October 2017 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH 0/3] ALSA: add snd_card_disconnect_sync()
by Kuninori Morimoto 11 Oct '17

11 Oct '17

Hi Takashi-san, Mark Current ALSA (SoC) might be kernel panic if user unbinds sound driver during playback. > aplay xxx.wav & > echo xxxx > /sys/bus/platform/drivers/xxxx/unbind Main issue is we *can't* skip unbind with return -Exxx, because unbind operation doesn't checks return value from each driver. Thus, we *must* stop driver immediately when unbind. 1) is for ALSA 2) is for ALSA SoC 3) is for Renesas sound driver. I think almost all driver want to have 3) type patch on .remove but this patch-set doesn't care at this point. Please let me know if they should have it. Takashi Iwai (1): 1) ALSA: add snd_card_disconnect_sync() Kuninori Morimoto (2): 2) ASoC: add snd_soc_card_disconnect_sync() 3) ASoC: rsnd: call snd_soc_card_disconnect_sync() when remove include/sound/core.h | 2 ++ include/sound/soc.h | 2 ++ sound/core/init.c | 18 ++++++++++++++++++ sound/core/pcm.c | 4 ++++ sound/soc/sh/rcar/core.c | 2 ++ sound/soc/soc-core.c | 10 ++++++++++ 6 files changed, 38 insertions(+) -- 1.9.1 Best regards --- Kuninori Morimoto

3 8

[alsa-devel] [PATCH] ASoC: rsnd: stop all working stream when .remove
by Kuninori Morimoto 11 Oct '17

11 Oct '17

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Driver should stop all working stream when .remove timing. Current Renesas sound driver is assuming that all stream was stopped when .remove but it was wrong. This patch stops all working stream when .remove, otherwise kernel will get damage for example in below case. Special thanks to Truong, Hiep > cd /sys/bus/platform/drivers/rcar_sound > aplay xxx.wav & > echo ec500000.sound > unbind Reported-by: Hiep Cao Minh <cm-hiep(a)jinso.co.jp> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> --- sound/soc/sh/rcar/core.c | 68 ++++++++++++++++++++++++++++++++++-------------- 1 file changed, 48 insertions(+), 20 deletions(-) diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c index 1071332..1bf472f 100644 --- a/sound/soc/sh/rcar/core.c +++ b/sound/soc/sh/rcar/core.c @@ -197,12 +197,6 @@ void rsnd_mod_interrupt(struct rsnd_mod *mod, } } -int rsnd_io_is_working(struct rsnd_dai_stream *io) -{ - /* see rsnd_dai_stream_init/quit() */ - return !!io->substream; -} - int rsnd_runtime_channel_original(struct rsnd_dai_stream *io) { struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); @@ -610,20 +604,24 @@ struct rsnd_dai_stream *rsnd_rdai_to_io(struct rsnd_dai *rdai, return &rdai->capture; } -static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, - struct snd_soc_dai *dai) +int rsnd_io_is_working(struct rsnd_dai_stream *io) +{ + /* see rsnd_dai_stream_init/quit() */ + return !!io->substream; +} + +#define rsnd_io_start(priv, io, sub) rsnd_io_operation(priv, io, sub) +#define rsnd_io_stop(priv, io) rsnd_io_operation(priv, io, NULL) +static int rsnd_io_operation(struct rsnd_priv *priv, + struct rsnd_dai_stream *io, + struct snd_pcm_substream *substream) { - struct rsnd_priv *priv = rsnd_dai_to_priv(dai); - struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); - struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream); int ret; unsigned long flags; spin_lock_irqsave(&priv->lock, flags); - switch (cmd) { - case SNDRV_PCM_TRIGGER_START: - case SNDRV_PCM_TRIGGER_RESUME: + if (substream) { rsnd_dai_stream_init(io, substream); ret = rsnd_dai_call(init, io, priv); @@ -638,9 +636,7 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, if (ret < 0) goto dai_trigger_end; - break; - case SNDRV_PCM_TRIGGER_STOP: - case SNDRV_PCM_TRIGGER_SUSPEND: + } else { ret = rsnd_dai_call(irq, io, priv, 0); ret |= rsnd_dai_call(stop, io, priv); @@ -648,9 +644,6 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, ret |= rsnd_dai_call(quit, io, priv); rsnd_dai_stream_quit(io); - break; - default: - ret = -EINVAL; } dai_trigger_end: @@ -659,6 +652,30 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, return ret; } +static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd, + struct snd_soc_dai *dai) +{ + struct rsnd_priv *priv = rsnd_dai_to_priv(dai); + struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); + struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream); + int ret; + + switch (cmd) { + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + ret = rsnd_io_start(priv, io, substream); + break; + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + ret = rsnd_io_stop(priv, io); + break; + default: + ret = -EINVAL; + } + + return ret; +} + static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) { struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); @@ -1477,6 +1494,17 @@ static int rsnd_remove(struct platform_device *pdev) }; int ret = 0, i; + /* + * Stop all working io + */ + for_each_rsnd_dai(rdai, priv, i) { + if (rsnd_io_is_working(&rdai->playback)) + rsnd_io_stop(priv, &rdai->playback); + + if (rsnd_io_is_working(&rdai->capture)) + rsnd_io_stop(priv, &rdai->capture); + } + pm_runtime_disable(&pdev->dev); for_each_rsnd_dai(rdai, priv, i) { -- 1.9.1

