kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/sound/drivers
History
Takashi Iwai 57db0e406c ALSA: dummy: Implement timer backend switching more safely 
commit ddce57a6f0 upstream.

Currently the selected timer backend is referred at any moment from
the running PCM callbacks.  When the backend is switched, it's
possible to lead to inconsistency from the running backend.  This was
pointed by syzkaller fuzzer, and the commit [7ee96216c3: ALSA:
dummy: Disable switching timer backend via sysfs] disabled the dynamic
switching for avoiding the crash.

This patch improves the handling of timer backend switching.  It keeps
the reference to the selected backend during the whole operation of an
opened stream so that it won't be changed by other streams.

Together with this change, the hrtimer parameter is reenabled as
writable now.

NOTE: this patch also turned out to fix the still remaining race.
Namely, ops was still replaced dynamically at dummy_pcm_open:

  static int dummy_pcm_open(struct snd_pcm_substream *substream)
  {
  ....
          dummy->timer_ops = &dummy_systimer_ops;
          if (hrtimer)
                  dummy->timer_ops = &dummy_hrtimer_ops;

Since dummy->timer_ops is common among all streams, and when the
replacement happens during accesses of other streams, it may lead to a
crash.  This was actually triggered by syzkaller fuzzer and KASAN.

This patch rewrites the code not to use the ops shared by all streams
any longer, too.

BugLink: http://lkml.kernel.org/r/CACT4Y+aZ+xisrpuM6cOXbL21DuM0yVxPYXf4cD4Md9uw0C3dBQ@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2016-02-25 10:34:50 +00:00
..
mpu401 ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
opl3 ALSA: Drop unused name argument in snd_register_oss_device() 2014-02-12 10:58:19 +01:00
opl4 ALSA: opl4: use list_move_tail instead of list_del/list_add_tail 2012-09-05 09:14:45 +02:00
pcsp ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
vx ALSA: vx_core: off by one in vx_read_status() 2013-06-21 14:32:06 +02:00
aloop.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
dummy.c ALSA: dummy: Implement timer backend switching more safely 2016-02-25 10:34:50 +00:00
Kconfig ALSA: sound kconfig typo 2013-04-24 14:02:36 +02:00
Makefile ALSA: introduce the snd-aloop module for the PCM loopback 2010-08-09 14:21:11 +02:00
ml403-ac97cr.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
mtpav.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
mts64.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
pcm-indirect2.c Fix common misspellings 2011-03-31 11:26:23 -03:00
pcm-indirect2.h [ALSA] Xilinx ML403 AC97 Controller Reference device driver 2008-01-31 17:29:15 +01:00
portman2x4.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
serial-u16550.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00
virmidi.c ALSA: drivers: Convert to snd_card_new() with a device pointer 2014-02-12 10:58:20 +01:00