Change adds compat ioctl to listen driver for supporting 32 bit userspace
client when kernel is compiled for 64 bit.
Change-Id: Ie6a6fb1f2b6ea569e03b02bc520ef79b95c1009c
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Compat driver should support compress ioctls when
COMPAT mode is enabled. Change adds support for
handling compress ioctls.
Change-Id: If7223ace326253240a1cd65bc9a111b8903977f1
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Allow some PCM devices to be hostless, i.e. there is no PCM data transferred
to or from the host CPU. This can be used to minimise power on systems since
the CPU can idle/sleep during the PCM device operation (e.g. a phone call
where the DAI is between a MODEM and DSP)
TODO: cleanup, look at adding a read/write blocker.
Singed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Handle ioctl magic 'U' as an user defined ioctl so that ALSA core calls
substream's ioctl handler. This gets rid of a requirement that ALSA core
needs to be changed every time when a new user defined ioctl is introduced.
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
This is needed to support the compressed audio till the
compressed core is done with development.
Signed-off-by: Asish Bhattacharya <asishb@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Incase of A2DP usecase using proxy driver, appl_ptr has
boundary value as 0x60000000 frames in sw_params for stereo(2 channels).
When this value crosses 0x40000000, then userspace calculating
appl_ptr at bytes results in crossing 32-bit value 0x100000000,
and points to 0x0 offset which can result in crash or pop.
To avoid above scenario, set the sw_params appl_ptr boundary value
within 0x40000000. Added proper check at sw_params update
to set this value correctly within 32-bit boundary(frames).
Change-Id: I537a04156699d90549a0a468ae19539ecd552d3b
CRs-Fixed: 483203
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
When compressed and pcm session is started the buffer pull will
Be from the DSP, in mmap mode for the scenario Hardware pointer
Is same as application pointer implies application has not filled the
Buffer to be send to DSP, and platform driver has to break and restart
The de queue process when the application has sufficient buffers.
When hardware pointer is same as application pointer it is an under run
Scenario where the ALSA framework has to trigger the under run and in HAL
The session has to re-prepare and re-triggered. based on the stop
Threshold, but in our system the stop threshold is INT_MAX which
Indicates that under run is not triggered in practical cases.
We have a brodcast usecase in which the mentioned under run case
Is hit mulitple times, and every time re-prepare and re-trigger will be
Expensive
Update the ASoC core framework to restart de queue process stopped
By platform Driver when the under run is hit, based on the available
Buffer and render flag, so the System will recover from the hang state.
To restart de queue process the ASoC core will be calling the restart
Callback registered by platform driver and this callback will be running in
Atomic context.
Change-Id: Ic9ea05a0dc6246346e9913493232882e2f5447d1
Signed-off-by: Santosh Mardi <gsantosh@codeaurora.org>
Dirty widget list can be accessed by multiple paths
in dapm framework. Dirty list is protected by dapm mutex.
Since dapm_force_enable_pin function accesses the dirty
list, protect it using the dapm mutex.
Signed-off-by: Aviral Gupta <aviralg@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
For wigdets which have set the suspend ignore flag asoc framework
shouldn't mark them as dirty when ASoC suspend function is called.
This change adds check to skip suspending the widgets with the flag set.
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Add a debug message which can be used for tracking widgets being
power-up and powered-down by DAPM, mainly used for debugging
purpose.
Change-Id: I291a381da44edca3bc2bb07be53b1969c03a48f0
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Widgets power up/down sequence in dapm is specific
to platform. Change makes msm specific changes to the
sequence.
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Add virtual ANC widgets which are used to enable ANC
before PA is turned on, and to disable ANC before TX is
turned off.
CRs-fixed: 387904
Change-Id: Id3eca8c09d1d1d3c3d89ebe3d58be9bf676eb9c0
Signed-off-by: Damir Didjusto <damird@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Return error code ENETRESET from the platform driver
during the SSR recovery.
This facilitates the client to handle the error code
and take corrective measures rather than being blocked
on the call.
CRs-Fixed: 683288
Change-Id: I618edf0276bbe8826b47edec39df0dd4f87ffe93
Signed-off-by: Aviral Gupta <aviralg@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Currently digital mute ops are called only for playback
use cases. Add support to call into codec digital mute
even for capture use cases.