3 21

[alsa-devel] [PATCH 0/3] ALSA: add snd_card_disconnect_sync()
by Kuninori Morimoto 11 Oct '17

11 Oct '17

Hi Takashi-san, Mark Current ALSA (SoC) might be kernel panic if user unbinds sound driver during playback. > aplay xxx.wav & > echo xxxx > /sys/bus/platform/drivers/xxxx/unbind Main issue is we *can't* skip unbind with return -Exxx, because unbind operation doesn't checks return value from each driver. Thus, we *must* stop driver immediately when unbind. 1) is for ALSA 2) is for ALSA SoC 3) is for Renesas sound driver. I think almost all driver want to have 3) type patch on .remove but this patch-set doesn't care at this point. Please let me know if they should have it. Takashi Iwai (1): 1) ALSA: add snd_card_disconnect_sync() Kuninori Morimoto (2): 2) ASoC: add snd_soc_card_disconnect_sync() 3) ASoC: rsnd: call snd_soc_card_disconnect_sync() when remove include/sound/core.h | 2 ++ include/sound/soc.h | 2 ++ sound/core/init.c | 18 ++++++++++++++++++ sound/core/pcm.c | 4 ++++ sound/soc/sh/rcar/core.c | 2 ++ sound/soc/soc-core.c | 10 ++++++++++ 6 files changed, 38 insertions(+) -- 1.9.1 Best regards --- Kuninori Morimoto

1 0

[alsa-devel] [PATCH 0/3] ALSA: add snd_card_disconnect_sync()
by Kuninori Morimoto 11 Oct '17

11 Oct '17

Hi Takashi-san, Mark Current ALSA (SoC) might be kernel panic if user unbinds sound driver during playback. > aplay xxx.wav & > echo xxxx > /sys/bus/platform/drivers/xxxx/unbind Main issue is we *can't* skip unbind with return -Exxx, because unbind operation doesn't checks return value from each driver. Thus, we *must* stop driver immediately when unbind. 1) is for ALSA 2) is for ALSA SoC 3) is for Renesas sound driver. I think almost all driver want to have 3) type patch on .remove but this patch-set doesn't care at this point. Please let me know if they should have it. Takashi Iwai (1): 1) ALSA: add snd_card_disconnect_sync() Kuninori Morimoto (2): 2) ASoC: add snd_soc_card_disconnect_sync() 3) ASoC: rsnd: call snd_soc_card_disconnect_sync() when remove include/sound/core.h | 2 ++ include/sound/soc.h | 2 ++ sound/core/init.c | 18 ++++++++++++++++++ sound/core/pcm.c | 4 ++++ sound/soc/sh/rcar/core.c | 2 ++ sound/soc/soc-core.c | 10 ++++++++++ 6 files changed, 38 insertions(+) -- 1.9.1 Best regards --- Kuninori Morimoto

