kernel.git/sound/sh, branch linux-6.9.y

ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs

2024-03-26T11:18:54Z

The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer. When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below: (Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard->channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard->channel-> //USE In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed. Fixes: 198de43d758c ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device") Suggested-by: Takashi Iwai Signed-off-by: Duoming Zhou Message-ID: <20240326094238.95442-1-duoming@zju.edu.cn> Signed-off-by: Takashi Iwai

ALSA: sh: Convert to generic PCM copy ops

2023-08-18T10:18:24Z

This patch converts the sh_dac_audio driver code to use the new unified PCM copy callback. It's a straightforward conversion from *_user() to *_iter() variants. Link: https://lore.kernel.org/r/20230815190136.8987-15-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: sh_dac_audio: Convert to platform remove callback returning void

2023-03-20T13:07:08Z

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Takashi Iwai Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20230315150745.67084-13-u.kleine-koenig@pengutronix.de Signed-off-by: Mark Brown

ALSA: sh: aica: Convert to platform remove callback returning void

2023-03-20T13:07:07Z

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Takashi Iwai Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20230315150745.67084-12-u.kleine-koenig@pengutronix.de Signed-off-by: Mark Brown

ALSA: sh: aica: Drop if blocks with always false condition

2023-03-20T13:06:58Z

snd_aica_remove() is only called after a successful call to snd_aica_probe(). With the latter it's sure that platform_set_drvdata() was called with a non-NULL argument. So platform_get_drvdata() won't return NULL and the check can be dropped. This prepares converting platform driver remove callbacks to return void. Signed-off-by: Uwe Kleine-König Acked-by: Takashi Iwai Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20230315150745.67084-2-u.kleine-koenig@pengutronix.de Signed-off-by: Mark Brown

module: remove never implemented MODULE_SUPPORTED_DEVICE

2021-03-17T20:16:18Z

MODULE_SUPPORTED_DEVICE was added in pre-git era and never was implemented. We can safely remove it, because the kernel has grown to have many more reliable mechanisms to determine if device is supported or not. Signed-off-by: Leon Romanovsky Signed-off-by: Linus Torvalds

ALSA: sh: Fix compile warning wrt const

2020-01-05T15:15:14Z

A long-standing compile warning was seen during build test: sound/sh/aica.c: In function 'load_aica_firmware': sound/sh/aica.c:521:25: warning: passing argument 2 of 'spu_memload' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] Fixes: 198de43d758c ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device") Link: https://lore.kernel.org/r/20200105144823.29547-69-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: sh: Fix unused variable warnings

2020-01-04T11:02:32Z

Remove unused variables that are left over after the conversion of new PCM ops: sound/sh/sh_dac_audio.c:166:26: warning: unused variable 'runtime' sound/sh/sh_dac_audio.c:186:26: warning: unused variable 'runtime' sound/sh/sh_dac_audio.c:205:26: warning: unused variable 'runtime' Fixes: 1cc2f8ba0b3e ("ALSA: sh: Convert to the new PCM ops") Link: https://lore.kernel.org/r/20200104110057.13875-1-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: sh: Constify snd_device_ops definitions

2020-01-03T08:24:05Z

Now we may declare const for snd_device_ops definitions, so let's do it for optimization. There should be no functional changes by this patch. Link: https://lore.kernel.org/r/20200103081714.9560-18-tiwai@suse.de Signed-off-by: Takashi Iwai

ALSA: sh: Drop superfluous ioctl PCM ops

2019-12-11T06:25:32Z

PCM core deals the empty ioctl field now as default(*). Let's kill the redundant lines. (*) commit fc033cbf6fb7 ("ALSA: pcm: Allow NULL ioctl ops") Link: https://lore.kernel.org/r/20191210061145.24641-19-tiwai@suse.de Signed-off-by: Takashi Iwai