1. 18 1月, 2018 2 次提交
  2. 17 1月, 2018 1 次提交
  3. 16 1月, 2018 1 次提交
  4. 13 1月, 2018 3 次提交
  5. 10 1月, 2018 2 次提交
  6. 09 1月, 2018 14 次提交
  7. 08 1月, 2018 6 次提交
  8. 05 1月, 2018 4 次提交
    • T
      ALSA: aloop: Fix racy hw constraints adjustment · 898dfe46
      Takashi Iwai 提交于
      The aloop driver tries to update the hw constraints of the connected
      target on the cable of the opened PCM substream.  This is done by
      adding the extra hw constraints rules referring to the substream
      runtime->hw fields, while the other substream may update the runtime
      hw of another side on the fly.
      
      This is, however, racy and may result in the inconsistent values when
      both PCM streams perform the prepare concurrently.  One of the reason
      is that it overwrites the other's runtime->hw field; which is not only
      racy but also broken when it's called before the open of another side
      finishes.  And, since the reference to runtime->hw isn't protected,
      the concurrent write may give the partial value update and become
      inconsistent.
      
      This patch is an attempt to fix and clean up:
      - The prepare doesn't change the runtime->hw of other side any longer,
        but only update the cable->hw that is referred commonly.
      - The extra rules refer to the loopback_pcm object instead of the
        runtime->hw.  The actual hw is deduced from cable->hw.
      - The extra rules take the cable_lock to protect against the race.
      
      Fixes: b1c73fc8 ("ALSA: snd-aloop: Fix hw_params restrictions and checking")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      898dfe46
    • T
      ALSA: aloop: Fix inconsistent format due to incomplete rule · b088b53e
      Takashi Iwai 提交于
      The extra hw constraint rule for the formats the aloop driver
      introduced has a slight flaw, where it doesn't return a positive value
      when the mask got changed.  It came from the fact that it's basically
      a copy&paste from snd_hw_constraint_mask64().  The original code is
      supposed to be a single-shot and it modifies the mask bits only once
      and never after, while what we need for aloop is the dynamic hw rule
      that limits the mask bits.
      
      This difference results in the inconsistent state, as the hw_refine
      doesn't apply the dependencies fully.  The worse and surprisingly
      result is that it causes a crash in OSS emulation when multiple
      full-duplex reads/writes are performed concurrently (I leave why it
      triggers Oops to readers as a homework).
      
      For fixing this, replace a few open-codes with the standard
      snd_mask_*() macros.
      
      Reported-by: syzbot+3902b5220e8ca27889ca@syzkaller.appspotmail.com
      Fixes: b1c73fc8 ("ALSA: snd-aloop: Fix hw_params restrictions and checking")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      b088b53e
    • T
      ALSA: aloop: Release cable upon open error path · 9685347a
      Takashi Iwai 提交于
      The aloop runtime object and its assignment in the cable are left even
      when opening a substream fails.  This doesn't mean any memory leak,
      but it still keeps the invalid pointer that may be referred by the
      another side of the cable spontaneously, which is a potential Oops
      cause.
      
      Clean up the cable assignment and the empty cable upon the error path
      properly.
      
      Fixes: 597603d6 ("ALSA: introduce the snd-aloop module for the PCM loopback")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      9685347a
    • T
      ALSA: pcm: Workaround for weird PulseAudio behavior on rewind error · fb51f1cd
      Takashi Iwai 提交于
      The commit 9027c463 ("ALSA: pcm: Call ack() whenever appl_ptr is
      updated") introduced the possible error code returned from the PCM
      rewind ioctl.  Basically the change was for handling the indirect PCM
      more correctly, but ironically, it caused rather a side-effect:
      PulseAudio gets pissed off when receiving an error from rewind, throws
      everything away and stops processing further, resulting in the
      silence.
      
      It's clearly a failure in the application side, so the best would be
      to fix that bug in PA.  OTOH, PA is mostly the only user of the rewind
      feature, so it's not good to slap the sole customer.
      
      This patch tries to mitigate the situation: instead of returning an
      error, now the rewind ioctl returns zero when the driver can't rewind.
      It indicates that no rewind was performed, so the behavior is
      consistent, at least.
      
      Fixes: 9027c463 ("ALSA: pcm: Call ack() whenever appl_ptr is updated")
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      fb51f1cd
  9. 04 1月, 2018 1 次提交
  10. 03 1月, 2018 4 次提交
  11. 02 1月, 2018 1 次提交
    • T
      ALSA: pcm: Remove incorrect snd_BUG_ON() usages · fe08f34d
      Takashi Iwai 提交于
      syzkaller triggered kernel warnings through PCM OSS emulation at
      closing a stream:
        WARNING: CPU: 0 PID: 3502 at sound/core/pcm_lib.c:1635
        snd_pcm_hw_param_first+0x289/0x690 sound/core/pcm_lib.c:1635
        Call Trace:
        ....
         snd_pcm_hw_param_near.constprop.27+0x78d/0x9a0 sound/core/oss/pcm_oss.c:457
         snd_pcm_oss_change_params+0x17d3/0x3720 sound/core/oss/pcm_oss.c:969
         snd_pcm_oss_make_ready+0xaa/0x130 sound/core/oss/pcm_oss.c:1128
         snd_pcm_oss_sync+0x257/0x830 sound/core/oss/pcm_oss.c:1638
         snd_pcm_oss_release+0x20b/0x280 sound/core/oss/pcm_oss.c:2431
         __fput+0x327/0x7e0 fs/file_table.c:210
         ....
      
      This happens while it tries to open and set up the aloop device
      concurrently.  The warning above (invoked from snd_BUG_ON() macro) is
      to detect the unexpected logical error where snd_pcm_hw_refine() call
      shouldn't fail.  The theory is true for the case where the hw_params
      config rules are static.  But for an aloop device, the hw_params rule
      condition does vary dynamically depending on the connected target;
      when another device is opened and changes the parameters, the device
      connected in another side is also affected, and it caused the error
      from snd_pcm_hw_refine().
      
      That is, the simplest "solution" for this is to remove the incorrect
      assumption of static rules, and treat such an error as a normal error
      path.  As there are a couple of other places using snd_BUG_ON()
      incorrectly, this patch removes these spurious snd_BUG_ON() calls.
      
      Reported-by: syzbot+6f11c7e2a1b91d466432@syzkaller.appspotmail.com
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      fe08f34d
  12. 27 12月, 2017 1 次提交