1 0

[alsa-devel] [PATCH 0/9] sound: Add sanity checks for invalid EPs
by Takashi Iwai 10 Oct '17

10 Oct '17

Hi, this is a patchset to cover the codes that may submit URBs containing invalid EPs without validation, which result in the kernel warning from the USB core. The first patch adds a new helper for simplifying the EP check, and the rest applies it at needed places. USB devs: could you check the first patch? I tried usb_find_common_endpoints() and friends at first, but it made the code more complex in the end, because we're dealing with the fixed endpoints and the validation is required for them. The original issues were spotted by syzkaller, and I put a few others for covering more similar cases. thanks, Takashi === Takashi Iwai (9): usb: core: Add a helper function to check the validity of EP type in URB ALSA: bcd2000: Add a sanity check for invalid EPs ALSA: caiaq: Add a sanity check for invalid EPs ALSA: line6: Add a sanity check for invalid EPs ALSA: usb-audio: Add sanity checks for invalid EPs ALSA: usx2y: Add sanity checks for invalid EPs ALSA: hiface: Add sanity checks for invalid EPs ALSA: caiaq: Add yet more sanity checks for invalid EPs ALSA: line6: Add yet more sanity checks for invalid EPs drivers/usb/core/urb.c | 28 +++++++++++++++++++++++++--- include/linux/usb.h | 2 ++ sound/usb/bcd2000/bcd2000.c | 7 +++++++ sound/usb/caiaq/device.c | 7 +++++++ sound/usb/caiaq/input.c | 9 +++++++++ sound/usb/hiface/pcm.c | 9 +++++++-- sound/usb/line6/driver.c | 30 ++++++++++++++++++++++-------- sound/usb/line6/midi.c | 17 +++++++++++------ sound/usb/midi.c | 38 ++++++++++++++++++++++++++++++-------- sound/usb/usx2y/usbusx2y.c | 8 ++++++++ sound/usb/usx2y/usbusx2yaudio.c | 3 +++ 11 files changed, 131 insertions(+), 27 deletions(-) -- 2.14.2

3 14

[alsa-devel] [PATCH 6/8] Documentation: fix sound related doc refs
by Tom Saeger 10 Oct '17

10 Oct '17

Make sound doc refs valid. Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com> --- Documentation/sound/hd-audio/notes.rst | 2 +- Documentation/sound/kernel-api/writing-an-alsa-driver.rst | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/sound/hd-audio/notes.rst b/Documentation/sound/hd-audio/notes.rst index f59c3cdbfaf4..9f7347830ba4 100644 --- a/Documentation/sound/hd-audio/notes.rst +++ b/Documentation/sound/hd-audio/notes.rst @@ -192,7 +192,7 @@ preset model instead of PCI (and codec-) SSID look-up. What ``model`` option values are available depends on the codec chip. Check your codec chip from the codec proc file (see "Codec Proc-File" section below). It will show the vendor/product name of your codec -chip. Then, see Documentation/sound/HD-Audio-Models.rst file, +chip. Then, see Documentation/sound/hd-audio/models.rst file, the section of HD-audio driver. You can find a list of codecs and ``model`` options belonging to each codec. For example, for Realtek ALC262 codec chip, pass ``model=ultra`` for devices that are compatible diff --git a/Documentation/sound/kernel-api/writing-an-alsa-driver.rst b/Documentation/sound/kernel-api/writing-an-alsa-driver.rst index 58ffa3f5bda7..a0b268466cb1 100644 --- a/Documentation/sound/kernel-api/writing-an-alsa-driver.rst +++ b/Documentation/sound/kernel-api/writing-an-alsa-driver.rst @@ -2498,7 +2498,7 @@ Mic boost Mic-boost switch is set as “Mic Boost” or “Mic Boost (6dB)”. More precise information can be found in -``Documentation/sound/alsa/ControlNames.txt``. +``Documentation/sound/designs/control-names.rst``. Access Flags ------------ -- 2.14.2

2 1

[alsa-devel] [PATCH 3/8] Documentation: fix input related doc refs
by Tom Saeger 10 Oct '17

