December 2018 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] UAF write in usb_audio_probe
by Mathias Payer 03 Dec '18

03 Dec '18

Hi there, We are submitting a patch for an UAF write in usb_audio_probe. A malicious USB device can send a broken device configuration that will trigger a free of the underlying object before it is decremented. I'm sending the patch and KASAN report after discussing with Takashi on the security mailing list so that he can merge. The attacker needs local access to plug in a malicious USB device that replays the trace (e.g., through FaceDancer) to get read/write primitives in the kernel. For, e.g., Android or locked Desktops this becomes security critical. This bug is present in 4.14.81 through to HEAD (i.e., all versions we tested). The place where UAF is triggered is in `usb_audio_probe` in `sound/usb/card.c`. In the error handling code in `usb_audio_probe`, if the number of interfaces read from the device side is zero, `chip->card` object is freed. Unfortunately, the `chip` object is part of the `card` object, thus, when `chip->card` is freed, `chip` is also freed. However, in the error handling code, the `active` field will be written to by an `atomic_dec` operation, resulting in an UAF write. ``` static int usb_audio_probe(struct usb_interface *intf, const struct usb_device_id *usb_id) ..... __error: if (chip) { if (!chip->num_interfaces) snd_card_free(chip->card); // UAF write atomic_dec(&chip->active); } mutex_unlock(&register_mutex); return err; ``` The attacker can race the snd_card_free and the atomic_dec by attaching new USB devices (the attacker can time when what parts of the first malicious device are read then play with attaching the second device; the race is arbitrarily repeatable). The new USB device descriptors will use the recently freed memory which is then modified by the atomic_dec, resulting in an attacker-controlled decrement operation to, e.g., a USB data structure under the attacker's control. We have also attached the KASAN report from when the bug was triggered. The patch for card.c is attached. It moves the atomic_dec to above the free of the chip memory object, ensuring that, if no cards are left, the decrement happens before the free. We've also added a comment to clarify that the two objects are dependent. Thanks, Hui Peng Mathias Payer

2 1

[alsa-devel] cplay: Always write whole buffer requested by user
by GitHub pull_request - opened 03 Dec '18

03 Dec '18

alsa-project/tinycompress pull request #1 was opened from dbaluta: cplay first writes frag * fragment_size and then it only writes one fragment at a time. This means for example than if the user supplied a buffer_size it will only be used for the first write. Reviewed-by: Charles Keepax <ckeepax(a)opensource.cirrus.com> Signed-off-by: Daniel Baluta <daniel.baluta(a)nxp.com> Request URL : https://github.com/alsa-project/tinycompress/pull/1 Patch URL : https://github.com/alsa-project/tinycompress/pull/1.patch Repository URL: https://github.com/alsa-project/tinycompress

1 0

[alsa-devel] [PATCH linux-next v2 5/6] dt-bindings: clock: add clock id for renesas adg clocks
by jiada_wang＠mentor.com 03 Dec '18

03 Dec '18

From: Jiada Wang <jiada_wang(a)mentor.com> This patch adds clock ID for renesas adg clocks Signed-off-by: Jiada Wang <jiada_wang(a)mentor.com> --- include/dt-bindings/clock/renesas-adg.h | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 include/dt-bindings/clock/renesas-adg.h diff --git a/include/dt-bindings/clock/renesas-adg.h b/include/dt-bindings/clock/renesas-adg.h new file mode 100644 index 000000000000..fe30c186cef7 --- /dev/null +++ b/include/dt-bindings/clock/renesas-adg.h @@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (C) 2018 Mentor Graphics inc. + */ +#ifndef __DT_BINDINGS_RENESAS_ADG_H__ +#define __DT_BINDINGS_RENESAS_ADG_H__ + +#define ADG_FIX 0 +#define ADG_AVB 1 + +#endif /* __DT_BINDINGS_RENESAS_ADG_H__ */ -- 2.17.0