CRs-Fixed: 662372
Change-Id: Idf5d1a823deb04d5ccb9139be745b6f936121a0c
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
While playback and capture is done concurrently the dapm widget
data is accessed parallelly which results in data corruption and
kernel panic. Fix this problem by serializing the stream event
operation by adding lock
dapm_seq_run will invoke dapm power sequence for pre-sorted list
of widgets to be powered up. Kernel panic issue is observed
during stability runs with the above sequence caused by null
pointer dereference in dapm_seq_run_coalesced. Fix kernel panic
issue by checking for valid snd_soc_dapm_context pointer in
dapm_seq_run before invoking dapm_seq_run_coalesced
Widget list in dapm is getting corrupted during concurrent
use cases where dapm_power_widget is accessed. This corruption
is resulting in kernel crash in dapm. Fix the issue by adding
protection in dapm_power_widgets API.
Change-Id: I49d19860277726cf3152e104ab40627fd56c021c
CRs-Fixed: 388785
Signed-off-by: Sriranjan Srikantam <cssrika@codeaurora.org>
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
When control value is queried framework is returning the
min value as zero even if min is negative.
This change will make sure that frame work will update
the max value in cases where min is negative.
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Based on which codec dai is selected, slimbus channel numbers
have to be queried when use case is being enabled.
Change adds support to get the channel numbers.
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
When kernel is compiled for 64 bit and userspace client is in 32 bit
mode compat ioctl path will be taken.If platform driver supports compat
mode asoc framework should call compat function pointers.
Change adds support in asoc framework to call snd_pcm_lib_ioctl
in compat mode.
Change-Id: Ib4254648666aedfc2037a267cd7ffe4af4be398f
Signed-off-by: Anish Kumar <kanish@codeaurora.org>
Compat ioctl pointer is assigned to ioctl field instead of compat_ioctl
member variable. Change updates the assignment.
CRs-fixed: 688027
Change-Id: I248e3225493f0ceafcb5e70ce0ff827ab77c7a74
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Add audio backend to hwdep interface. This is to provide ioctl
interface to communicate to routing driver.
Signed-off-by: Subhash Chandra Bose Naripeddy <snariped@codeaurora.org>
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
When kernel is compiled for 64 bit and userspace client is in 32 bit
mode compat ioctl path will be taken.If platform driver supports compat
mode asoc framework should call compat function pointers.
Change adds support in asoc framework to support compat mode.
Change-Id: I4929bc89c2ad467cdc83f5a00fe9d38e425c3ca2
Signed-off-by: Gopikrishnaiah Anand <agopik@codeaurora.org>
Check and set if pcm_new driver op is initialized by the driver.
This allows the compress offload drivers to register mixer
controls.
Change-Id: If54fa36cf19cbca7239d6e3e30455472e9a173d8
Signed-off-by: Ravi Kumar Alamanda <ralama@codeaurora.org>
Hostless pcm device coherent DMA mask is hardcorded to 32.
Update it based on size of dma address to support both
32 and 64 bit
Change-Id: I604d440cfd5abcf473ec87b18b5cc6ee8ff42b49
Signed-off-by: Neema Shetty <nshetty@codeaurora.org>
Signed-off-by: Vidyakumar Athota <vathota@codeaurora.org>
Multiple front end dailinks can use a single backend dailink.
When front end dailink is closed, associated back end dailink shouldn't
be closed if it is connected to other front ends.
Change ensures that back end dai is closed after all connected front end
dailinks are closed.
Change-Id: Ie00abca8391011377a9566adb837b3e46d499a5a
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
When multiple Front-end are using the same Back-end, putting
the stream state for a Front-end to STOP will make the the Backend
stream to be released, when the front-end is paused. This will avoid
the Backend to be released (when another active front-end stream is
present).
Instead, put the stream state to PAUSED, which will keep the Back-end
ON.
Change-Id: Ic31bf90a09b605b91f6b9fe3c09361b1145581fb
CRs-fixed: 428825
Signed-off-by: Banajit Goswami <bgoswa@codeaurora.org>
ALSA jack framework currently supports reporting only
one single microphone. Add support to report presence of
second microphone to userspace.