10 Oct '17

Make `input` document refs valid including: - joystick - joystick-parport Signed-off-by: Tom Saeger <tom.saeger(a)oracle.com> --- Documentation/admin-guide/kernel-parameters.txt | 10 +++++----- Documentation/hid/hiddev.txt | 2 +- Documentation/input/devices/xpad.rst | 3 ++- Documentation/sound/cards/joystick.rst | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index e857bbbc8575..411b41127eee 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -314,7 +314,7 @@ amijoy.map= [HW,JOY] Amiga joystick support Map of devices attached to JOY0DAT and JOY1DAT Format: <a>,<b> - See also Documentation/input/joystick.txt + See also Documentation/input/joydev/joystick.rst analog.map= [HW,JOY] Analog joystick and gamepad support Specifies type or capabilities of an analog joystick @@ -724,7 +724,7 @@ db9.dev[2|3]= [HW,JOY] Multisystem joystick support via parallel port (one device per port) Format: <port#>,<type> - See also Documentation/input/joystick-parport.txt + See also Documentation/input/devices/joystick-parport.rst ddebug_query= [KNL,DYNAMIC_DEBUG] Enable debug messages at early boot time. See @@ -1220,7 +1220,7 @@ [HW,JOY] Multisystem joystick and NES/SNES/PSX pad support via parallel port (up to 5 devices per port) Format: <port#>,<pad1>,<pad2>,<pad3>,<pad4>,<pad5> - See also Documentation/input/joystick-parport.txt + See also Documentation/input/devices/joystick-parport.rst gamma= [HW,DRM] @@ -1766,7 +1766,7 @@ ivrs_acpihid[00:14.5]=AMD0020:0 js= [HW,JOY] Analog joystick - See Documentation/input/joystick.txt. + See Documentation/input/joydev/joystick.rst. nokaslr [KNL] When CONFIG_RANDOMIZE_BASE is set, this disables @@ -4199,7 +4199,7 @@ TurboGraFX parallel port interface Format: <port#>,<js1>,<js2>,<js3>,<js4>,<js5>,<js6>,<js7> - See also Documentation/input/joystick-parport.txt + See also Documentation/input/devices/joystick-parport.rst udbg-immortal [PPC] When debugging early kernel crashes that happen after console_init() and before a proper diff --git a/Documentation/hid/hiddev.txt b/Documentation/hid/hiddev.txt index 6e8c9f1d2f22..638448707aa2 100644 --- a/Documentation/hid/hiddev.txt +++ b/Documentation/hid/hiddev.txt @@ -12,7 +12,7 @@ To support these disparate requirements, the Linux USB system provides HID events to two separate interfaces: * the input subsystem, which converts HID events into normal input device interfaces (such as keyboard, mouse and joystick) and a -normalised event interface - see Documentation/input/input.txt +normalised event interface - see Documentation/input/input.rst * the hiddev interface, which provides fairly raw HID events The data flow for a HID event produced by a device is something like diff --git a/Documentation/input/devices/xpad.rst b/Documentation/input/devices/xpad.rst index 5a709ab77c8d..b8bd65962dd8 100644 --- a/Documentation/input/devices/xpad.rst +++ b/Documentation/input/devices/xpad.rst @@ -230,4 +230,5 @@ Historic Edits 2005-03-19 - Dominic Cerquetti <binary1230(a)yahoo.com> - added stuff for dance pads, new d-pad->axes mappings -Later changes may be viewed with 'git log Documentation/input/xpad.txt' +Later changes may be viewed with +'git log --follow Documentation/input/devices/xpad.rst' diff --git a/Documentation/sound/cards/joystick.rst b/Documentation/sound/cards/joystick.rst index a6e468c81d02..488946fc1079 100644 --- a/Documentation/sound/cards/joystick.rst +++ b/Documentation/sound/cards/joystick.rst @@ -11,7 +11,7 @@ General First of all, you need to enable GAMEPORT support on Linux kernel for using a joystick with the ALSA driver. For the details of gameport -support, refer to Documentation/input/joystick.txt. +support, refer to Documentation/input/joydev/joystick.rst. The joystick support of ALSA drivers is different between ISA and PCI cards. In the case of ISA (PnP) cards, it's usually handled by the -- 2.14.2

