kernel.git/include/sound/pcm.h, branch linux-5.19.y

ALSA: pcm: Use deferred fasync helper

2022-08-25T09:45:52Z

[ Upstream commit 96b097091c66df4f6fbf5cbff21df6cc02a2f055 ] For avoiding the potential deadlock via kill_fasync() call, use the new fasync helpers to defer the invocation from timer API. Note that it's merely a workaround. Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com Reported-by: syzbot+669c9abf11a6a011dd09@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220728125945.29533-4-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin

ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock

2022-03-30T12:29:49Z

syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm->mmap_mutex is already held. Meanwhile, the copy_from/to_user calls at read/write operations also take the mm->mmap_lock internally, hence it may lead to a AB/BA deadlock. A similar problem was already seen in the past and we fixed it with a refcount (in commit b248371628aa). The former fix covered only the call paths with OSS read/write and OSS ioctls, while we need to cover the concurrent access via both ALSA and OSS APIs now. This patch addresses the problem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for OSS. The new field, runtime->buffer_accessing, keeps the number of concurrent read/write operations. Unlike the former buffer_mutex protection, this protects only around the copy_from/to_user() calls; the other codes are basically protected by the PCM stream lock. The refcount can be a negative, meaning blocked by the ioctls. If a negative value is seen, the read/write aborts with -EBUSY. In the ioctl side, OTOH, they check this refcount, too, and set to a negative value for blocking unless it's already being accessed. Reported-by: syzbot+6e5c88838328e99c7e1c@syzkaller.appspotmail.com Fixes: dca947d4d26d ("ALSA: pcm: Fix races among concurrent read/write and buffer changes") Cc: Link: https://lore.kernel.org/r/000000000000381a0d05db622a81@google.com Link: https://lore.kernel.org/r/20220330120903.4738-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: Fix races among concurrent hw_params and hw_free calls

2022-03-22T19:56:07Z

Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls. This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity. Reported-by: Hu Jiahui Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20220322170720.3529-2-tiwai@suse.de Signed-off-by: Takashi Iwai

Merge tag 'asoc-fix-v5.17-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

2022-02-01T15:52:54Z

ASoC: Fixes for v5.17 Quite a few fixes here, including an unusually large set in the core spurred on by various testing efforts as well as the usual small driver fixes. There are quite a few fixes for out of bounds writes in both the core and the various Qualcomm drivers, plus a couple of fixes for locking in the DPCM code.

ASoC: soc-pcm: Fix DPCM lockdep warning due to nested stream locks

2022-01-28T15:59:16Z

The recent change for DPCM locking caused spurious lockdep warnings. Actually the warnings are false-positive, as those are triggered due to the nested stream locks for FE and BE. Since both locks belong to the same lock class, lockdep sees it as if a deadlock. For fixing this, we need to take PCM stream locks for BE with the nested lock primitives. Since currently snd_pcm_stream_lock*() helper assumes only the top-level single locking, a new helper function snd_pcm_stream_lock_irqsave_nested() is defined for a single-depth nested lock, which is now used in the BE DAI trigger that is always performed inside a FE stream lock. Fixes: b2ae80663008 ("ASoC: soc-pcm: serialize BE triggers") Reported-and-tested-by: Hans de Goede Reported-and-tested-by: Marek Szyprowski Link: https://lore.kernel.org/r/73018f3c-9769-72ea-0325-b3f8e2381e30@redhat.com Link: https://lore.kernel.org/alsa-devel/9a0abddd-49e9-872d-2f00-a1697340f786@samsung.com Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20220119155249.26754-2-tiwai@suse.de Signed-off-by: Mark Brown

ALSA: pcm: comment about relation between msbits hw parameter and [S|U]32 formats