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Expose sound card online/offline state to procfs so userspace application
can poll and read sound card's state.
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
For some of the mixer controls client would like to register
count as a parameter. Macro adds support to specify the count.
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
Change to using upstream spmi bus architecture. All the spmi devices,
marked by spmi-dev-container, become platform devices.
spmi-slave-container devices become spmi_devices each representing
a slave. The read/write functions use regmap api's instead of calls to
spmi_ext_register_read/write() implemented by the spmi bus. This
regmap is instantiated per slave.
The spmi bus helper functions like spmi_get_irq get changed to their
platform bus equivalents.
Change Kconfig files include
* Remove dependence on OF_SPMI, MSM_QPNP_INT
* There were few places where an earlier commit
dcc2aedc80746acee589e4b47d3e6adf5d3ec253
missed adding dependence on SPMI along with MSM_SPMI.
Fix them.
* Add depends on ARCH_MSM. ARCH_MSM is used for internal builds.
Change the nodes in DTSI files to confirm to the modified drivers.
Update their binding docs to drop spmi-dev-container and
spmi-slave-container;
Finally update defconfig to use upstream SPMI.
Change-Id: Ic85bff27c09c84b152cb38acbc3cadd05c0ec57a
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
commit 13d5e5d4725c64ec06040d636832e78453f477b7 upstream.
The commit [7f0973e973cd: ALSA: seq: Fix lockdep warnings due to
double mutex locks] split the management of two linked lists (source
and destination) into two individual calls for avoiding the AB/BA
deadlock. However, this may leave the possible double deletion of one
of two lists when the counterpart is being deleted concurrently.
It ends up with a list corruption, as revealed by syzkaller fuzzer.
This patch fixes it by checking the list emptiness and skipping the
deletion and the following process.
BugLink: http://lkml.kernel.org/r/CACT4Y+bay9qsrz6dQu31EcGaH9XwfW7o3oBzSQUG9fMszoh=Sg@mail.gmail.com
Fixes: 7f0973e973cd ('ALSA: seq: Fix lockdep warnings due to 'double mutex locks)
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d99a36f4728fcbcc501b78447f625bdcce15b842 upstream.
When multiple concurrent writes happen on the ALSA sequencer device
right after the open, it may try to allocate vmalloc buffer for each
write and leak some of them. It's because the presence check and the
assignment of the buffer is done outside the spinlock for the pool.
The fix is to move the check and the assignment into the spinlock.
(The current implementation is suboptimal, as there can be multiple
unnecessary vmallocs because the allocation is done before the check
in the spinlock. But the pool size is already checked beforehand, so
this isn't a big problem; that is, the only possible path is the
multiple writes before any pool assignment, and practically seen, the
current coverage should be "good enough".)
The issue was triggered by syzkaller fuzzer.
BugLink: http://lkml.kernel.org/r/CACT4Y+bSzazpXNvtAr=WXaL8hptqjHwqEyFA+VN2AWEx=aurkg@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 67ec1072b053c15564e6090ab30127895dc77a89 upstream.
A non-atomic PCM stream may take snd_pcm_link_rwsem rw semaphore twice
in the same code path, e.g. one in snd_pcm_action_nonatomic() and
another in snd_pcm_stream_lock(). Usually this is OK, but when a
write lock is issued between these two read locks, the problem
happens: the write lock is blocked due to the first reade lock, and
the second read lock is also blocked by the write lock. This
eventually deadlocks.
The reason is the way rwsem manages waiters; it's queued like FIFO, so
even if the writer itself doesn't take the lock yet, it blocks all the
waiters (including reads) queued after it.
As a workaround, in this patch, we replace the standard down_write()
with an spinning loop. This is far from optimal, but it's good
enough, as the spinning time is supposed to be relatively short for
normal PCM operations, and the code paths requiring the write lock
aren't called so often.
Reported-by: Vinod Koul <vinod.koul@intel.com>
Tested-by: Ramesh Babu <ramesh.babu@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0b8c82190c12e530eb6003720dac103bf63e146e upstream.