2 1

[alsa-devel] [RESEND PATCH] ASoC: codecs: msm8916-wcd-digital: fix RX2 MIX1 and RX3 MIX1
by Jean-François Têtu 10 Oct '17

10 Oct '17

The kcontrol for the third input (rxN_mix1_inp3) of both RX2 and RX3 mixers are not using the correct control register. This simple patch fixes this. Signed-off-by: Jean-François Têtu <jean-francois.tetu(a)savoirfairelinux.com> --- sound/soc/codecs/msm8916-wcd-digital.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c index 66df8f810f0d..a10a724eb448 100644 --- a/sound/soc/codecs/msm8916-wcd-digital.c +++ b/sound/soc/codecs/msm8916-wcd-digital.c @@ -238,7 +238,7 @@ static const struct soc_enum rx_mix2_inp1_chain_enum = SOC_ENUM_SINGLE( static const struct soc_enum rx2_mix1_inp_enum[] = { SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 0, 6, rx_mix1_text), SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 3, 6, rx_mix1_text), - SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 0, 6, rx_mix1_text), + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B2_CTL, 0, 6, rx_mix1_text), }; /* RX2 MIX2 */ @@ -249,7 +249,7 @@ static const struct soc_enum rx2_mix2_inp1_chain_enum = SOC_ENUM_SINGLE( static const struct soc_enum rx3_mix1_inp_enum[] = { SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 0, 6, rx_mix1_text), SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 3, 6, rx_mix1_text), - SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 0, 6, rx_mix1_text), + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B2_CTL, 0, 6, rx_mix1_text), }; /* DEC */ -- 2.14.2

2 2

[alsa-devel] usb/sound: use-after-free in snd_usb_mixer_interrupt
by Andrey Konovalov 10 Oct '17