2021-12-13T07:18:43Z

Regarding to handling [U|S][32|24] PCM formats, many userspace application developers and driver developers have confusion, since they require them to understand justification or padding. It easily loses consistency and soundness to operate with many type of devices. In this commit, I attempt to solve the situation by adding comment about relation between [S|U]32 formats and 'msbits' hardware parameter. The formats are used for 'left-justified' sample format, and the available bit count in most significant bit is delivered to userspace in msbits hardware parameter (struct snd_pcm_hw_params.msbits), which is decided by msbits constraint added by pcm drivers (snd_pcm_hw_constraint_msbits()). In driver side, the msbits constraint includes two elements; the physical width of format and the available width of the format in most significant bit. The former is used to match SAMPLE_BITS of format. (For my convenience, I ignore wildcard in the usage of the constraint.) As a result of interaction between ALSA pcm core and ALSA pcm application, when the format in which SAMPLE_BITS equals to physical width of the msbits constaint, the msbits parameter is set by referring to the available width of the constraint. When the msbits parameter is not changed in the above process, ALSA pcm core set it alternatively with SAMPLE_BIT of chosen format. In userspace application side, the msbits is only available after calling ioctl(2) with SNDRV_PCM_IOCTL_HW_PARAMS request. Even if the hardware parameter structure includes somewhat value of SAMPLE_BITS interval parameter as width of format, all of the width is not always available since msbits can be less than the width. I note that [S|U]24 formats are used for 'right-justified' 24 bit sample formats within 32 bit frame. The first byte in most significant bit should be invalidated. Although the msbits exposed to userspace should be zero as invalid value, actually it is 32 from physical width of format. [ corrected typos -- tiwai ] Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20210529033353.21641-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai

ALSA: pcm: Allow exact buffer preallocation

2021-08-04T06:08:06Z

A few drivers want to have rather the exact buffer preallocation at the driver probe time and keep using it for the whole operations without allowing dynamic buffer allocation. For satisfying the demands, this patch extends the managed buffer allocation API slightly. Namely, when 0 is passed to max argument of the allocation helper functions snd_pcm_set_managed_buffer*(), it treats as if the fixed size allocation of the given size. If the pre-allocation fails in this mode, the function returns now -ENOMEM. Otherwise, i.e. max argument is non-zero, the function never returns -ENOMEM but tries to fall back to the smaller chunks and allows the dynamic allocation later -- which is still the default behavior until now. For more intuitive use, also two new helpers are added for handling the fixed size buffer allocation, too: snd_pcm_set_fixed_buffer() and snd_pcm_set_fixed_buffer_all(). Acked-by: Mark Brown Link: https://lore.kernel.org/r/20210802072815.13551-4-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: core: Abstract memory alloc helpers

2021-06-10T08:15:21Z

This patch introduces the ops table to each memory allocation type (SNDRV_DMA_TYPE_XXX) and abstract the handling for the better code management. Then we get separate the page allocation, release and other tasks for each type, especially for the SG buffer. Each buffer type has now callbacks in the struct snd_malloc_ops, and the common helper functions call those ops accordingly. The former inline code that is specific to SG-buffer is moved into the local sgbuf.c, and we can simplify the PCM code without details of memory handling. Link: https://lore.kernel.org/r/20210609162551.7842-4-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: core: Drop snd_sgbuf_get_ptr()

2021-06-10T08:15:21Z

snd_sgbuf_get_ptr() and its sibling snd_pcm_sgbuf_get_ptr() are no longer used by any drivers. Let's drop them. Link: https://lore.kernel.org/r/20210609162551.7842-3-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: pcm: add snd_pcm_period_elapsed() variant without acquiring lock of PCM substream

2021-06-10T07:49:54Z

Current implementation of ALSA PCM core has a kernel API, snd_pcm_period_elapsed(), for drivers to queue event to awaken processes from waiting for available frames. The function voluntarily acquires lock of PCM substream, therefore it is not called in process context for any PCM operation since the lock is already acquired. It is convenient for packet-oriented driver, at least for drivers to audio and music unit in IEEE 1394 bus. The drivers are allowed by Linux FireWire subsystem to process isochronous packets queued till recent isochronous cycle in process context in any time. This commit adds snd_pcm_period_elapsed() variant, snd_pcm_period_elapsed_without_lock(), for drivers to queue the event in the process context. Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20210610031733.56297-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai