kernel.git/sound/core/pcm.c, branch linux-3.2.y

ALSA: pcm: prevent UAF in snd_pcm_info

2018-03-03T15:50:44Z

commit 362bca57f5d78220f8b5907b875961af9436e229 upstream. When the device descriptor is closed, the `substream->runtime` pointer is freed. But another thread may be in the ioctl handler, case SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which calls snd_pcm_info() which accesses the now freed `substream->runtime`. Note: this fixes CVE-2017-0861 Signed-off-by: Robb Glasser Signed-off-by: Nick Desaulniers Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings

ALSA: Avoid endless sleep after disconnect

2012-11-16T16:46:50Z

commit 0914f7961babbf28aaa2f19b453951fb4841c03f upstream. When disconnect callback is called, each component should wake up sleepers and check card->shutdown flag for avoiding the endless sleep blocking the proper resource release. Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings

ALSA: PCM: Fix some races at disconnection

2012-11-16T16:46:48Z

commit 9b0573c07f278e9888c352aa9724035c75784ea0 upstream. Fix races at PCM disconnection: - while a PCM device is being opened or closed - while the PCM state is being changed without lock in prepare, hw_params, hw_free ops Reported-by: Matthieu CASTET Signed-off-by: Takashi Iwai Signed-off-by: Ben Hutchings

sound: Add module.h to the previously silent sound users

2011-10-31T23:31:21Z

Lots of sound drivers were getting module.h via the implicit presence of it in but we are going to clean that up. So fix up those users now. Signed-off-by: Paul Gortmaker

ALSA: core: sparse cleanups

2011-02-14T16:10:11Z

Change the core code where sparse complains. In most cases, this means just adding annotations to confirm that we indeed want to do the dirty things we're doing. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai

Merge branch 'fix/misc' into topic/misc

2010-10-11T11:45:22Z

ALSA: pcm - Fix race with proc files

2010-09-16T21:06:50Z

The PCM proc files may open a race against substream close, which can end up with an Oops. Use the open_mutex to protect for it. Signed-off-by: Takashi Iwai

sound: Remove unnecessary casts of private_data

2010-09-07T06:05:59Z

Signed-off-by: Joe Perches Signed-off-by: Takashi Iwai

ALSA: pcm: add more format names

2010-08-28T09:59:33Z

There were some new formats added in commit 15c0cee6c809 "ALSA: pcm: Define G723 3-bit and 5-bit formats". That commit increased SNDRV_PCM_FORMAT_LAST as well. My concern is that there are a couple places which do: for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) { if (dummy->pcm_hw.formats & (1ULL << i)) snd_iprintf(buffer, " %s", snd_pcm_format_name(i)); } I haven't tested these but it looks like if "i" were equal to SNDRV_PCM_FORMAT_G723_24 or higher then we might read past the end of the array. Signed-off-by: Dan Carpenter Signed-off-by: Takashi Iwai

PM QOS update

2010-05-10T21:08:19Z

This patch changes the string based list management to a handle base implementation to help with the hot path use of pm-qos, it also renames much of the API to use "request" as opposed to "requirement" that was used in the initial implementation. I did this because request more accurately represents what it actually does. Also, I added a string based ABI for users wanting to use a string interface. So if the user writes 0xDDDDDDDD formatted hex it will be accepted by the interface. (someone asked me for it and I don't think it hurts anything.) This patch updates some documentation input I got from Randy. Signed-off-by: markgross Signed-off-by: Rafael J. Wysocki