10 Oct '17

Hi! I've got the following report while fuzzing the kernel with syzkaller. On commit 8a5776a5f49812d29fe4b2d0a2d71675c3facf3f (4.14-rc4). gadgetfs: bound to dummy_udc driver usb 1-1: new full-speed USB device number 2 using dummy_hcd gadgetfs: connected gadgetfs: disconnected gadgetfs: connected usb 1-1: config 1 has an invalid interface number: 1 but max is 0 usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 1 usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 usb 1-1: too many endpoints for config 1 interface 1 altsetting 174: 131, using maximum allowed: 30 usb 1-1: config 1 interface 1 altsetting 174 has 0 endpoint descriptors, different from the interface de scriptor's value: 131 usb 1-1: config 1 interface 1 has no altsetting 0 usb 1-1: New USB device found, idVendor=0dba, idProduct=1000 usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=252 usb 1-1: SerialNumber: a gadgetfs: configuration #1 hub 1-1:1.0: USB hub found hub 1-1:1.0: config failed, can't read hub descriptor (err -22) snd-usb-audio: probe of 1-1:1.0 failed with error -22 ================================================================== BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0 Read of size 8 at addr ffff8800636f8900 by task swapper/1/0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.14.0-rc4-43418-g43a3f84d2109-dirty #391 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 print_address_description+0x78/0x280 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 kasan_report+0x23d/0x350 mm/kasan/report.c:409 __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430 snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490 __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779 usb_hcd_giveback_urb+0x337/0x420 drivers/usb/core/hcd.c:1845 dummy_timer+0xba9/0x39f0 drivers/usb/gadget/udc/dummy_hcd.c:1965 call_timer_fn+0x2a2/0x940 kernel/time/timer.c:1281 expire_timers kernel/time/timer.c:1320 __run_timers+0x87f/0xd40 kernel/time/timer.c:1620 run_timer_softirq+0x83/0x140 kernel/time/timer.c:1646 __do_softirq+0x2ee/0xc0f kernel/softirq.c:284 invoke_softirq kernel/softirq.c:364 irq_exit+0x171/0x1a0 kernel/softirq.c:405 exiting_irq ./arch/x86/include/asm/apic.h:638 smp_apic_timer_interrupt+0x2b9/0x8d0 arch/x86/kernel/apic/apic.c:1048 apic_timer_interrupt+0x9d/0xb0 </IRQ> RIP: 0010:native_safe_halt+0x6/0x10 ./arch/x86/include/asm/irqflags.h:53 RSP: 0018:ffff88006bac7b90 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: dffffc0000000020 RBX: 1ffff1000d758f76 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88006baa3a64 RBP: ffff88006bac7b90 R08: ffffffff813d5301 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1000d758f82 R13: ffff88006bac7cd0 R14: ffffffff8881ecc8 R15: 0000000000000000 arch_safe_halt ./arch/x86/include/asm/paravirt.h:93 default_idle+0x127/0x690 arch/x86/kernel/process.c:341 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:332 default_idle_call+0x3b/0x60 kernel/sched/idle.c:98 cpuidle_idle_call kernel/sched/idle.c:156 do_idle+0x33a/0x410 kernel/sched/idle.c:246 cpu_startup_entry+0x1d/0x20 kernel/sched/idle.c:351 start_secondary+0x3de/0x500 arch/x86/kernel/smpboot.c:278 secondary_startup_64+0xa5/0xa5 arch/x86/kernel/head_64.S:235 Allocated by task 1484: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772 kmalloc ./include/linux/slab.h:493 kzalloc ./include/linux/slab.h:666 snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540 create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516 snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560 create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59 snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560 usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Freed by task 1484: save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524 slab_free_hook mm/slub.c:1390 slab_free_freelist_hook mm/slub.c:1412 slab_free mm/slub.c:2988 kfree+0xf6/0x2f0 mm/slub.c:3919 snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244 snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250 __snd_device_free+0x1ff/0x380 sound/core/device.c:91 snd_device_free_all+0x8f/0xe0 sound/core/device.c:244 snd_card_do_free sound/core/init.c:461 release_card_device+0x47/0x170 sound/core/init.c:181 device_release+0x13f/0x210 drivers/base/core.c:814 kobject_cleanup lib/kobject.c:648 kobject_release lib/kobject.c:677 kref_put ./include/linux/kref.h:70 kobject_put+0x145/0x240 lib/kobject.c:694 put_device+0x25/0x30 drivers/base/core.c:1931 snd_card_free_when_closed sound/core/init.c:489 snd_card_free+0x156/0x220 sound/core/init.c:514 usb_audio_probe+0x1e36/0x2c10 sound/usb/card.c:648 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 The buggy address belongs to the object at ffff8800636f8900 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes inside of 192-byte region [ffff8800636f8900, ffff8800636f89c0) The buggy address belongs to the page: page:ffffea00018dbe00 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x100000000000100(slab) raw: 0100000000000100 0000000000000000 0000000000000000 0000000180100010 raw: ffffea00018dbc00 0000000400000004 ffff88006c003380 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8800636f8800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800636f8880: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc >ffff8800636f8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800636f8980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8800636f8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

2 3

[alsa-devel] [PATCH] ALSA: seq: Add sanity check for user-space pointer delivery
by Takashi Iwai 10 Oct '17

10 Oct '17

The sequencer event may contain a user-space pointer with its SNDRV_SEQ_EXT_USRPTR bit, and we assure that its delivery is limited with non-atomic mode. Otherwise the copy_from_user() may hit the fault and cause a problem. Although the core code doesn't set such a flag (only set at snd_seq_write()), any wild driver may set it mistakenly and lead to an unexpected crash. This patch adds a sanity check of such events at the delivery core code to filter out the invalid invocation in the atomic mode. Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/core/seq/seq_clientmgr.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 6c9cba2166d9..84759d9c54bf 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -802,6 +802,10 @@ static int snd_seq_deliver_event(struct snd_seq_client *client, struct snd_seq_e return -EMLINK; } + if (snd_seq_ev_is_variable(event) && + snd_BUG_ON(atomic && (event->data.ext.len & SNDRV_SEQ_EXT_USRPTR))) + return -EINVAL; + if (event->queue == SNDRV_SEQ_ADDRESS_SUBSCRIBERS || event->dest.client == SNDRV_SEQ_ADDRESS_SUBSCRIBERS) result = deliver_to_subscribers(client, event, atomic, hop); -- 2.14.2

1 0