The commit [991f86d7ae4e: ALSA: hda - Flush the pending probe work at
remove] introduced the sync of async probe work at remove for fixing
the race. However, this may lead to another hangup when the module
removal is performed quickly before starting the probe work, because
it issues flush_work() and it's blocked forever.
The workaround is to use cancel_work_sync() instead of flush_work()
there.
Fixes: 991f86d7ae4e ('ALSA: hda - Flush the pending probe work at remove')
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b28785fa9cede0d4f47310ca0dd2a4e1d50478b5 upstream.
The shift bit of IN1 boost gain control is 12.
Signed-off-by: Bard Liao <bardliao@realtek.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ddce57a6f0a2d8d1bfacfa77f06043bc760403c2 upstream.
Currently the selected timer backend is referred at any moment from
the running PCM callbacks. When the backend is switched, it's
possible to lead to inconsistency from the running backend. This was
pointed by syzkaller fuzzer, and the commit [7ee96216c31a: ALSA:
dummy: Disable switching timer backend via sysfs] disabled the dynamic
switching for avoiding the crash.
This patch improves the handling of timer backend switching. It keeps
the reference to the selected backend during the whole operation of an
opened stream so that it won't be changed by other streams.
Together with this change, the hrtimer parameter is reenabled as
writable now.
NOTE: this patch also turned out to fix the still remaining race.
Namely, ops was still replaced dynamically at dummy_pcm_open:
static int dummy_pcm_open(struct snd_pcm_substream *substream)
{
....
dummy->timer_ops = &dummy_systimer_ops;
if (hrtimer)
dummy->timer_ops = &dummy_hrtimer_ops;
Since dummy->timer_ops is common among all streams, and when the
replacement happens during accesses of other streams, it may lead to a
crash. This was actually triggered by syzkaller fuzzer and KASAN.
This patch rewrites the code not to use the ops shared by all streams
any longer, too.
BugLink: http://lkml.kernel.org/r/CACT4Y+aZ+xisrpuM6cOXbL21DuM0yVxPYXf4cD4Md9uw0C3dBQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2ebab40eb74a0225d5dfba72bfae317dd948fa2d upstream.
The hda_jack_tbl entries are managed by snd_array for allowing
multiple jacks. It's good per se, but the problem is that struct
hda_jack_callback keeps the hda_jack_tbl pointer. Since snd_array
doesn't preserve each pointer at resizing the array, we can't keep the
original pointer but have to deduce the pointer at each time via
snd_array_entry() instead. Actually, this resulted in the deference
to the wrong pointer on codecs that have many pins such as CS4208.
This patch replaces the pointer to the NID value as the search key.
As an unexpected good side effect, this even simplifies the code, as
only NID is needed in most cases.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c44d9b1181cf34e0860c72cc8a00e0c47417aac0 upstream.
Some Sony VAIO AiO models (VGC-JS4EF and VGC-JS25G, both with PCI SSID
104d:9044) need the same quirk to make the speaker working properly.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112031
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6c361d10e0eb859233c71954abcd20d2d8700587 upstream.
This reverts commit 0c25ad8040.
The original commit disabled the aamixer path due to the noise
problem, but it turned out that some mobo with the same PCI SSID
doesn't suffer from the issue, and the disabled function (analog
loopback) is still demanded by users.
Since the recent commit [e7fdd52779a6: ALSA: hda - Implement loopback
control switch for Realtek and other codecs], we have the dynamic
mixer switch to enable/disable the aamix path, and we don't have to
disable the path statically any longer. So, let's revert the
disablement, so that only the user suffering from the noise problem
can turn off the aamix on the fly.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=108301
Reported-by: <mutedbytes@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 360a8245680053619205a3ae10e6bfe624a5da1d upstream.
The static checker warning is:
sound/pci/hda/patch_hdmi.c:460 hdmi_eld_ctl_get()
error: __memcpy() 'eld->eld_buffer' too small (256 vs 512)
I have a hard time figuring out if this can ever cause an information leak
(I don't think so), but nonetheless it does not hurt to increase the
robustness of the code.
Fixes: 68e03de985 ('ALSA: hda - hdmi: Do not expose eld data when eld is invalid')
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2154cc0e2d4ae15132d005d17e473327c70c9a06 upstream.
Mac Mini 7,1 model with CS4208 codec reports the headphone jack
detection wrongly in an inverted way. Moreover, the advertised pins
for the audio input and SPDIF output have actually no jack detection.
This patch addresses these issues. The inv_jack_detect flag is set
for fixing the headphone jack detection, and the pin configs for audio
input and SPDIF output are marked as non-detectable.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105161
Report-and-tested-by: moosotc@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.
A slave timer element also unlinks at snd_timer_stop() but it takes
only slave_active_lock. When a slave is assigned to a master,
however, this may become a race against the master's interrupt
handling, eventually resulting in a list corruption. The actual bug
could be seen with a syzkaller fuzzer test case in BugLink below.
As a fix, we need to take timeri->timer->lock when timer isn't NULL,
i.e. assigned to a master, while the assignment to a master itself is
protected by slave_active_lock.
BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 117159f0b9d392fb433a7871426fad50317f06f7 upstream.
In snd_timer_notify1(), the wrong timer instance was passed for slave
ccallback function. This leads to the access to the wrong data when
an incompatible master is handled (e.g. the master is the sequencer
timer and the slave is a user timer), as spotted by syzkaller fuzzer.
This patch fixes that wrong assignment.
BugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 4dff5c7b7093b19c19d3a100f8a3ad87cb7cd9e7 upstream.
snd_timer_user_read() has a potential race among parallel reads, as
qhead and qused are updated outside the critical section due to
copy_to_user() calls. Move them into the critical section, and also
sanitize the relevant code a bit.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f784beb75ce82f4136f8a0960d3ee872f7109e09 upstream.
Although ALSA timer code got hardening for races, it still causes
use-after-free error. This is however rather a corrupted linked list,
not actually the concurrent accesses. Namely, when timer start is
triggered twice, list_add_tail() is called twice, too. This ends
up with the link corruption and triggers KASAN error.
The simplest fix would be replacing list_add_tail() with
list_move_tail(), but fundamentally it's the problem that we don't
check the double start/stop correctly. So, the right fix here is to
add the proper checks to snd_timer_start() and snd_timer_stop() (and
their variants).
BugLink: http://lkml.kernel.org/r/CACT4Y+ZyPRoMQjmawbvmCEDrkBD2BQuH7R09=eOkf5ESK8kJAw@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 094fd3be87b0f102589e2d5c3fa5d06b7e20496d upstream.
In ALSA timer core, the active timer instance is managed in
active_list linked list. Each element is added / removed dynamically
at timer start, stop and in timer interrupt. The problem is that
snd_timer_interrupt() has a thinko and leaves the element in
active_list when it's the last opened element. This eventually leads
to list corruption or use-after-free error.
This hasn't been revealed because we used to delete the list forcibly
in snd_timer_stop() in the past. However, the recent fix avoids the
double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link
corruption due to double start or stop]), and this leak hits reality.
This patch fixes the link management in snd_timer_interrupt(). Now it
simply unlinks no matter which stream is.
BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c3b1681375dc6e71d89a3ae00cc3ce9e775a8917 upstream.
This is a minor code cleanup without any functional changes:
- Kill keep_flag argument from _snd_timer_stop(), as all callers pass
only it false.
- Remove redundant NULL check in _snd_timer_stop().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7f0973e973cd74aa40747c9d38844560cd184ee8 upstream.
The port subscription code uses double mutex locks for source and
destination ports, and this may become racy once when wrongly set up.
It leads to lockdep warning splat, typically triggered by fuzzer like
syzkaller, although the actual deadlock hasn't been seen, so far.
This patch simplifies the handling by reducing to two single locks, so
that no lockdep warning will be trigger any longer.
By splitting to two actions, a still-in-progress element shall be
added in one list while handling another. For ignoring this element,
a new check is added in deliver_to_subscribers().
Along with it, the code to add/remove the subscribers list element was
cleaned up and refactored.
BugLink: http://lkml.kernel.org/r/CACT4Y+aKQXV7xkBW9hpQbzaDO7LrUvohxWh-UwMxXjDy-yBD=A@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