2 1

[alsa-devel] [PATCH] ASoC: dt-bindings: use a generic node name for rt5631
by Lubomir Rintel 03 Dec '18

03 Dec '18

The example should follow the practice or using a generic node name instead of the precise programming model, as recommended by the DTSpec. Signed-off-by: Lubomir Rintel <lkundrak(a)v3.sk> --- Documentation/devicetree/bindings/sound/rt5631.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/devicetree/bindings/sound/rt5631.txt b/Documentation/devicetree/bindings/sound/rt5631.txt index 92b986ca337b..56bc85232c49 100644 --- a/Documentation/devicetree/bindings/sound/rt5631.txt +++ b/Documentation/devicetree/bindings/sound/rt5631.txt @@ -35,14 +35,14 @@ Pins on the device (for linking into audio routes): Example: -alc5631: alc5631@1a { +alc5631: audio-codec@1a { compatible = "realtek,alc5631"; reg = <0x1a>; }; or -rt5631: rt5631@1a { +rt5631: audio-codec@1a { compatible = "realtek,rt5631"; reg = <0x1a>; }; -- 2.19.1

2 1

[alsa-devel] [PATCH 0/2] SOF dependencies
by Pierre-Louis Bossart 03 Dec '18

03 Dec '18

Two minor patches that are needed to build the rest of the SOF patches which I will post next week after the last round of internal reviews. Submitting them first. Keyon Jie (1): ALSA: HDA: export process_unsol_events() Pierre-Louis Bossart (1): ASoC: Intel: common: add ACPI matching tables for ICL include/sound/hdaudio.h | 1 + include/sound/soc-acpi-intel-match.h | 1 + sound/hda/hdac_bus.c | 7 ++-- sound/soc/intel/common/Makefile | 2 +- .../intel/common/soc-acpi-intel-icl-match.c | 32 +++++++++++++++++++ 5 files changed, 38 insertions(+), 5 deletions(-) create mode 100644 sound/soc/intel/common/soc-acpi-intel-icl-match.c -- 2.17.1

2 4

[alsa-devel] alsa-utils: axfer: use second argument for transmission direction
by GitHub pull_request - opened 03 Dec '18

03 Dec '18

alsa-project/alsa-utils pull request #4 was opened from takaswie: This patchset is for axfer command in alsa-utils to use second argument for transmission direction. As a result, syntax of its command line is axfer subcommand direction options For example: $ axfer transfer playback [options] $ axfer list capture [options] This fashion requires more typing to users, however in my taste this looks good because it's easier to understand than long/short options. Additionally, this patchset applies refactoring to list subcommand. Takashi Sakamoto (5): axfer: apply refactoring to list subcommand for backward compatibility to aplay(1) axfer: apply refactoring in list subcommand for new command system axfer: use second argument in command line for transmission direction axfer: use transfer subcommand as a default for compatibility mode to aplay(1) axfer: truncate parsed arguments before operating subcommand ``` axfer/main.c | 100 +++++++++++++++++++++++++++++----------- axfer/subcmd-list.c | 85 +++++++++++++++++++++++----------- axfer/subcmd-transfer.c | 7 --- 3 files changed, 133 insertions(+), 59 deletions(-) ``` Request URL : https://github.com/alsa-project/alsa-utils/pull/4 Patch URL : https://github.com/alsa-project/alsa-utils/pull/4.patch Repository URL: https://github.com/alsa-project/alsa-utils

1 0

[alsa-devel] Regression: very quiet speakers on Thinkpad T570s
by Jeremy Cline 03 Dec '18

03 Dec '18

Hi, Some folks have reported on the Fedora bug tracker[0] that the laptop speaker volume is very low on the Thinkpad T570 when running a kernel that includes commit 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform"). alsa-info.sh from v4.15.4 (just before commit 61fcf8ece9b6 arrived in stable) and v4.19.4 with the issue present are attached to the bugzilla. I've also Cc'd Tim, who uploaded them and has the laptop in question. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1554304 Regards, Jeremy

2 5