm: syz-executor164 Not tainted 6.15.8 #3 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014 RIP: 0010:ida_free+0x1fd/0x2f0 lib/idr.c:592 Code: f8 fc 41 83 fc 3e 76 69 e8 70 b2 f8 (...) RSP: 0018:ffffc900007f79c8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 1ffff920000fef3b RCX: ffffffff872176a5 RDX: ffff88800369d200 RSI: 0000000000000000 RDI: ffff88800369d200 RBP: 0000000000000000 R08: ffffffff87ba60a5 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f6f1abc1740(0000) GS:ffff8880d76a0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6f1ad7a784 CR3: 000000007a6e2000 CR4: 00000000000006f0 Call Trace: snd_utimer_put_id sound/core/timer.c:2043 [inline] [snd_timer] snd_utimer_create+0x59b/0x6a0 sound/core/timer.c:2184 [snd_timer] snd_utimer_ioctl_create sound/core/timer.c:2202 [inline] [snd_timer] __snd_timer_user_ioctl.isra.0+0x724/0x1340 sound/core/timer.c:2287 [snd_timer] snd_timer_user_ioctl+0x75/0xc0 sound/core/timer.c:2298 [snd_timer] vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x198/0x200 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x7b/0x160 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] The utimer->id should be set properly before the kasprintf() function, ensures the snd_utimer_put_id() function will free the allocated id. Fixes: 37745918e0e75 ("ALSA: timer: Introduce virtual userspace-driven timers") Signed-off-by: Dewei Meng Link: https://patch.msgid.link/20250821014317.40786-1-mengdewei@cqsoftware.com.cn Signed-off-by: Takashi Iwai

ALSA: core: Copy string more safely

2025-07-11T07:53:36+00:00

Replace the remaining strcpy() and sprintf() usages in the ALSA core code with the safer versions. The first strcpy() points actually to card->id, hence just use strscpy() with card->id instead. The append of suffix string is slightly rewritten so that we can use scnprintf() and strscpy(). Only for safety, no actual behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-104-tiwai@suse.de

ALSA: seq: Use safer strscpy() instead of strcpy()

2025-07-11T07:51:08+00:00

Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-4-tiwai@suse.de

ALSA: rawmidi: Use safer strscpy() instead of strcpy()

2025-07-11T07:51:08+00:00

ALSA: control: Use safer strscpy() instead of strcpy()

2025-07-11T07:51:08+00:00

Merge branch 'for-linus' into for-next

2025-07-11T07:50:06+00:00

Back-merge 6.16 devel branch for large patch sets including string cleanups and HD-audio reorganization Signed-off-by: Takashi Iwai

ALSA: compress_offload: tighten ioctl command number checks

2025-07-10T08:10:08+00:00

The snd_compr_ioctl() ignores the upper 24 bits of the ioctl command number and only compares the number of the ioctl command, which can cause unintended behavior if an application tries to use an unsupprted command that happens to have the same _IOC_NR() value. Remove the truncation to the low bits and compare the entire ioctl command code like every other driver does. Fixes: b21c60a4edd2 ("ALSA: core: add support for compress_offload") Signed-off-by: Arnd Bergmann Acked-by: Vinod Koul Link: https://patch.msgid.link/20250710063059.2683476-1-arnd@kernel.org Signed-off-by: Takashi Iwai

ALSA: hrtimer: Replace deprecated strcpy() with strscpy()

2025-06-30T12:08:07+00:00

strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250630105723.1703-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai

ALSA: timer: Replace deprecated strcpy() with strscpy()

2025-06-30T12:07:42+00:00

strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250630105420.1448-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai

ALSA: mixer_oss: Remove deprecated strcpy() function calls

2025-06-23T15:10:32+00:00

Remove the deprecated strcpy() function calls and assign the strings directly to a 'char *' instead. Use 'if/else if' instead of two separate if statements. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250623113855.37031-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai